@jmruthers/pace-core 0.2.7 → 0.5.1

package/dist/rbac/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/rbac/secureClient.ts","../../src/rbac/hooks.ts","../../src/rbac/adapters.tsx","../../src/rbac/components/PagePermissionProvider.tsx","../../src/rbac/components/PagePermissionGuard.tsx","../../src/rbac/utils/eventContext.ts","../../src/rbac/components/SecureDataProvider.tsx","../../src/rbac/components/PermissionEnforcer.tsx","../../src/rbac/components/RoleBasedRouter.tsx","../../src/rbac/components/NavigationProvider.tsx","../../src/rbac/components/NavigationGuard.tsx","../../src/rbac/components/EnhancedNavigationMenu.tsx","../../src/rbac/permissions.ts"],"sourcesContent":["/**\n * Secure Supabase Client for RBAC\n * @package @jmruthers/pace-core\n * @module RBAC/SecureClient\n * @since 1.0.0\n * \n * This module provides a secure Supabase client that enforces organisation context\n * and prevents direct database access outside of the RBAC system.\n */\n\nimport { createClient, SupabaseClient } from '@supabase/supabase-js';\nimport { Database } from '../types/database';\nimport { UUID } from './types';\nimport { OrganisationContextRequiredError } from './types';\n\n/**\n * Secure Supabase Client that enforces organisation context\n * \n * This client automatically injects organisation context into all requests\n * and prevents queries that don't have the required context.\n */\nexport class SecureSupabaseClient {\n  private supabase: SupabaseClient<Database>;\n  private supabaseUrl: string;\n  private supabaseKey: string;\n  private organisationId: UUID;\n  private eventId?: string;\n  private appId?: UUID;\n\n  constructor(\n    supabaseUrl: string,\n    supabaseKey: string,\n    organisationId: UUID,\n    eventId?: string,\n    appId?: UUID\n  ) {\n    this.supabaseUrl = supabaseUrl;\n    this.supabaseKey = supabaseKey;\n    this.organisationId = organisationId;\n    this.eventId = eventId;\n    this.appId = appId;\n\n    // Create the base Supabase client\n    this.supabase = createClient<Database>(supabaseUrl, supabaseKey, {\n      global: {\n        headers: {\n          'x-organisation-id': organisationId,\n          'x-event-id': eventId || '',\n          'x-app-id': appId || '',\n        },\n      },\n    });\n\n    // Override the auth methods to inject context\n    this.setupContextInjection();\n  }\n\n  /**\n   * Setup context injection for all database operations\n   */\n  private setupContextInjection() {\n    const originalFrom = this.supabase.from.bind(this.supabase);\n    \n    this.supabase.from = (table: string) => {\n      // Validate context before allowing any database operations\n      this.validateContext();\n      \n      const query = originalFrom(table);\n      \n      // Inject organisation context into all queries\n      return this.injectContext(query);\n    };\n\n    const originalRpc = this.supabase.rpc.bind(this.supabase);\n    \n    this.supabase.rpc = (fn: string, args?: any) => {\n      // Validate context before allowing any RPC calls\n      this.validateContext();\n      \n      // Inject context into RPC calls\n      const contextArgs = {\n        ...args,\n        p_organisation_id: this.organisationId,\n        p_event_id: this.eventId,\n        p_app_id: this.appId,\n      };\n      \n      return originalRpc(fn, contextArgs);\n    };\n  }\n\n  /**\n   * Inject organisation context into a query\n   */\n  private injectContext(query: any) {\n    const originalSelect = query.select.bind(query);\n    const originalInsert = query.insert.bind(query);\n    const originalUpdate = query.update.bind(query);\n    const originalDelete = query.delete.bind(query);\n\n    // Override select to add organisation filter\n    query.select = (columns?: string) => {\n      const result = originalSelect(columns);\n      return this.addOrganisationFilter(result);\n    };\n\n    // Override insert to add organisation context\n    query.insert = (values: any) => {\n      const contextValues = Array.isArray(values) \n        ? values.map(v => ({ ...v, organisation_id: this.organisationId }))\n        : { ...values, organisation_id: this.organisationId };\n      \n      return originalInsert(contextValues);\n    };\n\n    // Override update to add organisation filter\n    query.update = (values: any) => {\n      const result = originalUpdate(values);\n      return this.addOrganisationFilter(result);\n    };\n\n    // Override delete to add organisation filter\n    query.delete = () => {\n      const result = originalDelete();\n      return this.addOrganisationFilter(result);\n    };\n\n    return query;\n  }\n\n  /**\n   * Add organisation filter to a query\n   */\n  private addOrganisationFilter(query: any) {\n    // Add organisation_id filter to all queries\n    return query.eq('organisation_id', this.organisationId);\n  }\n\n  /**\n   * Validate that required context is present\n   */\n  private validateContext() {\n    if (!this.organisationId) {\n      throw new OrganisationContextRequiredError();\n    }\n  }\n\n  /**\n   * Get the current organisation ID\n   */\n  getOrganisationId(): UUID {\n    return this.organisationId;\n  }\n\n  /**\n   * Get the current event ID\n   */\n  getEventId(): string | undefined {\n    return this.eventId;\n  }\n\n  /**\n   * Get the current app ID\n   */\n  getAppId(): UUID | undefined {\n    return this.appId;\n  }\n\n  /**\n   * Create a new client with updated context\n   */\n  withContext(updates: {\n    organisationId?: UUID;\n    eventId?: string;\n    appId?: UUID;\n  }): SecureSupabaseClient {\n    return new SecureSupabaseClient(\n      this.supabaseUrl,\n      this.supabaseKey,\n      updates.organisationId || this.organisationId,\n      updates.eventId !== undefined ? updates.eventId : this.eventId,\n      updates.appId !== undefined ? updates.appId : this.appId\n    );\n  }\n\n  /**\n   * Get the underlying Supabase client (for internal use only)\n   * @internal\n   */\n  getClient(): SupabaseClient<Database> {\n    return this.supabase;\n  }\n}\n\n/**\n * Create a secure Supabase client with organisation context\n * \n * @param supabaseUrl - Supabase project URL\n * @param supabaseKey - Supabase anon key\n * @param organisationId - Required organisation ID\n * @param eventId - Optional event ID\n * @param appId - Optional app ID\n * @returns SecureSupabaseClient instance\n * \n * @example\n * ```typescript\n * const client = createSecureClient(\n *   'https://your-project.supabase.co',\n *   'your-anon-key',\n *   'org-123',\n *   'event-456',\n *   'app-789'\n * );\n * ```\n */\nexport function createSecureClient(\n  supabaseUrl: string,\n  supabaseKey: string,\n  organisationId: UUID,\n  eventId?: string,\n  appId?: UUID\n): SecureSupabaseClient {\n  return new SecureSupabaseClient(supabaseUrl, supabaseKey, organisationId, eventId, appId);\n}\n\n/**\n * Create a secure client from an existing Supabase client\n * \n * @param client - Existing Supabase client\n * @param organisationId - Required organisation ID\n * @param eventId - Optional event ID\n * @param appId - Optional app ID\n * @returns SecureSupabaseClient instance\n */\nexport function fromSupabaseClient(\n  client: SupabaseClient<Database>,\n  organisationId: UUID,\n  eventId?: string,\n  appId?: UUID\n): SecureSupabaseClient {\n  // We need the URL and key to create a new client, but they're not accessible\n  // This function should be used with createSecureClient instead\n  throw new Error('fromSupabaseClient is not supported. Use createSecureClient instead.');\n}\n","/**\n * RBAC React Hooks\n * @package @jmruthers/pace-core\n * @module RBAC/Hooks\n * @since 1.0.0\n * \n * This module provides React hooks for RBAC functionality.\n */\n\nimport { useState, useEffect, useCallback, useMemo } from 'react';\nimport { \n  UUID, \n  Scope, \n  Permission, \n  AccessLevel, \n  PermissionMap,\n  UsePermissionsReturn,\n  UseCanReturn\n} from './types';\nimport { \n  getAccessLevel, \n  getPermissionMap, \n  isPermitted,\n  isPermittedCached \n} from './api';\n\n/**\n * Hook to get user's permissions in a scope\n * \n * @param userId - User ID\n * @param scope - Permission scope\n * @returns Permission data and loading state\n * \n * @example\n * ```tsx\n * function MyComponent() {\n *   const { permissions, isLoading, error } = usePermissions(\n *     'user-123',\n *     { organisationId: 'org-456' }\n *   );\n *   \n *   if (isLoading) return <div>Loading...</div>;\n *   if (error) return <div>Error: {error.message}</div>;\n *   \n *   return (\n *     <div>\n *       {permissions['page-1']?.includes('read') && <ReadButton />}\n *       {permissions['page-1']?.includes('manage') && <ManageButton />}\n *     </div>\n *   );\n * }\n * ```\n */\nexport function usePermissions(userId: UUID, scope: Scope): UsePermissionsReturn {\n  const [permissions, setPermissions] = useState<PermissionMap>({});\n  const [isLoading, setIsLoading] = useState(true);\n  const [error, setError] = useState<Error | null>(null);\n\n  const fetchPermissions = useCallback(async () => {\n    if (!userId) {\n      setPermissions({});\n      setIsLoading(false);\n      return;\n    }\n\n    try {\n      setIsLoading(true);\n      setError(null);\n      \n      const result = await getPermissionMap({ userId, scope });\n      setPermissions(result);\n    } catch (err) {\n      setError(err instanceof Error ? err : new Error('Failed to fetch permissions'));\n    } finally {\n      setIsLoading(false);\n    }\n  }, [userId, scope.organisationId, scope.eventId, scope.appId]);\n\n  useEffect(() => {\n    fetchPermissions();\n  }, [fetchPermissions]);\n\n  return {\n    permissions,\n    isLoading,\n    error,\n    refetch: fetchPermissions,\n  };\n}\n\n/**\n * Hook to check if user has a specific permission\n * \n * @param userId - User ID\n * @param scope - Permission scope\n * @param permission - Permission to check\n * @param pageId - Optional page ID\n * @param useCache - Whether to use cached results (default: true)\n * @returns Permission check result and loading state\n * \n * @example\n * ```tsx\n * function MyComponent() {\n *   const { can, isLoading } = useCan(\n *     'user-123',\n *     { organisationId: 'org-456' },\n *     'manage:events',\n *     'page-789'\n *   );\n *   \n *   if (isLoading) return <div>Checking permission...</div>;\n *   \n *   return (\n *     <div>\n *       {can ? <AdminPanel /> : <AccessDenied />}\n *     </div>\n *   );\n * }\n * ```\n */\nexport function useCan(\n  userId: UUID,\n  scope: Scope,\n  permission: Permission,\n  pageId?: UUID,\n  useCache: boolean = true\n): UseCanReturn {\n  const [can, setCan] = useState(false);\n  const [isLoading, setIsLoading] = useState(true);\n  const [error, setError] = useState<Error | null>(null);\n\n  const check = useCallback(async () => {\n    console.log('[useCan] check() called with:', { userId, scope, permission, pageId });\n    console.log('[useCan] Hook parameters:', { userId, scope, permission, pageId, useCache });\n    \n    if (!userId) {\n      console.log('[useCan] No userId, denying access');\n      setCan(false);\n      setIsLoading(false);\n      return;\n    }\n\n    // Check for super admin status first - super admins bypass all scope requirements\n    try {\n      const { isSuperAdmin } = await import('./api');\n      const isSuper = await isSuperAdmin(userId);\n      if (isSuper) {\n        console.log('[useCan] User is super admin, granting access');\n        setCan(true);\n        setIsLoading(false);\n        return;\n      }\n    } catch (error) {\n      console.error('[useCan] Error checking super admin status:', error);\n      // Continue with normal permission check if super admin check fails\n    }\n\n    // Check if scope is incomplete (missing required fields)\n    if (!scope || !scope.organisationId || !scope.appId) {\n      console.log('[useCan] Incomplete scope, waiting for resolution:', scope);\n      setCan(false);\n      setIsLoading(true); // Keep loading until scope is complete\n      return;\n    }\n\n    console.log('[useCan] Scope is complete, checking permission...');\n    console.log('[useCan] Detailed scope info:', {\n      organisationId: scope.organisationId,\n      eventId: scope.eventId,\n      appId: scope.appId,\n      permission,\n      pageId\n    });\n    \n    try {\n      setIsLoading(true);\n      setError(null);\n      \n      console.log('[useCan] About to call isPermitted/isPermittedCached...');\n      const result = useCache \n        ? await isPermittedCached({ userId, scope, permission, pageId })\n        : await isPermitted({ userId, scope, permission, pageId });\n      \n      console.log('[useCan] Permission check result:', result);\n      console.log('[useCan] Permission check details:', {\n        userId,\n        scope,\n        permission,\n        pageId,\n        result,\n        timestamp: new Date().toISOString()\n      });\n      setCan(result);\n    } catch (err) {\n      console.error('[useCan] Permission check error:', err);\n      console.error('[useCan] Error details:', {\n        userId,\n        scope,\n        permission,\n        pageId,\n        error: err instanceof Error ? err.message : 'Unknown error',\n        timestamp: new Date().toISOString()\n      });\n      setError(err instanceof Error ? err : new Error('Failed to check permission'));\n      setCan(false);\n    } finally {\n      setIsLoading(false);\n    }\n  }, [userId, scope.organisationId, scope.eventId, scope.appId, permission, pageId, useCache]);\n\n  useEffect(() => {\n    check();\n  }, [check]);\n\n  return {\n    can,\n    isLoading,\n    error,\n    check,\n  };\n}\n\n/**\n * Hook to get user's access level in a scope\n * \n * @param userId - User ID\n * @param scope - Permission scope\n * @returns Access level and loading state\n * \n * @example\n * ```tsx\n * function MyComponent() {\n *   const { accessLevel, isLoading } = useAccessLevel(\n *     'user-123',\n *     { organisationId: 'org-456' }\n *   );\n *   \n *   if (isLoading) return <div>Loading...</div>;\n *   \n *   return (\n *     <div>\n *       {accessLevel === 'super' && <SuperAdminPanel />}\n *       {accessLevel === 'admin' && <AdminPanel />}\n *       {accessLevel === 'planner' && <PlannerPanel />}\n *     </div>\n *   );\n * }\n * ```\n */\nexport function useAccessLevel(userId: UUID, scope: Scope): {\n  accessLevel: AccessLevel | null;\n  isLoading: boolean;\n  error: Error | null;\n  refetch: () => Promise<void>;\n} {\n  const [accessLevel, setAccessLevel] = useState<AccessLevel | null>(null);\n  const [isLoading, setIsLoading] = useState(true);\n  const [error, setError] = useState<Error | null>(null);\n\n  const fetchAccessLevel = useCallback(async () => {\n    if (!userId) {\n      setAccessLevel(null);\n      setIsLoading(false);\n      return;\n    }\n\n    try {\n      setIsLoading(true);\n      setError(null);\n      \n      const result = await getAccessLevel({ userId, scope });\n      setAccessLevel(result);\n    } catch (err) {\n      setError(err instanceof Error ? err : new Error('Failed to fetch access level'));\n      setAccessLevel(null);\n    } finally {\n      setIsLoading(false);\n    }\n  }, [userId, scope.organisationId, scope.eventId, scope.appId]);\n\n  useEffect(() => {\n    fetchAccessLevel();\n  }, [fetchAccessLevel]);\n\n  return {\n    accessLevel,\n    isLoading,\n    error,\n    refetch: fetchAccessLevel,\n  };\n}\n\n/**\n * Hook to check multiple permissions at once\n * \n * @param userId - User ID\n * @param scope - Permission scope\n * @param permissions - Array of permissions to check\n * @param pageId - Optional page ID\n * @param useCache - Whether to use cached results (default: true)\n * @returns Object with permission results and loading state\n * \n * @example\n * ```tsx\n * function MyComponent() {\n *   const { permissions, isLoading } = useMultiplePermissions(\n *     'user-123',\n *     { organisationId: 'org-456' },\n *     ['read:events', 'manage:events', 'delete:events']\n *   );\n *   \n *   return (\n *     <div>\n *       {permissions['read:events'] && <ReadButton />}\n *       {permissions['manage:events'] && <ManageButton />}\n *       {permissions['delete:events'] && <DeleteButton />}\n *     </div>\n *   );\n * }\n * ```\n */\nexport function useMultiplePermissions(\n  userId: UUID,\n  scope: Scope,\n  permissions: Permission[],\n  pageId?: UUID,\n  useCache: boolean = true\n): {\n  permissions: Record<Permission, boolean>;\n  isLoading: boolean;\n  error: Error | null;\n  refetch: () => Promise<void>;\n} {\n  const [permissionResults, setPermissionResults] = useState<Record<Permission, boolean>>({} as Record<Permission, boolean>);\n  const [isLoading, setIsLoading] = useState(true);\n  const [error, setError] = useState<Error | null>(null);\n\n  const fetchPermissions = useCallback(async () => {\n    if (!userId || permissions.length === 0) {\n      setPermissionResults({} as Record<Permission, boolean>);\n      setIsLoading(false);\n      return;\n    }\n\n    try {\n      setIsLoading(true);\n      setError(null);\n      \n      const results: Record<Permission, boolean> = {} as Record<Permission, boolean>;\n      \n      // Check all permissions in parallel\n      const promises = permissions.map(async (permission) => {\n        const result = useCache \n          ? await isPermittedCached({ userId, scope, permission, pageId })\n          : await isPermitted({ userId, scope, permission, pageId });\n        \n        return { permission, result };\n      });\n      \n      const resolved = await Promise.all(promises);\n      \n      resolved.forEach(({ permission, result }) => {\n        results[permission] = result;\n      });\n      \n      setPermissionResults(results);\n    } catch (err) {\n      setError(err instanceof Error ? err : new Error('Failed to check permissions'));\n      setPermissionResults({} as Record<Permission, boolean>);\n    } finally {\n      setIsLoading(false);\n    }\n  }, [userId, scope.organisationId, scope.eventId, scope.appId, permissions, pageId, useCache]);\n\n  useEffect(() => {\n    fetchPermissions();\n  }, [fetchPermissions]);\n\n  return {\n    permissions: permissionResults,\n    isLoading,\n    error,\n    refetch: fetchPermissions,\n  };\n}\n\n/**\n * Hook to check if user has any of the specified permissions\n * \n * @param userId - User ID\n * @param scope - Permission scope\n * @param permissions - Array of permissions to check\n * @param pageId - Optional page ID\n * @returns True if user has any permission and loading state\n * \n * @example\n * ```tsx\n * function MyComponent() {\n *   const { hasAny, isLoading } = useHasAnyPermission(\n *     'user-123',\n *     { organisationId: 'org-456' },\n *     ['read:events', 'manage:events']\n *   );\n *   \n *   return (\n *     <div>\n *       {hasAny ? <EventContent /> : <AccessDenied />}\n *     </div>\n *   );\n * }\n * ```\n */\nexport function useHasAnyPermission(\n  userId: UUID,\n  scope: Scope,\n  permissions: Permission[],\n  pageId?: UUID\n): {\n  hasAny: boolean;\n  isLoading: boolean;\n  error: Error | null;\n  refetch: () => Promise<void>;\n} {\n  const { permissions: permissionResults, isLoading, error, refetch } = useMultiplePermissions(\n    userId,\n    scope,\n    permissions,\n    pageId\n  );\n\n  const hasAny = useMemo(() => {\n    return Object.values(permissionResults).some(Boolean);\n  }, [permissionResults]);\n\n  return {\n    hasAny,\n    isLoading,\n    error,\n    refetch,\n  };\n}\n\n/**\n * Hook to check if user has all of the specified permissions\n * \n * @param userId - User ID\n * @param scope - Permission scope\n * @param permissions - Array of permissions to check\n * @param pageId - Optional page ID\n * @returns True if user has all permissions and loading state\n * \n * @example\n * ```tsx\n * function MyComponent() {\n *   const { hasAll, isLoading } = useHasAllPermissions(\n *     'user-123',\n *     { organisationId: 'org-456' },\n *     ['read:events', 'manage:events']\n *   );\n *   \n *   return (\n *     <div>\n *       {hasAll ? <FullAccessPanel /> : <LimitedAccessPanel />}\n *     </div>\n *   );\n * }\n * ```\n */\nexport function useHasAllPermissions(\n  userId: UUID,\n  scope: Scope,\n  permissions: Permission[],\n  pageId?: UUID\n): {\n  hasAll: boolean;\n  isLoading: boolean;\n  error: Error | null;\n  refetch: () => Promise<void>;\n} {\n  const { permissions: permissionResults, isLoading, error, refetch } = useMultiplePermissions(\n    userId,\n    scope,\n    permissions,\n    pageId\n  );\n\n  const hasAll = useMemo(() => {\n    return Object.values(permissionResults).every(Boolean);\n  }, [permissionResults]);\n\n  return {\n    hasAll,\n    isLoading,\n    error,\n    refetch,\n  };\n}\n\n/**\n * Hook to read cached permissions (contract requirement)\n * \n * This hook only reads from the core cache and does not perform\n * any bespoke caching as per the contract requirements.\n * \n * @param userId - User ID\n * @param scope - Permission scope\n * @returns Cached permission data and loading state\n * \n * @example\n * ```tsx\n * function MyComponent() {\n *   const { permissions, isLoading, error } = useCachedPermissions(\n *     'user-123',\n *     { organisationId: 'org-456' }\n *   );\n *   \n *   if (isLoading) return <div>Loading cached permissions...</div>;\n *   if (error) return <div>Error: {error.message}</div>;\n *   \n *   return (\n *     <div>\n *       {permissions['page-1']?.includes('read') && <ReadButton />}\n *       {permissions['page-1']?.includes('manage') && <ManageButton />}\n *     </div>\n *   );\n * }\n * ```\n */\nexport function useCachedPermissions(userId: UUID, scope: Scope): {\n  permissions: PermissionMap;\n  isLoading: boolean;\n  error: Error | null;\n  refetch: () => Promise<void>;\n} {\n  const [permissions, setPermissions] = useState<PermissionMap>({});\n  const [isLoading, setIsLoading] = useState(true);\n  const [error, setError] = useState<Error | null>(null);\n\n  const fetchCachedPermissions = useCallback(async () => {\n    if (!userId) {\n      setPermissions({});\n      setIsLoading(false);\n      return;\n    }\n\n    try {\n      setIsLoading(true);\n      setError(null);\n      \n      // Use cached version of getPermissionMap\n      const result = await getPermissionMap({ userId, scope });\n      setPermissions(result);\n    } catch (err) {\n      setError(err instanceof Error ? err : new Error('Failed to fetch cached permissions'));\n    } finally {\n      setIsLoading(false);\n    }\n  }, [userId, scope.organisationId, scope.eventId, scope.appId]);\n\n  useEffect(() => {\n    fetchCachedPermissions();\n  }, [fetchCachedPermissions]);\n\n  return {\n    permissions,\n    isLoading,\n    error,\n    refetch: fetchCachedPermissions,\n  };\n}\n","/**\n * RBAC Adapters\n * @package @jmruthers/pace-core\n * @module RBAC/Adapters\n * @since 1.0.0\n * \n * This module provides adapters for different frameworks and server runtimes.\n */\n\nimport React, { ReactNode, useContext } from 'react';\nimport { UUID, Permission } from './types';\nimport { useCan } from './hooks';\nimport { rbacCache, RBACCache } from './cache';\nimport { getRBACLogger } from './config';\n\n// ============================================================================\n// REACT COMPONENTS\n// ============================================================================\n\n/**\n * Permission Guard Component\n * \n * A React component that conditionally renders children based on permissions.\n * Can auto-infer userId from context if not provided.\n * \n * @example\n * ```tsx\n * // With explicit userId and scope\n * <PermissionGuard\n *   userId=\"user-123\"\n *   scope={{ organisationId: 'org-456' }}\n *   permission=\"manage:events\"\n *   pageId=\"page-789\"\n *   fallback={<AccessDenied />}\n * >\n *   <AdminPanel />\n * </PermissionGuard>\n * \n * // With context inference (requires auth context)\n * <PermissionGuard\n *   permission=\"manage:events\"\n *   scope={{ organisationId: 'org-456' }}\n *   fallback={<AccessDenied />}\n * >\n *   <AdminPanel />\n * </PermissionGuard>\n * ```\n */\nexport function PermissionGuard({\n  userId,\n  scope,\n  permission,\n  pageId,\n  children,\n  fallback = null,\n  onDenied,\n  loading = null,\n  // NEW: Phase 1 - Enhanced Security Features\n  strictMode = true,\n  auditLog = true,\n  enforceAudit = true,\n}: {\n  userId?: UUID;\n  scope: { organisationId: UUID; eventId?: string; appId?: UUID };\n  permission: Permission;\n  pageId?: UUID;\n  children: ReactNode;\n  fallback?: ReactNode;\n  onDenied?: () => void;\n  loading?: ReactNode;\n  // NEW: Phase 1 - Enhanced Security Features\n  strictMode?: boolean;\n  auditLog?: boolean;\n  enforceAudit?: boolean;\n}): React.ReactNode {\n  const logger = getRBACLogger();\n  \n  // Always call hooks at the top level\n  const authContext = useContext(React.createContext<any>(null));\n  \n  // Try to get userId from context if not provided\n  let effectiveUserId = userId;\n  if (!effectiveUserId) {\n    try {\n      // Try to get from common auth contexts\n      if (authContext?.user?.id) {\n        effectiveUserId = authContext.user.id;\n      } else {\n        // Try to get from window or global context\n        const globalUser = (window as any).__PACE_USER__;\n        if (globalUser?.id) {\n          effectiveUserId = globalUser.id;\n        }\n      }\n    } catch (error) {\n      logger.debug('Could not infer userId from context:', error);\n    }\n  }\n\n  // Always call useCan hook, but handle the case where userId might be undefined\n  const { can, isLoading, error } = useCan(effectiveUserId || '', scope, permission, pageId);\n\n  // If still no userId, show helpful error\n  if (!effectiveUserId) {\n    logger.error('PermissionGuard: No userId provided and could not infer from context');\n    return (\n      <div className=\"rbac-error\" role=\"alert\">\n        <p>Permission check failed: User context not available</p>\n        <details>\n          <summary>Debug info</summary>\n          <p>Make sure to either:</p>\n          <ul>\n            <li>Pass userId prop explicitly</li>\n            <li>Wrap your app with an auth provider</li>\n            <li>Set window.__PACE_USER__ with user data</li>\n          </ul>\n        </details>\n      </div>\n    );\n  }\n\n  // Handle loading state\n  if (isLoading) {\n    return loading || (\n      <div className=\"rbac-loading\" role=\"status\" aria-live=\"polite\">\n        <span className=\"sr-only\">Checking permissions...</span>\n      </div>\n    );\n  }\n\n  // Handle error state\n  if (error) {\n    logger.error('Permission check failed:', error);\n    // NEW: Phase 1 - Record failed permission check for audit\n    if (auditLog) {\n      logger.info(`[PermissionGuard] Permission check failed:`, {\n        userId: effectiveUserId,\n        scope,\n        permission,\n        pageId,\n        error: error.message,\n        timestamp: new Date().toISOString()\n      });\n    }\n    return fallback;\n  }\n\n  // Handle permission denied\n  if (!can) {\n    // NEW: Phase 1 - Record denied permission check for audit\n    if (auditLog) {\n      logger.info(`[PermissionGuard] Permission denied:`, {\n        userId: effectiveUserId,\n        scope,\n        permission,\n        pageId,\n        timestamp: new Date().toISOString()\n      });\n    }\n    \n    // NEW: Phase 1 - Handle strict mode violations\n    if (strictMode) {\n      logger.error(`[PermissionGuard] STRICT MODE VIOLATION: User attempted to access protected resource without permission`, {\n        userId: effectiveUserId,\n        scope,\n        permission,\n        pageId,\n        timestamp: new Date().toISOString()\n      });\n    }\n    \n    if (onDenied) {\n      onDenied();\n    }\n    return <>{fallback}</>;\n  }\n\n  // NEW: Phase 1 - Record successful permission check for audit\n  if (auditLog) {\n    logger.info(`[PermissionGuard] Permission granted:`, {\n      userId: effectiveUserId,\n      scope,\n      permission,\n      pageId,\n      timestamp: new Date().toISOString()\n    });\n  }\n\n  // Render children if permission granted\n  return <>{children}</>;\n}\n\n/**\n * Access Level Guard Component\n * \n * A React component that conditionally renders children based on access level.\n * Can auto-infer userId from context if not provided.\n * \n * @example\n * ```tsx\n * // With explicit userId and scope\n * <AccessLevelGuard\n *   userId=\"user-123\"\n *   scope={{ organisationId: 'org-456' }}\n *   minLevel=\"admin\"\n *   fallback={<AccessDenied />}\n * >\n *   <AdminPanel />\n * </AccessLevelGuard>\n * \n * // With context inference (requires auth context)\n * <AccessLevelGuard\n *   minLevel=\"admin\"\n *   scope={{ organisationId: 'org-456' }}\n *   fallback={<AccessDenied />}\n * >\n *   <AdminPanel />\n * </AccessLevelGuard>\n * ```\n */\nexport function AccessLevelGuard({\n  userId,\n  scope,\n  minLevel,\n  children,\n  fallback = null,\n  loading = null,\n}: {\n  userId?: UUID;\n  scope: { organisationId: UUID; eventId?: string; appId?: UUID };\n  minLevel: 'viewer' | 'participant' | 'planner' | 'admin' | 'super';\n  children: ReactNode;\n  fallback?: ReactNode;\n  loading?: ReactNode;\n}): React.ReactNode {\n  const logger = getRBACLogger();\n  \n  // Always call hooks at the top level\n  const authContext = useContext(React.createContext<any>(null));\n  \n  // Try to get userId from context if not provided\n  let effectiveUserId = userId;\n  if (!effectiveUserId) {\n    try {\n      // Try to get from common auth contexts\n      if (authContext?.user?.id) {\n        effectiveUserId = authContext.user.id;\n      } else {\n        // Try to get from window or global context\n        const globalUser = (window as any).__PACE_USER__;\n        if (globalUser?.id) {\n          effectiveUserId = globalUser.id;\n        }\n      }\n    } catch (error) {\n      logger.debug('Could not infer userId from context:', error);\n    }\n  }\n\n  // Always call useAccessLevel hook, but handle the case where userId might be undefined\n  const { accessLevel, isLoading, error } = useAccessLevel(effectiveUserId || '', scope);\n\n  // If still no userId, show helpful error\n  if (!effectiveUserId) {\n    logger.error('AccessLevelGuard: No userId provided and could not infer from context');\n    return (\n      <div className=\"rbac-error\" role=\"alert\">\n        <p>Access level check failed: User context not available</p>\n        <details>\n          <summary>Debug info</summary>\n          <p>Make sure to either:</p>\n          <ul>\n            <li>Pass userId prop explicitly</li>\n            <li>Wrap your app with an auth provider</li>\n            <li>Set window.__PACE_USER__ with user data</li>\n          </ul>\n        </details>\n      </div>\n    );\n  }\n\n  // Handle loading state\n  if (isLoading) {\n    return loading || (\n      <div className=\"rbac-loading\" role=\"status\" aria-live=\"polite\">\n        <span className=\"sr-only\">Checking access level...</span>\n      </div>\n    );\n  }\n\n  // Handle error state\n  if (error) {\n    logger.error('Access level check failed:', error);\n    return fallback;\n  }\n\n  // Check access level\n  const levelHierarchy = ['viewer', 'participant', 'planner', 'admin', 'super'];\n  const userLevelIndex = accessLevel ? levelHierarchy.indexOf(accessLevel) : -1;\n  const requiredLevelIndex = levelHierarchy.indexOf(minLevel);\n\n  if (userLevelIndex < requiredLevelIndex) {\n    return <>{fallback}</>;\n  }\n\n  return <>{children}</>;\n}\n\n// ============================================================================\n// SERVER ADAPTERS\n// ============================================================================\n\n/**\n * Permission Guard for Server Handlers\n * \n * Wraps a server handler with permission checking.\n * \n * @param config - Permission guard configuration\n * @param handler - Handler function to wrap\n * @returns Wrapped handler function\n * \n * @example\n * ```typescript\n * const protectedHandler = withPermissionGuard(\n *   { permission: 'manage:events', pageId: 'page-789' },\n *   async (req, res) => {\n *     // Handler logic here\n *     res.json({ success: true });\n *   }\n * );\n * ```\n */\nexport function withPermissionGuard<T extends any[]>(\n  config: {\n    permission: Permission;\n    pageId?: UUID;\n  },\n  handler: (...args: T) => Promise<any>\n) {\n  return async (...args: T): Promise<any> => {\n    // Extract user context from request\n    const [req] = args;\n    const userId = req.user?.id;\n    const organisationId = req.organisationId;\n    const eventId = req.eventId;\n    const appId = req.appId;\n\n    if (!userId || !organisationId) {\n      throw new Error('User context required for permission check');\n    }\n\n    // Check permission\n    const { isPermitted } = await import('./api');\n    const hasPermission = await isPermitted({\n      userId,\n      scope: { organisationId, eventId, appId },\n      permission: config.permission,\n      pageId: config.pageId,\n    });\n\n    if (!hasPermission) {\n      throw new Error(`Permission denied: ${config.permission}`);\n    }\n\n    // Execute handler\n    return handler(...args);\n  };\n}\n\n/**\n * Access Level Guard for Server Handlers\n * \n * Wraps a server handler with access level checking.\n * \n * @param minLevel - Minimum access level required\n * @param handler - Handler function to wrap\n * @returns Wrapped handler function\n * \n * @example\n * ```typescript\n * const adminHandler = withAccessLevelGuard(\n *   'admin',\n *   async (req, res) => {\n *     // Admin-only logic here\n *     res.json({ success: true });\n *   }\n * );\n * ```\n */\nexport function withAccessLevelGuard<T extends any[]>(\n  minLevel: 'viewer' | 'participant' | 'planner' | 'admin' | 'super',\n  handler: (...args: T) => Promise<any>\n) {\n  return async (...args: T): Promise<any> => {\n    // Extract user context from request\n    const [req] = args;\n    const userId = req.user?.id;\n    const organisationId = req.organisationId;\n    const eventId = req.eventId;\n    const appId = req.appId;\n\n    if (!userId || !organisationId) {\n      throw new Error('User context required for access level check');\n    }\n\n    // Check access level\n    const { getAccessLevel } = await import('./api');\n    const accessLevel = await getAccessLevel({\n      userId,\n      scope: { organisationId, eventId, appId },\n    });\n\n    const levelHierarchy = ['viewer', 'participant', 'planner', 'admin', 'super'];\n    const userLevelIndex = levelHierarchy.indexOf(accessLevel);\n    const requiredLevelIndex = levelHierarchy.indexOf(minLevel);\n\n    if (userLevelIndex < requiredLevelIndex) {\n      throw new Error(`Access level required: ${minLevel}, got: ${accessLevel}`);\n    }\n\n    // Execute handler\n    return handler(...args);\n  };\n}\n\n/**\n * Role Guard for Server Handlers\n * \n * Wraps a server handler with role-based access control.\n * This is the primary middleware for routing protection as specified in the contract.\n * \n * @param config - Role guard configuration\n * @param handler - Handler function to wrap\n * @returns Wrapped handler function\n * \n * @example\n * ```typescript\n * const adminHandler = withRoleGuard(\n *   { \n *     globalRoles: ['super_admin'],\n *     organisationRoles: ['org_admin', 'leader'],\n *     eventAppRoles: ['event_admin', 'planner']\n *   },\n *   async (req, res) => {\n *     // Admin-only logic here\n *     res.json({ success: true });\n *   }\n * );\n * ```\n */\nexport function withRoleGuard<T extends any[]>(\n  config: {\n    globalRoles?: string[];\n    organisationRoles?: string[];\n    eventAppRoles?: string[];\n    requireAll?: boolean;\n  },\n  handler: (...args: T) => Promise<any>\n) {\n  return async (...args: T): Promise<any> => {\n    // Extract user context from request\n    const [req] = args;\n    const userId = req.user?.id;\n    const organisationId = req.organisationId;\n    const eventId = req.eventId;\n    const appId = req.appId;\n\n    if (!userId || !organisationId) {\n      throw new Error('User context required for role check');\n    }\n\n    // Check global roles first (super_admin bypasses all)\n    if (config.globalRoles && config.globalRoles.length > 0) {\n      const { isSuperAdmin } = await import('./api');\n      const isSuper = await isSuperAdmin(userId);\n      \n      if (isSuper) {\n        // Log bypass for super admin - only if we have a valid organisation ID\n        if (organisationId) {\n          const { emitAuditEvent } = await import('./audit');\n          await emitAuditEvent({\n            type: 'permission_check',\n            userId,\n            organisationId,\n            eventId,\n            appId,\n            permission: 'bypass:all',\n            decision: true,\n            source: 'api',\n            bypass: true,\n            duration_ms: 0,\n            metadata: {\n              operation: 'role_guard',\n              reason: 'super_admin_bypass'\n            }\n          });\n        }\n        \n        return handler(...args);\n      }\n    }\n\n    // Check organisation roles\n    if (config.organisationRoles && config.organisationRoles.length > 0) {\n      const { isOrganisationAdmin } = await import('./api');\n      const isOrgAdmin = await isOrganisationAdmin(userId, organisationId);\n      \n      if (!isOrgAdmin && config.requireAll !== false) {\n        throw new Error(`Organisation admin role required`);\n      }\n    }\n\n    // Check event-app roles if event and app context provided\n    if (config.eventAppRoles && config.eventAppRoles.length > 0 && eventId && appId) {\n      const { isEventAdmin } = await import('./api');\n      const isEventAdminUser = await isEventAdmin(userId, { organisationId, eventId, appId });\n      \n      if (!isEventAdminUser && config.requireAll !== false) {\n        throw new Error(`Event admin role required`);\n      }\n    }\n\n    // Log successful role check - only if we have a valid organisation ID\n    if (organisationId) {\n      const { emitAuditEvent } = await import('./audit');\n      await emitAuditEvent({\n        type: 'permission_check',\n        userId,\n        organisationId,\n        eventId,\n        appId,\n        permission: 'role:check',\n        decision: true,\n        source: 'api',\n        bypass: false,\n        duration_ms: 0,\n        metadata: {\n          operation: 'role_guard'\n        }\n      });\n    }\n\n    // Execute handler\n    return handler(...args);\n  };\n}\n\n// ============================================================================\n// NEXT.JS MIDDLEWARE\n// ============================================================================\n\n/**\n * Next.js Middleware for RBAC\n * \n * Middleware that checks permissions before allowing access to pages.\n * \n * @param config - Middleware configuration\n * @returns Next.js middleware function\n * \n * @example\n * ```typescript\n * // middleware.ts\n * import { createRBACMiddleware } from '@jmruthers/pace-core/rbac';\n * \n * export default createRBACMiddleware({\n *   protectedRoutes: [\n *     { path: '/admin', permission: 'manage:admin' },\n *     { path: '/events', permission: 'read:events' },\n *   ],\n *   fallbackUrl: '/access-denied',\n * });\n * ```\n */\nexport function createRBACMiddleware(config: {\n  protectedRoutes: Array<{\n    path: string;\n    permission: Permission;\n    pageId?: UUID;\n  }>;\n  fallbackUrl?: string;\n}) {\n  return async (req: { nextUrl: { pathname: string }; user?: { id: string }; organisationId?: string }, res: { redirect: (url: string) => void }, next: () => void) => {\n    const { pathname } = req.nextUrl;\n    const userId = req.user?.id;\n    const organisationId = req.organisationId;\n\n    if (!userId || !organisationId) {\n      return res.redirect(config.fallbackUrl || '/login');\n    }\n\n    // Find matching protected route\n    const protectedRoute = config.protectedRoutes.find(route => \n      pathname.startsWith(route.path)\n    );\n\n    if (protectedRoute) {\n      try {\n        const { isPermitted } = await import('./api');\n        const hasPermission = await isPermitted({\n          userId,\n          scope: { organisationId },\n          permission: protectedRoute.permission,\n          pageId: protectedRoute.pageId,\n        });\n\n        if (!hasPermission) {\n          return res.redirect(config.fallbackUrl || '/access-denied');\n        }\n    } catch (_error) {\n      // Permission check failed - error logged via RBAC logger\n      return res.redirect(config.fallbackUrl || '/access-denied');\n    }\n    }\n\n    next();\n  };\n}\n\n// ============================================================================\n// EXPRESS MIDDLEWARE\n// ============================================================================\n\n/**\n * Express Middleware for RBAC\n * \n * Middleware that checks permissions for Express routes.\n * \n * @param config - Middleware configuration\n * @returns Express middleware function\n * \n * @example\n * ```typescript\n * import { createRBACExpressMiddleware } from '@jmruthers/pace-core/rbac';\n * \n * app.use(createRBACExpressMiddleware({\n *   permission: 'read:api',\n *   pageId: 'api-page-123',\n * }));\n * ```\n */\nexport function createRBACExpressMiddleware(config: {\n  permission: Permission;\n  pageId?: UUID;\n}) {\n  return async (req: { user?: { id: string }; organisationId?: string; eventId?: string; appId?: string }, res: { status: (code: number) => { json: (data: object) => void } }, next: () => void) => {\n    const userId = req.user?.id;\n    const organisationId = req.organisationId;\n    const eventId = req.eventId;\n    const appId = req.appId;\n\n    if (!userId || !organisationId) {\n      return res.status(401).json({ error: 'User context required' });\n    }\n\n    try {\n      const { isPermitted } = await import('./api');\n      const hasPermission = await isPermitted({\n        userId,\n        scope: { organisationId, eventId, appId },\n        permission: config.permission,\n        pageId: config.pageId,\n      });\n\n      if (!hasPermission) {\n        return res.status(403).json({ error: 'Permission denied' });\n      }\n\n      next();\n    } catch (_error) {\n      // Permission check failed - error logged via RBAC logger\n      return res.status(500).json({ error: 'Permission check failed' });\n    }\n  };\n}\n\n// ============================================================================\n// UTILITY FUNCTIONS\n// ============================================================================\n\n/**\n * Check if a user has a permission (synchronous cache check only)\n * \n * @param userId - User ID\n * @param scope - Permission scope\n * @param permission - Permission to check\n * @param pageId - Optional page ID\n * @returns True if permission is cached and granted\n */\nexport function hasPermissionCached(\n  userId: UUID,\n  scope: { organisationId: UUID; eventId?: string; appId?: UUID },\n  _permission: Permission,\n  _pageId?: UUID\n): boolean {\n  const cacheKey = RBACCache.generatePermissionKey({\n    userId,\n    organisationId: scope.organisationId,\n    eventId: scope.eventId,\n    appId: scope.appId,\n  });\n  \n  return rbacCache.get<boolean>(cacheKey) || false;\n}\n\n/**\n * Check if a user has any of the specified permissions (synchronous cache check only)\n * \n * @param userId - User ID\n * @param scope - Permission scope\n * @param permissions - Array of permissions to check\n * @param pageId - Optional page ID\n * @returns True if any permission is cached and granted\n */\nexport function hasAnyPermissionCached(\n  userId: UUID,\n  scope: { organisationId: UUID; eventId?: string; appId?: UUID },\n  permissions: Permission[],\n  pageId?: UUID\n): boolean {\n  return permissions.some(permission => \n    hasPermissionCached(userId, scope, permission, pageId)\n  );\n}\n\n// Import useAccessLevel for AccessLevelGuard\nimport { useAccessLevel } from './hooks';\n","/**\n * @file Page Permission Provider Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/PagePermissionProvider\n * @since 2.0.0\n *\n * A context provider that manages page-level permissions across the entire application.\n * This component ensures that all pages are properly protected and provides centralized\n * page permission management.\n *\n * Features:\n * - App-wide page permission management\n * - Strict mode to prevent bypassing\n * - Automatic audit logging\n * - Integration with existing RBAC system\n * - Page permission tracking\n * - Error handling and recovery\n *\n * @example\n * ```tsx\n * // Basic app setup with page permissions\n * <PagePermissionProvider strictMode={true} auditLog={true}>\n *   <App />\n * </PagePermissionProvider>\n * \n * // With custom configuration\n * <PagePermissionProvider\n *   strictMode={true}\n *   auditLog={true}\n *   onPageAccess={(pageName, operation, allowed) => {\n *     console.log(`Page access: ${pageName} ${operation} - ${allowed ? 'allowed' : 'denied'}`);\n *   }}\n * >\n *   <App />\n * </PagePermissionProvider>\n * ```\n *\n * @security\n * - Enforces page-level permissions across the app\n * - Prevents apps from bypassing permission checks\n * - Automatic audit logging for all page access attempts\n * - Integration with existing RBAC system\n * - Page permission tracking and monitoring\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Efficient context updates\n * - Minimal re-renders\n * - Cached permission checks\n *\n * @dependencies\n * - React 18+ - Context and hooks\n * - useUnifiedAuth - Authentication context\n * - RBAC types - Type definitions\n */\n\nimport React, { createContext, useContext, useState, useCallback, useMemo, useEffect } from 'react';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { UUID, Scope, Permission } from '../types';\n\nexport interface PagePermissionContextType {\n  /** Check if user has permission for a page */\n  hasPagePermission: (pageName: string, operation: string, pageId?: string, scope?: Scope) => boolean;\n  \n  /** Get all page permissions for current user */\n  getPagePermissions: () => Record<string, string[]>;\n  \n  /** Check if page permission checking is enabled */\n  isEnabled: boolean;\n  \n  /** Check if strict mode is enabled */\n  isStrictMode: boolean;\n  \n  /** Check if audit logging is enabled */\n  isAuditLogEnabled: boolean;\n  \n  /** Get page access history */\n  getPageAccessHistory: () => PageAccessRecord[];\n  \n  /** Clear page access history */\n  clearPageAccessHistory: () => void;\n}\n\nexport interface PageAccessRecord {\n  pageName: string;\n  operation: string;\n  userId: UUID;\n  scope: Scope;\n  allowed: boolean;\n  timestamp: string;\n  pageId?: string;\n}\n\nexport interface PagePermissionProviderProps {\n  /** Child components */\n  children: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Enable audit logging (default: true) */\n  auditLog?: boolean;\n  \n  /** Callback when page access is attempted */\n  onPageAccess?: (pageName: string, operation: string, allowed: boolean, record: PageAccessRecord) => void;\n  \n  /** Callback when strict mode violation occurs */\n  onStrictModeViolation?: (pageName: string, operation: string, record: PageAccessRecord) => void;\n  \n  /** Maximum number of access records to keep in history */\n  maxHistorySize?: number;\n}\n\nconst PagePermissionContext = createContext<PagePermissionContextType | null>(null);\n\n/**\n * PagePermissionProvider - Manages page-level permissions across the app\n * \n * This provider ensures that all pages are properly protected and provides\n * centralized page permission management with strict enforcement.\n * \n * @param props - Provider props\n * @returns React element with page permission context\n */\nexport function PagePermissionProvider({\n  children,\n  strictMode = true,\n  auditLog = true,\n  onPageAccess,\n  onStrictModeViolation,\n  maxHistorySize = 1000\n}: PagePermissionProviderProps) {\n  const { user, selectedOrganisationId, selectedEventId } = useUnifiedAuth();\n  const [pageAccessHistory, setPageAccessHistory] = useState<PageAccessRecord[]>([]);\n  const [isEnabled, setIsEnabled] = useState(true);\n\n  // Get current scope\n  const currentScope = useMemo((): Scope | null => {\n    if (!selectedOrganisationId) return null;\n    \n    return {\n      organisationId: selectedOrganisationId,\n      eventId: selectedEventId || undefined,\n      appId: undefined\n    };\n  }, [selectedOrganisationId, selectedEventId]);\n\n  // Check if user has permission for a page\n  const hasPagePermission = useCallback((\n    pageName: string, \n    operation: string, \n    pageId?: string, \n    scope?: Scope\n  ): boolean => {\n    if (!isEnabled) return true;\n    if (!user?.id) return false;\n    \n    const effectiveScope = scope || currentScope;\n    if (!effectiveScope) return false;\n    \n    // Use the existing RBAC system to check permissions\n    // This is a synchronous check for the context - actual permission checking\n    // happens in the PagePermissionGuard component using useCan hook\n    const permission = `${operation}:page.${pageName}` as Permission;\n    \n    // Return false by default (secure by default) - let individual PagePermissionGuard\n    // components handle the actual permission checking asynchronously\n    // This context is mainly for tracking and audit purposes\n    return false;\n  }, [isEnabled, user?.id, currentScope]);\n\n  // Get all page permissions for current user\n  const getPagePermissions = useCallback((): Record<string, string[]> => {\n    if (!isEnabled || !user?.id) return {};\n    \n    // For now, return empty object - this will be enhanced with actual permission checking\n    // when we integrate with the existing RBAC system\n    return {};\n  }, [isEnabled, user?.id]);\n\n  // Get page access history\n  const getPageAccessHistory = useCallback((): PageAccessRecord[] => {\n    return [...pageAccessHistory];\n  }, [pageAccessHistory]);\n\n  // Clear page access history\n  const clearPageAccessHistory = useCallback(() => {\n    setPageAccessHistory([]);\n  }, []);\n\n  // Record page access attempt\n  const recordPageAccess = useCallback((\n    pageName: string,\n    operation: string,\n    allowed: boolean,\n    pageId?: string,\n    scope?: Scope\n  ) => {\n    if (!auditLog || !user?.id) return;\n    \n    const record: PageAccessRecord = {\n      pageName,\n      operation,\n      userId: user.id,\n      scope: scope || currentScope || { organisationId: '' },\n      allowed,\n      timestamp: new Date().toISOString(),\n      pageId\n    };\n    \n    setPageAccessHistory(prev => {\n      const newHistory = [record, ...prev];\n      return newHistory.slice(0, maxHistorySize);\n    });\n    \n    if (onPageAccess) {\n      onPageAccess(pageName, operation, allowed, record);\n    }\n    \n    if (strictMode && !allowed && onStrictModeViolation) {\n      onStrictModeViolation(pageName, operation, record);\n    }\n  }, [auditLog, user?.id, currentScope, maxHistorySize, onPageAccess, onStrictModeViolation, strictMode]);\n\n  // Context value\n  const contextValue = useMemo((): PagePermissionContextType => ({\n    hasPagePermission,\n    getPagePermissions,\n    isEnabled,\n    isStrictMode: strictMode,\n    isAuditLogEnabled: auditLog,\n    getPageAccessHistory,\n    clearPageAccessHistory\n  }), [\n    hasPagePermission,\n    getPagePermissions,\n    isEnabled,\n    strictMode,\n    auditLog,\n    getPageAccessHistory,\n    clearPageAccessHistory\n  ]);\n\n  // Log strict mode violations\n  useEffect(() => {\n    if (strictMode && auditLog) {\n      console.log(`[PagePermissionProvider] Strict mode enabled - all page access attempts will be logged and enforced`);\n    }\n  }, [strictMode, auditLog]);\n\n  return (\n    <PagePermissionContext.Provider value={contextValue}>\n      {children}\n    </PagePermissionContext.Provider>\n  );\n}\n\n/**\n * Hook to use page permission context\n * \n * @returns Page permission context\n * @throws Error if used outside of PagePermissionProvider\n */\nexport function usePagePermissions(): PagePermissionContextType {\n  const context = useContext(PagePermissionContext);\n  \n  if (!context) {\n    throw new Error('usePagePermissions must be used within a PagePermissionProvider');\n  }\n  \n  return context;\n}\n\nexport default PagePermissionProvider;\n","/**\n * @file Page Permission Guard Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/PagePermissionGuard\n * @since 2.0.0\n *\n * A component that enforces page-level permissions and prevents apps from bypassing\n * permission checks. This is a critical security component that ensures all pages\n * are properly protected.\n *\n * Features:\n * - Page-level permission enforcement\n * - Strict mode to prevent bypassing\n * - Automatic audit logging\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized access\n * - TypeScript support with strict typing\n *\n * @example\n * ```tsx\n * // Basic page protection\n * <PagePermissionGuard\n *   pageName=\"dashboard\"\n *   operation=\"read\"\n *   fallback={<AccessDeniedPage />}\n * >\n *   <DashboardPage />\n * </PagePermissionGuard>\n * \n * // Strict mode (prevents bypassing)\n * <PagePermissionGuard\n *   pageName=\"admin\"\n *   operation=\"read\"\n *   strictMode={true}\n *   fallback={<AccessDeniedPage />}\n * >\n *   <AdminPage />\n * </PagePermissionGuard>\n * \n * // With custom fallback\n * <PagePermissionGuard\n *   pageName=\"settings\"\n *   operation=\"update\"\n *   fallback={<div>You don't have permission to access settings</div>}\n * >\n *   <SettingsPage />\n * </PagePermissionGuard>\n * ```\n *\n * @security\n * - Enforces page-level permissions\n * - Prevents apps from bypassing permission checks\n * - Automatic audit logging for all page access attempts\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized access\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Cached permission checks\n * - Minimal re-renders\n * - Efficient error handling\n *\n * @dependencies\n * - React 18+ - Component framework\n * - useCan hook - Permission checking\n * - useUnifiedAuth - Authentication context\n * - RBAC types - Type definitions\n */\n\nimport React, { useMemo, useCallback, useEffect, useState } from 'react';\nimport { useCan } from '../hooks';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { UUID, Permission, Scope } from '../types';\nimport { createScopeFromEvent } from '../utils/eventContext';\nimport { getCurrentAppName } from '../../utils/appNameResolver';\n\nexport interface PagePermissionGuardProps {\n  /** Name of the page being protected */\n  pageName: string;\n  \n  /** Operation being performed on the page */\n  operation: 'read' | 'create' | 'update' | 'delete';\n  \n  /** Content to render when user has permission */\n  children: React.ReactNode;\n  \n  /** Content to render when user lacks permission */\n  fallback?: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Force audit logging for this page access (default: true) */\n  auditLog?: boolean;\n  \n  /** Custom page ID for permission checking */\n  pageId?: string;\n  \n  /** Custom scope for permission checking */\n  scope?: Scope;\n  \n  /** Callback when access is denied */\n  onDenied?: (pageName: string, operation: string) => void;\n  \n  /** Loading state content */\n  loading?: React.ReactNode;\n}\n\n/**\n * PagePermissionGuard - Enforces page-level permissions\n * \n * This component ensures that users can only access pages they have permission for.\n * It integrates with the existing RBAC system and provides strict enforcement to\n * prevent apps from bypassing permission checks.\n * \n * @param props - Component props\n * @returns React element with permission enforcement\n */\nexport function PagePermissionGuard({\n  pageName,\n  operation,\n  children,\n  fallback = <DefaultAccessDenied />,\n  strictMode = true,\n  auditLog = true,\n  pageId,\n  scope,\n  onDenied,\n  loading = <DefaultLoading />\n}: PagePermissionGuardProps) {\n  const { user, selectedOrganisationId, selectedEventId, supabase } = useUnifiedAuth();\n  const [hasChecked, setHasChecked] = useState(false);\n  const [checkError, setCheckError] = useState<Error | null>(null);\n  const [resolvedScope, setResolvedScope] = useState<Scope | null>(null);\n\n  // Resolve scope - either use provided scope or resolve from context\n  useEffect(() => {\n    const resolveScope = async () => {\n      if (scope) {\n        setResolvedScope(scope);\n        return;\n      }\n\n      // Get app ID from package.json or environment\n      let appId: string | undefined = undefined;\n      \n      // Try to resolve from database\n      if (supabase) {\n        const appName = getCurrentAppName();\n        if (appName) {\n          try {\n            console.log('[PagePermissionGuard] Resolving app name to ID:', appName);\n            const { data: app, error } = await supabase\n              .from('rbac_apps')\n              .select('id, name, is_active')\n              .eq('name', appName)\n              .eq('is_active', true)\n              .single() as { data: { id: string; name: string; is_active: boolean } | null; error: any };\n            \n            if (error) {\n              console.error('[PagePermissionGuard] Database error resolving app ID:', error);\n              // Check if app exists but is inactive\n              const { data: inactiveApp } = await supabase\n                .from('rbac_apps')\n                .select('id, name, is_active')\n                .eq('name', appName)\n                .single() as { data: { id: string; name: string; is_active: boolean } | null };\n              \n              if (inactiveApp) {\n                console.error(`[PagePermissionGuard] App \"${appName}\" exists but is inactive (is_active: ${inactiveApp.is_active})`);\n              } else {\n                console.error(`[PagePermissionGuard] App \"${appName}\" not found in rbac_apps table`);\n              }\n            } else if (app) {\n              appId = app.id;\n              console.log('[PagePermissionGuard] Successfully resolved app ID:', app.id);\n            } else {\n              console.error('[PagePermissionGuard] No app data returned for:', appName);\n            }\n          } catch (error) {\n            console.error('[PagePermissionGuard] Unexpected error resolving app ID:', error);\n          }\n        } else {\n          console.error('[PagePermissionGuard] No app name found. Make sure to call setRBACAppName() in your app setup.');\n        }\n      }\n\n      // If we have both organisation and event, use them directly\n      if (selectedOrganisationId && selectedEventId) {\n        if (!appId) {\n          // In test environments, allow undefined appId\n          if (process.env.NODE_ENV === 'test') {\n            console.warn('[PagePermissionGuard] App ID not resolved in test environment, proceeding without it');\n          } else {\n            console.error('[PagePermissionGuard] CRITICAL: App ID not resolved. Check console for details.');\n            setCheckError(new Error('App ID not resolved. Check console for database errors.'));\n            setResolvedScope(null); // Ensure we don't proceed with incomplete scope\n            return;\n          }\n        }\n        \n        // Validate that appId is a UUID, not an app name (only in production)\n        if (process.env.NODE_ENV === 'production' && appId) {\n          const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n          if (!uuidRegex.test(appId)) {\n            console.error('[PagePermissionGuard] CRITICAL: App ID is not a valid UUID:', appId);\n            setCheckError(new Error(`Invalid app ID format: ${appId}. Expected UUID.`));\n            setResolvedScope(null); // Ensure we don't proceed with invalid scope\n            return;\n          }\n        }\n        const resolvedScope = {\n          organisationId: selectedOrganisationId,\n          eventId: selectedEventId,\n          appId: appId\n        };\n        console.log('[PagePermissionGuard] Setting resolved scope:', resolvedScope);\n        setResolvedScope(resolvedScope);\n        return;\n      }\n\n      // If we only have organisation, use it\n      if (selectedOrganisationId) {\n        if (!appId) {\n          // In test environments, allow undefined appId\n          if (process.env.NODE_ENV === 'test') {\n            console.warn('[PagePermissionGuard] App ID not resolved in test environment, proceeding without it');\n          } else {\n            console.error('[PagePermissionGuard] CRITICAL: App ID not resolved. Check console for details.');\n            setCheckError(new Error('App ID not resolved. Check console for database errors.'));\n            setResolvedScope(null); // Ensure we don't proceed with incomplete scope\n            return;\n          }\n        }\n        \n        // Validate that appId is a UUID, not an app name (only in production)\n        if (process.env.NODE_ENV === 'production' && appId) {\n          const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n          if (!uuidRegex.test(appId)) {\n            console.error('[PagePermissionGuard] CRITICAL: App ID is not a valid UUID:', appId);\n            setCheckError(new Error(`Invalid app ID format: ${appId}. Expected UUID.`));\n            setResolvedScope(null); // Ensure we don't proceed with invalid scope\n            return;\n          }\n        }\n        const resolvedScope = {\n          organisationId: selectedOrganisationId,\n          eventId: selectedEventId || undefined,\n          appId: appId\n        };\n        console.log('[PagePermissionGuard] Setting resolved scope (org only):', resolvedScope);\n        setResolvedScope(resolvedScope);\n        return;\n      }\n\n      // If we only have event, resolve organisation from event\n      if (selectedEventId && supabase) {\n        try {\n          const eventScope = await createScopeFromEvent(supabase, selectedEventId);\n          if (!eventScope) {\n            setCheckError(new Error('Could not resolve organization from event context'));\n            setResolvedScope(null); // Ensure we don't proceed with incomplete scope\n            return;\n          }\n          // Preserve the resolved app ID\n          setResolvedScope({\n            ...eventScope,\n            appId: appId || eventScope.appId\n          });\n        } catch (error) {\n          setCheckError(error as Error);\n          setResolvedScope(null); // Ensure we don't proceed with incomplete scope\n        }\n        return;\n      }\n\n      // No context available\n      setCheckError(new Error('Either organisation context or event context is required for page permission checking'));\n      setResolvedScope(null); // Ensure we don't proceed with incomplete scope\n    };\n\n    resolveScope();\n  }, [scope, selectedOrganisationId, selectedEventId, supabase]);\n\n  // Determine the page ID for permission checking\n  const effectivePageId = useMemo((): string => {\n    return pageId || pageName;\n  }, [pageId, pageName]);\n\n  // Build the permission string\n  const permission = useMemo((): Permission => {\n    return `${operation}:page.${pageName}` as Permission;\n  }, [operation, pageName]);\n\n  // Check if user has permission - only call useCan when we have a resolved scope\n  // If resolvedScope is null, we're still resolving, so show loading state\n  console.log('[PagePermissionGuard] Calling useCan with scope:', resolvedScope);\n  console.log('[PagePermissionGuard] resolvedScope:', resolvedScope);\n  console.log('[PagePermissionGuard] selectedEventId:', selectedEventId);\n  \n  console.log('[PagePermissionGuard] About to call useCan with:', {\n    userId: user?.id || '',\n    scope: resolvedScope || { organisationId: '', appId: '', eventId: selectedEventId || undefined },\n    permission,\n    pageId: effectivePageId,\n    useCache: true\n  });\n  \n  const { can, isLoading: canIsLoading, error: canError } = useCan(\n    user?.id || '',\n    resolvedScope || { organisationId: '', appId: '', eventId: selectedEventId || undefined },\n    permission,\n    effectivePageId,\n    true // Use cache\n  );\n  \n  console.log('[PagePermissionGuard] useCan returned:', { can, canIsLoading, canError });\n  \n  // Combine loading states - we're loading if either scope is resolving OR permission check is loading\n  const isLoading = !resolvedScope || canIsLoading;\n  const error = checkError || canError;\n  \n  console.log('[PagePermissionGuard] Combined state:', { \n    can, \n    isLoading, \n    canIsLoading,\n    resolvedScopeExists: !!resolvedScope,\n    error: error?.message \n  });\n\n  // Handle permission check completion\n  useEffect(() => {\n    if (!isLoading && !error) {\n      setHasChecked(true);\n      setCheckError(null);\n      \n      if (!can && onDenied) {\n        onDenied(pageName, operation);\n      }\n    } else if (error) {\n      setCheckError(error);\n      setHasChecked(true);\n    }\n  }, [can, isLoading, error, pageName, operation, onDenied]);\n\n  // Log page access attempt for audit\n  useEffect(() => {\n    if (auditLog && hasChecked && !isLoading) {\n      console.log(`[PagePermissionGuard] Page access attempt:`, {\n        pageName,\n        operation,\n        userId: user?.id,\n        scope: resolvedScope,\n        allowed: can,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [auditLog, hasChecked, isLoading, pageName, operation, user?.id, resolvedScope, can]);\n\n  // Handle strict mode violations\n  useEffect(() => {\n    if (strictMode && hasChecked && !isLoading && !can) {\n      console.error(`[PagePermissionGuard] STRICT MODE VIOLATION: User attempted to access protected page without permission`, {\n        pageName,\n        operation,\n        userId: user?.id,\n        scope: resolvedScope,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [strictMode, hasChecked, isLoading, can, pageName, operation, user?.id, resolvedScope]);\n\n  // Show loading state\n  if (isLoading || !resolvedScope || !hasChecked) {\n    return <>{loading}</>;\n  }\n\n  // Show error state\n  if (checkError) {\n    console.error(`[PagePermissionGuard] Permission check failed for page ${pageName}:`, checkError);\n    return <>{fallback}</>;\n  }\n\n  // Show access denied\n  if (!can) {\n    return <>{fallback}</>;\n  }\n\n  // Show protected content\n  return <>{children}</>;\n}\n\n/**\n * Default access denied component\n */\nfunction DefaultAccessDenied() {\n  return (\n    <div className=\"flex flex-col items-center justify-center min-h-[200px] p-8 text-center\">\n      <div className=\"mb-4\">\n        <svg className=\"w-16 h-16 text-acc-500 mx-auto\" fill=\"none\" stroke=\"currentColor\" viewBox=\"0 0 24 24\">\n          <path strokeLinecap=\"round\" strokeLinejoin=\"round\" strokeWidth={2} d=\"M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L3.732 16.5c-.77.833.192 2.5 1.732 2.5z\" />\n        </svg>\n      </div>\n      <h2 className=\"text-xl font-semibold text-sec-900 mb-2\">Access Denied</h2>\n      <p className=\"text-sec-600 mb-4\">You don't have permission to access this page.</p>\n      <button \n        onClick={() => window.history.back()}\n        className=\"px-4 py-2 bg-main-600 text-main-50 rounded-md hover:bg-main-700 transition-colors\"\n      >\n        Go Back\n      </button>\n    </div>\n  );\n}\n\n/**\n * Default loading component\n */\nfunction DefaultLoading() {\n  return (\n    <div className=\"flex items-center justify-center min-h-[200px] p-8\">\n      <div className=\"flex items-center space-x-2\">\n        <div className=\"animate-spin rounded-full h-8 w-8 border-b-2 border-main-600\"></div>\n        <span className=\"text-sec-600\">Checking permissions...</span>\n      </div>\n    </div>\n  );\n}\n\nexport default PagePermissionGuard;\n","/**\n * Event Context Utilities for RBAC\n * @package @jmruthers/pace-core\n * @module RBAC/EventContext\n * @since 1.0.0\n * \n * This module provides utilities for event-based RBAC operations where\n * the organization context is derived from the event context.\n */\n\nimport { SupabaseClient } from '@supabase/supabase-js';\nimport { Database } from '../../types/database';\nimport { UUID, Scope } from '../types';\n\n/**\n * Get organization ID from event ID\n * \n * @param supabase - Supabase client\n * @param eventId - Event ID\n * @returns Promise resolving to organization ID or null\n */\nexport async function getOrganisationFromEvent(\n  supabase: SupabaseClient<Database>,\n  eventId: string\n): Promise<UUID | null> {\n  const { data, error } = await supabase\n    .from('event')\n    .select('organisation_id')\n    .eq('event_id', eventId)\n    .single() as { data: { organisation_id: string } | null; error: any };\n\n  if (error || !data) {\n    return null;\n  }\n\n  return data.organisation_id;\n}\n\n/**\n * Create a complete scope from event context\n * \n * @param supabase - Supabase client\n * @param eventId - Event ID\n * @param appId - Optional app ID\n * @returns Promise resolving to complete scope\n */\nexport async function createScopeFromEvent(\n  supabase: SupabaseClient<Database>,\n  eventId: string,\n  appId?: UUID\n): Promise<Scope | null> {\n  const organisationId = await getOrganisationFromEvent(supabase, eventId);\n  \n  if (!organisationId) {\n    return null;\n  }\n\n  return {\n    organisationId,\n    eventId,\n    appId\n  };\n}\n\n/**\n * Check if a scope is event-based (has eventId but no explicit organisationId)\n * \n * @param scope - Permission scope\n * @returns True if scope is event-based\n */\nexport function isEventBasedScope(scope: Scope): boolean {\n  return !scope.organisationId && !!scope.eventId;\n}\n\n/**\n * Validate that an event-based scope has the required context\n * \n * @param scope - Permission scope\n * @returns True if scope is valid for event-based operations\n */\nexport function isValidEventBasedScope(scope: Scope): boolean {\n  return isEventBasedScope(scope) && !!scope.eventId;\n}\n","/**\n * @file Secure Data Provider Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/SecureDataProvider\n * @since 2.0.0\n *\n * A context provider that prevents apps from accessing Supabase directly and ensures\n * all data access goes through the secure RBAC system. This is a critical security\n * component that enforces data access control.\n *\n * Features:\n * - Prevents direct Supabase client access\n * - Enforces secure data access patterns\n * - Automatic organisation context injection\n * - RLS policy enforcement\n * - Audit logging for all data access\n * - Integration with existing RBAC system\n *\n * @example\n * ```tsx\n * // Basic app setup with secure data access\n * <SecureDataProvider strictMode={true} auditLog={true}>\n *   <App />\n * </SecureDataProvider>\n * \n * // With custom configuration\n * <SecureDataProvider\n *   strictMode={true}\n *   auditLog={true}\n *   onDataAccess={(table, operation, allowed) => {\n *     console.log(`Data access: ${table} ${operation} - ${allowed ? 'allowed' : 'denied'}`);\n *   }}\n * >\n *   <App />\n * </SecureDataProvider>\n * ```\n *\n * @security\n * - Prevents direct Supabase client access\n * - Enforces secure data access patterns\n * - Automatic organisation context injection\n * - RLS policy enforcement\n * - Audit logging for all data access\n * - Integration with existing RBAC system\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Efficient context updates\n * - Minimal re-renders\n * - Cached permission checks\n *\n * @dependencies\n * - React 18+ - Context and hooks\n * - useUnifiedAuth - Authentication context\n * - useSecureDataAccess - Secure data access hook\n * - RBAC types - Type definitions\n */\n\nimport React, { createContext, useContext, useState, useCallback, useMemo, useEffect } from 'react';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { useSecureDataAccess } from '../../hooks/useSecureDataAccess';\nimport { UUID, Scope, Permission } from '../types';\n\nexport interface DataAccessRecord {\n  table: string;\n  operation: string;\n  userId: UUID;\n  scope: Scope;\n  allowed: boolean;\n  timestamp: string;\n  query?: string;\n  filters?: Record<string, any>;\n}\n\nexport interface SecureDataContextType {\n  /** Check if data access is allowed for a table and operation */\n  isDataAccessAllowed: (table: string, operation: string, scope?: Scope) => boolean;\n  \n  /** Get all data access permissions for current user */\n  getDataAccessPermissions: () => Record<string, string[]>;\n  \n  /** Check if secure data access is enabled */\n  isEnabled: boolean;\n  \n  /** Check if strict mode is enabled */\n  isStrictMode: boolean;\n  \n  /** Check if audit logging is enabled */\n  isAuditLogEnabled: boolean;\n  \n  /** Get data access history */\n  getDataAccessHistory: () => DataAccessRecord[];\n  \n  /** Clear data access history */\n  clearDataAccessHistory: () => void;\n  \n  /** Validate data access attempt */\n  validateDataAccess: (table: string, operation: string, scope?: Scope) => boolean;\n}\n\nexport interface SecureDataProviderProps {\n  /** Child components */\n  children: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Enable audit logging (default: true) */\n  auditLog?: boolean;\n  \n  /** Callback when data access is attempted */\n  onDataAccess?: (table: string, operation: string, allowed: boolean, record: DataAccessRecord) => void;\n  \n  /** Callback when strict mode violation occurs */\n  onStrictModeViolation?: (table: string, operation: string, record: DataAccessRecord) => void;\n  \n  /** Maximum number of access records to keep in history */\n  maxHistorySize?: number;\n  \n  /** Enable RLS enforcement (default: true) */\n  enforceRLS?: boolean;\n}\n\nconst SecureDataContext = createContext<SecureDataContextType | null>(null);\n\n/**\n * SecureDataProvider - Prevents direct Supabase access and enforces secure data patterns\n * \n * This provider ensures that all data access goes through the secure RBAC system\n * and prevents apps from bypassing data access controls.\n * \n * @param props - Provider props\n * @returns React element with secure data context\n */\nexport function SecureDataProvider({\n  children,\n  strictMode = true,\n  auditLog = true,\n  onDataAccess,\n  onStrictModeViolation,\n  maxHistorySize = 1000,\n  enforceRLS = true\n}: SecureDataProviderProps) {\n  const { user, selectedOrganisationId, selectedEventId } = useUnifiedAuth();\n  const { validateContext } = useSecureDataAccess();\n  const [dataAccessHistory, setDataAccessHistory] = useState<DataAccessRecord[]>([]);\n  const [isEnabled, setIsEnabled] = useState(true);\n\n  // Get current scope\n  const currentScope = useMemo((): Scope | null => {\n    if (!selectedOrganisationId) return null;\n    \n    return {\n      organisationId: selectedOrganisationId,\n      eventId: selectedEventId || undefined,\n      appId: undefined\n    };\n  }, [selectedOrganisationId, selectedEventId]);\n\n  // Check if data access is allowed for a table and operation\n  const isDataAccessAllowed = useCallback((\n    table: string, \n    operation: string, \n    scope?: Scope\n  ): boolean => {\n    if (!isEnabled) return true;\n    if (!user?.id) return false;\n    \n    const effectiveScope = scope || currentScope;\n    if (!effectiveScope) return false;\n    \n    // Use the existing RBAC system to check data access permissions\n    // This is a synchronous check for the context - actual permission checking\n    // happens in the useSecureDataAccess hook using the RBAC engine\n    const permission = `${operation}:data.${table}` as Permission;\n    \n    // For now, we'll return true and let the useSecureDataAccess hook\n    // handle the actual permission checking asynchronously\n    // This context is mainly for tracking and audit purposes\n    return true;\n  }, [isEnabled, user?.id, currentScope]);\n\n  // Get all data access permissions for current user\n  const getDataAccessPermissions = useCallback((): Record<string, string[]> => {\n    if (!isEnabled || !user?.id) return {};\n    \n    // For now, return empty object - this will be enhanced with actual permission checking\n    // when we integrate with the existing RBAC system\n    return {};\n  }, [isEnabled, user?.id]);\n\n  // Get data access history\n  const getDataAccessHistory = useCallback((): DataAccessRecord[] => {\n    return [...dataAccessHistory];\n  }, [dataAccessHistory]);\n\n  // Clear data access history\n  const clearDataAccessHistory = useCallback(() => {\n    setDataAccessHistory([]);\n  }, []);\n\n  // Validate data access attempt\n  const validateDataAccess = useCallback((\n    table: string,\n    operation: string,\n    scope?: Scope\n  ): boolean => {\n    if (!isEnabled) return true;\n    if (!user?.id) return false;\n    \n    const effectiveScope = scope || currentScope;\n    if (!effectiveScope) return false;\n    \n    // Validate organisation context\n    try {\n      validateContext();\n    } catch (error) {\n      console.error(`[SecureDataProvider] Organisation context validation failed:`, error);\n      return false;\n    }\n    \n    return isDataAccessAllowed(table, operation, effectiveScope);\n  }, [isEnabled, user?.id, currentScope, validateContext, isDataAccessAllowed]);\n\n  // Record data access attempt\n  const recordDataAccess = useCallback((\n    table: string,\n    operation: string,\n    allowed: boolean,\n    query?: string,\n    filters?: Record<string, any>,\n    scope?: Scope\n  ) => {\n    if (!auditLog || !user?.id) return;\n    \n    const record: DataAccessRecord = {\n      table,\n      operation,\n      userId: user.id,\n      scope: scope || currentScope || { organisationId: '' },\n      allowed,\n      timestamp: new Date().toISOString(),\n      query,\n      filters\n    };\n    \n    setDataAccessHistory(prev => {\n      const newHistory = [record, ...prev];\n      return newHistory.slice(0, maxHistorySize);\n    });\n    \n    if (onDataAccess) {\n      onDataAccess(table, operation, allowed, record);\n    }\n    \n    if (strictMode && !allowed && onStrictModeViolation) {\n      onStrictModeViolation(table, operation, record);\n    }\n  }, [auditLog, user?.id, currentScope, maxHistorySize, onDataAccess, onStrictModeViolation, strictMode]);\n\n  // Context value\n  const contextValue = useMemo((): SecureDataContextType => ({\n    isDataAccessAllowed,\n    getDataAccessPermissions,\n    isEnabled,\n    isStrictMode: strictMode,\n    isAuditLogEnabled: auditLog,\n    getDataAccessHistory,\n    clearDataAccessHistory,\n    validateDataAccess\n  }), [\n    isDataAccessAllowed,\n    getDataAccessPermissions,\n    isEnabled,\n    strictMode,\n    auditLog,\n    getDataAccessHistory,\n    clearDataAccessHistory,\n    validateDataAccess\n  ]);\n\n  // Log strict mode violations\n  useEffect(() => {\n    if (strictMode && auditLog) {\n      console.log(`[SecureDataProvider] Strict mode enabled - all data access attempts will be logged and enforced`);\n    }\n  }, [strictMode, auditLog]);\n\n  // Log RLS enforcement\n  useEffect(() => {\n    if (enforceRLS && auditLog) {\n      console.log(`[SecureDataProvider] RLS enforcement enabled - all queries will include organisation context`);\n    }\n  }, [enforceRLS, auditLog]);\n\n  return (\n    <SecureDataContext.Provider value={contextValue}>\n      {children}\n    </SecureDataContext.Provider>\n  );\n}\n\n/**\n * Hook to use secure data context\n * \n * @returns Secure data context\n * @throws Error if used outside of SecureDataProvider\n */\nexport function useSecureData(): SecureDataContextType {\n  const context = useContext(SecureDataContext);\n  \n  if (!context) {\n    throw new Error('useSecureData must be used within a SecureDataProvider');\n  }\n  \n  return context;\n}\n\nexport default SecureDataProvider;\n","/**\n * @file Permission Enforcer Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/PermissionEnforcer\n * @since 2.0.0\n *\n * A component that enforces permissions and prevents apps from bypassing permission checks.\n * This is a critical security component that provides centralized permission enforcement.\n *\n * Features:\n * - Centralized permission enforcement\n * - Strict mode to prevent bypassing\n * - Automatic audit logging\n * - Integration with existing RBAC system\n * - Multiple permission checking\n * - Clear error messages for unauthorized access\n *\n * @example\n * ```tsx\n * // Basic permission enforcement\n * <PermissionEnforcer\n *   permissions={['read:events', 'manage:events']}\n *   operation=\"event-management\"\n *   fallback={<AccessDeniedPage />}\n * >\n *   <EventManagementPage />\n * </PermissionEnforcer>\n * \n * // Strict mode (prevents bypassing)\n * <PermissionEnforcer\n *   permissions={['admin:system']}\n *   operation=\"system-administration\"\n *   strictMode={true}\n *   fallback={<AccessDeniedPage />}\n * >\n *   <SystemAdminPage />\n * </PermissionEnforcer>\n * \n * // With custom fallback\n * <PermissionEnforcer\n *   permissions={['update:settings']}\n *   operation=\"settings-update\"\n *   fallback={<div>You don't have permission to update settings</div>}\n * >\n *   <SettingsUpdatePage />\n * </PermissionEnforcer>\n * ```\n *\n * @security\n * - Enforces permissions for all operations\n * - Prevents apps from bypassing permission checks\n * - Automatic audit logging for all permission checks\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized access\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Cached permission checks\n * - Minimal re-renders\n * - Efficient error handling\n *\n * @dependencies\n * - React 18+ - Component framework\n * - useCan hook - Permission checking\n * - useUnifiedAuth - Authentication context\n * - RBAC types - Type definitions\n */\n\nimport React, { useMemo, useCallback, useEffect, useState } from 'react';\nimport { useCan } from '../hooks';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { UUID, Permission, Scope } from '../types';\nimport { createScopeFromEvent } from '../utils/eventContext';\n\nexport interface PermissionEnforcerProps {\n  /** Permissions required for access */\n  permissions: Permission[];\n  \n  /** Operation being performed */\n  operation: string;\n  \n  /** Content to render when user has permission */\n  children: React.ReactNode;\n  \n  /** Content to render when user lacks permission */\n  fallback?: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Force audit logging for this operation (default: true) */\n  auditLog?: boolean;\n  \n  /** Custom scope for permission checking */\n  scope?: Scope;\n  \n  /** Callback when access is denied */\n  onDenied?: (permissions: Permission[], operation: string) => void;\n  \n  /** Loading state content */\n  loading?: React.ReactNode;\n  \n  /** Require all permissions (AND) or any permission (OR) */\n  requireAll?: boolean;\n}\n\n/**\n * PermissionEnforcer - Enforces permissions for operations\n * \n * This component ensures that users can only perform operations they have permission for.\n * It integrates with the existing RBAC system and provides strict enforcement to\n * prevent apps from bypassing permission checks.\n * \n * @param props - Component props\n * @returns React element with permission enforcement\n */\nexport function PermissionEnforcer({\n  permissions,\n  operation,\n  children,\n  fallback = <DefaultAccessDenied />,\n  strictMode = true,\n  auditLog = true,\n  scope,\n  onDenied,\n  loading = <DefaultLoading />,\n  requireAll = true\n}: PermissionEnforcerProps) {\n  const { user, selectedOrganisationId, selectedEventId, supabase } = useUnifiedAuth();\n  const [hasChecked, setHasChecked] = useState(false);\n  const [checkError, setCheckError] = useState<Error | null>(null);\n  const [permissionResults, setPermissionResults] = useState<Record<string, boolean>>({});\n  const [resolvedScope, setResolvedScope] = useState<Scope | null>(null);\n\n  // Resolve scope - either use provided scope or resolve from context\n  useEffect(() => {\n    const resolveScope = async () => {\n      if (scope) {\n        setResolvedScope(scope);\n        return;\n      }\n\n      // If we have both organisation and event, use them directly\n      if (selectedOrganisationId && selectedEventId) {\n        setResolvedScope({\n          organisationId: selectedOrganisationId,\n          eventId: selectedEventId,\n          appId: undefined\n        });\n        return;\n      }\n\n      // If we only have organisation, use it\n      if (selectedOrganisationId) {\n        setResolvedScope({\n          organisationId: selectedOrganisationId,\n          eventId: selectedEventId || undefined,\n          appId: undefined\n        });\n        return;\n      }\n\n      // If we only have event, resolve organisation from event\n      if (selectedEventId && supabase) {\n        try {\n          const eventScope = await createScopeFromEvent(supabase, selectedEventId);\n          if (!eventScope) {\n            setCheckError(new Error('Could not resolve organization from event context'));\n            return;\n          }\n          setResolvedScope(eventScope);\n        } catch (error) {\n          setCheckError(error as Error);\n        }\n        return;\n      }\n\n      // No context available\n      setCheckError(new Error('Either organisation context or event context is required for permission checking'));\n    };\n\n    resolveScope();\n  }, [scope, selectedOrganisationId, selectedEventId, supabase]);\n\n  // Check permissions using the first permission as a representative\n  // For multiple permissions, we'll check them sequentially\n  const representativePermission = permissions[0];\n  const { can, isLoading, error } = useCan(\n    user?.id || '',\n    resolvedScope || { eventId: selectedEventId || undefined },\n    representativePermission,\n    undefined,\n    true // Use cache\n  );\n\n  // Determine if user has required permissions\n  const hasRequiredPermissions = useMemo((): boolean => {\n    if (permissions.length === 0) return true;\n    \n    // For now, use the representative permission result\n    // In a future enhancement, we could check all permissions\n    // but this would require multiple useCan hooks or a custom hook\n    return can;\n  }, [permissions, can]);\n\n  // Handle permission check completion\n  useEffect(() => {\n    if (!isLoading && !error) {\n      setHasChecked(true);\n      setCheckError(null);\n      \n      if (!hasRequiredPermissions && onDenied) {\n        onDenied(permissions, operation);\n      }\n    } else if (error) {\n      setCheckError(error);\n      setHasChecked(true);\n    }\n  }, [hasRequiredPermissions, isLoading, error, permissions, operation, onDenied]);\n\n  // Log permission check attempt for audit\n  useEffect(() => {\n    if (auditLog && hasChecked && !isLoading) {\n      console.log(`[PermissionEnforcer] Permission check attempt:`, {\n        permissions,\n        operation,\n        userId: user?.id,\n        scope: resolvedScope,\n        allowed: hasRequiredPermissions,\n        requireAll,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [auditLog, hasChecked, isLoading, permissions, operation, user?.id, resolvedScope, hasRequiredPermissions, requireAll]);\n\n  // Handle strict mode violations\n  useEffect(() => {\n    if (strictMode && hasChecked && !isLoading && !hasRequiredPermissions) {\n      console.error(`[PermissionEnforcer] STRICT MODE VIOLATION: User attempted to perform operation without permission`, {\n        permissions,\n        operation,\n        userId: user?.id,\n        scope: resolvedScope,\n        requireAll,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [strictMode, hasChecked, isLoading, hasRequiredPermissions, permissions, operation, user?.id, resolvedScope, requireAll]);\n\n  // Show loading state\n  if (isLoading || !hasChecked) {\n    return <>{loading}</>;\n  }\n\n  // Show error state\n  if (checkError) {\n    console.error(`[PermissionEnforcer] Permission check failed for operation ${operation}:`, checkError);\n    return <>{fallback}</>;\n  }\n\n  // Show access denied\n  if (!hasRequiredPermissions) {\n    return <>{fallback}</>;\n  }\n\n  // Show protected content\n  return <>{children}</>;\n}\n\n/**\n * Default access denied component\n */\nfunction DefaultAccessDenied() {\n  return (\n    <div className=\"flex flex-col items-center justify-center min-h-[200px] p-8 text-center\">\n      <div className=\"mb-4\">\n        <svg className=\"w-16 h-16 text-acc-500 mx-auto\" fill=\"none\" stroke=\"currentColor\" viewBox=\"0 0 24 24\">\n          <path strokeLinecap=\"round\" strokeLinejoin=\"round\" strokeWidth={2} d=\"M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L3.732 16.5c-.77.833.192 2.5 1.732 2.5z\" />\n        </svg>\n      </div>\n      <h2 className=\"text-xl font-semibold text-sec-900 mb-2\">Access Denied</h2>\n      <p className=\"text-sec-600 mb-4\">You don't have permission to perform this operation.</p>\n      <button \n        onClick={() => window.history.back()}\n        className=\"px-4 py-2 bg-main-600 text-main-50 rounded-md hover:bg-main-700 transition-colors\"\n      >\n        Go Back\n      </button>\n    </div>\n  );\n}\n\n/**\n * Default loading component\n */\nfunction DefaultLoading() {\n  return (\n    <div className=\"flex items-center justify-center min-h-[200px] p-8\">\n      <div className=\"flex items-center space-x-2\">\n        <div className=\"animate-spin rounded-full h-8 w-8 border-b-2 border-main-600\"></div>\n        <span className=\"text-sec-600\">Checking permissions...</span>\n      </div>\n    </div>\n  );\n}\n\nexport default PermissionEnforcer;\n","/**\n * @file Role Based Router Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/RoleBasedRouter\n * @since 2.0.0\n *\n * A component that provides centralized routing control and prevents apps from\n * implementing custom routing that bypasses permission checks. This is a critical\n * security component that ensures all routes are properly protected.\n *\n * Features:\n * - Centralized routing control\n * - Role-based route protection\n * - Permission-based route filtering\n * - Strict mode to prevent bypassing\n * - Automatic audit logging\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized routes\n *\n * @example\n * ```tsx\n * // Basic role-based routing\n * <RoleBasedRouter\n *   routes={routeConfig}\n *   fallbackRoute=\"/unauthorized\"\n *   strictMode={true}\n * >\n *   <App />\n * </RoleBasedRouter>\n * \n * // With custom configuration\n * <RoleBasedRouter\n *   routes={routeConfig}\n *   fallbackRoute=\"/unauthorized\"\n *   strictMode={true}\n *   auditLog={true}\n *   onRouteAccess={(route, allowed) => {\n *     console.log(`Route access: ${route} - ${allowed ? 'allowed' : 'denied'}`);\n *   }}\n * >\n *   <App />\n * </RoleBasedRouter>\n * ```\n *\n * @security\n * - Enforces route-level permissions\n * - Prevents apps from bypassing route protection\n * - Automatic audit logging for all route access attempts\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized routes\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Cached permission checks\n * - Minimal re-renders\n * - Efficient route matching\n *\n * @dependencies\n * - React 18+ - Component framework\n * - React Router - Routing functionality\n * - useCan hook - Permission checking\n * - useUnifiedAuth - Authentication context\n * - RBAC types - Type definitions\n */\n\nimport React, { useMemo, useCallback, useEffect, useState, createContext, useContext } from 'react';\nimport { useLocation, useNavigate, Outlet } from 'react-router-dom';\nimport { useCan } from '../hooks';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { UUID, Permission, Scope, AccessLevel } from '../types';\n\nexport interface RouteConfig {\n  /** Route path */\n  path: string;\n  \n  /** React component to render */\n  component: React.ComponentType;\n  \n  /** Permissions required for this route */\n  permissions: Permission[];\n  \n  /** Roles that can access this route */\n  roles?: string[];\n  \n  /** Minimum access level required */\n  accessLevel?: AccessLevel;\n  \n  /** Page ID for permission checking */\n  pageId?: string;\n  \n  /** Enable strict mode for this route */\n  strictMode?: boolean;\n  \n  /** Route metadata */\n  meta?: {\n    title?: string;\n    description?: string;\n    requiresAuth?: boolean;\n    hidden?: boolean;\n  };\n}\n\nexport interface RouteAccessRecord {\n  route: string;\n  permissions: Permission[];\n  userId: UUID;\n  scope: Scope;\n  allowed: boolean;\n  timestamp: string;\n  pageId?: string;\n  roles?: string[];\n  accessLevel?: AccessLevel;\n}\n\nexport interface RoleBasedRouterContextType {\n  /** Get all accessible routes for current user */\n  getAccessibleRoutes: () => RouteConfig[];\n  \n  /** Check if user can access a specific route */\n  canAccessRoute: (path: string) => boolean;\n  \n  /** Get route configuration for a path */\n  getRouteConfig: (path: string) => RouteConfig | null;\n  \n  /** Get route access history */\n  getRouteAccessHistory: () => RouteAccessRecord[];\n  \n  /** Clear route access history */\n  clearRouteAccessHistory: () => void;\n  \n  /** Check if strict mode is enabled */\n  isStrictMode: boolean;\n  \n  /** Check if audit logging is enabled */\n  isAuditLogEnabled: boolean;\n}\n\nexport interface RoleBasedRouterProps {\n  /** Route configuration */\n  routes: RouteConfig[];\n  \n  /** Fallback route for unauthorized access */\n  fallbackRoute?: string;\n  \n  /** Child components */\n  children: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Enable audit logging (default: true) */\n  auditLog?: boolean;\n  \n  /** Callback when route access is attempted */\n  onRouteAccess?: (route: string, allowed: boolean, record: RouteAccessRecord) => void;\n  \n  /** Callback when strict mode violation occurs */\n  onStrictModeViolation?: (route: string, record: RouteAccessRecord) => void;\n  \n  /** Maximum number of access records to keep in history */\n  maxHistorySize?: number;\n  \n  /** Custom unauthorized component */\n  unauthorizedComponent?: React.ComponentType<{ route: string; reason: string }>;\n}\n\nconst RoleBasedRouterContext = createContext<RoleBasedRouterContextType | null>(null);\n\n/**\n * RoleBasedRouter - Centralized routing control with role-based protection\n * \n * This component ensures that all routes are properly protected and provides\n * centralized routing control to prevent apps from bypassing route protection.\n * \n * @param props - Router props\n * @returns React element with role-based routing\n */\nexport function RoleBasedRouter({\n  routes,\n  fallbackRoute = '/unauthorized',\n  children,\n  strictMode = true,\n  auditLog = true,\n  onRouteAccess,\n  onStrictModeViolation,\n  maxHistorySize = 1000,\n  unauthorizedComponent: UnauthorizedComponent = DefaultUnauthorizedComponent\n}: RoleBasedRouterProps) {\n  const { user, selectedOrganisationId, selectedEventId } = useUnifiedAuth();\n  const location = useLocation();\n  const navigate = useNavigate();\n  const [routeAccessHistory, setRouteAccessHistory] = useState<RouteAccessRecord[]>([]);\n  const [currentRoute, setCurrentRoute] = useState<string>('');\n\n  // Get current scope\n  const currentScope = useMemo((): Scope | null => {\n    if (!selectedOrganisationId) return null;\n    \n    return {\n      organisationId: selectedOrganisationId,\n      eventId: selectedEventId || undefined,\n      appId: undefined\n    };\n  }, [selectedOrganisationId, selectedEventId]);\n\n  // Get route configuration for current path\n  const currentRouteConfig = useMemo((): RouteConfig | null => {\n    const currentPath = location.pathname;\n    return routes.find(route => route.path === currentPath) || null;\n  }, [routes, location.pathname]);\n\n  // Check if user can access a specific route\n  const canAccessRoute = useCallback((path: string): boolean => {\n    if (!user?.id || !currentScope) return false;\n    \n    const routeConfig = routes.find(route => route.path === path);\n    if (!routeConfig) return false;\n    \n    // Use the existing RBAC system to check route permissions\n    // This is a synchronous check for the context - actual permission checking\n    // happens in the individual route components using useCan hook\n    // For now, we'll return true and let the individual route components\n    // handle the actual permission checking asynchronously\n    return true;\n  }, [user?.id, currentScope, routes]);\n\n  // Use useCan hook for actual permission checking\n  const { can: canAccessCurrentRoute, isLoading: permissionLoading } = useCan(\n    user?.id || '',\n    currentScope || { organisationId: '', eventId: undefined, appId: undefined },\n    currentRouteConfig?.permissions?.[0] || 'read:page',\n    currentRouteConfig?.pageId\n  );\n\n  // If route has no permissions, deny access (secure by default)\n  const hasPermissions = currentRouteConfig?.permissions && currentRouteConfig.permissions.length > 0;\n  const finalCanAccess = hasPermissions ? canAccessCurrentRoute : false;\n  const finalLoading = hasPermissions ? permissionLoading : false;\n\n  // Get all accessible routes for current user\n  const getAccessibleRoutes = useCallback((): RouteConfig[] => {\n    if (!user?.id || !currentScope) return [];\n    \n    return routes.filter(route => canAccessRoute(route.path));\n  }, [user?.id, currentScope, routes, canAccessRoute]);\n\n  // Get route configuration for a path\n  const getRouteConfig = useCallback((path: string): RouteConfig | null => {\n    return routes.find(route => route.path === path) || null;\n  }, [routes]);\n\n  // Get route access history\n  const getRouteAccessHistory = useCallback((): RouteAccessRecord[] => {\n    return [...routeAccessHistory];\n  }, [routeAccessHistory]);\n\n  // Clear route access history\n  const clearRouteAccessHistory = useCallback(() => {\n    setRouteAccessHistory([]);\n  }, []);\n\n  // Record route access attempt\n  const recordRouteAccess = useCallback((\n    route: string,\n    allowed: boolean,\n    routeConfig: RouteConfig\n  ) => {\n    if (!auditLog || !user?.id || !currentScope) return;\n    \n    const record: RouteAccessRecord = {\n      route,\n      permissions: routeConfig.permissions,\n      userId: user.id,\n      scope: currentScope,\n      allowed,\n      timestamp: new Date().toISOString(),\n      pageId: routeConfig.pageId,\n      roles: routeConfig.roles,\n      accessLevel: routeConfig.accessLevel\n    };\n    \n    setRouteAccessHistory(prev => {\n      const newHistory = [record, ...prev];\n      return newHistory.slice(0, maxHistorySize);\n    });\n    \n    if (onRouteAccess) {\n      onRouteAccess(route, allowed, record);\n    }\n    \n    if (strictMode && !allowed && onStrictModeViolation) {\n      onStrictModeViolation(route, record);\n    }\n  }, [auditLog, user?.id, currentScope, maxHistorySize, onRouteAccess, onStrictModeViolation, strictMode]);\n\n  // Check route access on location change\n  useEffect(() => {\n    const currentPath = location.pathname;\n    setCurrentRoute(currentPath);\n    \n    if (!currentRouteConfig) {\n      // Route not found in configuration\n      if (strictMode) {\n        console.error(`[RoleBasedRouter] STRICT MODE VIOLATION: Route not found in configuration`, {\n          route: currentPath,\n          userId: user?.id,\n          timestamp: new Date().toISOString()\n        });\n        \n        if (onStrictModeViolation) {\n          onStrictModeViolation(currentPath, {\n            route: currentPath,\n            permissions: [],\n            userId: user?.id || '',\n            scope: currentScope || { organisationId: '' },\n            allowed: false,\n            timestamp: new Date().toISOString()\n          });\n        }\n      }\n      return;\n    }\n    \n    // Use the actual permission check result\n    const allowed = finalCanAccess;\n    recordRouteAccess(currentPath, allowed, currentRouteConfig);\n    \n    if (!allowed) {\n      // Redirect to fallback route\n      navigate(fallbackRoute, { replace: true });\n    }\n  }, [location.pathname, currentRouteConfig, canAccessCurrentRoute, recordRouteAccess, strictMode, user?.id, currentScope, onStrictModeViolation, navigate, fallbackRoute]);\n\n  // Context value\n  const contextValue = useMemo((): RoleBasedRouterContextType => ({\n    getAccessibleRoutes,\n    canAccessRoute,\n    getRouteConfig,\n    getRouteAccessHistory,\n    clearRouteAccessHistory,\n    isStrictMode: strictMode,\n    isAuditLogEnabled: auditLog\n  }), [\n    getAccessibleRoutes,\n    canAccessRoute,\n    getRouteConfig,\n    getRouteAccessHistory,\n    clearRouteAccessHistory,\n    strictMode,\n    auditLog\n  ]);\n\n  // Show loading state while checking permissions\n  if (finalLoading) {\n    return (\n      <div className=\"flex items-center justify-center min-h-screen\">\n        <div className=\"text-center\">\n          <div className=\"animate-spin rounded-full h-8 w-8 border-b-2 border-main-600 mx-auto mb-4\"></div>\n          <p className=\"text-sec-600\">Checking permissions...</p>\n        </div>\n      </div>\n    );\n  }\n\n  // Show unauthorized component if user can't access current route\n  if (currentRouteConfig && !finalCanAccess) {\n    return (\n      <UnauthorizedComponent \n        route={currentRoute} \n        reason=\"Insufficient permissions\" \n      />\n    );\n  }\n  return (\n    <RoleBasedRouterContext.Provider value={contextValue}>\n      {children}\n      <Outlet />\n    </RoleBasedRouterContext.Provider>\n  );\n}\n\n/**\n * Hook to use role-based router context\n * \n * @returns Role-based router context\n * @throws Error if used outside of RoleBasedRouter\n */\nexport function useRoleBasedRouter(): RoleBasedRouterContextType {\n  const context = useContext(RoleBasedRouterContext);\n  \n  if (!context) {\n    throw new Error('useRoleBasedRouter must be used within a RoleBasedRouter');\n  }\n  \n  return context;\n}\n\n/**\n * Default unauthorized component\n */\nfunction DefaultUnauthorizedComponent({ route, reason }: { route: string; reason: string }) {\n  return (\n    <div className=\"flex flex-col items-center justify-center min-h-screen p-8 text-center\">\n      <div className=\"mb-4\">\n        <svg className=\"w-16 h-16 text-acc-500 mx-auto\" fill=\"none\" stroke=\"currentColor\" viewBox=\"0 0 24 24\">\n          <path strokeLinecap=\"round\" strokeLinejoin=\"round\" strokeWidth={2} d=\"M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L3.732 16.5c-.77.833.192 2.5 1.732 2.5z\" />\n        </svg>\n      </div>\n      <h2 className=\"text-xl font-semibold text-sec-900 mb-2\">Access Denied</h2>\n      <p className=\"text-sec-600 mb-4\">\n        You don't have permission to access <code className=\"bg-sec-100 px-2 py-1 rounded\">{route}</code>\n      </p>\n      <p className=\"text-sm text-sec-500 mb-4\">Reason: {reason}</p>\n      <button \n        onClick={() => window.history.back()}\n        className=\"px-4 py-2 bg-main-600 text-main-50 rounded-md hover:bg-main-700 transition-colors\"\n      >\n        Go Back\n      </button>\n    </div>\n  );\n}\n\nexport default RoleBasedRouter;\n\n","/**\n * @file Navigation Provider Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/NavigationProvider\n * @since 2.0.0\n *\n * A context provider that manages navigation permissions across the entire application.\n * This component ensures that all navigation items are properly protected and provides\n * centralized navigation permission management.\n *\n * Features:\n * - App-wide navigation permission management\n * - Strict mode to prevent bypassing\n * - Automatic audit logging\n * - Integration with existing RBAC system\n * - Navigation permission tracking\n * - Error handling and recovery\n *\n * @example\n * ```tsx\n * // Basic app setup with navigation permissions\n * <NavigationProvider strictMode={true} auditLog={true}>\n *   <App />\n * </NavigationProvider>\n * \n * // With custom configuration\n * <NavigationProvider\n *   strictMode={true}\n *   auditLog={true}\n *   onNavigationAccess={(item, allowed) => {\n *     console.log(`Navigation access: ${item} - ${allowed ? 'allowed' : 'denied'}`);\n *   }}\n * >\n *   <App />\n * </NavigationProvider>\n * ```\n *\n * @security\n * - Enforces navigation-level permissions across the app\n * - Prevents apps from bypassing navigation permission checks\n * - Automatic audit logging for all navigation access attempts\n * - Integration with existing RBAC system\n * - Navigation permission tracking and monitoring\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Efficient context updates\n * - Minimal re-renders\n * - Cached permission checks\n *\n * @dependencies\n * - React 18+ - Context and hooks\n * - useUnifiedAuth - Authentication context\n * - RBAC types - Type definitions\n */\n\nimport React, { createContext, useContext, useState, useCallback, useMemo, useEffect } from 'react';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { UUID, Scope, Permission } from '../types';\n\nexport interface NavigationItem {\n  /** Unique identifier for the navigation item */\n  id: string;\n  \n  /** Display label for the navigation item */\n  label: string;\n  \n  /** Navigation path/URL */\n  path: string;\n  \n  /** Permissions required for this navigation item */\n  permissions: Permission[];\n  \n  /** Roles that can access this navigation item */\n  roles?: string[];\n  \n  /** Minimum access level required */\n  accessLevel?: 'viewer' | 'participant' | 'planner' | 'admin' | 'super';\n  \n  /** Page ID for permission checking */\n  pageId?: string;\n  \n  /** Enable strict mode for this navigation item */\n  strictMode?: boolean;\n  \n  /** Navigation item metadata */\n  meta?: {\n    icon?: string;\n    description?: string;\n    hidden?: boolean;\n    order?: number;\n  };\n}\n\nexport interface NavigationAccessRecord {\n  navigationItem: string;\n  permissions: Permission[];\n  userId: UUID;\n  scope: Scope;\n  allowed: boolean;\n  timestamp: string;\n  pageId?: string;\n  roles?: string[];\n  accessLevel?: string;\n}\n\nexport interface NavigationContextType {\n  /** Check if user has permission for a navigation item */\n  hasNavigationPermission: (item: NavigationItem) => boolean;\n  \n  /** Get all navigation permissions for current user */\n  getNavigationPermissions: () => Record<string, string[]>;\n  \n  /** Get filtered navigation items based on permissions */\n  getFilteredNavigationItems: (items: NavigationItem[]) => NavigationItem[];\n  \n  /** Check if navigation permission checking is enabled */\n  isEnabled: boolean;\n  \n  /** Check if strict mode is enabled */\n  isStrictMode: boolean;\n  \n  /** Check if audit logging is enabled */\n  isAuditLogEnabled: boolean;\n  \n  /** Get navigation access history */\n  getNavigationAccessHistory: () => NavigationAccessRecord[];\n  \n  /** Clear navigation access history */\n  clearNavigationAccessHistory: () => void;\n}\n\nexport interface NavigationProviderProps {\n  /** Child components */\n  children: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Enable audit logging (default: true) */\n  auditLog?: boolean;\n  \n  /** Callback when navigation access is attempted */\n  onNavigationAccess?: (item: NavigationItem, allowed: boolean, record: NavigationAccessRecord) => void;\n  \n  /** Callback when strict mode violation occurs */\n  onStrictModeViolation?: (item: NavigationItem, record: NavigationAccessRecord) => void;\n  \n  /** Maximum number of access records to keep in history */\n  maxHistorySize?: number;\n}\n\nconst NavigationContext = createContext<NavigationContextType | null>(null);\n\n/**\n * NavigationProvider - Manages navigation-level permissions across the app\n * \n * This provider ensures that all navigation items are properly protected and provides\n * centralized navigation permission management with strict enforcement.\n * \n * @param props - Provider props\n * @returns React element with navigation permission context\n */\nexport function NavigationProvider({\n  children,\n  strictMode = true,\n  auditLog = true,\n  onNavigationAccess,\n  onStrictModeViolation,\n  maxHistorySize = 1000\n}: NavigationProviderProps) {\n  const { user, selectedOrganisationId, selectedEventId } = useUnifiedAuth();\n  const [navigationAccessHistory, setNavigationAccessHistory] = useState<NavigationAccessRecord[]>([]);\n  const [isEnabled, setIsEnabled] = useState(true);\n\n  // Get current scope\n  const currentScope = useMemo((): Scope | null => {\n    if (!selectedOrganisationId) return null;\n    \n    return {\n      organisationId: selectedOrganisationId,\n      eventId: selectedEventId || undefined,\n      appId: undefined\n    };\n  }, [selectedOrganisationId, selectedEventId]);\n\n  // Check if user has permission for a navigation item\n  const hasNavigationPermission = useCallback((\n    item: NavigationItem\n  ): boolean => {\n    if (!isEnabled) return true;\n    if (!user?.id) return false;\n    \n    if (!currentScope) return false;\n    \n    // Use the existing RBAC system to check navigation permissions\n    // This is a synchronous check for the context - actual permission checking\n    // happens in the individual navigation components using useCan hook\n    // For now, we'll return true and let the individual navigation components\n    // handle the actual permission checking asynchronously\n    return true;\n  }, [isEnabled, user?.id, currentScope]);\n\n  // Get all navigation permissions for current user\n  const getNavigationPermissions = useCallback((): Record<string, string[]> => {\n    if (!isEnabled || !user?.id) return {};\n    \n    // For now, return empty object - this will be enhanced with actual permission checking\n    // when we integrate with the existing RBAC system\n    return {};\n  }, [isEnabled, user?.id]);\n\n  // Get filtered navigation items based on permissions\n  const getFilteredNavigationItems = useCallback((items: NavigationItem[]): NavigationItem[] => {\n    if (!isEnabled) return items;\n    \n    return items.filter(item => hasNavigationPermission(item));\n  }, [isEnabled, hasNavigationPermission]);\n\n  // Get navigation access history\n  const getNavigationAccessHistory = useCallback((): NavigationAccessRecord[] => {\n    return [...navigationAccessHistory];\n  }, [navigationAccessHistory]);\n\n  // Clear navigation access history\n  const clearNavigationAccessHistory = useCallback(() => {\n    setNavigationAccessHistory([]);\n  }, []);\n\n  // Record navigation access attempt\n  const recordNavigationAccess = useCallback((\n    item: NavigationItem,\n    allowed: boolean\n  ) => {\n    if (!auditLog || !user?.id || !currentScope) return;\n    \n    const record: NavigationAccessRecord = {\n      navigationItem: item.id,\n      permissions: item.permissions,\n      userId: user.id,\n      scope: currentScope,\n      allowed,\n      timestamp: new Date().toISOString(),\n      pageId: item.pageId,\n      roles: item.roles,\n      accessLevel: item.accessLevel\n    };\n    \n    setNavigationAccessHistory(prev => {\n      const newHistory = [record, ...prev];\n      return newHistory.slice(0, maxHistorySize);\n    });\n    \n    if (onNavigationAccess) {\n      onNavigationAccess(item, allowed, record);\n    }\n    \n    if (strictMode && !allowed && onStrictModeViolation) {\n      onStrictModeViolation(item, record);\n    }\n  }, [auditLog, user?.id, currentScope, maxHistorySize, onNavigationAccess, onStrictModeViolation, strictMode]);\n\n  // Context value\n  const contextValue = useMemo((): NavigationContextType => ({\n    hasNavigationPermission,\n    getNavigationPermissions,\n    getFilteredNavigationItems,\n    isEnabled,\n    isStrictMode: strictMode,\n    isAuditLogEnabled: auditLog,\n    getNavigationAccessHistory,\n    clearNavigationAccessHistory\n  }), [\n    hasNavigationPermission,\n    getNavigationPermissions,\n    getFilteredNavigationItems,\n    isEnabled,\n    strictMode,\n    auditLog,\n    getNavigationAccessHistory,\n    clearNavigationAccessHistory\n  ]);\n\n  // Log strict mode violations\n  useEffect(() => {\n    if (strictMode && auditLog) {\n      console.log(`[NavigationProvider] Strict mode enabled - all navigation access attempts will be logged and enforced`);\n    }\n  }, [strictMode, auditLog]);\n\n  return (\n    <NavigationContext.Provider value={contextValue}>\n      {children}\n    </NavigationContext.Provider>\n  );\n}\n\n/**\n * Hook to use navigation permission context\n * \n * @returns Navigation permission context\n * @throws Error if used outside of NavigationProvider\n */\nexport function useNavigationPermissions(): NavigationContextType {\n  const context = useContext(NavigationContext);\n  \n  if (!context) {\n    throw new Error('useNavigationPermissions must be used within a NavigationProvider');\n  }\n  \n  return context;\n}\n\nexport default NavigationProvider;","/**\n * @file Navigation Guard Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/NavigationGuard\n * @since 2.0.0\n *\n * A component that enforces navigation-level permissions and prevents apps from bypassing\n * navigation permission checks. This is a critical security component that ensures all\n * navigation items are properly protected.\n *\n * Features:\n * - Navigation-level permission enforcement\n * - Strict mode to prevent bypassing\n * - Automatic audit logging\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized navigation\n * - TypeScript support with strict typing\n *\n * @example\n * ```tsx\n * // Basic navigation protection\n * <NavigationGuard\n *   navigationItem={navItem}\n *   fallback={<AccessDeniedNavItem />}\n * >\n *   <NavigationLink />\n * </NavigationGuard>\n * \n * // Strict mode (prevents bypassing)\n * <NavigationGuard\n *   navigationItem={adminNavItem}\n *   strictMode={true}\n *   fallback={<AccessDeniedNavItem />}\n * >\n *   <AdminNavigationLink />\n * </NavigationGuard>\n * \n * // With custom fallback\n * <NavigationGuard\n *   navigationItem={settingsNavItem}\n *   fallback={<div>You don't have permission to access settings</div>}\n * >\n *   <SettingsNavigationLink />\n * </NavigationGuard>\n * ```\n *\n * @security\n * - Enforces navigation-level permissions\n * - Prevents apps from bypassing navigation permission checks\n * - Automatic audit logging for all navigation access attempts\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized navigation\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Cached permission checks\n * - Minimal re-renders\n * - Efficient error handling\n *\n * @dependencies\n * - React 18+ - Component framework\n * - useCan hook - Permission checking\n * - useUnifiedAuth - Authentication context\n * - RBAC types - Type definitions\n */\n\nimport React, { useMemo, useCallback, useEffect, useState } from 'react';\nimport { useCan } from '../hooks';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { UUID, Permission, Scope } from '../types';\nimport { createScopeFromEvent } from '../utils/eventContext';\nimport { NavigationItem } from './NavigationProvider';\n\nexport interface NavigationGuardProps {\n  /** Navigation item being protected */\n  navigationItem: NavigationItem;\n  \n  /** Content to render when user has permission */\n  children: React.ReactNode;\n  \n  /** Content to render when user lacks permission */\n  fallback?: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Force audit logging for this navigation access (default: true) */\n  auditLog?: boolean;\n  \n  /** Custom scope for permission checking */\n  scope?: Scope;\n  \n  /** Callback when access is denied */\n  onDenied?: (item: NavigationItem) => void;\n  \n  /** Loading state content */\n  loading?: React.ReactNode;\n  \n  /** Require all permissions (AND) or any permission (OR) */\n  requireAll?: boolean;\n}\n\n/**\n * NavigationGuard - Enforces navigation-level permissions\n * \n * This component ensures that users can only access navigation items they have permission for.\n * It integrates with the existing RBAC system and provides strict enforcement to\n * prevent apps from bypassing navigation permission checks.\n * \n * @param props - Component props\n * @returns React element with navigation permission enforcement\n */\nexport function NavigationGuard({\n  navigationItem,\n  children,\n  fallback = <DefaultAccessDenied />,\n  strictMode = true,\n  auditLog = true,\n  scope,\n  onDenied,\n  loading = <DefaultLoading />,\n  requireAll = true\n}: NavigationGuardProps) {\n  const { user, selectedOrganisationId, selectedEventId, supabase } = useUnifiedAuth();\n  const [hasChecked, setHasChecked] = useState(false);\n  const [checkError, setCheckError] = useState<Error | null>(null);\n  const [resolvedScope, setResolvedScope] = useState<Scope | null>(null);\n\n  // Resolve scope - either use provided scope or resolve from context\n  useEffect(() => {\n    const resolveScope = async () => {\n      if (scope) {\n        setResolvedScope(scope);\n        return;\n      }\n\n      // If we have both organisation and event, use them directly\n      if (selectedOrganisationId && selectedEventId) {\n        setResolvedScope({\n          organisationId: selectedOrganisationId,\n          eventId: selectedEventId,\n          appId: undefined\n        });\n        return;\n      }\n\n      // If we only have organisation, use it\n      if (selectedOrganisationId) {\n        setResolvedScope({\n          organisationId: selectedOrganisationId,\n          eventId: selectedEventId || undefined,\n          appId: undefined\n        });\n        return;\n      }\n\n      // If we only have event, resolve organisation from event\n      if (selectedEventId && supabase) {\n        try {\n          const eventScope = await createScopeFromEvent(supabase, selectedEventId);\n          if (!eventScope) {\n            setCheckError(new Error('Could not resolve organization from event context'));\n            return;\n          }\n          setResolvedScope(eventScope);\n        } catch (error) {\n          setCheckError(error as Error);\n        }\n        return;\n      }\n\n      // No context available\n      setCheckError(new Error('Either organisation context or event context is required for navigation permission checking'));\n    };\n\n    resolveScope();\n  }, [scope, selectedOrganisationId, selectedEventId, supabase]);\n\n  // Check permissions using the first permission as a representative\n  // For multiple permissions, we'll check them sequentially\n  const representativePermission = navigationItem.permissions[0];\n  const { can, isLoading, error } = useCan(\n    user?.id || '',\n    resolvedScope || { eventId: selectedEventId || undefined },\n    representativePermission,\n    navigationItem.pageId,\n    true // Use cache\n  );\n\n  // Determine if user has required permissions\n  const hasRequiredPermissions = useMemo((): boolean => {\n    if (navigationItem.permissions.length === 0) return true;\n    \n    // For now, use the representative permission result\n    // In a future enhancement, we could check all permissions\n    // but this would require multiple useCan hooks or a custom hook\n    return can;\n  }, [navigationItem.permissions, can]);\n\n  // Handle permission check completion\n  useEffect(() => {\n    if (!isLoading && !error) {\n      setHasChecked(true);\n      setCheckError(null);\n      \n      if (!hasRequiredPermissions && onDenied) {\n        onDenied(navigationItem);\n      }\n    } else if (error) {\n      setCheckError(error);\n      setHasChecked(true);\n    }\n  }, [hasRequiredPermissions, isLoading, error, navigationItem, onDenied]);\n\n  // Log navigation access attempt for audit\n  useEffect(() => {\n    if (auditLog && hasChecked && !isLoading) {\n      console.log(`[NavigationGuard] Navigation access attempt:`, {\n        navigationItem: navigationItem.id,\n        permissions: navigationItem.permissions,\n        userId: user?.id,\n        scope: resolvedScope,\n        allowed: hasRequiredPermissions,\n        requireAll,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [auditLog, hasChecked, isLoading, navigationItem, user?.id, resolvedScope, hasRequiredPermissions, requireAll]);\n\n  // Handle strict mode violations\n  useEffect(() => {\n    if (strictMode && hasChecked && !isLoading && !hasRequiredPermissions) {\n      console.error(`[NavigationGuard] STRICT MODE VIOLATION: User attempted to access protected navigation item without permission`, {\n        navigationItem: navigationItem.id,\n        permissions: navigationItem.permissions,\n        userId: user?.id,\n        scope: resolvedScope,\n        requireAll,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [strictMode, hasChecked, isLoading, hasRequiredPermissions, navigationItem, user?.id, resolvedScope, requireAll]);\n\n  // Show loading state\n  if (isLoading || !resolvedScope || !hasChecked) {\n    return <>{loading}</>;\n  }\n\n  // Show error state\n  if (checkError) {\n    console.error(`[NavigationGuard] Permission check failed for navigation item ${navigationItem.id}:`, checkError);\n    return <>{fallback}</>;\n  }\n\n  // Show access denied\n  if (!hasRequiredPermissions) {\n    return <>{fallback}</>;\n  }\n\n  // Show protected content\n  return <>{children}</>;\n}\n\n/**\n * Default access denied component\n */\nfunction DefaultAccessDenied() {\n  return (\n    <div className=\"flex items-center justify-center p-2 text-center\">\n      <div className=\"flex items-center space-x-2\">\n        <svg className=\"w-4 h-4 text-acc-500\" fill=\"none\" stroke=\"currentColor\" viewBox=\"0 0 24 24\">\n          <path strokeLinecap=\"round\" strokeLinejoin=\"round\" strokeWidth={2} d=\"M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L3.732 16.5c-.77.833.192 2.5 1.732 2.5z\" />\n        </svg>\n        <span className=\"text-sm text-sec-600\">Access Denied</span>\n      </div>\n    </div>\n  );\n}\n\n/**\n * Default loading component\n */\nfunction DefaultLoading() {\n  return (\n    <div className=\"flex items-center justify-center p-2\">\n      <div className=\"flex items-center space-x-2\">\n        <div className=\"animate-spin rounded-full h-4 w-4 border-b-2 border-main-600\"></div>\n        <span className=\"text-sm text-sec-600\">Checking...</span>\n      </div>\n    </div>\n  );\n}\n\nexport default NavigationGuard;","/**\n * @file Enhanced Navigation Menu Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/EnhancedNavigationMenu\n * @since 2.0.0\n *\n * An enhanced navigation menu component that integrates with the RBAC system to provide\n * secure navigation with automatic permission filtering and enforcement.\n *\n * Features:\n * - Automatic permission-based filtering\n * - Strict mode enforcement\n * - Audit logging for navigation access\n * - Integration with existing RBAC system\n * - Customizable navigation items\n * - Error handling and recovery\n *\n * @example\n * ```tsx\n * // Basic enhanced navigation menu\n * <EnhancedNavigationMenu\n *   items={navigationItems}\n *   strictMode={true}\n *   auditLog={true}\n * />\n * \n * // With custom configuration\n * <EnhancedNavigationMenu\n *   items={navigationItems}\n *   strictMode={true}\n *   auditLog={true}\n *   onNavigationAccess={(item, allowed) => {\n *     console.log(`Navigation access: ${item.id} - ${allowed ? 'allowed' : 'denied'}`);\n *   }}\n * />\n * ```\n *\n * @security\n * - Enforces navigation-level permissions\n * - Prevents apps from bypassing navigation permission checks\n * - Automatic audit logging for all navigation access attempts\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized navigation\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Cached permission checks\n * - Minimal re-renders\n * - Efficient filtering\n *\n * @dependencies\n * - React 18+ - Component framework\n * - NavigationProvider - Navigation permission context\n * - NavigationGuard - Individual navigation item protection\n * - RBAC types - Type definitions\n */\n\nimport React, { useMemo, useCallback, useEffect, useState } from 'react';\nimport { useNavigationPermissions, NavigationItem } from './NavigationProvider';\nimport NavigationGuard from './NavigationGuard';\n\nexport interface EnhancedNavigationMenuProps {\n  /** Navigation items to display */\n  items: NavigationItem[];\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Enable audit logging (default: true) */\n  auditLog?: boolean;\n  \n  /** Callback when navigation access is attempted */\n  onNavigationAccess?: (item: NavigationItem, allowed: boolean) => void;\n  \n  /** Callback when strict mode violation occurs */\n  onStrictModeViolation?: (item: NavigationItem) => void;\n  \n  /** Custom className for the navigation menu */\n  className?: string;\n  \n  /** Custom className for navigation items */\n  itemClassName?: string;\n  \n  /** Custom className for active navigation items */\n  activeItemClassName?: string;\n  \n  /** Custom className for disabled navigation items */\n  disabledItemClassName?: string;\n  \n  /** Show/hide navigation items that user doesn't have permission for */\n  hideUnauthorizedItems?: boolean;\n  \n  /** Custom render function for navigation items */\n  renderItem?: (item: NavigationItem, isAuthorized: boolean) => React.ReactNode;\n  \n  /** Current active path for highlighting */\n  activePath?: string;\n  \n  /** Navigation item click handler */\n  onItemClick?: (item: NavigationItem) => void;\n}\n\n/**\n * EnhancedNavigationMenu - Secure navigation menu with RBAC integration\n * \n * This component provides a navigation menu that automatically filters items based on\n * user permissions and enforces strict security controls.\n * \n * @param props - Component props\n * @returns React element with enhanced navigation menu\n */\nexport function EnhancedNavigationMenu({\n  items,\n  strictMode = true,\n  auditLog = true,\n  onNavigationAccess,\n  onStrictModeViolation,\n  className = 'flex flex-col space-y-1',\n  itemClassName = 'px-3 py-2 rounded-md text-sm font-medium transition-colors',\n  activeItemClassName = 'bg-main-100 text-main-700',\n  disabledItemClassName = 'text-sec-400 cursor-not-allowed',\n  hideUnauthorizedItems = false,\n  renderItem,\n  activePath,\n  onItemClick\n}: EnhancedNavigationMenuProps) {\n  const { \n    hasNavigationPermission, \n    getFilteredNavigationItems,\n    isEnabled,\n    isStrictMode,\n    isAuditLogEnabled \n  } = useNavigationPermissions();\n  \n  const [navigationHistory, setNavigationHistory] = useState<NavigationItem[]>([]);\n\n  // Get filtered navigation items based on permissions\n  const filteredItems = useMemo((): NavigationItem[] => {\n    if (!isEnabled) return items;\n    \n    return getFilteredNavigationItems(items);\n  }, [isEnabled, items, getFilteredNavigationItems]);\n\n  // Handle navigation item click\n  const handleItemClick = useCallback((item: NavigationItem) => {\n    if (onItemClick) {\n      onItemClick(item);\n    }\n    \n    // Record navigation attempt\n    if (auditLog) {\n      console.log(`[EnhancedNavigationMenu] Navigation item clicked:`, {\n        item: item.id,\n        path: item.path,\n        permissions: item.permissions,\n        timestamp: new Date().toISOString()\n      });\n    }\n    \n    // Add to navigation history\n    setNavigationHistory(prev => {\n      const newHistory = [item, ...prev.filter(i => i.id !== item.id)];\n      return newHistory.slice(0, 10); // Keep last 10 items\n    });\n  }, [onItemClick, auditLog]);\n\n  // Handle navigation access attempt\n  const handleNavigationAccess = useCallback((item: NavigationItem, allowed: boolean) => {\n    if (onNavigationAccess) {\n      onNavigationAccess(item, allowed);\n    }\n    \n    if (auditLog) {\n      console.log(`[EnhancedNavigationMenu] Navigation access attempt:`, {\n        item: item.id,\n        allowed,\n        strictMode,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [onNavigationAccess, auditLog, strictMode]);\n\n  // Handle strict mode violation\n  const handleStrictModeViolation = useCallback((item: NavigationItem) => {\n    if (onStrictModeViolation) {\n      onStrictModeViolation(item);\n    }\n    \n    if (strictMode) {\n      console.error(`[EnhancedNavigationMenu] STRICT MODE VIOLATION: User attempted to access protected navigation item without permission`, {\n        item: item.id,\n        path: item.path,\n        permissions: item.permissions,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [onStrictModeViolation, strictMode]);\n\n  // Default render function for navigation items\n  const defaultRenderItem = useCallback((item: NavigationItem, isAuthorized: boolean) => {\n    const isActive = activePath === item.path;\n    const isDisabled = !isAuthorized;\n    \n    return (\n      <NavigationGuard\n        key={item.id}\n        navigationItem={item}\n        strictMode={strictMode}\n        auditLog={auditLog}\n        onDenied={handleStrictModeViolation}\n        fallback={\n          hideUnauthorizedItems ? null : (\n            <div className={`${itemClassName} ${disabledItemClassName}`}>\n              <div className=\"flex items-center space-x-2\">\n                {item.meta?.icon && (\n                  <span className=\"text-sm\">{item.meta.icon}</span>\n                )}\n                <span>{item.label}</span>\n                <span className=\"text-xs text-sec-400\">(Access Denied)</span>\n              </div>\n            </div>\n          )\n        }\n      >\n        <button\n          onClick={() => handleItemClick(item)}\n          className={`${itemClassName} ${\n            isActive ? activeItemClassName : ''\n          } ${\n            isDisabled ? disabledItemClassName : 'hover:bg-sec-100'\n          }`}\n          disabled={isDisabled}\n        >\n          <div className=\"flex items-center space-x-2\">\n            {item.meta?.icon && (\n              <span className=\"text-sm\">{item.meta.icon}</span>\n            )}\n            <span>{item.label}</span>\n            {item.meta?.description && (\n              <span className=\"text-xs text-sec-500 ml-auto\">\n                {item.meta.description}\n              </span>\n            )}\n          </div>\n        </button>\n      </NavigationGuard>\n    );\n  }, [\n    activePath,\n    itemClassName,\n    activeItemClassName,\n    disabledItemClassName,\n    hideUnauthorizedItems,\n    strictMode,\n    auditLog,\n    handleStrictModeViolation,\n    handleItemClick\n  ]);\n\n  // Log strict mode violations\n  useEffect(() => {\n    if (strictMode && auditLog) {\n      console.log(`[EnhancedNavigationMenu] Strict mode enabled - all navigation access attempts will be logged and enforced`);\n    }\n  }, [strictMode, auditLog]);\n\n  // Log navigation menu initialization\n  useEffect(() => {\n    if (auditLog) {\n      console.log(`[EnhancedNavigationMenu] Navigation menu initialized:`, {\n        totalItems: items.length,\n        filteredItems: filteredItems.length,\n        strictMode,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [items.length, filteredItems.length, strictMode, auditLog]);\n\n  return (\n    <nav className={className}>\n      {filteredItems.map(item => {\n        const isAuthorized = hasNavigationPermission(item);\n        \n        if (renderItem) {\n          return renderItem(item, isAuthorized);\n        }\n        \n        return defaultRenderItem(item, isAuthorized);\n      })}\n    </nav>\n  );\n}\n\nexport default EnhancedNavigationMenu;\n","/**\n * RBAC Permissions Definitions\n * @package @jmruthers/pace-core\n * @module RBAC/Permissions\n * @since 1.0.0\n * \n * This module defines all permissions used in the RBAC system.\n * All permission strings must be imported from this file to ensure consistency.\n */\n\nimport { Permission } from './types';\n\n// ============================================================================\n// GLOBAL PERMISSIONS\n// ============================================================================\n\nexport const GLOBAL_PERMISSIONS = {\n  MANAGE_ALL: 'manage:*' as Permission,\n  READ_ALL: 'read:*' as Permission,\n  CREATE_ALL: 'create:*' as Permission,\n  UPDATE_ALL: 'update:*' as Permission,\n  DELETE_ALL: 'delete:*' as Permission,\n} as const;\n\n// ============================================================================\n// ORGANISATION PERMISSIONS\n// ============================================================================\n\nexport const ORGANISATION_PERMISSIONS = {\n  // Organisation management\n  MANAGE_ORGANISATION: 'manage:organisation' as Permission,\n  READ_ORGANISATION: 'read:organisation' as Permission,\n  UPDATE_ORGANISATION: 'update:organisation' as Permission,\n  \n  // User management\n  MANAGE_USERS: 'manage:users' as Permission,\n  READ_USERS: 'read:users' as Permission,\n  CREATE_USERS: 'create:users' as Permission,\n  UPDATE_USERS: 'update:users' as Permission,\n  DELETE_USERS: 'delete:users' as Permission,\n  \n  // Role management\n  MANAGE_ROLES: 'manage:roles' as Permission,\n  READ_ROLES: 'read:roles' as Permission,\n  CREATE_ROLES: 'create:roles' as Permission,\n  UPDATE_ROLES: 'update:roles' as Permission,\n  DELETE_ROLES: 'delete:roles' as Permission,\n  \n  // Event management\n  MANAGE_EVENTS: 'manage:events' as Permission,\n  READ_EVENTS: 'read:events' as Permission,\n  CREATE_EVENTS: 'create:events' as Permission,\n  UPDATE_EVENTS: 'update:events' as Permission,\n  DELETE_EVENTS: 'delete:events' as Permission,\n  \n  // App management\n  MANAGE_APPS: 'manage:apps' as Permission,\n  READ_APPS: 'read:apps' as Permission,\n  CREATE_APPS: 'create:apps' as Permission,\n  UPDATE_APPS: 'update:apps' as Permission,\n  DELETE_APPS: 'delete:apps' as Permission,\n} as const;\n\n// ============================================================================\n// EVENT-APP PERMISSIONS\n// ============================================================================\n\nexport const EVENT_APP_PERMISSIONS = {\n  // Event management\n  MANAGE_EVENT: 'manage:event' as Permission,\n  READ_EVENT: 'read:event' as Permission,\n  UPDATE_EVENT: 'update:event' as Permission,\n  \n  // App management\n  MANAGE_APP: 'manage:app' as Permission,\n  READ_APP: 'read:app' as Permission,\n  UPDATE_APP: 'update:app' as Permission,\n  \n  // Team management\n  MANAGE_TEAM: 'manage:team' as Permission,\n  READ_TEAM: 'read:team' as Permission,\n  CREATE_TEAM: 'create:team' as Permission,\n  UPDATE_TEAM: 'update:team' as Permission,\n  DELETE_TEAM: 'delete:team' as Permission,\n  \n  // Team members\n  MANAGE_TEAM_MEMBERS: 'manage:team.members' as Permission,\n  READ_TEAM_MEMBERS: 'read:team.members' as Permission,\n  CREATE_TEAM_MEMBERS: 'create:team.members' as Permission,\n  UPDATE_TEAM_MEMBERS: 'update:team.members' as Permission,\n  DELETE_TEAM_MEMBERS: 'delete:team.members' as Permission,\n  \n  // Event content\n  MANAGE_EVENT_CONTENT: 'manage:event.content' as Permission,\n  READ_EVENT_CONTENT: 'read:event.content' as Permission,\n  CREATE_EVENT_CONTENT: 'create:event.content' as Permission,\n  UPDATE_EVENT_CONTENT: 'update:event.content' as Permission,\n  DELETE_EVENT_CONTENT: 'delete:event.content' as Permission,\n  \n  // Event settings\n  MANAGE_EVENT_SETTINGS: 'manage:event.settings' as Permission,\n  READ_EVENT_SETTINGS: 'read:event.settings' as Permission,\n  UPDATE_EVENT_SETTINGS: 'update:event.settings' as Permission,\n} as const;\n\n// ============================================================================\n// PAGE PERMISSIONS\n// ============================================================================\n\nexport const PAGE_PERMISSIONS = {\n  // General page access\n  READ_PAGE: 'read:page' as Permission,\n  MANAGE_PAGE: 'manage:page' as Permission,\n  \n  // Admin pages\n  READ_ADMIN: 'read:admin' as Permission,\n  MANAGE_ADMIN: 'manage:admin' as Permission,\n  \n  // Dashboard pages\n  READ_DASHBOARD: 'read:dashboard' as Permission,\n  MANAGE_DASHBOARD: 'manage:dashboard' as Permission,\n  \n  // Settings pages\n  READ_SETTINGS: 'read:settings' as Permission,\n  MANAGE_SETTINGS: 'manage:settings' as Permission,\n  \n  // Reports pages\n  READ_REPORTS: 'read:reports' as Permission,\n  MANAGE_REPORTS: 'manage:reports' as Permission,\n} as const;\n\n// ============================================================================\n// PERMISSION GROUPS\n// ============================================================================\n\nexport const PERMISSION_GROUPS = {\n  // Global admin permissions\n  GLOBAL_ADMIN: [\n    GLOBAL_PERMISSIONS.MANAGE_ALL,\n    GLOBAL_PERMISSIONS.READ_ALL,\n    GLOBAL_PERMISSIONS.CREATE_ALL,\n    GLOBAL_PERMISSIONS.UPDATE_ALL,\n    GLOBAL_PERMISSIONS.DELETE_ALL,\n  ],\n  \n  // Organisation admin permissions\n  ORG_ADMIN: [\n    ORGANISATION_PERMISSIONS.MANAGE_ORGANISATION,\n    ORGANISATION_PERMISSIONS.READ_ORGANISATION,\n    ORGANISATION_PERMISSIONS.UPDATE_ORGANISATION,\n    ORGANISATION_PERMISSIONS.MANAGE_USERS,\n    ORGANISATION_PERMISSIONS.READ_USERS,\n    ORGANISATION_PERMISSIONS.CREATE_USERS,\n    ORGANISATION_PERMISSIONS.UPDATE_USERS,\n    ORGANISATION_PERMISSIONS.DELETE_USERS,\n    ORGANISATION_PERMISSIONS.MANAGE_ROLES,\n    ORGANISATION_PERMISSIONS.READ_ROLES,\n    ORGANISATION_PERMISSIONS.CREATE_ROLES,\n    ORGANISATION_PERMISSIONS.UPDATE_ROLES,\n    ORGANISATION_PERMISSIONS.DELETE_ROLES,\n    ORGANISATION_PERMISSIONS.MANAGE_EVENTS,\n    ORGANISATION_PERMISSIONS.READ_EVENTS,\n    ORGANISATION_PERMISSIONS.CREATE_EVENTS,\n    ORGANISATION_PERMISSIONS.UPDATE_EVENTS,\n    ORGANISATION_PERMISSIONS.DELETE_EVENTS,\n    ORGANISATION_PERMISSIONS.MANAGE_APPS,\n    ORGANISATION_PERMISSIONS.READ_APPS,\n    ORGANISATION_PERMISSIONS.CREATE_APPS,\n    ORGANISATION_PERMISSIONS.UPDATE_APPS,\n    ORGANISATION_PERMISSIONS.DELETE_APPS,\n  ],\n  \n  // Event admin permissions\n  EVENT_ADMIN: [\n    EVENT_APP_PERMISSIONS.MANAGE_EVENT,\n    EVENT_APP_PERMISSIONS.READ_EVENT,\n    EVENT_APP_PERMISSIONS.UPDATE_EVENT,\n    EVENT_APP_PERMISSIONS.MANAGE_APP,\n    EVENT_APP_PERMISSIONS.READ_APP,\n    EVENT_APP_PERMISSIONS.UPDATE_APP,\n    EVENT_APP_PERMISSIONS.MANAGE_TEAM,\n    EVENT_APP_PERMISSIONS.READ_TEAM,\n    EVENT_APP_PERMISSIONS.CREATE_TEAM,\n    EVENT_APP_PERMISSIONS.UPDATE_TEAM,\n    EVENT_APP_PERMISSIONS.DELETE_TEAM,\n    EVENT_APP_PERMISSIONS.MANAGE_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.READ_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.CREATE_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.UPDATE_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.DELETE_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.MANAGE_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.READ_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.CREATE_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.UPDATE_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.DELETE_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.MANAGE_EVENT_SETTINGS,\n    EVENT_APP_PERMISSIONS.READ_EVENT_SETTINGS,\n    EVENT_APP_PERMISSIONS.UPDATE_EVENT_SETTINGS,\n  ],\n  \n  // Planner permissions\n  PLANNER: [\n    EVENT_APP_PERMISSIONS.READ_EVENT,\n    EVENT_APP_PERMISSIONS.UPDATE_EVENT,\n    EVENT_APP_PERMISSIONS.READ_APP,\n    EVENT_APP_PERMISSIONS.UPDATE_APP,\n    EVENT_APP_PERMISSIONS.READ_TEAM,\n    EVENT_APP_PERMISSIONS.CREATE_TEAM,\n    EVENT_APP_PERMISSIONS.UPDATE_TEAM,\n    EVENT_APP_PERMISSIONS.READ_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.CREATE_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.UPDATE_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.READ_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.CREATE_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.UPDATE_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.READ_EVENT_SETTINGS,\n    EVENT_APP_PERMISSIONS.UPDATE_EVENT_SETTINGS,\n  ],\n  \n  // Participant permissions\n  PARTICIPANT: [\n    EVENT_APP_PERMISSIONS.READ_EVENT,\n    EVENT_APP_PERMISSIONS.READ_APP,\n    EVENT_APP_PERMISSIONS.READ_TEAM,\n    EVENT_APP_PERMISSIONS.READ_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.READ_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.READ_EVENT_SETTINGS,\n  ],\n  \n  // Viewer permissions\n  VIEWER: [\n    EVENT_APP_PERMISSIONS.READ_EVENT,\n    EVENT_APP_PERMISSIONS.READ_APP,\n    EVENT_APP_PERMISSIONS.READ_TEAM,\n    EVENT_APP_PERMISSIONS.READ_EVENT_CONTENT,\n  ],\n} as const;\n\n// ============================================================================\n// PERMISSION VALIDATION\n// ============================================================================\n\n/**\n * Validate that a permission string is properly formatted\n * \n * @param permission - Permission string to validate\n * @returns True if valid, false otherwise\n */\nexport function isValidPermission(permission: string): permission is Permission {\n  // Allow wildcard only at the end: manage:* or read:events\n  // But not: read:events* or read:*events\n  // Also reject uppercase operations and resource names\n  const pattern = /^(read|create|update|delete|manage):[a-z0-9._-]+$|^(read|create|update|delete|manage):\\*$/;\n  return pattern.test(permission);\n}\n\n/**\n * Get all permissions for a role\n * \n * @param role - Role name\n * @returns Array of permissions for the role\n */\nexport function getPermissionsForRole(role: string): Permission[] {\n  switch (role) {\n    case 'super_admin':\n      return [...PERMISSION_GROUPS.GLOBAL_ADMIN];\n    case 'org_admin':\n      return [...PERMISSION_GROUPS.ORG_ADMIN];\n    case 'event_admin':\n      return [...PERMISSION_GROUPS.EVENT_ADMIN];\n    case 'planner':\n      return [...PERMISSION_GROUPS.PLANNER];\n    case 'participant':\n      return [...PERMISSION_GROUPS.PARTICIPANT];\n    case 'viewer':\n      return [...PERMISSION_GROUPS.VIEWER];\n    default:\n      return [];\n  }\n}\n\n// ============================================================================\n// EXPORTS\n// ============================================================================\n\nexport const ALL_PERMISSIONS = {\n  ...GLOBAL_PERMISSIONS,\n  ...ORGANISATION_PERMISSIONS,\n  ...EVENT_APP_PERMISSIONS,\n  ...PAGE_PERMISSIONS,\n} as const;\n\nexport type AllPermissions = typeof ALL_PERMISSIONS;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,SAAS,oBAAoC;AAWtC,IAAM,uBAAN,MAAM,sBAAqB;AAAA,EAQhC,YACE,aACA,aACA,gBACA,SACA,OACA;AACA,SAAK,cAAc;AACnB,SAAK,cAAc;AACnB,SAAK,iBAAiB;AACtB,SAAK,UAAU;AACf,SAAK,QAAQ;AAGb,SAAK,WAAW,aAAuB,aAAa,aAAa;AAAA,MAC/D,QAAQ;AAAA,QACN,SAAS;AAAA,UACP,qBAAqB;AAAA,UACrB,cAAc,WAAW;AAAA,UACzB,YAAY,SAAS;AAAA,QACvB;AAAA,MACF;AAAA,IACF,CAAC;AAGD,SAAK,sBAAsB;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKQ,wBAAwB;AAC9B,UAAM,eAAe,KAAK,SAAS,KAAK,KAAK,KAAK,QAAQ;AAE1D,SAAK,SAAS,OAAO,CAAC,UAAkB;AAEtC,WAAK,gBAAgB;AAErB,YAAM,QAAQ,aAAa,KAAK;AAGhC,aAAO,KAAK,cAAc,KAAK;AAAA,IACjC;AAEA,UAAM,cAAc,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ;AAExD,SAAK,SAAS,MAAM,CAAC,IAAY,SAAe;AAE9C,WAAK,gBAAgB;AAGrB,YAAM,cAAc;AAAA,QAClB,GAAG;AAAA,QACH,mBAAmB,KAAK;AAAA,QACxB,YAAY,KAAK;AAAA,QACjB,UAAU,KAAK;AAAA,MACjB;AAEA,aAAO,YAAY,IAAI,WAAW;AAAA,IACpC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,OAAY;AAChC,UAAM,iBAAiB,MAAM,OAAO,KAAK,KAAK;AAC9C,UAAM,iBAAiB,MAAM,OAAO,KAAK,KAAK;AAC9C,UAAM,iBAAiB,MAAM,OAAO,KAAK,KAAK;AAC9C,UAAM,iBAAiB,MAAM,OAAO,KAAK,KAAK;AAG9C,UAAM,SAAS,CAAC,YAAqB;AACnC,YAAM,SAAS,eAAe,OAAO;AACrC,aAAO,KAAK,sBAAsB,MAAM;AAAA,IAC1C;AAGA,UAAM,SAAS,CAAC,WAAgB;AAC9B,YAAM,gBAAgB,MAAM,QAAQ,MAAM,IACtC,OAAO,IAAI,QAAM,EAAE,GAAG,GAAG,iBAAiB,KAAK,eAAe,EAAE,IAChE,EAAE,GAAG,QAAQ,iBAAiB,KAAK,eAAe;AAEtD,aAAO,eAAe,aAAa;AAAA,IACrC;AAGA,UAAM,SAAS,CAAC,WAAgB;AAC9B,YAAM,SAAS,eAAe,MAAM;AACpC,aAAO,KAAK,sBAAsB,MAAM;AAAA,IAC1C;AAGA,UAAM,SAAS,MAAM;AACnB,YAAM,SAAS,eAAe;AAC9B,aAAO,KAAK,sBAAsB,MAAM;AAAA,IAC1C;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,sBAAsB,OAAY;AAExC,WAAO,MAAM,GAAG,mBAAmB,KAAK,cAAc;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB;AACxB,QAAI,CAAC,KAAK,gBAAgB;AACxB,YAAM,IAAI,iCAAiC;AAAA,IAC7C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,oBAA0B;AACxB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,aAAiC;AAC/B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,WAA6B;AAC3B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,SAIa;AACvB,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AAAA,MACL,QAAQ,kBAAkB,KAAK;AAAA,MAC/B,QAAQ,YAAY,SAAY,QAAQ,UAAU,KAAK;AAAA,MACvD,QAAQ,UAAU,SAAY,QAAQ,QAAQ,KAAK;AAAA,IACrD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAsC;AACpC,WAAO,KAAK;AAAA,EACd;AACF;AAuBO,SAAS,mBACd,aACA,aACA,gBACA,SACA,OACsB;AACtB,SAAO,IAAI,qBAAqB,aAAa,aAAa,gBAAgB,SAAS,KAAK;AAC1F;AAWO,SAAS,mBACd,QACA,gBACA,SACA,OACsB;AAGtB,QAAM,IAAI,MAAM,sEAAsE;AACxF;;;AC1OA,SAAS,UAAU,WAAW,aAAa,eAAe;AA4CnD,SAAS,eAAe,QAAc,OAAoC;AAC/E,QAAM,CAAC,aAAa,cAAc,IAAI,SAAwB,CAAC,CAAC;AAChE,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAC/C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAuB,IAAI;AAErD,QAAM,mBAAmB,YAAY,YAAY;AAC/C,QAAI,CAAC,QAAQ;AACX,qBAAe,CAAC,CAAC;AACjB,mBAAa,KAAK;AAClB;AAAA,IACF;AAEA,QAAI;AACF,mBAAa,IAAI;AACjB,eAAS,IAAI;AAEb,YAAM,SAAS,MAAM,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AACvD,qBAAe,MAAM;AAAA,IACvB,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,6BAA6B,CAAC;AAAA,IAChF,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,QAAQ,MAAM,gBAAgB,MAAM,SAAS,MAAM,KAAK,CAAC;AAE7D,YAAU,MAAM;AACd,qBAAiB;AAAA,EACnB,GAAG,CAAC,gBAAgB,CAAC;AAErB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAgCO,SAAS,OACd,QACA,OACA,YACA,QACA,WAAoB,MACN;AACd,QAAM,CAAC,KAAK,MAAM,IAAI,SAAS,KAAK;AACpC,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAC/C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAuB,IAAI;AAErD,QAAM,QAAQ,YAAY,YAAY;AACpC,YAAQ,IAAI,iCAAiC,EAAE,QAAQ,OAAO,YAAY,OAAO,CAAC;AAClF,YAAQ,IAAI,6BAA6B,EAAE,QAAQ,OAAO,YAAY,QAAQ,SAAS,CAAC;AAExF,QAAI,CAAC,QAAQ;AACX,cAAQ,IAAI,oCAAoC;AAChD,aAAO,KAAK;AACZ,mBAAa,KAAK;AAClB;AAAA,IACF;AAGA,QAAI;AACF,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,oBAAO;AAC7C,YAAM,UAAU,MAAM,aAAa,MAAM;AACzC,UAAI,SAAS;AACX,gBAAQ,IAAI,+CAA+C;AAC3D,eAAO,IAAI;AACX,qBAAa,KAAK;AAClB;AAAA,MACF;AAAA,IACF,SAASA,QAAO;AACd,cAAQ,MAAM,+CAA+CA,MAAK;AAAA,IAEpE;AAGA,QAAI,CAAC,SAAS,CAAC,MAAM,kBAAkB,CAAC,MAAM,OAAO;AACnD,cAAQ,IAAI,sDAAsD,KAAK;AACvE,aAAO,KAAK;AACZ,mBAAa,IAAI;AACjB;AAAA,IACF;AAEA,YAAQ,IAAI,oDAAoD;AAChE,YAAQ,IAAI,iCAAiC;AAAA,MAC3C,gBAAgB,MAAM;AAAA,MACtB,SAAS,MAAM;AAAA,MACf,OAAO,MAAM;AAAA,MACb;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI;AACF,mBAAa,IAAI;AACjB,eAAS,IAAI;AAEb,cAAQ,IAAI,yDAAyD;AACrE,YAAM,SAAS,WACX,MAAM,kBAAkB,EAAE,QAAQ,OAAO,YAAY,OAAO,CAAC,IAC7D,MAAM,YAAY,EAAE,QAAQ,OAAO,YAAY,OAAO,CAAC;AAE3D,cAAQ,IAAI,qCAAqC,MAAM;AACvD,cAAQ,IAAI,sCAAsC;AAAA,QAChD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AACD,aAAO,MAAM;AAAA,IACf,SAAS,KAAK;AACZ,cAAQ,MAAM,oCAAoC,GAAG;AACrD,cAAQ,MAAM,2BAA2B;AAAA,QACvC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,eAAe,QAAQ,IAAI,UAAU;AAAA,QAC5C,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AACD,eAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,4BAA4B,CAAC;AAC7E,aAAO,KAAK;AAAA,IACd,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,QAAQ,MAAM,gBAAgB,MAAM,SAAS,MAAM,OAAO,YAAY,QAAQ,QAAQ,CAAC;AAE3F,YAAU,MAAM;AACd,UAAM;AAAA,EACR,GAAG,CAAC,KAAK,CAAC;AAEV,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AA6BO,SAAS,eAAe,QAAc,OAK3C;AACA,QAAM,CAAC,aAAa,cAAc,IAAI,SAA6B,IAAI;AACvE,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAC/C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAuB,IAAI;AAErD,QAAM,mBAAmB,YAAY,YAAY;AAC/C,QAAI,CAAC,QAAQ;AACX,qBAAe,IAAI;AACnB,mBAAa,KAAK;AAClB;AAAA,IACF;AAEA,QAAI;AACF,mBAAa,IAAI;AACjB,eAAS,IAAI;AAEb,YAAM,SAAS,MAAM,eAAe,EAAE,QAAQ,MAAM,CAAC;AACrD,qBAAe,MAAM;AAAA,IACvB,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,8BAA8B,CAAC;AAC/E,qBAAe,IAAI;AAAA,IACrB,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,QAAQ,MAAM,gBAAgB,MAAM,SAAS,MAAM,KAAK,CAAC;AAE7D,YAAU,MAAM;AACd,qBAAiB;AAAA,EACnB,GAAG,CAAC,gBAAgB,CAAC;AAErB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,EACX;AACF;AA+BO,SAAS,uBACd,QACA,OACA,aACA,QACA,WAAoB,MAMpB;AACA,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,SAAsC,CAAC,CAAgC;AACzH,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAC/C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAuB,IAAI;AAErD,QAAM,mBAAmB,YAAY,YAAY;AAC/C,QAAI,CAAC,UAAU,YAAY,WAAW,GAAG;AACvC,2BAAqB,CAAC,CAAgC;AACtD,mBAAa,KAAK;AAClB;AAAA,IACF;AAEA,QAAI;AACF,mBAAa,IAAI;AACjB,eAAS,IAAI;AAEb,YAAM,UAAuC,CAAC;AAG9C,YAAM,WAAW,YAAY,IAAI,OAAO,eAAe;AACrD,cAAM,SAAS,WACX,MAAM,kBAAkB,EAAE,QAAQ,OAAO,YAAY,OAAO,CAAC,IAC7D,MAAM,YAAY,EAAE,QAAQ,OAAO,YAAY,OAAO,CAAC;AAE3D,eAAO,EAAE,YAAY,OAAO;AAAA,MAC9B,CAAC;AAED,YAAM,WAAW,MAAM,QAAQ,IAAI,QAAQ;AAE3C,eAAS,QAAQ,CAAC,EAAE,YAAY,OAAO,MAAM;AAC3C,gBAAQ,UAAU,IAAI;AAAA,MACxB,CAAC;AAED,2BAAqB,OAAO;AAAA,IAC9B,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,6BAA6B,CAAC;AAC9E,2BAAqB,CAAC,CAAgC;AAAA,IACxD,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,QAAQ,MAAM,gBAAgB,MAAM,SAAS,MAAM,OAAO,aAAa,QAAQ,QAAQ,CAAC;AAE5F,YAAU,MAAM;AACd,qBAAiB;AAAA,EACnB,GAAG,CAAC,gBAAgB,CAAC;AAErB,SAAO;AAAA,IACL,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA,SAAS;AAAA,EACX;AACF;AA4BO,SAAS,oBACd,QACA,OACA,aACA,QAMA;AACA,QAAM,EAAE,aAAa,mBAAmB,WAAW,OAAO,QAAQ,IAAI;AAAA,IACpE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,SAAS,QAAQ,MAAM;AAC3B,WAAO,OAAO,OAAO,iBAAiB,EAAE,KAAK,OAAO;AAAA,EACtD,GAAG,CAAC,iBAAiB,CAAC;AAEtB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AA4BO,SAAS,qBACd,QACA,OACA,aACA,QAMA;AACA,QAAM,EAAE,aAAa,mBAAmB,WAAW,OAAO,QAAQ,IAAI;AAAA,IACpE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,SAAS,QAAQ,MAAM;AAC3B,WAAO,OAAO,OAAO,iBAAiB,EAAE,MAAM,OAAO;AAAA,EACvD,GAAG,CAAC,iBAAiB,CAAC;AAEtB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAgCO,SAAS,qBAAqB,QAAc,OAKjD;AACA,QAAM,CAAC,aAAa,cAAc,IAAI,SAAwB,CAAC,CAAC;AAChE,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAC/C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAuB,IAAI;AAErD,QAAM,yBAAyB,YAAY,YAAY;AACrD,QAAI,CAAC,QAAQ;AACX,qBAAe,CAAC,CAAC;AACjB,mBAAa,KAAK;AAClB;AAAA,IACF;AAEA,QAAI;AACF,mBAAa,IAAI;AACjB,eAAS,IAAI;AAGb,YAAM,SAAS,MAAM,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AACvD,qBAAe,MAAM;AAAA,IACvB,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,oCAAoC,CAAC;AAAA,IACvF,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,QAAQ,MAAM,gBAAgB,MAAM,SAAS,MAAM,KAAK,CAAC;AAE7D,YAAU,MAAM;AACd,2BAAuB;AAAA,EACzB,GAAG,CAAC,sBAAsB,CAAC;AAE3B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,EACX;AACF;;;AChjBA,OAAO,SAAoB,kBAAkB;AAkGrC,SAmEG,UAnEH,KAIE,YAJF;AA3DD,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA,UAAU;AAAA;AAAA,EAEV,aAAa;AAAA,EACb,WAAW;AAAA,EACX,eAAe;AACjB,GAaoB;AAClB,QAAM,SAAS,cAAc;AAG7B,QAAM,cAAc,WAAW,MAAM,cAAmB,IAAI,CAAC;AAG7D,MAAI,kBAAkB;AACtB,MAAI,CAAC,iBAAiB;AACpB,QAAI;AAEF,UAAI,aAAa,MAAM,IAAI;AACzB,0BAAkB,YAAY,KAAK;AAAA,MACrC,OAAO;AAEL,cAAM,aAAc,OAAe;AACnC,YAAI,YAAY,IAAI;AAClB,4BAAkB,WAAW;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,SAASC,QAAO;AACd,aAAO,MAAM,wCAAwCA,MAAK;AAAA,IAC5D;AAAA,EACF;AAGA,QAAM,EAAE,KAAK,WAAW,MAAM,IAAI,OAAO,mBAAmB,IAAI,OAAO,YAAY,MAAM;AAGzF,MAAI,CAAC,iBAAiB;AACpB,WAAO,MAAM,sEAAsE;AACnF,WACE,qBAAC,SAAI,WAAU,cAAa,MAAK,SAC/B;AAAA,0BAAC,OAAE,iEAAmD;AAAA,MACtD,qBAAC,aACC;AAAA,4BAAC,aAAQ,wBAAU;AAAA,QACnB,oBAAC,OAAE,kCAAoB;AAAA,QACvB,qBAAC,QACC;AAAA,8BAAC,QAAG,yCAA2B;AAAA,UAC/B,oBAAC,QAAG,iDAAmC;AAAA,UACvC,oBAAC,QAAG,qDAAuC;AAAA,WAC7C;AAAA,SACF;AAAA,OACF;AAAA,EAEJ;AAGA,MAAI,WAAW;AACb,WAAO,WACL,oBAAC,SAAI,WAAU,gBAAe,MAAK,UAAS,aAAU,UACpD,8BAAC,UAAK,WAAU,WAAU,qCAAuB,GACnD;AAAA,EAEJ;AAGA,MAAI,OAAO;AACT,WAAO,MAAM,4BAA4B,KAAK;AAE9C,QAAI,UAAU;AACZ,aAAO,KAAK,8CAA8C;AAAA,QACxD,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,MAAM;AAAA,QACb,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAGA,MAAI,CAAC,KAAK;AAER,QAAI,UAAU;AACZ,aAAO,KAAK,wCAAwC;AAAA,QAClD,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAGA,QAAI,YAAY;AACd,aAAO,MAAM,2GAA2G;AAAA,QACtH,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,QAAI,UAAU;AACZ,eAAS;AAAA,IACX;AACA,WAAO,gCAAG,oBAAS;AAAA,EACrB;AAGA,MAAI,UAAU;AACZ,WAAO,KAAK,yCAAyC;AAAA,MACnD,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAGA,SAAO,gCAAG,UAAS;AACrB;AA8BO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX,UAAU;AACZ,GAOoB;AAClB,QAAM,SAAS,cAAc;AAG7B,QAAM,cAAc,WAAW,MAAM,cAAmB,IAAI,CAAC;AAG7D,MAAI,kBAAkB;AACtB,MAAI,CAAC,iBAAiB;AACpB,QAAI;AAEF,UAAI,aAAa,MAAM,IAAI;AACzB,0BAAkB,YAAY,KAAK;AAAA,MACrC,OAAO;AAEL,cAAM,aAAc,OAAe;AACnC,YAAI,YAAY,IAAI;AAClB,4BAAkB,WAAW;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,SAASA,QAAO;AACd,aAAO,MAAM,wCAAwCA,MAAK;AAAA,IAC5D;AAAA,EACF;AAGA,QAAM,EAAE,aAAa,WAAW,MAAM,IAAI,eAAe,mBAAmB,IAAI,KAAK;AAGrF,MAAI,CAAC,iBAAiB;AACpB,WAAO,MAAM,uEAAuE;AACpF,WACE,qBAAC,SAAI,WAAU,cAAa,MAAK,SAC/B;AAAA,0BAAC,OAAE,mEAAqD;AAAA,MACxD,qBAAC,aACC;AAAA,4BAAC,aAAQ,wBAAU;AAAA,QACnB,oBAAC,OAAE,kCAAoB;AAAA,QACvB,qBAAC,QACC;AAAA,8BAAC,QAAG,yCAA2B;AAAA,UAC/B,oBAAC,QAAG,iDAAmC;AAAA,UACvC,oBAAC,QAAG,qDAAuC;AAAA,WAC7C;AAAA,SACF;AAAA,OACF;AAAA,EAEJ;AAGA,MAAI,WAAW;AACb,WAAO,WACL,oBAAC,SAAI,WAAU,gBAAe,MAAK,UAAS,aAAU,UACpD,8BAAC,UAAK,WAAU,WAAU,sCAAwB,GACpD;AAAA,EAEJ;AAGA,MAAI,OAAO;AACT,WAAO,MAAM,8BAA8B,KAAK;AAChD,WAAO;AAAA,EACT;AAGA,QAAM,iBAAiB,CAAC,UAAU,eAAe,WAAW,SAAS,OAAO;AAC5E,QAAM,iBAAiB,cAAc,eAAe,QAAQ,WAAW,IAAI;AAC3E,QAAM,qBAAqB,eAAe,QAAQ,QAAQ;AAE1D,MAAI,iBAAiB,oBAAoB;AACvC,WAAO,gCAAG,oBAAS;AAAA,EACrB;AAEA,SAAO,gCAAG,UAAS;AACrB;AA0BO,SAAS,oBACd,QAIA,SACA;AACA,SAAO,UAAU,SAA0B;AAEzC,UAAM,CAAC,GAAG,IAAI;AACd,UAAM,SAAS,IAAI,MAAM;AACzB,UAAM,iBAAiB,IAAI;AAC3B,UAAM,UAAU,IAAI;AACpB,UAAM,QAAQ,IAAI;AAElB,QAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAGA,UAAM,EAAE,aAAAC,aAAY,IAAI,MAAM,OAAO,oBAAO;AAC5C,UAAMC,iBAAgB,MAAMD,aAAY;AAAA,MACtC;AAAA,MACA,OAAO,EAAE,gBAAgB,SAAS,MAAM;AAAA,MACxC,YAAY,OAAO;AAAA,MACnB,QAAQ,OAAO;AAAA,IACjB,CAAC;AAED,QAAI,CAACC,gBAAe;AAClB,YAAM,IAAI,MAAM,sBAAsB,OAAO,UAAU,EAAE;AAAA,IAC3D;AAGA,WAAO,QAAQ,GAAG,IAAI;AAAA,EACxB;AACF;AAsBO,SAAS,qBACd,UACA,SACA;AACA,SAAO,UAAU,SAA0B;AAEzC,UAAM,CAAC,GAAG,IAAI;AACd,UAAM,SAAS,IAAI,MAAM;AACzB,UAAM,iBAAiB,IAAI;AAC3B,UAAM,UAAU,IAAI;AACpB,UAAM,QAAQ,IAAI;AAElB,QAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAGA,UAAM,EAAE,gBAAAC,gBAAe,IAAI,MAAM,OAAO,oBAAO;AAC/C,UAAM,cAAc,MAAMA,gBAAe;AAAA,MACvC;AAAA,MACA,OAAO,EAAE,gBAAgB,SAAS,MAAM;AAAA,IAC1C,CAAC;AAED,UAAM,iBAAiB,CAAC,UAAU,eAAe,WAAW,SAAS,OAAO;AAC5E,UAAM,iBAAiB,eAAe,QAAQ,WAAW;AACzD,UAAM,qBAAqB,eAAe,QAAQ,QAAQ;AAE1D,QAAI,iBAAiB,oBAAoB;AACvC,YAAM,IAAI,MAAM,0BAA0B,QAAQ,UAAU,WAAW,EAAE;AAAA,IAC3E;AAGA,WAAO,QAAQ,GAAG,IAAI;AAAA,EACxB;AACF;AA2BO,SAAS,cACd,QAMA,SACA;AACA,SAAO,UAAU,SAA0B;AAEzC,UAAM,CAAC,GAAG,IAAI;AACd,UAAM,SAAS,IAAI,MAAM;AACzB,UAAM,iBAAiB,IAAI;AAC3B,UAAM,UAAU,IAAI;AACpB,UAAM,QAAQ,IAAI;AAElB,QAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAGA,QAAI,OAAO,eAAe,OAAO,YAAY,SAAS,GAAG;AACvD,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,oBAAO;AAC7C,YAAM,UAAU,MAAM,aAAa,MAAM;AAEzC,UAAI,SAAS;AAEX,YAAI,gBAAgB;AAClB,gBAAM,EAAE,gBAAAC,gBAAe,IAAI,MAAM,OAAO,sBAAS;AACjD,gBAAMA,gBAAe;AAAA,YACnB,MAAM;AAAA,YACN;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,YAAY;AAAA,YACZ,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,aAAa;AAAA,YACb,UAAU;AAAA,cACR,WAAW;AAAA,cACX,QAAQ;AAAA,YACV;AAAA,UACF,CAAC;AAAA,QACH;AAEA,eAAO,QAAQ,GAAG,IAAI;AAAA,MACxB;AAAA,IACF;AAGA,QAAI,OAAO,qBAAqB,OAAO,kBAAkB,SAAS,GAAG;AACnE,YAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,oBAAO;AACpD,YAAM,aAAa,MAAM,oBAAoB,QAAQ,cAAc;AAEnE,UAAI,CAAC,cAAc,OAAO,eAAe,OAAO;AAC9C,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACpD;AAAA,IACF;AAGA,QAAI,OAAO,iBAAiB,OAAO,cAAc,SAAS,KAAK,WAAW,OAAO;AAC/E,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,oBAAO;AAC7C,YAAM,mBAAmB,MAAM,aAAa,QAAQ,EAAE,gBAAgB,SAAS,MAAM,CAAC;AAEtF,UAAI,CAAC,oBAAoB,OAAO,eAAe,OAAO;AACpD,cAAM,IAAI,MAAM,2BAA2B;AAAA,MAC7C;AAAA,IACF;AAGA,QAAI,gBAAgB;AAClB,YAAM,EAAE,gBAAAA,gBAAe,IAAI,MAAM,OAAO,sBAAS;AACjD,YAAMA,gBAAe;AAAA,QACnB,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,UAAU;AAAA,UACR,WAAW;AAAA,QACb;AAAA,MACF,CAAC;AAAA,IACH;AAGA,WAAO,QAAQ,GAAG,IAAI;AAAA,EACxB;AACF;AA4BO,SAAS,qBAAqB,QAOlC;AACD,SAAO,OAAO,KAAwF,KAA0C,SAAqB;AACnK,UAAM,EAAE,SAAS,IAAI,IAAI;AACzB,UAAM,SAAS,IAAI,MAAM;AACzB,UAAM,iBAAiB,IAAI;AAE3B,QAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,aAAO,IAAI,SAAS,OAAO,eAAe,QAAQ;AAAA,IACpD;AAGA,UAAM,iBAAiB,OAAO,gBAAgB;AAAA,MAAK,WACjD,SAAS,WAAW,MAAM,IAAI;AAAA,IAChC;AAEA,QAAI,gBAAgB;AAClB,UAAI;AACF,cAAM,EAAE,aAAAH,aAAY,IAAI,MAAM,OAAO,oBAAO;AAC5C,cAAMC,iBAAgB,MAAMD,aAAY;AAAA,UACtC;AAAA,UACA,OAAO,EAAE,eAAe;AAAA,UACxB,YAAY,eAAe;AAAA,UAC3B,QAAQ,eAAe;AAAA,QACzB,CAAC;AAED,YAAI,CAACC,gBAAe;AAClB,iBAAO,IAAI,SAAS,OAAO,eAAe,gBAAgB;AAAA,QAC5D;AAAA,MACJ,SAAS,QAAQ;AAEf,eAAO,IAAI,SAAS,OAAO,eAAe,gBAAgB;AAAA,MAC5D;AAAA,IACA;AAEA,SAAK;AAAA,EACP;AACF;AAwBO,SAAS,4BAA4B,QAGzC;AACD,SAAO,OAAO,KAA2F,KAAqE,SAAqB;AACjM,UAAM,SAAS,IAAI,MAAM;AACzB,UAAM,iBAAiB,IAAI;AAC3B,UAAM,UAAU,IAAI;AACpB,UAAM,QAAQ,IAAI;AAElB,QAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,wBAAwB,CAAC;AAAA,IAChE;AAEA,QAAI;AACF,YAAM,EAAE,aAAAD,aAAY,IAAI,MAAM,OAAO,oBAAO;AAC5C,YAAMC,iBAAgB,MAAMD,aAAY;AAAA,QACtC;AAAA,QACA,OAAO,EAAE,gBAAgB,SAAS,MAAM;AAAA,QACxC,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,MACjB,CAAC;AAED,UAAI,CAACC,gBAAe;AAClB,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MAC5D;AAEA,WAAK;AAAA,IACP,SAAS,QAAQ;AAEf,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,0BAA0B,CAAC;AAAA,IAClE;AAAA,EACF;AACF;AAeO,SAAS,oBACd,QACA,OACA,aACA,SACS;AACT,QAAM,WAAW,UAAU,sBAAsB;AAAA,IAC/C;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,SAAS,MAAM;AAAA,IACf,OAAO,MAAM;AAAA,EACf,CAAC;AAED,SAAO,UAAU,IAAa,QAAQ,KAAK;AAC7C;AAWO,SAAS,uBACd,QACA,OACA,aACA,QACS;AACT,SAAO,YAAY;AAAA,IAAK,gBACtB,oBAAoB,QAAQ,OAAO,YAAY,MAAM;AAAA,EACvD;AACF;;;ACzpBA;AADA,SAAgB,eAAe,cAAAG,aAAY,YAAAC,WAAU,eAAAC,cAAa,WAAAC,UAAS,aAAAC,kBAAiB;AAmMxF,gBAAAC,YAAA;AA1IJ,IAAM,wBAAwB,cAAgD,IAAI;AAW3E,SAAS,uBAAuB;AAAA,EACrC;AAAA,EACA,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,iBAAiB;AACnB,GAAgC;AAC9B,QAAM,EAAE,MAAM,wBAAwB,gBAAgB,IAAI,eAAe;AACzE,QAAM,CAAC,mBAAmB,oBAAoB,IAAIJ,UAA6B,CAAC,CAAC;AACjF,QAAM,CAAC,WAAW,YAAY,IAAIA,UAAS,IAAI;AAG/C,QAAM,eAAeE,SAAQ,MAAoB;AAC/C,QAAI,CAAC,uBAAwB,QAAO;AAEpC,WAAO;AAAA,MACL,gBAAgB;AAAA,MAChB,SAAS,mBAAmB;AAAA,MAC5B,OAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,wBAAwB,eAAe,CAAC;AAG5C,QAAM,oBAAoBD,aAAY,CACpC,UACA,WACA,QACA,UACY;AACZ,QAAI,CAAC,UAAW,QAAO;AACvB,QAAI,CAAC,MAAM,GAAI,QAAO;AAEtB,UAAM,iBAAiB,SAAS;AAChC,QAAI,CAAC,eAAgB,QAAO;AAK5B,UAAM,aAAa,GAAG,SAAS,SAAS,QAAQ;AAKhD,WAAO;AAAA,EACT,GAAG,CAAC,WAAW,MAAM,IAAI,YAAY,CAAC;AAGtC,QAAM,qBAAqBA,aAAY,MAAgC;AACrE,QAAI,CAAC,aAAa,CAAC,MAAM,GAAI,QAAO,CAAC;AAIrC,WAAO,CAAC;AAAA,EACV,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC;AAGxB,QAAM,uBAAuBA,aAAY,MAA0B;AACjE,WAAO,CAAC,GAAG,iBAAiB;AAAA,EAC9B,GAAG,CAAC,iBAAiB,CAAC;AAGtB,QAAM,yBAAyBA,aAAY,MAAM;AAC/C,yBAAqB,CAAC,CAAC;AAAA,EACzB,GAAG,CAAC,CAAC;AAGL,QAAM,mBAAmBA,aAAY,CACnC,UACA,WACA,SACA,QACA,UACG;AACH,QAAI,CAAC,YAAY,CAAC,MAAM,GAAI;AAE5B,UAAM,SAA2B;AAAA,MAC/B;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,OAAO,SAAS,gBAAgB,EAAE,gBAAgB,GAAG;AAAA,MACrD;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC;AAAA,IACF;AAEA,yBAAqB,UAAQ;AAC3B,YAAM,aAAa,CAAC,QAAQ,GAAG,IAAI;AACnC,aAAO,WAAW,MAAM,GAAG,cAAc;AAAA,IAC3C,CAAC;AAED,QAAI,cAAc;AAChB,mBAAa,UAAU,WAAW,SAAS,MAAM;AAAA,IACnD;AAEA,QAAI,cAAc,CAAC,WAAW,uBAAuB;AACnD,4BAAsB,UAAU,WAAW,MAAM;AAAA,IACnD;AAAA,EACF,GAAG,CAAC,UAAU,MAAM,IAAI,cAAc,gBAAgB,cAAc,uBAAuB,UAAU,CAAC;AAGtG,QAAM,eAAeC,SAAQ,OAAkC;AAAA,IAC7D;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,EACF,IAAI;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,EAAAC,WAAU,MAAM;AACd,QAAI,cAAc,UAAU;AAC1B,cAAQ,IAAI,qGAAqG;AAAA,IACnH;AAAA,EACF,GAAG,CAAC,YAAY,QAAQ,CAAC;AAEzB,SACE,gBAAAC,KAAC,sBAAsB,UAAtB,EAA+B,OAAO,cACpC,UACH;AAEJ;AAQO,SAAS,qBAAgD;AAC9D,QAAM,UAAUL,YAAW,qBAAqB;AAEhD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AAEA,SAAO;AACT;;;AC1MA,SAAgB,WAAAM,UAAsB,aAAAC,YAAW,YAAAC,iBAAgB;AAEjE;;;AClDA,eAAsB,yBACpB,UACA,SACsB;AACtB,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,SAC3B,KAAK,OAAO,EACZ,OAAO,iBAAiB,EACxB,GAAG,YAAY,OAAO,EACtB,OAAO;AAEV,MAAI,SAAS,CAAC,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,SAAO,KAAK;AACd;AAUA,eAAsB,qBACpB,UACA,SACA,OACuB;AACvB,QAAM,iBAAiB,MAAM,yBAAyB,UAAU,OAAO;AAEvE,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;ADYA;AAgDa,SA4PF,YAAAC,WA5PE,OAAAC,MAmRT,QAAAC,aAnRS;AAJN,SAAS,oBAAoB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,gBAAAD,KAAC,uBAAoB;AAAA,EAChC,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU,gBAAAA,KAAC,kBAAe;AAC5B,GAA6B;AAC3B,QAAM,EAAE,MAAM,wBAAwB,iBAAiB,SAAS,IAAI,eAAe;AACnF,QAAM,CAAC,YAAY,aAAa,IAAIE,UAAS,KAAK;AAClD,QAAM,CAAC,YAAY,aAAa,IAAIA,UAAuB,IAAI;AAC/D,QAAM,CAAC,eAAe,gBAAgB,IAAIA,UAAuB,IAAI;AAGrE,EAAAC,WAAU,MAAM;AACd,UAAM,eAAe,YAAY;AAC/B,UAAI,OAAO;AACT,yBAAiB,KAAK;AACtB;AAAA,MACF;AAGA,UAAI,QAA4B;AAGhC,UAAI,UAAU;AACZ,cAAM,UAAU,kBAAkB;AAClC,YAAI,SAAS;AACX,cAAI;AACF,oBAAQ,IAAI,mDAAmD,OAAO;AACtE,kBAAM,EAAE,MAAM,KAAK,OAAAC,OAAM,IAAI,MAAM,SAChC,KAAK,WAAW,EAChB,OAAO,qBAAqB,EAC5B,GAAG,QAAQ,OAAO,EAClB,GAAG,aAAa,IAAI,EACpB,OAAO;AAEV,gBAAIA,QAAO;AACT,sBAAQ,MAAM,0DAA0DA,MAAK;AAE7E,oBAAM,EAAE,MAAM,YAAY,IAAI,MAAM,SACjC,KAAK,WAAW,EAChB,OAAO,qBAAqB,EAC5B,GAAG,QAAQ,OAAO,EAClB,OAAO;AAEV,kBAAI,aAAa;AACf,wBAAQ,MAAM,8BAA8B,OAAO,wCAAwC,YAAY,SAAS,GAAG;AAAA,cACrH,OAAO;AACL,wBAAQ,MAAM,8BAA8B,OAAO,gCAAgC;AAAA,cACrF;AAAA,YACF,WAAW,KAAK;AACd,sBAAQ,IAAI;AACZ,sBAAQ,IAAI,uDAAuD,IAAI,EAAE;AAAA,YAC3E,OAAO;AACL,sBAAQ,MAAM,mDAAmD,OAAO;AAAA,YAC1E;AAAA,UACF,SAASA,QAAO;AACd,oBAAQ,MAAM,4DAA4DA,MAAK;AAAA,UACjF;AAAA,QACF,OAAO;AACL,kBAAQ,MAAM,gGAAgG;AAAA,QAChH;AAAA,MACF;AAGA,UAAI,0BAA0B,iBAAiB;AAC7C,YAAI,CAAC,OAAO;AAEV,cAAI,OAAiC;AACnC,oBAAQ,KAAK,sFAAsF;AAAA,UACrG,OAAO;AACL,oBAAQ,MAAM,iFAAiF;AAC/F,0BAAc,IAAI,MAAM,yDAAyD,CAAC;AAClF,6BAAiB,IAAI;AACrB;AAAA,UACF;AAAA,QACF;AAGA,YAA6C,OAAO;AAClD,gBAAM,YAAY;AAClB,cAAI,CAAC,UAAU,KAAK,KAAK,GAAG;AAC1B,oBAAQ,MAAM,+DAA+D,KAAK;AAClF,0BAAc,IAAI,MAAM,0BAA0B,KAAK,kBAAkB,CAAC;AAC1E,6BAAiB,IAAI;AACrB;AAAA,UACF;AAAA,QACF;AACA,cAAMC,iBAAgB;AAAA,UACpB,gBAAgB;AAAA,UAChB,SAAS;AAAA,UACT;AAAA,QACF;AACA,gBAAQ,IAAI,iDAAiDA,cAAa;AAC1E,yBAAiBA,cAAa;AAC9B;AAAA,MACF;AAGA,UAAI,wBAAwB;AAC1B,YAAI,CAAC,OAAO;AAEV,cAAI,OAAiC;AACnC,oBAAQ,KAAK,sFAAsF;AAAA,UACrG,OAAO;AACL,oBAAQ,MAAM,iFAAiF;AAC/F,0BAAc,IAAI,MAAM,yDAAyD,CAAC;AAClF,6BAAiB,IAAI;AACrB;AAAA,UACF;AAAA,QACF;AAGA,YAA6C,OAAO;AAClD,gBAAM,YAAY;AAClB,cAAI,CAAC,UAAU,KAAK,KAAK,GAAG;AAC1B,oBAAQ,MAAM,+DAA+D,KAAK;AAClF,0BAAc,IAAI,MAAM,0BAA0B,KAAK,kBAAkB,CAAC;AAC1E,6BAAiB,IAAI;AACrB;AAAA,UACF;AAAA,QACF;AACA,cAAMA,iBAAgB;AAAA,UACpB,gBAAgB;AAAA,UAChB,SAAS,mBAAmB;AAAA,UAC5B;AAAA,QACF;AACA,gBAAQ,IAAI,4DAA4DA,cAAa;AACrF,yBAAiBA,cAAa;AAC9B;AAAA,MACF;AAGA,UAAI,mBAAmB,UAAU;AAC/B,YAAI;AACF,gBAAM,aAAa,MAAM,qBAAqB,UAAU,eAAe;AACvE,cAAI,CAAC,YAAY;AACf,0BAAc,IAAI,MAAM,mDAAmD,CAAC;AAC5E,6BAAiB,IAAI;AACrB;AAAA,UACF;AAEA,2BAAiB;AAAA,YACf,GAAG;AAAA,YACH,OAAO,SAAS,WAAW;AAAA,UAC7B,CAAC;AAAA,QACH,SAASD,QAAO;AACd,wBAAcA,MAAc;AAC5B,2BAAiB,IAAI;AAAA,QACvB;AACA;AAAA,MACF;AAGA,oBAAc,IAAI,MAAM,uFAAuF,CAAC;AAChH,uBAAiB,IAAI;AAAA,IACvB;AAEA,iBAAa;AAAA,EACf,GAAG,CAAC,OAAO,wBAAwB,iBAAiB,QAAQ,CAAC;AAG7D,QAAM,kBAAkBE,SAAQ,MAAc;AAC5C,WAAO,UAAU;AAAA,EACnB,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAGrB,QAAM,aAAaA,SAAQ,MAAkB;AAC3C,WAAO,GAAG,SAAS,SAAS,QAAQ;AAAA,EACtC,GAAG,CAAC,WAAW,QAAQ,CAAC;AAIxB,UAAQ,IAAI,oDAAoD,aAAa;AAC7E,UAAQ,IAAI,wCAAwC,aAAa;AACjE,UAAQ,IAAI,0CAA0C,eAAe;AAErE,UAAQ,IAAI,oDAAoD;AAAA,IAC9D,QAAQ,MAAM,MAAM;AAAA,IACpB,OAAO,iBAAiB,EAAE,gBAAgB,IAAI,OAAO,IAAI,SAAS,mBAAmB,OAAU;AAAA,IAC/F;AAAA,IACA,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,EAAE,KAAK,WAAW,cAAc,OAAO,SAAS,IAAI;AAAA,IACxD,MAAM,MAAM;AAAA,IACZ,iBAAiB,EAAE,gBAAgB,IAAI,OAAO,IAAI,SAAS,mBAAmB,OAAU;AAAA,IACxF;AAAA,IACA;AAAA,IACA;AAAA;AAAA,EACF;AAEA,UAAQ,IAAI,0CAA0C,EAAE,KAAK,cAAc,SAAS,CAAC;AAGrF,QAAM,YAAY,CAAC,iBAAiB;AACpC,QAAM,QAAQ,cAAc;AAE5B,UAAQ,IAAI,yCAAyC;AAAA,IACnD;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,CAAC,CAAC;AAAA,IACvB,OAAO,OAAO;AAAA,EAChB,CAAC;AAGD,EAAAH,WAAU,MAAM;AACd,QAAI,CAAC,aAAa,CAAC,OAAO;AACxB,oBAAc,IAAI;AAClB,oBAAc,IAAI;AAElB,UAAI,CAAC,OAAO,UAAU;AACpB,iBAAS,UAAU,SAAS;AAAA,MAC9B;AAAA,IACF,WAAW,OAAO;AAChB,oBAAc,KAAK;AACnB,oBAAc,IAAI;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,KAAK,WAAW,OAAO,UAAU,WAAW,QAAQ,CAAC;AAGzD,EAAAA,WAAU,MAAM;AACd,QAAI,YAAY,cAAc,CAAC,WAAW;AACxC,cAAQ,IAAI,8CAA8C;AAAA,QACxD;AAAA,QACA;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,OAAO;AAAA,QACP,SAAS;AAAA,QACT,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,UAAU,YAAY,WAAW,UAAU,WAAW,MAAM,IAAI,eAAe,GAAG,CAAC;AAGvF,EAAAA,WAAU,MAAM;AACd,QAAI,cAAc,cAAc,CAAC,aAAa,CAAC,KAAK;AAClD,cAAQ,MAAM,2GAA2G;AAAA,QACvH;AAAA,QACA;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,OAAO;AAAA,QACP,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,YAAY,YAAY,WAAW,KAAK,UAAU,WAAW,MAAM,IAAI,aAAa,CAAC;AAGzF,MAAI,aAAa,CAAC,iBAAiB,CAAC,YAAY;AAC9C,WAAO,gBAAAH,KAAAD,WAAA,EAAG,mBAAQ;AAAA,EACpB;AAGA,MAAI,YAAY;AACd,YAAQ,MAAM,0DAA0D,QAAQ,KAAK,UAAU;AAC/F,WAAO,gBAAAC,KAAAD,WAAA,EAAG,oBAAS;AAAA,EACrB;AAGA,MAAI,CAAC,KAAK;AACR,WAAO,gBAAAC,KAAAD,WAAA,EAAG,oBAAS;AAAA,EACrB;AAGA,SAAO,gBAAAC,KAAAD,WAAA,EAAG,UAAS;AACrB;AAKA,SAAS,sBAAsB;AAC7B,SACE,gBAAAE,MAAC,SAAI,WAAU,2EACb;AAAA,oBAAAD,KAAC,SAAI,WAAU,QACb,0BAAAA,KAAC,SAAI,WAAU,kCAAiC,MAAK,QAAO,QAAO,gBAAe,SAAQ,aACxF,0BAAAA,KAAC,UAAK,eAAc,SAAQ,gBAAe,SAAQ,aAAa,GAAG,GAAE,6IAA4I,GACnN,GACF;AAAA,IACA,gBAAAA,KAAC,QAAG,WAAU,2CAA0C,2BAAa;AAAA,IACrE,gBAAAA,KAAC,OAAE,WAAU,qBAAoB,4DAA8C;AAAA,IAC/E,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,SAAS,MAAM,OAAO,QAAQ,KAAK;AAAA,QACnC,WAAU;AAAA,QACX;AAAA;AAAA,IAED;AAAA,KACF;AAEJ;AAKA,SAAS,iBAAiB;AACxB,SACE,gBAAAA,KAAC,SAAI,WAAU,sDACb,0BAAAC,MAAC,SAAI,WAAU,+BACb;AAAA,oBAAAD,KAAC,SAAI,WAAU,gEAA+D;AAAA,IAC9E,gBAAAA,KAAC,UAAK,WAAU,gBAAe,qCAAuB;AAAA,KACxD,GACF;AAEJ;;;AEhXA;AADA,SAAgB,iBAAAO,gBAAe,cAAAC,aAAY,YAAAC,WAAU,eAAAC,cAAa,WAAAC,UAAS,aAAAC,kBAAiB;AA8OxF,gBAAAC,YAAA;AA7KJ,IAAM,oBAAoBC,eAA4C,IAAI;AAWnE,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,iBAAiB;AAAA,EACjB,aAAa;AACf,GAA4B;AAC1B,QAAM,EAAE,MAAM,wBAAwB,gBAAgB,IAAI,eAAe;AACzE,QAAM,EAAE,gBAAgB,IAAI,oBAAoB;AAChD,QAAM,CAAC,mBAAmB,oBAAoB,IAAIC,UAA6B,CAAC,CAAC;AACjF,QAAM,CAAC,WAAW,YAAY,IAAIA,UAAS,IAAI;AAG/C,QAAM,eAAeC,SAAQ,MAAoB;AAC/C,QAAI,CAAC,uBAAwB,QAAO;AAEpC,WAAO;AAAA,MACL,gBAAgB;AAAA,MAChB,SAAS,mBAAmB;AAAA,MAC5B,OAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,wBAAwB,eAAe,CAAC;AAG5C,QAAM,sBAAsBC,aAAY,CACtC,OACA,WACA,UACY;AACZ,QAAI,CAAC,UAAW,QAAO;AACvB,QAAI,CAAC,MAAM,GAAI,QAAO;AAEtB,UAAM,iBAAiB,SAAS;AAChC,QAAI,CAAC,eAAgB,QAAO;AAK5B,UAAM,aAAa,GAAG,SAAS,SAAS,KAAK;AAK7C,WAAO;AAAA,EACT,GAAG,CAAC,WAAW,MAAM,IAAI,YAAY,CAAC;AAGtC,QAAM,2BAA2BA,aAAY,MAAgC;AAC3E,QAAI,CAAC,aAAa,CAAC,MAAM,GAAI,QAAO,CAAC;AAIrC,WAAO,CAAC;AAAA,EACV,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC;AAGxB,QAAM,uBAAuBA,aAAY,MAA0B;AACjE,WAAO,CAAC,GAAG,iBAAiB;AAAA,EAC9B,GAAG,CAAC,iBAAiB,CAAC;AAGtB,QAAM,yBAAyBA,aAAY,MAAM;AAC/C,yBAAqB,CAAC,CAAC;AAAA,EACzB,GAAG,CAAC,CAAC;AAGL,QAAM,qBAAqBA,aAAY,CACrC,OACA,WACA,UACY;AACZ,QAAI,CAAC,UAAW,QAAO;AACvB,QAAI,CAAC,MAAM,GAAI,QAAO;AAEtB,UAAM,iBAAiB,SAAS;AAChC,QAAI,CAAC,eAAgB,QAAO;AAG5B,QAAI;AACF,sBAAgB;AAAA,IAClB,SAAS,OAAO;AACd,cAAQ,MAAM,gEAAgE,KAAK;AACnF,aAAO;AAAA,IACT;AAEA,WAAO,oBAAoB,OAAO,WAAW,cAAc;AAAA,EAC7D,GAAG,CAAC,WAAW,MAAM,IAAI,cAAc,iBAAiB,mBAAmB,CAAC;AAG5E,QAAM,mBAAmBA,aAAY,CACnC,OACA,WACA,SACA,OACA,SACA,UACG;AACH,QAAI,CAAC,YAAY,CAAC,MAAM,GAAI;AAE5B,UAAM,SAA2B;AAAA,MAC/B;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,OAAO,SAAS,gBAAgB,EAAE,gBAAgB,GAAG;AAAA,MACrD;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC;AAAA,MACA;AAAA,IACF;AAEA,yBAAqB,UAAQ;AAC3B,YAAM,aAAa,CAAC,QAAQ,GAAG,IAAI;AACnC,aAAO,WAAW,MAAM,GAAG,cAAc;AAAA,IAC3C,CAAC;AAED,QAAI,cAAc;AAChB,mBAAa,OAAO,WAAW,SAAS,MAAM;AAAA,IAChD;AAEA,QAAI,cAAc,CAAC,WAAW,uBAAuB;AACnD,4BAAsB,OAAO,WAAW,MAAM;AAAA,IAChD;AAAA,EACF,GAAG,CAAC,UAAU,MAAM,IAAI,cAAc,gBAAgB,cAAc,uBAAuB,UAAU,CAAC;AAGtG,QAAM,eAAeD,SAAQ,OAA8B;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,EAAAE,WAAU,MAAM;AACd,QAAI,cAAc,UAAU;AAC1B,cAAQ,IAAI,iGAAiG;AAAA,IAC/G;AAAA,EACF,GAAG,CAAC,YAAY,QAAQ,CAAC;AAGzB,EAAAA,WAAU,MAAM;AACd,QAAI,cAAc,UAAU;AAC1B,cAAQ,IAAI,8FAA8F;AAAA,IAC5G;AAAA,EACF,GAAG,CAAC,YAAY,QAAQ,CAAC;AAEzB,SACE,gBAAAL,KAAC,kBAAkB,UAAlB,EAA2B,OAAO,cAChC,UACH;AAEJ;AAQO,SAAS,gBAAuC;AACrD,QAAM,UAAUM,YAAW,iBAAiB;AAE5C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,SAAO;AACT;;;ACxPA,SAAgB,WAAAC,UAAsB,aAAAC,YAAW,YAAAC,iBAAgB;AAEjE;AAkDa,SAmIF,YAAAC,WAnIE,OAAAC,MA0JT,QAAAC,aA1JS;AAJN,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,gBAAAD,KAACE,sBAAA,EAAoB;AAAA,EAChC,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,UAAU,gBAAAF,KAACG,iBAAA,EAAe;AAAA,EAC1B,aAAa;AACf,GAA4B;AAC1B,QAAM,EAAE,MAAM,wBAAwB,iBAAiB,SAAS,IAAI,eAAe;AACnF,QAAM,CAAC,YAAY,aAAa,IAAIC,UAAS,KAAK;AAClD,QAAM,CAAC,YAAY,aAAa,IAAIA,UAAuB,IAAI;AAC/D,QAAM,CAAC,mBAAmB,oBAAoB,IAAIA,UAAkC,CAAC,CAAC;AACtF,QAAM,CAAC,eAAe,gBAAgB,IAAIA,UAAuB,IAAI;AAGrE,EAAAC,WAAU,MAAM;AACd,UAAM,eAAe,YAAY;AAC/B,UAAI,OAAO;AACT,yBAAiB,KAAK;AACtB;AAAA,MACF;AAGA,UAAI,0BAA0B,iBAAiB;AAC7C,yBAAiB;AAAA,UACf,gBAAgB;AAAA,UAChB,SAAS;AAAA,UACT,OAAO;AAAA,QACT,CAAC;AACD;AAAA,MACF;AAGA,UAAI,wBAAwB;AAC1B,yBAAiB;AAAA,UACf,gBAAgB;AAAA,UAChB,SAAS,mBAAmB;AAAA,UAC5B,OAAO;AAAA,QACT,CAAC;AACD;AAAA,MACF;AAGA,UAAI,mBAAmB,UAAU;AAC/B,YAAI;AACF,gBAAM,aAAa,MAAM,qBAAqB,UAAU,eAAe;AACvE,cAAI,CAAC,YAAY;AACf,0BAAc,IAAI,MAAM,mDAAmD,CAAC;AAC5E;AAAA,UACF;AACA,2BAAiB,UAAU;AAAA,QAC7B,SAASC,QAAO;AACd,wBAAcA,MAAc;AAAA,QAC9B;AACA;AAAA,MACF;AAGA,oBAAc,IAAI,MAAM,kFAAkF,CAAC;AAAA,IAC7G;AAEA,iBAAa;AAAA,EACf,GAAG,CAAC,OAAO,wBAAwB,iBAAiB,QAAQ,CAAC;AAI7D,QAAM,2BAA2B,YAAY,CAAC;AAC9C,QAAM,EAAE,KAAK,WAAW,MAAM,IAAI;AAAA,IAChC,MAAM,MAAM;AAAA,IACZ,iBAAiB,EAAE,SAAS,mBAAmB,OAAU;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA;AAAA,EACF;AAGA,QAAM,yBAAyBC,SAAQ,MAAe;AACpD,QAAI,YAAY,WAAW,EAAG,QAAO;AAKrC,WAAO;AAAA,EACT,GAAG,CAAC,aAAa,GAAG,CAAC;AAGrB,EAAAF,WAAU,MAAM;AACd,QAAI,CAAC,aAAa,CAAC,OAAO;AACxB,oBAAc,IAAI;AAClB,oBAAc,IAAI;AAElB,UAAI,CAAC,0BAA0B,UAAU;AACvC,iBAAS,aAAa,SAAS;AAAA,MACjC;AAAA,IACF,WAAW,OAAO;AAChB,oBAAc,KAAK;AACnB,oBAAc,IAAI;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,wBAAwB,WAAW,OAAO,aAAa,WAAW,QAAQ,CAAC;AAG/E,EAAAA,WAAU,MAAM;AACd,QAAI,YAAY,cAAc,CAAC,WAAW;AACxC,cAAQ,IAAI,kDAAkD;AAAA,QAC5D;AAAA,QACA;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,OAAO;AAAA,QACP,SAAS;AAAA,QACT;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,UAAU,YAAY,WAAW,aAAa,WAAW,MAAM,IAAI,eAAe,wBAAwB,UAAU,CAAC;AAGzH,EAAAA,WAAU,MAAM;AACd,QAAI,cAAc,cAAc,CAAC,aAAa,CAAC,wBAAwB;AACrE,cAAQ,MAAM,sGAAsG;AAAA,QAClH;AAAA,QACA;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,OAAO;AAAA,QACP;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,YAAY,YAAY,WAAW,wBAAwB,aAAa,WAAW,MAAM,IAAI,eAAe,UAAU,CAAC;AAG3H,MAAI,aAAa,CAAC,YAAY;AAC5B,WAAO,gBAAAL,KAAAD,WAAA,EAAG,mBAAQ;AAAA,EACpB;AAGA,MAAI,YAAY;AACd,YAAQ,MAAM,8DAA8D,SAAS,KAAK,UAAU;AACpG,WAAO,gBAAAC,KAAAD,WAAA,EAAG,oBAAS;AAAA,EACrB;AAGA,MAAI,CAAC,wBAAwB;AAC3B,WAAO,gBAAAC,KAAAD,WAAA,EAAG,oBAAS;AAAA,EACrB;AAGA,SAAO,gBAAAC,KAAAD,WAAA,EAAG,UAAS;AACrB;AAKA,SAASG,uBAAsB;AAC7B,SACE,gBAAAD,MAAC,SAAI,WAAU,2EACb;AAAA,oBAAAD,KAAC,SAAI,WAAU,QACb,0BAAAA,KAAC,SAAI,WAAU,kCAAiC,MAAK,QAAO,QAAO,gBAAe,SAAQ,aACxF,0BAAAA,KAAC,UAAK,eAAc,SAAQ,gBAAe,SAAQ,aAAa,GAAG,GAAE,6IAA4I,GACnN,GACF;AAAA,IACA,gBAAAA,KAAC,QAAG,WAAU,2CAA0C,2BAAa;AAAA,IACrE,gBAAAA,KAAC,OAAE,WAAU,qBAAoB,kEAAoD;AAAA,IACrF,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,SAAS,MAAM,OAAO,QAAQ,KAAK;AAAA,QACnC,WAAU;AAAA,QACX;AAAA;AAAA,IAED;AAAA,KACF;AAEJ;AAKA,SAASG,kBAAiB;AACxB,SACE,gBAAAH,KAAC,SAAI,WAAU,sDACb,0BAAAC,MAAC,SAAI,WAAU,+BACb;AAAA,oBAAAD,KAAC,SAAI,WAAU,gEAA+D;AAAA,IAC9E,gBAAAA,KAAC,UAAK,WAAU,gBAAe,qCAAuB;AAAA,KACxD,GACF;AAEJ;;;AC/OA,SAAgB,WAAAQ,UAAS,eAAAC,cAAa,aAAAC,YAAW,YAAAC,WAAU,iBAAAC,gBAAe,cAAAC,mBAAkB;AAC5F,SAAS,aAAa,aAAa,cAAc;AAEjD;AAgSQ,SACE,OAAAC,MADF,QAAAC,aAAA;AA9LR,IAAM,yBAAyBC,eAAiD,IAAI;AAW7E,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA,gBAAgB;AAAA,EAChB;AAAA,EACA,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,iBAAiB;AAAA,EACjB,uBAAuB,wBAAwB;AACjD,GAAyB;AACvB,QAAM,EAAE,MAAM,wBAAwB,gBAAgB,IAAI,eAAe;AACzE,QAAM,WAAW,YAAY;AAC7B,QAAM,WAAW,YAAY;AAC7B,QAAM,CAAC,oBAAoB,qBAAqB,IAAIC,UAA8B,CAAC,CAAC;AACpF,QAAM,CAAC,cAAc,eAAe,IAAIA,UAAiB,EAAE;AAG3D,QAAM,eAAeC,SAAQ,MAAoB;AAC/C,QAAI,CAAC,uBAAwB,QAAO;AAEpC,WAAO;AAAA,MACL,gBAAgB;AAAA,MAChB,SAAS,mBAAmB;AAAA,MAC5B,OAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,wBAAwB,eAAe,CAAC;AAG5C,QAAM,qBAAqBA,SAAQ,MAA0B;AAC3D,UAAM,cAAc,SAAS;AAC7B,WAAO,OAAO,KAAK,WAAS,MAAM,SAAS,WAAW,KAAK;AAAA,EAC7D,GAAG,CAAC,QAAQ,SAAS,QAAQ,CAAC;AAG9B,QAAM,iBAAiBC,aAAY,CAAC,SAA0B;AAC5D,QAAI,CAAC,MAAM,MAAM,CAAC,aAAc,QAAO;AAEvC,UAAM,cAAc,OAAO,KAAK,WAAS,MAAM,SAAS,IAAI;AAC5D,QAAI,CAAC,YAAa,QAAO;AAOzB,WAAO;AAAA,EACT,GAAG,CAAC,MAAM,IAAI,cAAc,MAAM,CAAC;AAGnC,QAAM,EAAE,KAAK,uBAAuB,WAAW,kBAAkB,IAAI;AAAA,IACnE,MAAM,MAAM;AAAA,IACZ,gBAAgB,EAAE,gBAAgB,IAAI,SAAS,QAAW,OAAO,OAAU;AAAA,IAC3E,oBAAoB,cAAc,CAAC,KAAK;AAAA,IACxC,oBAAoB;AAAA,EACtB;AAGA,QAAM,iBAAiB,oBAAoB,eAAe,mBAAmB,YAAY,SAAS;AAClG,QAAM,iBAAiB,iBAAiB,wBAAwB;AAChE,QAAM,eAAe,iBAAiB,oBAAoB;AAG1D,QAAM,sBAAsBA,aAAY,MAAqB;AAC3D,QAAI,CAAC,MAAM,MAAM,CAAC,aAAc,QAAO,CAAC;AAExC,WAAO,OAAO,OAAO,WAAS,eAAe,MAAM,IAAI,CAAC;AAAA,EAC1D,GAAG,CAAC,MAAM,IAAI,cAAc,QAAQ,cAAc,CAAC;AAGnD,QAAM,iBAAiBA,aAAY,CAAC,SAAqC;AACvE,WAAO,OAAO,KAAK,WAAS,MAAM,SAAS,IAAI,KAAK;AAAA,EACtD,GAAG,CAAC,MAAM,CAAC;AAGX,QAAM,wBAAwBA,aAAY,MAA2B;AACnE,WAAO,CAAC,GAAG,kBAAkB;AAAA,EAC/B,GAAG,CAAC,kBAAkB,CAAC;AAGvB,QAAM,0BAA0BA,aAAY,MAAM;AAChD,0BAAsB,CAAC,CAAC;AAAA,EAC1B,GAAG,CAAC,CAAC;AAGL,QAAM,oBAAoBA,aAAY,CACpC,OACA,SACA,gBACG;AACH,QAAI,CAAC,YAAY,CAAC,MAAM,MAAM,CAAC,aAAc;AAE7C,UAAM,SAA4B;AAAA,MAChC;AAAA,MACA,aAAa,YAAY;AAAA,MACzB,QAAQ,KAAK;AAAA,MACb,OAAO;AAAA,MACP;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,QAAQ,YAAY;AAAA,MACpB,OAAO,YAAY;AAAA,MACnB,aAAa,YAAY;AAAA,IAC3B;AAEA,0BAAsB,UAAQ;AAC5B,YAAM,aAAa,CAAC,QAAQ,GAAG,IAAI;AACnC,aAAO,WAAW,MAAM,GAAG,cAAc;AAAA,IAC3C,CAAC;AAED,QAAI,eAAe;AACjB,oBAAc,OAAO,SAAS,MAAM;AAAA,IACtC;AAEA,QAAI,cAAc,CAAC,WAAW,uBAAuB;AACnD,4BAAsB,OAAO,MAAM;AAAA,IACrC;AAAA,EACF,GAAG,CAAC,UAAU,MAAM,IAAI,cAAc,gBAAgB,eAAe,uBAAuB,UAAU,CAAC;AAGvG,EAAAC,WAAU,MAAM;AACd,UAAM,cAAc,SAAS;AAC7B,oBAAgB,WAAW;AAE3B,QAAI,CAAC,oBAAoB;AAEvB,UAAI,YAAY;AACd,gBAAQ,MAAM,6EAA6E;AAAA,UACzF,OAAO;AAAA,UACP,QAAQ,MAAM;AAAA,UACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC,CAAC;AAED,YAAI,uBAAuB;AACzB,gCAAsB,aAAa;AAAA,YACjC,OAAO;AAAA,YACP,aAAa,CAAC;AAAA,YACd,QAAQ,MAAM,MAAM;AAAA,YACpB,OAAO,gBAAgB,EAAE,gBAAgB,GAAG;AAAA,YAC5C,SAAS;AAAA,YACT,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,UACpC,CAAC;AAAA,QACH;AAAA,MACF;AACA;AAAA,IACF;AAGA,UAAM,UAAU;AAChB,sBAAkB,aAAa,SAAS,kBAAkB;AAE1D,QAAI,CAAC,SAAS;AAEZ,eAAS,eAAe,EAAE,SAAS,KAAK,CAAC;AAAA,IAC3C;AAAA,EACF,GAAG,CAAC,SAAS,UAAU,oBAAoB,uBAAuB,mBAAmB,YAAY,MAAM,IAAI,cAAc,uBAAuB,UAAU,aAAa,CAAC;AAGxK,QAAM,eAAeF,SAAQ,OAAmC;AAAA,IAC9D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,mBAAmB;AAAA,EACrB,IAAI;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,MAAI,cAAc;AAChB,WACE,gBAAAJ,KAAC,SAAI,WAAU,iDACb,0BAAAC,MAAC,SAAI,WAAU,eACb;AAAA,sBAAAD,KAAC,SAAI,WAAU,6EAA4E;AAAA,MAC3F,gBAAAA,KAAC,OAAE,WAAU,gBAAe,qCAAuB;AAAA,OACrD,GACF;AAAA,EAEJ;AAGA,MAAI,sBAAsB,CAAC,gBAAgB;AACzC,WACE,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,OAAO;AAAA,QACP,QAAO;AAAA;AAAA,IACT;AAAA,EAEJ;AACA,SACE,gBAAAC,MAAC,uBAAuB,UAAvB,EAAgC,OAAO,cACrC;AAAA;AAAA,IACD,gBAAAD,KAAC,UAAO;AAAA,KACV;AAEJ;AAQO,SAAS,qBAAiD;AAC/D,QAAM,UAAUO,YAAW,sBAAsB;AAEjD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAEA,SAAO;AACT;AAKA,SAAS,6BAA6B,EAAE,OAAO,OAAO,GAAsC;AAC1F,SACE,gBAAAN,MAAC,SAAI,WAAU,0EACb;AAAA,oBAAAD,KAAC,SAAI,WAAU,QACb,0BAAAA,KAAC,SAAI,WAAU,kCAAiC,MAAK,QAAO,QAAO,gBAAe,SAAQ,aACxF,0BAAAA,KAAC,UAAK,eAAc,SAAQ,gBAAe,SAAQ,aAAa,GAAG,GAAE,6IAA4I,GACnN,GACF;AAAA,IACA,gBAAAA,KAAC,QAAG,WAAU,2CAA0C,2BAAa;AAAA,IACrE,gBAAAC,MAAC,OAAE,WAAU,qBAAoB;AAAA;AAAA,MACK,gBAAAD,KAAC,UAAK,WAAU,gCAAgC,iBAAM;AAAA,OAC5F;AAAA,IACA,gBAAAC,MAAC,OAAE,WAAU,6BAA4B;AAAA;AAAA,MAAS;AAAA,OAAO;AAAA,IACzD,gBAAAD;AAAA,MAAC;AAAA;AAAA,QACC,SAAS,MAAM,OAAO,QAAQ,KAAK;AAAA,QACnC,WAAU;AAAA,QACX;AAAA;AAAA,IAED;AAAA,KACF;AAEJ;;;AC5WA;AADA,SAAgB,iBAAAQ,gBAAe,cAAAC,aAAY,YAAAC,WAAU,eAAAC,cAAa,WAAAC,UAAS,aAAAC,kBAAiB;AA2OxF,gBAAAC,YAAA;AA3IJ,IAAM,oBAAoBN,eAA4C,IAAI;AAWnE,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,iBAAiB;AACnB,GAA4B;AAC1B,QAAM,EAAE,MAAM,wBAAwB,gBAAgB,IAAI,eAAe;AACzE,QAAM,CAAC,yBAAyB,0BAA0B,IAAIE,UAAmC,CAAC,CAAC;AACnG,QAAM,CAAC,WAAW,YAAY,IAAIA,UAAS,IAAI;AAG/C,QAAM,eAAeE,SAAQ,MAAoB;AAC/C,QAAI,CAAC,uBAAwB,QAAO;AAEpC,WAAO;AAAA,MACL,gBAAgB;AAAA,MAChB,SAAS,mBAAmB;AAAA,MAC5B,OAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,wBAAwB,eAAe,CAAC;AAG5C,QAAM,0BAA0BD,aAAY,CAC1C,SACY;AACZ,QAAI,CAAC,UAAW,QAAO;AACvB,QAAI,CAAC,MAAM,GAAI,QAAO;AAEtB,QAAI,CAAC,aAAc,QAAO;AAO1B,WAAO;AAAA,EACT,GAAG,CAAC,WAAW,MAAM,IAAI,YAAY,CAAC;AAGtC,QAAM,2BAA2BA,aAAY,MAAgC;AAC3E,QAAI,CAAC,aAAa,CAAC,MAAM,GAAI,QAAO,CAAC;AAIrC,WAAO,CAAC;AAAA,EACV,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC;AAGxB,QAAM,6BAA6BA,aAAY,CAAC,UAA8C;AAC5F,QAAI,CAAC,UAAW,QAAO;AAEvB,WAAO,MAAM,OAAO,UAAQ,wBAAwB,IAAI,CAAC;AAAA,EAC3D,GAAG,CAAC,WAAW,uBAAuB,CAAC;AAGvC,QAAM,6BAA6BA,aAAY,MAAgC;AAC7E,WAAO,CAAC,GAAG,uBAAuB;AAAA,EACpC,GAAG,CAAC,uBAAuB,CAAC;AAG5B,QAAM,+BAA+BA,aAAY,MAAM;AACrD,+BAA2B,CAAC,CAAC;AAAA,EAC/B,GAAG,CAAC,CAAC;AAGL,QAAM,yBAAyBA,aAAY,CACzC,MACA,YACG;AACH,QAAI,CAAC,YAAY,CAAC,MAAM,MAAM,CAAC,aAAc;AAE7C,UAAM,SAAiC;AAAA,MACrC,gBAAgB,KAAK;AAAA,MACrB,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,MACb,OAAO;AAAA,MACP;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,IACpB;AAEA,+BAA2B,UAAQ;AACjC,YAAM,aAAa,CAAC,QAAQ,GAAG,IAAI;AACnC,aAAO,WAAW,MAAM,GAAG,cAAc;AAAA,IAC3C,CAAC;AAED,QAAI,oBAAoB;AACtB,yBAAmB,MAAM,SAAS,MAAM;AAAA,IAC1C;AAEA,QAAI,cAAc,CAAC,WAAW,uBAAuB;AACnD,4BAAsB,MAAM,MAAM;AAAA,IACpC;AAAA,EACF,GAAG,CAAC,UAAU,MAAM,IAAI,cAAc,gBAAgB,oBAAoB,uBAAuB,UAAU,CAAC;AAG5G,QAAM,eAAeC,SAAQ,OAA8B;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,EACF,IAAI;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,EAAAC,WAAU,MAAM;AACd,QAAI,cAAc,UAAU;AAC1B,cAAQ,IAAI,uGAAuG;AAAA,IACrH;AAAA,EACF,GAAG,CAAC,YAAY,QAAQ,CAAC;AAEzB,SACE,gBAAAC,KAAC,kBAAkB,UAAlB,EAA2B,OAAO,cAChC,UACH;AAEJ;AAQO,SAAS,2BAAkD;AAChE,QAAM,UAAUL,YAAW,iBAAiB;AAE5C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAEA,SAAO;AACT;;;ACrPA,SAAgB,WAAAM,UAAsB,aAAAC,YAAW,YAAAC,iBAAgB;AAEjE;AA+Ca,SAkIF,YAAAC,WAlIE,OAAAC,MA0JP,QAAAC,aA1JO;AAHN,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA,WAAW,gBAAAD,KAACE,sBAAA,EAAoB;AAAA,EAChC,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,UAAU,gBAAAF,KAACG,iBAAA,EAAe;AAAA,EAC1B,aAAa;AACf,GAAyB;AACvB,QAAM,EAAE,MAAM,wBAAwB,iBAAiB,SAAS,IAAI,eAAe;AACnF,QAAM,CAAC,YAAY,aAAa,IAAIC,UAAS,KAAK;AAClD,QAAM,CAAC,YAAY,aAAa,IAAIA,UAAuB,IAAI;AAC/D,QAAM,CAAC,eAAe,gBAAgB,IAAIA,UAAuB,IAAI;AAGrE,EAAAC,WAAU,MAAM;AACd,UAAM,eAAe,YAAY;AAC/B,UAAI,OAAO;AACT,yBAAiB,KAAK;AACtB;AAAA,MACF;AAGA,UAAI,0BAA0B,iBAAiB;AAC7C,yBAAiB;AAAA,UACf,gBAAgB;AAAA,UAChB,SAAS;AAAA,UACT,OAAO;AAAA,QACT,CAAC;AACD;AAAA,MACF;AAGA,UAAI,wBAAwB;AAC1B,yBAAiB;AAAA,UACf,gBAAgB;AAAA,UAChB,SAAS,mBAAmB;AAAA,UAC5B,OAAO;AAAA,QACT,CAAC;AACD;AAAA,MACF;AAGA,UAAI,mBAAmB,UAAU;AAC/B,YAAI;AACF,gBAAM,aAAa,MAAM,qBAAqB,UAAU,eAAe;AACvE,cAAI,CAAC,YAAY;AACf,0BAAc,IAAI,MAAM,mDAAmD,CAAC;AAC5E;AAAA,UACF;AACA,2BAAiB,UAAU;AAAA,QAC7B,SAASC,QAAO;AACd,wBAAcA,MAAc;AAAA,QAC9B;AACA;AAAA,MACF;AAGA,oBAAc,IAAI,MAAM,6FAA6F,CAAC;AAAA,IACxH;AAEA,iBAAa;AAAA,EACf,GAAG,CAAC,OAAO,wBAAwB,iBAAiB,QAAQ,CAAC;AAI7D,QAAM,2BAA2B,eAAe,YAAY,CAAC;AAC7D,QAAM,EAAE,KAAK,WAAW,MAAM,IAAI;AAAA,IAChC,MAAM,MAAM;AAAA,IACZ,iBAAiB,EAAE,SAAS,mBAAmB,OAAU;AAAA,IACzD;AAAA,IACA,eAAe;AAAA,IACf;AAAA;AAAA,EACF;AAGA,QAAM,yBAAyBC,SAAQ,MAAe;AACpD,QAAI,eAAe,YAAY,WAAW,EAAG,QAAO;AAKpD,WAAO;AAAA,EACT,GAAG,CAAC,eAAe,aAAa,GAAG,CAAC;AAGpC,EAAAF,WAAU,MAAM;AACd,QAAI,CAAC,aAAa,CAAC,OAAO;AACxB,oBAAc,IAAI;AAClB,oBAAc,IAAI;AAElB,UAAI,CAAC,0BAA0B,UAAU;AACvC,iBAAS,cAAc;AAAA,MACzB;AAAA,IACF,WAAW,OAAO;AAChB,oBAAc,KAAK;AACnB,oBAAc,IAAI;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,wBAAwB,WAAW,OAAO,gBAAgB,QAAQ,CAAC;AAGvE,EAAAA,WAAU,MAAM;AACd,QAAI,YAAY,cAAc,CAAC,WAAW;AACxC,cAAQ,IAAI,gDAAgD;AAAA,QAC1D,gBAAgB,eAAe;AAAA,QAC/B,aAAa,eAAe;AAAA,QAC5B,QAAQ,MAAM;AAAA,QACd,OAAO;AAAA,QACP,SAAS;AAAA,QACT;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,UAAU,YAAY,WAAW,gBAAgB,MAAM,IAAI,eAAe,wBAAwB,UAAU,CAAC;AAGjH,EAAAA,WAAU,MAAM;AACd,QAAI,cAAc,cAAc,CAAC,aAAa,CAAC,wBAAwB;AACrE,cAAQ,MAAM,kHAAkH;AAAA,QAC9H,gBAAgB,eAAe;AAAA,QAC/B,aAAa,eAAe;AAAA,QAC5B,QAAQ,MAAM;AAAA,QACd,OAAO;AAAA,QACP;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,YAAY,YAAY,WAAW,wBAAwB,gBAAgB,MAAM,IAAI,eAAe,UAAU,CAAC;AAGnH,MAAI,aAAa,CAAC,iBAAiB,CAAC,YAAY;AAC9C,WAAO,gBAAAL,KAAAD,WAAA,EAAG,mBAAQ;AAAA,EACpB;AAGA,MAAI,YAAY;AACd,YAAQ,MAAM,iEAAiE,eAAe,EAAE,KAAK,UAAU;AAC/G,WAAO,gBAAAC,KAAAD,WAAA,EAAG,oBAAS;AAAA,EACrB;AAGA,MAAI,CAAC,wBAAwB;AAC3B,WAAO,gBAAAC,KAAAD,WAAA,EAAG,oBAAS;AAAA,EACrB;AAGA,SAAO,gBAAAC,KAAAD,WAAA,EAAG,UAAS;AACrB;AAKA,SAASG,uBAAsB;AAC7B,SACE,gBAAAF,KAAC,SAAI,WAAU,oDACb,0BAAAC,MAAC,SAAI,WAAU,+BACb;AAAA,oBAAAD,KAAC,SAAI,WAAU,wBAAuB,MAAK,QAAO,QAAO,gBAAe,SAAQ,aAC9E,0BAAAA,KAAC,UAAK,eAAc,SAAQ,gBAAe,SAAQ,aAAa,GAAG,GAAE,6IAA4I,GACnN;AAAA,IACA,gBAAAA,KAAC,UAAK,WAAU,wBAAuB,2BAAa;AAAA,KACtD,GACF;AAEJ;AAKA,SAASG,kBAAiB;AACxB,SACE,gBAAAH,KAAC,SAAI,WAAU,wCACb,0BAAAC,MAAC,SAAI,WAAU,+BACb;AAAA,oBAAAD,KAAC,SAAI,WAAU,gEAA+D;AAAA,IAC9E,gBAAAA,KAAC,UAAK,WAAU,wBAAuB,yBAAW;AAAA,KACpD,GACF;AAEJ;AAEA,IAAO,0BAAQ;;;AC5Of,SAAgB,WAAAQ,UAAS,eAAAC,cAAa,aAAAC,YAAW,YAAAC,iBAAgB;AA4JnD,SAEI,OAAAC,MAFJ,QAAAC,aAAA;AAtGP,SAAS,uBAAuB;AAAA,EACrC;AAAA,EACA,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AACF,GAAgC;AAC9B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,yBAAyB;AAE7B,QAAM,CAAC,mBAAmB,oBAAoB,IAAIC,UAA2B,CAAC,CAAC;AAG/E,QAAM,gBAAgBC,SAAQ,MAAwB;AACpD,QAAI,CAAC,UAAW,QAAO;AAEvB,WAAO,2BAA2B,KAAK;AAAA,EACzC,GAAG,CAAC,WAAW,OAAO,0BAA0B,CAAC;AAGjD,QAAM,kBAAkBC,aAAY,CAAC,SAAyB;AAC5D,QAAI,aAAa;AACf,kBAAY,IAAI;AAAA,IAClB;AAGA,QAAI,UAAU;AACZ,cAAQ,IAAI,qDAAqD;AAAA,QAC/D,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,aAAa,KAAK;AAAA,QAClB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAGA,yBAAqB,UAAQ;AAC3B,YAAM,aAAa,CAAC,MAAM,GAAG,KAAK,OAAO,OAAK,EAAE,OAAO,KAAK,EAAE,CAAC;AAC/D,aAAO,WAAW,MAAM,GAAG,EAAE;AAAA,IAC/B,CAAC;AAAA,EACH,GAAG,CAAC,aAAa,QAAQ,CAAC;AAG1B,QAAM,yBAAyBA,aAAY,CAAC,MAAsB,YAAqB;AACrF,QAAI,oBAAoB;AACtB,yBAAmB,MAAM,OAAO;AAAA,IAClC;AAEA,QAAI,UAAU;AACZ,cAAQ,IAAI,uDAAuD;AAAA,QACjE,MAAM,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,oBAAoB,UAAU,UAAU,CAAC;AAG7C,QAAM,4BAA4BA,aAAY,CAAC,SAAyB;AACtE,QAAI,uBAAuB;AACzB,4BAAsB,IAAI;AAAA,IAC5B;AAEA,QAAI,YAAY;AACd,cAAQ,MAAM,yHAAyH;AAAA,QACrI,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,aAAa,KAAK;AAAA,QAClB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,uBAAuB,UAAU,CAAC;AAGtC,QAAM,oBAAoBA,aAAY,CAAC,MAAsB,iBAA0B;AACrF,UAAM,WAAW,eAAe,KAAK;AACrC,UAAM,aAAa,CAAC;AAEpB,WACE,gBAAAJ;AAAA,MAAC;AAAA;AAAA,QAEC,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV,UACE,wBAAwB,OACtB,gBAAAA,KAAC,SAAI,WAAW,GAAG,aAAa,IAAI,qBAAqB,IACvD,0BAAAC,MAAC,SAAI,WAAU,+BACZ;AAAA,eAAK,MAAM,QACV,gBAAAD,KAAC,UAAK,WAAU,WAAW,eAAK,KAAK,MAAK;AAAA,UAE5C,gBAAAA,KAAC,UAAM,eAAK,OAAM;AAAA,UAClB,gBAAAA,KAAC,UAAK,WAAU,wBAAuB,6BAAe;AAAA,WACxD,GACF;AAAA,QAIJ,0BAAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAS,MAAM,gBAAgB,IAAI;AAAA,YACnC,WAAW,GAAG,aAAa,IACzB,WAAW,sBAAsB,EACnC,IACE,aAAa,wBAAwB,kBACvC;AAAA,YACA,UAAU;AAAA,YAEV,0BAAAC,MAAC,SAAI,WAAU,+BACZ;AAAA,mBAAK,MAAM,QACV,gBAAAD,KAAC,UAAK,WAAU,WAAW,eAAK,KAAK,MAAK;AAAA,cAE5C,gBAAAA,KAAC,UAAM,eAAK,OAAM;AAAA,cACjB,KAAK,MAAM,eACV,gBAAAA,KAAC,UAAK,WAAU,gCACb,eAAK,KAAK,aACb;AAAA,eAEJ;AAAA;AAAA,QACF;AAAA;AAAA,MAvCK,KAAK;AAAA,IAwCZ;AAAA,EAEJ,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,EAAAK,WAAU,MAAM;AACd,QAAI,cAAc,UAAU;AAC1B,cAAQ,IAAI,2GAA2G;AAAA,IACzH;AAAA,EACF,GAAG,CAAC,YAAY,QAAQ,CAAC;AAGzB,EAAAA,WAAU,MAAM;AACd,QAAI,UAAU;AACZ,cAAQ,IAAI,yDAAyD;AAAA,QACnE,YAAY,MAAM;AAAA,QAClB,eAAe,cAAc;AAAA,QAC7B;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,MAAM,QAAQ,cAAc,QAAQ,YAAY,QAAQ,CAAC;AAE7D,SACE,gBAAAL,KAAC,SAAI,WACF,wBAAc,IAAI,UAAQ;AACzB,UAAM,eAAe,wBAAwB,IAAI;AAEjD,QAAI,YAAY;AACd,aAAO,WAAW,MAAM,YAAY;AAAA,IACtC;AAEA,WAAO,kBAAkB,MAAM,YAAY;AAAA,EAC7C,CAAC,GACH;AAEJ;;;ACnRO,IAAM,qBAAqB;AAAA,EAChC,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAMO,IAAM,2BAA2B;AAAA;AAAA,EAEtC,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,qBAAqB;AAAA;AAAA,EAGrB,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EACd,cAAc;AAAA;AAAA,EAGd,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EACd,cAAc;AAAA;AAAA,EAGd,eAAe;AAAA,EACf,aAAa;AAAA,EACb,eAAe;AAAA,EACf,eAAe;AAAA,EACf,eAAe;AAAA;AAAA,EAGf,aAAa;AAAA,EACb,WAAW;AAAA,EACX,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf;AAMO,IAAM,wBAAwB;AAAA;AAAA,EAEnC,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,cAAc;AAAA;AAAA,EAGd,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,YAAY;AAAA;AAAA,EAGZ,aAAa;AAAA,EACb,WAAW;AAAA,EACX,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA;AAAA,EAGb,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,qBAAqB;AAAA,EACrB,qBAAqB;AAAA;AAAA,EAGrB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,sBAAsB;AAAA;AAAA,EAGtB,uBAAuB;AAAA,EACvB,qBAAqB;AAAA,EACrB,uBAAuB;AACzB;AAMO,IAAM,mBAAmB;AAAA;AAAA,EAE9B,WAAW;AAAA,EACX,aAAa;AAAA;AAAA,EAGb,YAAY;AAAA,EACZ,cAAc;AAAA;AAAA,EAGd,gBAAgB;AAAA,EAChB,kBAAkB;AAAA;AAAA,EAGlB,eAAe;AAAA,EACf,iBAAiB;AAAA;AAAA,EAGjB,cAAc;AAAA,EACd,gBAAgB;AAClB;AAMO,IAAM,oBAAoB;AAAA;AAAA,EAE/B,cAAc;AAAA,IACZ,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,EACrB;AAAA;AAAA,EAGA,WAAW;AAAA,IACT,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,EAC3B;AAAA;AAAA,EAGA,aAAa;AAAA,IACX,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,EACxB;AAAA;AAAA,EAGA,SAAS;AAAA,IACP,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,EACxB;AAAA;AAAA,EAGA,aAAa;AAAA,IACX,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,EACxB;AAAA;AAAA,EAGA,QAAQ;AAAA,IACN,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,EACxB;AACF;AAYO,SAAS,kBAAkB,YAA8C;AAI9E,QAAM,UAAU;AAChB,SAAO,QAAQ,KAAK,UAAU;AAChC;AAQO,SAAS,sBAAsB,MAA4B;AAChE,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO,CAAC,GAAG,kBAAkB,YAAY;AAAA,IAC3C,KAAK;AACH,aAAO,CAAC,GAAG,kBAAkB,SAAS;AAAA,IACxC,KAAK;AACH,aAAO,CAAC,GAAG,kBAAkB,WAAW;AAAA,IAC1C,KAAK;AACH,aAAO,CAAC,GAAG,kBAAkB,OAAO;AAAA,IACtC,KAAK;AACH,aAAO,CAAC,GAAG,kBAAkB,WAAW;AAAA,IAC1C,KAAK;AACH,aAAO,CAAC,GAAG,kBAAkB,MAAM;AAAA,IACrC;AACE,aAAO,CAAC;AAAA,EACZ;AACF;AAMO,IAAM,kBAAkB;AAAA,EAC7B,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL;","names":["error","error","isPermitted","hasPermission","getAccessLevel","emitAuditEvent","useContext","useState","useCallback","useMemo","useEffect","jsx","useMemo","useEffect","useState","Fragment","jsx","jsxs","useState","useEffect","error","resolvedScope","useMemo","createContext","useContext","useState","useCallback","useMemo","useEffect","jsx","createContext","useState","useMemo","useCallback","useEffect","useContext","useMemo","useEffect","useState","Fragment","jsx","jsxs","DefaultAccessDenied","DefaultLoading","useState","useEffect","error","useMemo","useMemo","useCallback","useEffect","useState","createContext","useContext","jsx","jsxs","createContext","useState","useMemo","useCallback","useEffect","useContext","createContext","useContext","useState","useCallback","useMemo","useEffect","jsx","useMemo","useEffect","useState","Fragment","jsx","jsxs","DefaultAccessDenied","DefaultLoading","useState","useEffect","error","useMemo","useMemo","useCallback","useEffect","useState","jsx","jsxs","useState","useMemo","useCallback","useEffect"]}
+{"version":3,"sources":["../../src/rbac/secureClient.ts","../../src/rbac/components/PagePermissionProvider.tsx","../../src/rbac/components/PagePermissionGuard.tsx","../../src/rbac/utils/eventContext.ts","../../src/rbac/components/SecureDataProvider.tsx","../../src/rbac/components/PermissionEnforcer.tsx","../../src/rbac/components/RoleBasedRouter.tsx","../../src/rbac/components/NavigationProvider.tsx","../../src/rbac/components/NavigationGuard.tsx","../../src/rbac/components/EnhancedNavigationMenu.tsx","../../src/rbac/adapters.tsx","../../src/rbac/permissions.ts"],"sourcesContent":["/**\n * Secure Supabase Client for RBAC\n * @package @jmruthers/pace-core\n * @module RBAC/SecureClient\n * @since 1.0.0\n * \n * This module provides a secure Supabase client that enforces organisation context\n * and prevents direct database access outside of the RBAC system.\n */\n\nimport { createClient, SupabaseClient } from '@supabase/supabase-js';\nimport { Database } from '../types/database';\nimport { UUID } from './types';\nimport { OrganisationContextRequiredError } from './types';\n\n/**\n * Secure Supabase Client that enforces organisation context\n * \n * This client automatically injects organisation context into all requests\n * and prevents queries that don't have the required context.\n */\nexport class SecureSupabaseClient {\n  private supabase: SupabaseClient<Database>;\n  private supabaseUrl: string;\n  private supabaseKey: string;\n  private organisationId: UUID;\n  private eventId?: string;\n  private appId?: UUID;\n\n  constructor(\n    supabaseUrl: string,\n    supabaseKey: string,\n    organisationId: UUID,\n    eventId?: string,\n    appId?: UUID\n  ) {\n    this.supabaseUrl = supabaseUrl;\n    this.supabaseKey = supabaseKey;\n    this.organisationId = organisationId;\n    this.eventId = eventId;\n    this.appId = appId;\n\n    // Create the base Supabase client\n    this.supabase = createClient<Database>(supabaseUrl, supabaseKey, {\n      global: {\n        headers: {\n          'x-organisation-id': organisationId,\n          'x-event-id': eventId || '',\n          'x-app-id': appId || '',\n        },\n      },\n    });\n\n    // Override the auth methods to inject context\n    this.setupContextInjection();\n  }\n\n  /**\n   * Setup context injection for all database operations\n   */\n  private setupContextInjection() {\n    const originalFrom = this.supabase.from.bind(this.supabase);\n    \n    this.supabase.from = (table: string) => {\n      // Validate context before allowing any database operations\n      this.validateContext();\n      \n      const query = originalFrom(table);\n      \n      // Inject organisation context into all queries\n      return this.injectContext(query);\n    };\n\n    const originalRpc = this.supabase.rpc.bind(this.supabase);\n    \n    this.supabase.rpc = (fn: string, args?: any) => {\n      // Validate context before allowing any RPC calls\n      this.validateContext();\n      \n      // Inject context into RPC calls\n      const contextArgs = {\n        ...args,\n        p_organisation_id: this.organisationId,\n        p_event_id: this.eventId,\n        p_app_id: this.appId,\n      };\n      \n      return originalRpc(fn, contextArgs);\n    };\n  }\n\n  /**\n   * Inject organisation context into a query\n   */\n  private injectContext(query: any) {\n    const originalSelect = query.select.bind(query);\n    const originalInsert = query.insert.bind(query);\n    const originalUpdate = query.update.bind(query);\n    const originalDelete = query.delete.bind(query);\n\n    // Override select to add organisation filter\n    query.select = (columns?: string) => {\n      const result = originalSelect(columns);\n      return this.addOrganisationFilter(result);\n    };\n\n    // Override insert to add organisation context\n    query.insert = (values: any) => {\n      const contextValues = Array.isArray(values) \n        ? values.map(v => ({ ...v, organisation_id: this.organisationId }))\n        : { ...values, organisation_id: this.organisationId };\n      \n      return originalInsert(contextValues);\n    };\n\n    // Override update to add organisation filter\n    query.update = (values: any) => {\n      const result = originalUpdate(values);\n      return this.addOrganisationFilter(result);\n    };\n\n    // Override delete to add organisation filter\n    query.delete = () => {\n      const result = originalDelete();\n      return this.addOrganisationFilter(result);\n    };\n\n    return query;\n  }\n\n  /**\n   * Add organisation filter to a query\n   */\n  private addOrganisationFilter(query: any) {\n    // Add organisation_id filter to all queries\n    return query.eq('organisation_id', this.organisationId);\n  }\n\n  /**\n   * Validate that required context is present\n   */\n  private validateContext() {\n    if (!this.organisationId) {\n      throw new OrganisationContextRequiredError();\n    }\n  }\n\n  /**\n   * Get the current organisation ID\n   */\n  getOrganisationId(): UUID {\n    return this.organisationId;\n  }\n\n  /**\n   * Get the current event ID\n   */\n  getEventId(): string | undefined {\n    return this.eventId;\n  }\n\n  /**\n   * Get the current app ID\n   */\n  getAppId(): UUID | undefined {\n    return this.appId;\n  }\n\n  /**\n   * Create a new client with updated context\n   */\n  withContext(updates: {\n    organisationId?: UUID;\n    eventId?: string;\n    appId?: UUID;\n  }): SecureSupabaseClient {\n    return new SecureSupabaseClient(\n      this.supabaseUrl,\n      this.supabaseKey,\n      updates.organisationId || this.organisationId,\n      updates.eventId !== undefined ? updates.eventId : this.eventId,\n      updates.appId !== undefined ? updates.appId : this.appId\n    );\n  }\n\n  /**\n   * Get the underlying Supabase client (for internal use only)\n   * @internal\n   */\n  getClient(): SupabaseClient<Database> {\n    return this.supabase;\n  }\n}\n\n/**\n * Create a secure Supabase client with organisation context\n * \n * @param supabaseUrl - Supabase project URL\n * @param supabaseKey - Supabase anon key\n * @param organisationId - Required organisation ID\n * @param eventId - Optional event ID\n * @param appId - Optional app ID\n * @returns SecureSupabaseClient instance\n * \n * @example\n * ```typescript\n * const client = createSecureClient(\n *   'https://your-project.supabase.co',\n *   'your-anon-key',\n *   'org-123',\n *   'event-456',\n *   'app-789'\n * );\n * ```\n */\nexport function createSecureClient(\n  supabaseUrl: string,\n  supabaseKey: string,\n  organisationId: UUID,\n  eventId?: string,\n  appId?: UUID\n): SecureSupabaseClient {\n  return new SecureSupabaseClient(supabaseUrl, supabaseKey, organisationId, eventId, appId);\n}\n\n/**\n * Create a secure client from an existing Supabase client\n * \n * @param client - Existing Supabase client\n * @param organisationId - Required organisation ID\n * @param eventId - Optional event ID\n * @param appId - Optional app ID\n * @returns SecureSupabaseClient instance\n */\nexport function fromSupabaseClient(\n  client: SupabaseClient<Database>,\n  organisationId: UUID,\n  eventId?: string,\n  appId?: UUID\n): SecureSupabaseClient {\n  // We need the URL and key to create a new client, but they're not accessible\n  // This function should be used with createSecureClient instead\n  throw new Error('fromSupabaseClient is not supported. Use createSecureClient instead.');\n}\n","/**\n * @file Page Permission Provider Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/PagePermissionProvider\n * @since 2.0.0\n *\n * A context provider that manages page-level permissions across the entire application.\n * This component ensures that all pages are properly protected and provides centralized\n * page permission management.\n *\n * Features:\n * - App-wide page permission management\n * - Strict mode to prevent bypassing\n * - Automatic audit logging\n * - Integration with existing RBAC system\n * - Page permission tracking\n * - Error handling and recovery\n *\n * @example\n * ```tsx\n * // Basic app setup with page permissions\n * <PagePermissionProvider strictMode={true} auditLog={true}>\n *   <App />\n * </PagePermissionProvider>\n * \n * // With custom configuration\n * <PagePermissionProvider\n *   strictMode={true}\n *   auditLog={true}\n *   onPageAccess={(pageName, operation, allowed) => {\n *     console.log(`Page access: ${pageName} ${operation} - ${allowed ? 'allowed' : 'denied'}`);\n *   }}\n * >\n *   <App />\n * </PagePermissionProvider>\n * ```\n *\n * @security\n * - Enforces page-level permissions across the app\n * - Prevents apps from bypassing permission checks\n * - Automatic audit logging for all page access attempts\n * - Integration with existing RBAC system\n * - Page permission tracking and monitoring\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Efficient context updates\n * - Minimal re-renders\n * - Cached permission checks\n *\n * @dependencies\n * - React 18+ - Context and hooks\n * - useUnifiedAuth - Authentication context\n * - RBAC types - Type definitions\n */\n\nimport React, { createContext, useContext, useState, useCallback, useMemo, useEffect } from 'react';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { UUID, Scope, Permission } from '../types';\n\nexport interface PagePermissionContextType {\n  /** Check if user has permission for a page */\n  hasPagePermission: (pageName: string, operation: string, pageId?: string, scope?: Scope) => boolean;\n  \n  /** Get all page permissions for current user */\n  getPagePermissions: () => Record<string, string[]>;\n  \n  /** Check if page permission checking is enabled */\n  isEnabled: boolean;\n  \n  /** Check if strict mode is enabled */\n  isStrictMode: boolean;\n  \n  /** Check if audit logging is enabled */\n  isAuditLogEnabled: boolean;\n  \n  /** Get page access history */\n  getPageAccessHistory: () => PageAccessRecord[];\n  \n  /** Clear page access history */\n  clearPageAccessHistory: () => void;\n}\n\nexport interface PageAccessRecord {\n  pageName: string;\n  operation: string;\n  userId: UUID;\n  scope: Scope;\n  allowed: boolean;\n  timestamp: string;\n  pageId?: string;\n}\n\nexport interface PagePermissionProviderProps {\n  /** Child components */\n  children: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Enable audit logging (default: true) */\n  auditLog?: boolean;\n  \n  /** Callback when page access is attempted */\n  onPageAccess?: (pageName: string, operation: string, allowed: boolean, record: PageAccessRecord) => void;\n  \n  /** Callback when strict mode violation occurs */\n  onStrictModeViolation?: (pageName: string, operation: string, record: PageAccessRecord) => void;\n  \n  /** Maximum number of access records to keep in history */\n  maxHistorySize?: number;\n}\n\nconst PagePermissionContext = createContext<PagePermissionContextType | null>(null);\n\n/**\n * PagePermissionProvider - Manages page-level permissions across the app\n * \n * This provider ensures that all pages are properly protected and provides\n * centralized page permission management with strict enforcement.\n * \n * @param props - Provider props\n * @returns React element with page permission context\n */\nexport function PagePermissionProvider({\n  children,\n  strictMode = true,\n  auditLog = true,\n  onPageAccess,\n  onStrictModeViolation,\n  maxHistorySize = 1000\n}: PagePermissionProviderProps) {\n  const { user, selectedOrganisationId, selectedEventId } = useUnifiedAuth();\n  const [pageAccessHistory, setPageAccessHistory] = useState<PageAccessRecord[]>([]);\n  const [isEnabled, setIsEnabled] = useState(true);\n\n  // Get current scope\n  const currentScope = useMemo((): Scope | null => {\n    if (!selectedOrganisationId) return null;\n    \n    return {\n      organisationId: selectedOrganisationId,\n      eventId: selectedEventId || undefined,\n      appId: undefined\n    };\n  }, [selectedOrganisationId, selectedEventId]);\n\n  // Check if user has permission for a page\n  const hasPagePermission = useCallback((\n    pageName: string, \n    operation: string, \n    pageId?: string, \n    scope?: Scope\n  ): boolean => {\n    if (!isEnabled) return true;\n    if (!user?.id) return false;\n    \n    const effectiveScope = scope || currentScope;\n    if (!effectiveScope) return false;\n    \n    // Use the existing RBAC system to check permissions\n    // This is a synchronous check for the context - actual permission checking\n    // happens in the PagePermissionGuard component using useCan hook\n    const permission = `${operation}:page.${pageName}` as Permission;\n    \n    // Return false by default (secure by default) - let individual PagePermissionGuard\n    // components handle the actual permission checking asynchronously\n    // This context is mainly for tracking and audit purposes\n    return false;\n  }, [isEnabled, user?.id, currentScope]);\n\n  // Get all page permissions for current user\n  const getPagePermissions = useCallback((): Record<string, string[]> => {\n    if (!isEnabled || !user?.id) return {};\n    \n    // For now, return empty object - this will be enhanced with actual permission checking\n    // when we integrate with the existing RBAC system\n    return {};\n  }, [isEnabled, user?.id]);\n\n  // Get page access history\n  const getPageAccessHistory = useCallback((): PageAccessRecord[] => {\n    return [...pageAccessHistory];\n  }, [pageAccessHistory]);\n\n  // Clear page access history\n  const clearPageAccessHistory = useCallback(() => {\n    setPageAccessHistory([]);\n  }, []);\n\n  // Record page access attempt\n  const recordPageAccess = useCallback((\n    pageName: string,\n    operation: string,\n    allowed: boolean,\n    pageId?: string,\n    scope?: Scope\n  ) => {\n    if (!auditLog || !user?.id) return;\n    \n    const record: PageAccessRecord = {\n      pageName,\n      operation,\n      userId: user.id,\n      scope: scope || currentScope || { organisationId: '' },\n      allowed,\n      timestamp: new Date().toISOString(),\n      pageId\n    };\n    \n    setPageAccessHistory(prev => {\n      const newHistory = [record, ...prev];\n      return newHistory.slice(0, maxHistorySize);\n    });\n    \n    if (onPageAccess) {\n      onPageAccess(pageName, operation, allowed, record);\n    }\n    \n    if (strictMode && !allowed && onStrictModeViolation) {\n      onStrictModeViolation(pageName, operation, record);\n    }\n  }, [auditLog, user?.id, currentScope, maxHistorySize, onPageAccess, onStrictModeViolation, strictMode]);\n\n  // Context value\n  const contextValue = useMemo((): PagePermissionContextType => ({\n    hasPagePermission,\n    getPagePermissions,\n    isEnabled,\n    isStrictMode: strictMode,\n    isAuditLogEnabled: auditLog,\n    getPageAccessHistory,\n    clearPageAccessHistory\n  }), [\n    hasPagePermission,\n    getPagePermissions,\n    isEnabled,\n    strictMode,\n    auditLog,\n    getPageAccessHistory,\n    clearPageAccessHistory\n  ]);\n\n  // Log strict mode violations\n  useEffect(() => {\n    if (strictMode && auditLog) {\n      console.log(`[PagePermissionProvider] Strict mode enabled - all page access attempts will be logged and enforced`);\n    }\n  }, [strictMode, auditLog]);\n\n  return (\n    <PagePermissionContext.Provider value={contextValue}>\n      {children}\n    </PagePermissionContext.Provider>\n  );\n}\n\n/**\n * Hook to use page permission context\n * \n * @returns Page permission context\n * @throws Error if used outside of PagePermissionProvider\n */\nexport function usePagePermissions(): PagePermissionContextType {\n  const context = useContext(PagePermissionContext);\n  \n  if (!context) {\n    throw new Error('usePagePermissions must be used within a PagePermissionProvider');\n  }\n  \n  return context;\n}\n\nexport default PagePermissionProvider;\n","/**\n * @file Page Permission Guard Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/PagePermissionGuard\n * @since 2.0.0\n *\n * A component that enforces page-level permissions and prevents apps from bypassing\n * permission checks. This is a critical security component that ensures all pages\n * are properly protected.\n *\n * Features:\n * - Page-level permission enforcement\n * - Strict mode to prevent bypassing\n * - Automatic audit logging\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized access\n * - TypeScript support with strict typing\n *\n * @example\n * ```tsx\n * // Basic page protection\n * <PagePermissionGuard\n *   pageName=\"dashboard\"\n *   operation=\"read\"\n *   fallback={<AccessDeniedPage />}\n * >\n *   <DashboardPage />\n * </PagePermissionGuard>\n * \n * // Strict mode (prevents bypassing)\n * <PagePermissionGuard\n *   pageName=\"admin\"\n *   operation=\"read\"\n *   strictMode={true}\n *   fallback={<AccessDeniedPage />}\n * >\n *   <AdminPage />\n * </PagePermissionGuard>\n * \n * // With custom fallback\n * <PagePermissionGuard\n *   pageName=\"settings\"\n *   operation=\"update\"\n *   fallback={<div>You don't have permission to access settings</div>}\n * >\n *   <SettingsPage />\n * </PagePermissionGuard>\n * ```\n *\n * @security\n * - Enforces page-level permissions\n * - Prevents apps from bypassing permission checks\n * - Automatic audit logging for all page access attempts\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized access\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Cached permission checks\n * - Minimal re-renders\n * - Efficient error handling\n *\n * @dependencies\n * - React 18+ - Component framework\n * - useCan hook - Permission checking\n * - useUnifiedAuth - Authentication context\n * - RBAC types - Type definitions\n */\n\nimport React, { useMemo, useCallback, useEffect, useState } from 'react';\nimport { useCan } from '../hooks';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { UUID, Permission, Scope } from '../types';\nimport { createScopeFromEvent } from '../utils/eventContext';\nimport { getCurrentAppName } from '../../utils/appNameResolver';\n\nexport interface PagePermissionGuardProps {\n  /** Name of the page being protected */\n  pageName: string;\n  \n  /** Operation being performed on the page */\n  operation: 'read' | 'create' | 'update' | 'delete';\n  \n  /** Content to render when user has permission */\n  children: React.ReactNode;\n  \n  /** Content to render when user lacks permission */\n  fallback?: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Force audit logging for this page access (default: true) */\n  auditLog?: boolean;\n  \n  /** Custom page ID for permission checking */\n  pageId?: string;\n  \n  /** Custom scope for permission checking */\n  scope?: Scope;\n  \n  /** Callback when access is denied */\n  onDenied?: (pageName: string, operation: string) => void;\n  \n  /** Loading state content */\n  loading?: React.ReactNode;\n}\n\n/**\n * PagePermissionGuard - Enforces page-level permissions\n * \n * This component ensures that users can only access pages they have permission for.\n * It integrates with the existing RBAC system and provides strict enforcement to\n * prevent apps from bypassing permission checks.\n * \n * @param props - Component props\n * @returns React element with permission enforcement\n */\nexport function PagePermissionGuard({\n  pageName,\n  operation,\n  children,\n  fallback = <DefaultAccessDenied />,\n  strictMode = true,\n  auditLog = true,\n  pageId,\n  scope,\n  onDenied,\n  loading = <DefaultLoading />\n}: PagePermissionGuardProps) {\n  const { user, selectedOrganisationId, selectedEventId, supabase } = useUnifiedAuth();\n  const [hasChecked, setHasChecked] = useState(false);\n  const [checkError, setCheckError] = useState<Error | null>(null);\n  const [resolvedScope, setResolvedScope] = useState<Scope | null>(null);\n\n  // Resolve scope - either use provided scope or resolve from context\n  useEffect(() => {\n    const resolveScope = async () => {\n      if (scope) {\n        setResolvedScope(scope);\n        return;\n      }\n\n      // Get app ID from package.json or environment\n      let appId: string | undefined = undefined;\n      \n      // Try to resolve from database\n      if (supabase) {\n        const appName = getCurrentAppName();\n        if (appName) {\n          try {\n            console.log('[PagePermissionGuard] Resolving app name to ID:', appName);\n            const { data: app, error } = await supabase\n              .from('rbac_apps')\n              .select('id, name, is_active')\n              .eq('name', appName)\n              .eq('is_active', true)\n              .single() as { data: { id: string; name: string; is_active: boolean } | null; error: any };\n            \n            if (error) {\n              console.error('[PagePermissionGuard] Database error resolving app ID:', error);\n              // Check if app exists but is inactive\n              const { data: inactiveApp } = await supabase\n                .from('rbac_apps')\n                .select('id, name, is_active')\n                .eq('name', appName)\n                .single() as { data: { id: string; name: string; is_active: boolean } | null };\n              \n              if (inactiveApp) {\n                console.error(`[PagePermissionGuard] App \"${appName}\" exists but is inactive (is_active: ${inactiveApp.is_active})`);\n              } else {\n                console.error(`[PagePermissionGuard] App \"${appName}\" not found in rbac_apps table`);\n              }\n            } else if (app) {\n              appId = app.id;\n              console.log('[PagePermissionGuard] Successfully resolved app ID:', app.id);\n            } else {\n              console.error('[PagePermissionGuard] No app data returned for:', appName);\n            }\n          } catch (error) {\n            console.error('[PagePermissionGuard] Unexpected error resolving app ID:', error);\n          }\n        } else {\n          console.error('[PagePermissionGuard] No app name found. Make sure to call setRBACAppName() in your app setup.');\n        }\n      }\n\n      // If we have both organisation and event, use them directly\n      if (selectedOrganisationId && selectedEventId) {\n        if (!appId) {\n          // In test environments, allow undefined appId\n          if (process.env.NODE_ENV === 'test') {\n            console.warn('[PagePermissionGuard] App ID not resolved in test environment, proceeding without it');\n          } else {\n            console.error('[PagePermissionGuard] CRITICAL: App ID not resolved. Check console for details.');\n            setCheckError(new Error('App ID not resolved. Check console for database errors.'));\n            setResolvedScope(null); // Ensure we don't proceed with incomplete scope\n            return;\n          }\n        }\n        \n        // Validate that appId is a UUID, not an app name (only in production)\n        if (process.env.NODE_ENV === 'production' && appId) {\n          const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n          if (!uuidRegex.test(appId)) {\n            console.error('[PagePermissionGuard] CRITICAL: App ID is not a valid UUID:', appId);\n            setCheckError(new Error(`Invalid app ID format: ${appId}. Expected UUID.`));\n            setResolvedScope(null); // Ensure we don't proceed with invalid scope\n            return;\n          }\n        }\n        const resolvedScope = {\n          organisationId: selectedOrganisationId,\n          eventId: selectedEventId,\n          appId: appId\n        };\n        console.log('[PagePermissionGuard] Setting resolved scope:', resolvedScope);\n        setResolvedScope(resolvedScope);\n        return;\n      }\n\n      // If we only have organisation, use it\n      if (selectedOrganisationId) {\n        if (!appId) {\n          // In test environments, allow undefined appId\n          if (process.env.NODE_ENV === 'test') {\n            console.warn('[PagePermissionGuard] App ID not resolved in test environment, proceeding without it');\n          } else {\n            console.error('[PagePermissionGuard] CRITICAL: App ID not resolved. Check console for details.');\n            setCheckError(new Error('App ID not resolved. Check console for database errors.'));\n            setResolvedScope(null); // Ensure we don't proceed with incomplete scope\n            return;\n          }\n        }\n        \n        // Validate that appId is a UUID, not an app name (only in production)\n        if (process.env.NODE_ENV === 'production' && appId) {\n          const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n          if (!uuidRegex.test(appId)) {\n            console.error('[PagePermissionGuard] CRITICAL: App ID is not a valid UUID:', appId);\n            setCheckError(new Error(`Invalid app ID format: ${appId}. Expected UUID.`));\n            setResolvedScope(null); // Ensure we don't proceed with invalid scope\n            return;\n          }\n        }\n        const resolvedScope = {\n          organisationId: selectedOrganisationId,\n          eventId: selectedEventId || undefined,\n          appId: appId\n        };\n        console.log('[PagePermissionGuard] Setting resolved scope (org only):', resolvedScope);\n        setResolvedScope(resolvedScope);\n        return;\n      }\n\n      // If we only have event, resolve organisation from event\n      if (selectedEventId && supabase) {\n        try {\n          const eventScope = await createScopeFromEvent(supabase, selectedEventId);\n          if (!eventScope) {\n            setCheckError(new Error('Could not resolve organization from event context'));\n            setResolvedScope(null); // Ensure we don't proceed with incomplete scope\n            return;\n          }\n          // Preserve the resolved app ID\n          setResolvedScope({\n            ...eventScope,\n            appId: appId || eventScope.appId\n          });\n        } catch (error) {\n          setCheckError(error as Error);\n          setResolvedScope(null); // Ensure we don't proceed with incomplete scope\n        }\n        return;\n      }\n\n      // No context available\n      setCheckError(new Error('Either organisation context or event context is required for page permission checking'));\n      setResolvedScope(null); // Ensure we don't proceed with incomplete scope\n    };\n\n    resolveScope();\n  }, [scope, selectedOrganisationId, selectedEventId, supabase]);\n\n  // Determine the page ID for permission checking\n  const effectivePageId = useMemo((): string => {\n    return pageId || pageName;\n  }, [pageId, pageName]);\n\n  // Build the permission string\n  const permission = useMemo((): Permission => {\n    return `${operation}:page.${pageName}` as Permission;\n  }, [operation, pageName]);\n\n  // Check if user has permission - only call useCan when we have a resolved scope\n  // If resolvedScope is null, we're still resolving, so show loading state\n  console.log('[PagePermissionGuard] Calling useCan with scope:', resolvedScope);\n  console.log('[PagePermissionGuard] resolvedScope:', resolvedScope);\n  console.log('[PagePermissionGuard] selectedEventId:', selectedEventId);\n  \n  console.log('[PagePermissionGuard] About to call useCan with:', {\n    userId: user?.id || '',\n    scope: resolvedScope || { organisationId: '', appId: '', eventId: selectedEventId || undefined },\n    permission,\n    pageId: effectivePageId,\n    useCache: true\n  });\n  \n  const { can, isLoading: canIsLoading, error: canError } = useCan(\n    user?.id || '',\n    resolvedScope || { organisationId: '', appId: '', eventId: selectedEventId || undefined },\n    permission,\n    effectivePageId,\n    true // Use cache\n  );\n  \n  console.log('[PagePermissionGuard] useCan returned:', { can, canIsLoading, canError });\n  \n  // Combine loading states - we're loading if either scope is resolving OR permission check is loading\n  const isLoading = !resolvedScope || canIsLoading;\n  const error = checkError || canError;\n  \n  console.log('[PagePermissionGuard] Combined state:', { \n    can, \n    isLoading, \n    canIsLoading,\n    resolvedScopeExists: !!resolvedScope,\n    error: error?.message \n  });\n\n  // Handle permission check completion\n  useEffect(() => {\n    if (!isLoading && !error) {\n      setHasChecked(true);\n      setCheckError(null);\n      \n      if (!can && onDenied) {\n        onDenied(pageName, operation);\n      }\n    } else if (error) {\n      setCheckError(error);\n      setHasChecked(true);\n    }\n  }, [can, isLoading, error, pageName, operation, onDenied]);\n\n  // Log page access attempt for audit\n  useEffect(() => {\n    if (auditLog && hasChecked && !isLoading) {\n      console.log(`[PagePermissionGuard] Page access attempt:`, {\n        pageName,\n        operation,\n        userId: user?.id,\n        scope: resolvedScope,\n        allowed: can,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [auditLog, hasChecked, isLoading, pageName, operation, user?.id, resolvedScope, can]);\n\n  // Handle strict mode violations\n  useEffect(() => {\n    if (strictMode && hasChecked && !isLoading && !can) {\n      console.error(`[PagePermissionGuard] STRICT MODE VIOLATION: User attempted to access protected page without permission`, {\n        pageName,\n        operation,\n        userId: user?.id,\n        scope: resolvedScope,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [strictMode, hasChecked, isLoading, can, pageName, operation, user?.id, resolvedScope]);\n\n  // Show loading state\n  if (isLoading || !resolvedScope || !hasChecked) {\n    return <>{loading}</>;\n  }\n\n  // Show error state\n  if (checkError) {\n    console.error(`[PagePermissionGuard] Permission check failed for page ${pageName}:`, checkError);\n    return <>{fallback}</>;\n  }\n\n  // Show access denied\n  if (!can) {\n    return <>{fallback}</>;\n  }\n\n  // Show protected content\n  return <>{children}</>;\n}\n\n/**\n * Default access denied component\n */\nfunction DefaultAccessDenied() {\n  return (\n    <div className=\"flex flex-col items-center justify-center min-h-[200px] p-8 text-center\">\n      <div className=\"mb-4\">\n        <svg className=\"w-16 h-16 text-acc-500 mx-auto\" fill=\"none\" stroke=\"currentColor\" viewBox=\"0 0 24 24\">\n          <path strokeLinecap=\"round\" strokeLinejoin=\"round\" strokeWidth={2} d=\"M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L3.732 16.5c-.77.833.192 2.5 1.732 2.5z\" />\n        </svg>\n      </div>\n      <h2 className=\"text-xl font-semibold text-sec-900 mb-2\">Access Denied</h2>\n      <p className=\"text-sec-600 mb-4\">You don't have permission to access this page.</p>\n      <button \n        onClick={() => window.history.back()}\n        className=\"px-4 py-2 bg-main-600 text-main-50 rounded-md hover:bg-main-700 transition-colors\"\n      >\n        Go Back\n      </button>\n    </div>\n  );\n}\n\n/**\n * Default loading component\n */\nfunction DefaultLoading() {\n  return (\n    <div className=\"flex items-center justify-center min-h-[200px] p-8\">\n      <div className=\"flex items-center space-x-2\">\n        <div className=\"animate-spin rounded-full h-8 w-8 border-b-2 border-main-600\"></div>\n        <span className=\"text-sec-600\">Checking permissions...</span>\n      </div>\n    </div>\n  );\n}\n\nexport default PagePermissionGuard;\n","/**\n * Event Context Utilities for RBAC\n * @package @jmruthers/pace-core\n * @module RBAC/EventContext\n * @since 1.0.0\n * \n * This module provides utilities for event-based RBAC operations where\n * the organization context is derived from the event context.\n */\n\nimport { SupabaseClient } from '@supabase/supabase-js';\nimport { Database } from '../../types/database';\nimport { UUID, Scope } from '../types';\n\n/**\n * Get organization ID from event ID\n * \n * @param supabase - Supabase client\n * @param eventId - Event ID\n * @returns Promise resolving to organization ID or null\n */\nexport async function getOrganisationFromEvent(\n  supabase: SupabaseClient<Database>,\n  eventId: string\n): Promise<UUID | null> {\n  const { data, error } = await supabase\n    .from('event')\n    .select('organisation_id')\n    .eq('event_id', eventId)\n    .single() as { data: { organisation_id: string } | null; error: any };\n\n  if (error || !data) {\n    return null;\n  }\n\n  return data.organisation_id;\n}\n\n/**\n * Create a complete scope from event context\n * \n * @param supabase - Supabase client\n * @param eventId - Event ID\n * @param appId - Optional app ID\n * @returns Promise resolving to complete scope\n */\nexport async function createScopeFromEvent(\n  supabase: SupabaseClient<Database>,\n  eventId: string,\n  appId?: UUID\n): Promise<Scope | null> {\n  const organisationId = await getOrganisationFromEvent(supabase, eventId);\n  \n  if (!organisationId) {\n    return null;\n  }\n\n  return {\n    organisationId,\n    eventId,\n    appId\n  };\n}\n\n/**\n * Check if a scope is event-based (has eventId but no explicit organisationId)\n * \n * @param scope - Permission scope\n * @returns True if scope is event-based\n */\nexport function isEventBasedScope(scope: Scope): boolean {\n  return !scope.organisationId && !!scope.eventId;\n}\n\n/**\n * Validate that an event-based scope has the required context\n * \n * @param scope - Permission scope\n * @returns True if scope is valid for event-based operations\n */\nexport function isValidEventBasedScope(scope: Scope): boolean {\n  return isEventBasedScope(scope) && !!scope.eventId;\n}\n","/**\n * @file Secure Data Provider Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/SecureDataProvider\n * @since 2.0.0\n *\n * A context provider that prevents apps from accessing Supabase directly and ensures\n * all data access goes through the secure RBAC system. This is a critical security\n * component that enforces data access control.\n *\n * Features:\n * - Prevents direct Supabase client access\n * - Enforces secure data access patterns\n * - Automatic organisation context injection\n * - RLS policy enforcement\n * - Audit logging for all data access\n * - Integration with existing RBAC system\n *\n * @example\n * ```tsx\n * // Basic app setup with secure data access\n * <SecureDataProvider strictMode={true} auditLog={true}>\n *   <App />\n * </SecureDataProvider>\n * \n * // With custom configuration\n * <SecureDataProvider\n *   strictMode={true}\n *   auditLog={true}\n *   onDataAccess={(table, operation, allowed) => {\n *     console.log(`Data access: ${table} ${operation} - ${allowed ? 'allowed' : 'denied'}`);\n *   }}\n * >\n *   <App />\n * </SecureDataProvider>\n * ```\n *\n * @security\n * - Prevents direct Supabase client access\n * - Enforces secure data access patterns\n * - Automatic organisation context injection\n * - RLS policy enforcement\n * - Audit logging for all data access\n * - Integration with existing RBAC system\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Efficient context updates\n * - Minimal re-renders\n * - Cached permission checks\n *\n * @dependencies\n * - React 18+ - Context and hooks\n * - useUnifiedAuth - Authentication context\n * - useSecureDataAccess - Secure data access hook\n * - RBAC types - Type definitions\n */\n\nimport React, { createContext, useContext, useState, useCallback, useMemo, useEffect } from 'react';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { useSecureDataAccess } from '../../hooks/useSecureDataAccess';\nimport { UUID, Scope, Permission } from '../types';\n\nexport interface DataAccessRecord {\n  table: string;\n  operation: string;\n  userId: UUID;\n  scope: Scope;\n  allowed: boolean;\n  timestamp: string;\n  query?: string;\n  filters?: Record<string, any>;\n}\n\nexport interface SecureDataContextType {\n  /** Check if data access is allowed for a table and operation */\n  isDataAccessAllowed: (table: string, operation: string, scope?: Scope) => boolean;\n  \n  /** Get all data access permissions for current user */\n  getDataAccessPermissions: () => Record<string, string[]>;\n  \n  /** Check if secure data access is enabled */\n  isEnabled: boolean;\n  \n  /** Check if strict mode is enabled */\n  isStrictMode: boolean;\n  \n  /** Check if audit logging is enabled */\n  isAuditLogEnabled: boolean;\n  \n  /** Get data access history */\n  getDataAccessHistory: () => DataAccessRecord[];\n  \n  /** Clear data access history */\n  clearDataAccessHistory: () => void;\n  \n  /** Validate data access attempt */\n  validateDataAccess: (table: string, operation: string, scope?: Scope) => boolean;\n}\n\nexport interface SecureDataProviderProps {\n  /** Child components */\n  children: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Enable audit logging (default: true) */\n  auditLog?: boolean;\n  \n  /** Callback when data access is attempted */\n  onDataAccess?: (table: string, operation: string, allowed: boolean, record: DataAccessRecord) => void;\n  \n  /** Callback when strict mode violation occurs */\n  onStrictModeViolation?: (table: string, operation: string, record: DataAccessRecord) => void;\n  \n  /** Maximum number of access records to keep in history */\n  maxHistorySize?: number;\n  \n  /** Enable RLS enforcement (default: true) */\n  enforceRLS?: boolean;\n}\n\nconst SecureDataContext = createContext<SecureDataContextType | null>(null);\n\n/**\n * SecureDataProvider - Prevents direct Supabase access and enforces secure data patterns\n * \n * This provider ensures that all data access goes through the secure RBAC system\n * and prevents apps from bypassing data access controls.\n * \n * @param props - Provider props\n * @returns React element with secure data context\n */\nexport function SecureDataProvider({\n  children,\n  strictMode = true,\n  auditLog = true,\n  onDataAccess,\n  onStrictModeViolation,\n  maxHistorySize = 1000,\n  enforceRLS = true\n}: SecureDataProviderProps) {\n  const { user, selectedOrganisationId, selectedEventId } = useUnifiedAuth();\n  const { validateContext } = useSecureDataAccess();\n  const [dataAccessHistory, setDataAccessHistory] = useState<DataAccessRecord[]>([]);\n  const [isEnabled, setIsEnabled] = useState(true);\n\n  // Get current scope\n  const currentScope = useMemo((): Scope | null => {\n    if (!selectedOrganisationId) return null;\n    \n    return {\n      organisationId: selectedOrganisationId,\n      eventId: selectedEventId || undefined,\n      appId: undefined\n    };\n  }, [selectedOrganisationId, selectedEventId]);\n\n  // Check if data access is allowed for a table and operation\n  const isDataAccessAllowed = useCallback((\n    table: string, \n    operation: string, \n    scope?: Scope\n  ): boolean => {\n    if (!isEnabled) return true;\n    if (!user?.id) return false;\n    \n    const effectiveScope = scope || currentScope;\n    if (!effectiveScope) return false;\n    \n    // Use the existing RBAC system to check data access permissions\n    // This is a synchronous check for the context - actual permission checking\n    // happens in the useSecureDataAccess hook using the RBAC engine\n    const permission = `${operation}:data.${table}` as Permission;\n    \n    // For now, we'll return true and let the useSecureDataAccess hook\n    // handle the actual permission checking asynchronously\n    // This context is mainly for tracking and audit purposes\n    return true;\n  }, [isEnabled, user?.id, currentScope]);\n\n  // Get all data access permissions for current user\n  const getDataAccessPermissions = useCallback((): Record<string, string[]> => {\n    if (!isEnabled || !user?.id) return {};\n    \n    // For now, return empty object - this will be enhanced with actual permission checking\n    // when we integrate with the existing RBAC system\n    return {};\n  }, [isEnabled, user?.id]);\n\n  // Get data access history\n  const getDataAccessHistory = useCallback((): DataAccessRecord[] => {\n    return [...dataAccessHistory];\n  }, [dataAccessHistory]);\n\n  // Clear data access history\n  const clearDataAccessHistory = useCallback(() => {\n    setDataAccessHistory([]);\n  }, []);\n\n  // Validate data access attempt\n  const validateDataAccess = useCallback((\n    table: string,\n    operation: string,\n    scope?: Scope\n  ): boolean => {\n    if (!isEnabled) return true;\n    if (!user?.id) return false;\n    \n    const effectiveScope = scope || currentScope;\n    if (!effectiveScope) return false;\n    \n    // Validate organisation context\n    try {\n      validateContext();\n    } catch (error) {\n      console.error(`[SecureDataProvider] Organisation context validation failed:`, error);\n      return false;\n    }\n    \n    return isDataAccessAllowed(table, operation, effectiveScope);\n  }, [isEnabled, user?.id, currentScope, validateContext, isDataAccessAllowed]);\n\n  // Record data access attempt\n  const recordDataAccess = useCallback((\n    table: string,\n    operation: string,\n    allowed: boolean,\n    query?: string,\n    filters?: Record<string, any>,\n    scope?: Scope\n  ) => {\n    if (!auditLog || !user?.id) return;\n    \n    const record: DataAccessRecord = {\n      table,\n      operation,\n      userId: user.id,\n      scope: scope || currentScope || { organisationId: '' },\n      allowed,\n      timestamp: new Date().toISOString(),\n      query,\n      filters\n    };\n    \n    setDataAccessHistory(prev => {\n      const newHistory = [record, ...prev];\n      return newHistory.slice(0, maxHistorySize);\n    });\n    \n    if (onDataAccess) {\n      onDataAccess(table, operation, allowed, record);\n    }\n    \n    if (strictMode && !allowed && onStrictModeViolation) {\n      onStrictModeViolation(table, operation, record);\n    }\n  }, [auditLog, user?.id, currentScope, maxHistorySize, onDataAccess, onStrictModeViolation, strictMode]);\n\n  // Context value\n  const contextValue = useMemo((): SecureDataContextType => ({\n    isDataAccessAllowed,\n    getDataAccessPermissions,\n    isEnabled,\n    isStrictMode: strictMode,\n    isAuditLogEnabled: auditLog,\n    getDataAccessHistory,\n    clearDataAccessHistory,\n    validateDataAccess\n  }), [\n    isDataAccessAllowed,\n    getDataAccessPermissions,\n    isEnabled,\n    strictMode,\n    auditLog,\n    getDataAccessHistory,\n    clearDataAccessHistory,\n    validateDataAccess\n  ]);\n\n  // Log strict mode violations\n  useEffect(() => {\n    if (strictMode && auditLog) {\n      console.log(`[SecureDataProvider] Strict mode enabled - all data access attempts will be logged and enforced`);\n    }\n  }, [strictMode, auditLog]);\n\n  // Log RLS enforcement\n  useEffect(() => {\n    if (enforceRLS && auditLog) {\n      console.log(`[SecureDataProvider] RLS enforcement enabled - all queries will include organisation context`);\n    }\n  }, [enforceRLS, auditLog]);\n\n  return (\n    <SecureDataContext.Provider value={contextValue}>\n      {children}\n    </SecureDataContext.Provider>\n  );\n}\n\n/**\n * Hook to use secure data context\n * \n * @returns Secure data context\n * @throws Error if used outside of SecureDataProvider\n */\nexport function useSecureData(): SecureDataContextType {\n  const context = useContext(SecureDataContext);\n  \n  if (!context) {\n    throw new Error('useSecureData must be used within a SecureDataProvider');\n  }\n  \n  return context;\n}\n\nexport default SecureDataProvider;\n","/**\n * @file Permission Enforcer Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/PermissionEnforcer\n * @since 2.0.0\n *\n * A component that enforces permissions and prevents apps from bypassing permission checks.\n * This is a critical security component that provides centralized permission enforcement.\n *\n * Features:\n * - Centralized permission enforcement\n * - Strict mode to prevent bypassing\n * - Automatic audit logging\n * - Integration with existing RBAC system\n * - Multiple permission checking\n * - Clear error messages for unauthorized access\n *\n * @example\n * ```tsx\n * // Basic permission enforcement\n * <PermissionEnforcer\n *   permissions={['read:events', 'manage:events']}\n *   operation=\"event-management\"\n *   fallback={<AccessDeniedPage />}\n * >\n *   <EventManagementPage />\n * </PermissionEnforcer>\n * \n * // Strict mode (prevents bypassing)\n * <PermissionEnforcer\n *   permissions={['admin:system']}\n *   operation=\"system-administration\"\n *   strictMode={true}\n *   fallback={<AccessDeniedPage />}\n * >\n *   <SystemAdminPage />\n * </PermissionEnforcer>\n * \n * // With custom fallback\n * <PermissionEnforcer\n *   permissions={['update:settings']}\n *   operation=\"settings-update\"\n *   fallback={<div>You don't have permission to update settings</div>}\n * >\n *   <SettingsUpdatePage />\n * </PermissionEnforcer>\n * ```\n *\n * @security\n * - Enforces permissions for all operations\n * - Prevents apps from bypassing permission checks\n * - Automatic audit logging for all permission checks\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized access\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Cached permission checks\n * - Minimal re-renders\n * - Efficient error handling\n *\n * @dependencies\n * - React 18+ - Component framework\n * - useCan hook - Permission checking\n * - useUnifiedAuth - Authentication context\n * - RBAC types - Type definitions\n */\n\nimport React, { useMemo, useCallback, useEffect, useState } from 'react';\nimport { useCan } from '../hooks';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { UUID, Permission, Scope } from '../types';\nimport { createScopeFromEvent } from '../utils/eventContext';\n\nexport interface PermissionEnforcerProps {\n  /** Permissions required for access */\n  permissions: Permission[];\n  \n  /** Operation being performed */\n  operation: string;\n  \n  /** Content to render when user has permission */\n  children: React.ReactNode;\n  \n  /** Content to render when user lacks permission */\n  fallback?: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Force audit logging for this operation (default: true) */\n  auditLog?: boolean;\n  \n  /** Custom scope for permission checking */\n  scope?: Scope;\n  \n  /** Callback when access is denied */\n  onDenied?: (permissions: Permission[], operation: string) => void;\n  \n  /** Loading state content */\n  loading?: React.ReactNode;\n  \n  /** Require all permissions (AND) or any permission (OR) */\n  requireAll?: boolean;\n}\n\n/**\n * PermissionEnforcer - Enforces permissions for operations\n * \n * This component ensures that users can only perform operations they have permission for.\n * It integrates with the existing RBAC system and provides strict enforcement to\n * prevent apps from bypassing permission checks.\n * \n * @param props - Component props\n * @returns React element with permission enforcement\n */\nexport function PermissionEnforcer({\n  permissions,\n  operation,\n  children,\n  fallback = <DefaultAccessDenied />,\n  strictMode = true,\n  auditLog = true,\n  scope,\n  onDenied,\n  loading = <DefaultLoading />,\n  requireAll = true\n}: PermissionEnforcerProps) {\n  const { user, selectedOrganisationId, selectedEventId, supabase } = useUnifiedAuth();\n  const [hasChecked, setHasChecked] = useState(false);\n  const [checkError, setCheckError] = useState<Error | null>(null);\n  const [permissionResults, setPermissionResults] = useState<Record<string, boolean>>({});\n  const [resolvedScope, setResolvedScope] = useState<Scope | null>(null);\n\n  // Resolve scope - either use provided scope or resolve from context\n  useEffect(() => {\n    const resolveScope = async () => {\n      if (scope) {\n        setResolvedScope(scope);\n        return;\n      }\n\n      // If we have both organisation and event, use them directly\n      if (selectedOrganisationId && selectedEventId) {\n        setResolvedScope({\n          organisationId: selectedOrganisationId,\n          eventId: selectedEventId,\n          appId: undefined\n        });\n        return;\n      }\n\n      // If we only have organisation, use it\n      if (selectedOrganisationId) {\n        setResolvedScope({\n          organisationId: selectedOrganisationId,\n          eventId: selectedEventId || undefined,\n          appId: undefined\n        });\n        return;\n      }\n\n      // If we only have event, resolve organisation from event\n      if (selectedEventId && supabase) {\n        try {\n          const eventScope = await createScopeFromEvent(supabase, selectedEventId);\n          if (!eventScope) {\n            setCheckError(new Error('Could not resolve organization from event context'));\n            return;\n          }\n          setResolvedScope(eventScope);\n        } catch (error) {\n          setCheckError(error as Error);\n        }\n        return;\n      }\n\n      // No context available\n      setCheckError(new Error('Either organisation context or event context is required for permission checking'));\n    };\n\n    resolveScope();\n  }, [scope, selectedOrganisationId, selectedEventId, supabase]);\n\n  // Check permissions using the first permission as a representative\n  // For multiple permissions, we'll check them sequentially\n  const representativePermission = permissions[0];\n  const { can, isLoading, error } = useCan(\n    user?.id || '',\n    resolvedScope || { eventId: selectedEventId || undefined },\n    representativePermission,\n    undefined,\n    true // Use cache\n  );\n\n  // Determine if user has required permissions\n  const hasRequiredPermissions = useMemo((): boolean => {\n    if (permissions.length === 0) return true;\n    \n    // For now, use the representative permission result\n    // In a future enhancement, we could check all permissions\n    // but this would require multiple useCan hooks or a custom hook\n    return can;\n  }, [permissions, can]);\n\n  // Handle permission check completion\n  useEffect(() => {\n    if (!isLoading && !error) {\n      setHasChecked(true);\n      setCheckError(null);\n      \n      if (!hasRequiredPermissions && onDenied) {\n        onDenied(permissions, operation);\n      }\n    } else if (error) {\n      setCheckError(error);\n      setHasChecked(true);\n    }\n  }, [hasRequiredPermissions, isLoading, error, permissions, operation, onDenied]);\n\n  // Log permission check attempt for audit\n  useEffect(() => {\n    if (auditLog && hasChecked && !isLoading) {\n      console.log(`[PermissionEnforcer] Permission check attempt:`, {\n        permissions,\n        operation,\n        userId: user?.id,\n        scope: resolvedScope,\n        allowed: hasRequiredPermissions,\n        requireAll,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [auditLog, hasChecked, isLoading, permissions, operation, user?.id, resolvedScope, hasRequiredPermissions, requireAll]);\n\n  // Handle strict mode violations\n  useEffect(() => {\n    if (strictMode && hasChecked && !isLoading && !hasRequiredPermissions) {\n      console.error(`[PermissionEnforcer] STRICT MODE VIOLATION: User attempted to perform operation without permission`, {\n        permissions,\n        operation,\n        userId: user?.id,\n        scope: resolvedScope,\n        requireAll,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [strictMode, hasChecked, isLoading, hasRequiredPermissions, permissions, operation, user?.id, resolvedScope, requireAll]);\n\n  // Show loading state\n  if (isLoading || !hasChecked) {\n    return <>{loading}</>;\n  }\n\n  // Show error state\n  if (checkError) {\n    console.error(`[PermissionEnforcer] Permission check failed for operation ${operation}:`, checkError);\n    return <>{fallback}</>;\n  }\n\n  // Show access denied\n  if (!hasRequiredPermissions) {\n    return <>{fallback}</>;\n  }\n\n  // Show protected content\n  return <>{children}</>;\n}\n\n/**\n * Default access denied component\n */\nfunction DefaultAccessDenied() {\n  return (\n    <div className=\"flex flex-col items-center justify-center min-h-[200px] p-8 text-center\">\n      <div className=\"mb-4\">\n        <svg className=\"w-16 h-16 text-acc-500 mx-auto\" fill=\"none\" stroke=\"currentColor\" viewBox=\"0 0 24 24\">\n          <path strokeLinecap=\"round\" strokeLinejoin=\"round\" strokeWidth={2} d=\"M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L3.732 16.5c-.77.833.192 2.5 1.732 2.5z\" />\n        </svg>\n      </div>\n      <h2 className=\"text-xl font-semibold text-sec-900 mb-2\">Access Denied</h2>\n      <p className=\"text-sec-600 mb-4\">You don't have permission to perform this operation.</p>\n      <button \n        onClick={() => window.history.back()}\n        className=\"px-4 py-2 bg-main-600 text-main-50 rounded-md hover:bg-main-700 transition-colors\"\n      >\n        Go Back\n      </button>\n    </div>\n  );\n}\n\n/**\n * Default loading component\n */\nfunction DefaultLoading() {\n  return (\n    <div className=\"flex items-center justify-center min-h-[200px] p-8\">\n      <div className=\"flex items-center space-x-2\">\n        <div className=\"animate-spin rounded-full h-8 w-8 border-b-2 border-main-600\"></div>\n        <span className=\"text-sec-600\">Checking permissions...</span>\n      </div>\n    </div>\n  );\n}\n\nexport default PermissionEnforcer;\n","/**\n * @file Role Based Router Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/RoleBasedRouter\n * @since 2.0.0\n *\n * A component that provides centralized routing control and prevents apps from\n * implementing custom routing that bypasses permission checks. This is a critical\n * security component that ensures all routes are properly protected.\n *\n * Features:\n * - Centralized routing control\n * - Role-based route protection\n * - Permission-based route filtering\n * - Strict mode to prevent bypassing\n * - Automatic audit logging\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized routes\n *\n * @example\n * ```tsx\n * // Basic role-based routing\n * <RoleBasedRouter\n *   routes={routeConfig}\n *   fallbackRoute=\"/unauthorized\"\n *   strictMode={true}\n * >\n *   <App />\n * </RoleBasedRouter>\n * \n * // With custom configuration\n * <RoleBasedRouter\n *   routes={routeConfig}\n *   fallbackRoute=\"/unauthorized\"\n *   strictMode={true}\n *   auditLog={true}\n *   onRouteAccess={(route, allowed) => {\n *     console.log(`Route access: ${route} - ${allowed ? 'allowed' : 'denied'}`);\n *   }}\n * >\n *   <App />\n * </RoleBasedRouter>\n * ```\n *\n * @security\n * - Enforces route-level permissions\n * - Prevents apps from bypassing route protection\n * - Automatic audit logging for all route access attempts\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized routes\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Cached permission checks\n * - Minimal re-renders\n * - Efficient route matching\n *\n * @dependencies\n * - React 18+ - Component framework\n * - React Router - Routing functionality\n * - useCan hook - Permission checking\n * - useUnifiedAuth - Authentication context\n * - RBAC types - Type definitions\n */\n\nimport React, { useMemo, useCallback, useEffect, useState, createContext, useContext } from 'react';\nimport { useLocation, useNavigate, Outlet } from 'react-router-dom';\nimport { useCan } from '../hooks';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { UUID, Permission, Scope, AccessLevel } from '../types';\n\nexport interface RouteConfig {\n  /** Route path */\n  path: string;\n  \n  /** React component to render */\n  component: React.ComponentType;\n  \n  /** Permissions required for this route */\n  permissions: Permission[];\n  \n  /** Roles that can access this route */\n  roles?: string[];\n  \n  /** Minimum access level required */\n  accessLevel?: AccessLevel;\n  \n  /** Page ID for permission checking */\n  pageId?: string;\n  \n  /** Enable strict mode for this route */\n  strictMode?: boolean;\n  \n  /** Route metadata */\n  meta?: {\n    title?: string;\n    description?: string;\n    requiresAuth?: boolean;\n    hidden?: boolean;\n  };\n}\n\nexport interface RouteAccessRecord {\n  route: string;\n  permissions: Permission[];\n  userId: UUID;\n  scope: Scope;\n  allowed: boolean;\n  timestamp: string;\n  pageId?: string;\n  roles?: string[];\n  accessLevel?: AccessLevel;\n}\n\nexport interface RoleBasedRouterContextType {\n  /** Get all accessible routes for current user */\n  getAccessibleRoutes: () => RouteConfig[];\n  \n  /** Check if user can access a specific route */\n  canAccessRoute: (path: string) => boolean;\n  \n  /** Get route configuration for a path */\n  getRouteConfig: (path: string) => RouteConfig | null;\n  \n  /** Get route access history */\n  getRouteAccessHistory: () => RouteAccessRecord[];\n  \n  /** Clear route access history */\n  clearRouteAccessHistory: () => void;\n  \n  /** Check if strict mode is enabled */\n  isStrictMode: boolean;\n  \n  /** Check if audit logging is enabled */\n  isAuditLogEnabled: boolean;\n}\n\nexport interface RoleBasedRouterProps {\n  /** Route configuration */\n  routes: RouteConfig[];\n  \n  /** Fallback route for unauthorized access */\n  fallbackRoute?: string;\n  \n  /** Child components */\n  children: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Enable audit logging (default: true) */\n  auditLog?: boolean;\n  \n  /** Callback when route access is attempted */\n  onRouteAccess?: (route: string, allowed: boolean, record: RouteAccessRecord) => void;\n  \n  /** Callback when strict mode violation occurs */\n  onStrictModeViolation?: (route: string, record: RouteAccessRecord) => void;\n  \n  /** Maximum number of access records to keep in history */\n  maxHistorySize?: number;\n  \n  /** Custom unauthorized component */\n  unauthorizedComponent?: React.ComponentType<{ route: string; reason: string }>;\n}\n\nconst RoleBasedRouterContext = createContext<RoleBasedRouterContextType | null>(null);\n\n/**\n * RoleBasedRouter - Centralized routing control with role-based protection\n * \n * This component ensures that all routes are properly protected and provides\n * centralized routing control to prevent apps from bypassing route protection.\n * \n * @param props - Router props\n * @returns React element with role-based routing\n */\nexport function RoleBasedRouter({\n  routes,\n  fallbackRoute = '/unauthorized',\n  children,\n  strictMode = true,\n  auditLog = true,\n  onRouteAccess,\n  onStrictModeViolation,\n  maxHistorySize = 1000,\n  unauthorizedComponent: UnauthorizedComponent = DefaultUnauthorizedComponent\n}: RoleBasedRouterProps) {\n  const { user, selectedOrganisationId, selectedEventId } = useUnifiedAuth();\n  const location = useLocation();\n  const navigate = useNavigate();\n  const [routeAccessHistory, setRouteAccessHistory] = useState<RouteAccessRecord[]>([]);\n  const [currentRoute, setCurrentRoute] = useState<string>('');\n\n  // Get current scope\n  const currentScope = useMemo((): Scope | null => {\n    if (!selectedOrganisationId) return null;\n    \n    return {\n      organisationId: selectedOrganisationId,\n      eventId: selectedEventId || undefined,\n      appId: undefined\n    };\n  }, [selectedOrganisationId, selectedEventId]);\n\n  // Get route configuration for current path\n  const currentRouteConfig = useMemo((): RouteConfig | null => {\n    const currentPath = location.pathname;\n    return routes.find(route => route.path === currentPath) || null;\n  }, [routes, location.pathname]);\n\n  // Check if user can access a specific route\n  const canAccessRoute = useCallback((path: string): boolean => {\n    if (!user?.id || !currentScope) return false;\n    \n    const routeConfig = routes.find(route => route.path === path);\n    if (!routeConfig) return false;\n    \n    // Use the existing RBAC system to check route permissions\n    // This is a synchronous check for the context - actual permission checking\n    // happens in the individual route components using useCan hook\n    // For now, we'll return true and let the individual route components\n    // handle the actual permission checking asynchronously\n    return true;\n  }, [user?.id, currentScope, routes]);\n\n  // Use useCan hook for actual permission checking\n  const { can: canAccessCurrentRoute, isLoading: permissionLoading } = useCan(\n    user?.id || '',\n    currentScope || { organisationId: '', eventId: undefined, appId: undefined },\n    currentRouteConfig?.permissions?.[0] || 'read:page',\n    currentRouteConfig?.pageId\n  );\n\n  // If route has no permissions, deny access (secure by default)\n  const hasPermissions = currentRouteConfig?.permissions && currentRouteConfig.permissions.length > 0;\n  const finalCanAccess = hasPermissions ? canAccessCurrentRoute : false;\n  const finalLoading = hasPermissions ? permissionLoading : false;\n\n  // Get all accessible routes for current user\n  const getAccessibleRoutes = useCallback((): RouteConfig[] => {\n    if (!user?.id || !currentScope) return [];\n    \n    return routes.filter(route => canAccessRoute(route.path));\n  }, [user?.id, currentScope, routes, canAccessRoute]);\n\n  // Get route configuration for a path\n  const getRouteConfig = useCallback((path: string): RouteConfig | null => {\n    return routes.find(route => route.path === path) || null;\n  }, [routes]);\n\n  // Get route access history\n  const getRouteAccessHistory = useCallback((): RouteAccessRecord[] => {\n    return [...routeAccessHistory];\n  }, [routeAccessHistory]);\n\n  // Clear route access history\n  const clearRouteAccessHistory = useCallback(() => {\n    setRouteAccessHistory([]);\n  }, []);\n\n  // Record route access attempt\n  const recordRouteAccess = useCallback((\n    route: string,\n    allowed: boolean,\n    routeConfig: RouteConfig\n  ) => {\n    if (!auditLog || !user?.id || !currentScope) return;\n    \n    const record: RouteAccessRecord = {\n      route,\n      permissions: routeConfig.permissions,\n      userId: user.id,\n      scope: currentScope,\n      allowed,\n      timestamp: new Date().toISOString(),\n      pageId: routeConfig.pageId,\n      roles: routeConfig.roles,\n      accessLevel: routeConfig.accessLevel\n    };\n    \n    setRouteAccessHistory(prev => {\n      const newHistory = [record, ...prev];\n      return newHistory.slice(0, maxHistorySize);\n    });\n    \n    if (onRouteAccess) {\n      onRouteAccess(route, allowed, record);\n    }\n    \n    if (strictMode && !allowed && onStrictModeViolation) {\n      onStrictModeViolation(route, record);\n    }\n  }, [auditLog, user?.id, currentScope, maxHistorySize, onRouteAccess, onStrictModeViolation, strictMode]);\n\n  // Check route access on location change\n  useEffect(() => {\n    const currentPath = location.pathname;\n    setCurrentRoute(currentPath);\n    \n    if (!currentRouteConfig) {\n      // Route not found in configuration\n      if (strictMode) {\n        console.error(`[RoleBasedRouter] STRICT MODE VIOLATION: Route not found in configuration`, {\n          route: currentPath,\n          userId: user?.id,\n          timestamp: new Date().toISOString()\n        });\n        \n        if (onStrictModeViolation) {\n          onStrictModeViolation(currentPath, {\n            route: currentPath,\n            permissions: [],\n            userId: user?.id || '',\n            scope: currentScope || { organisationId: '' },\n            allowed: false,\n            timestamp: new Date().toISOString()\n          });\n        }\n      }\n      return;\n    }\n    \n    // Use the actual permission check result\n    const allowed = finalCanAccess;\n    recordRouteAccess(currentPath, allowed, currentRouteConfig);\n    \n    if (!allowed) {\n      // Redirect to fallback route\n      navigate(fallbackRoute, { replace: true });\n    }\n  }, [location.pathname, currentRouteConfig, canAccessCurrentRoute, recordRouteAccess, strictMode, user?.id, currentScope, onStrictModeViolation, navigate, fallbackRoute]);\n\n  // Context value\n  const contextValue = useMemo((): RoleBasedRouterContextType => ({\n    getAccessibleRoutes,\n    canAccessRoute,\n    getRouteConfig,\n    getRouteAccessHistory,\n    clearRouteAccessHistory,\n    isStrictMode: strictMode,\n    isAuditLogEnabled: auditLog\n  }), [\n    getAccessibleRoutes,\n    canAccessRoute,\n    getRouteConfig,\n    getRouteAccessHistory,\n    clearRouteAccessHistory,\n    strictMode,\n    auditLog\n  ]);\n\n  // Show loading state while checking permissions\n  if (finalLoading) {\n    return (\n      <div className=\"flex items-center justify-center min-h-screen\">\n        <div className=\"text-center\">\n          <div className=\"animate-spin rounded-full h-8 w-8 border-b-2 border-main-600 mx-auto mb-4\"></div>\n          <p className=\"text-sec-600\">Checking permissions...</p>\n        </div>\n      </div>\n    );\n  }\n\n  // Show unauthorized component if user can't access current route\n  if (currentRouteConfig && !finalCanAccess) {\n    return (\n      <UnauthorizedComponent \n        route={currentRoute} \n        reason=\"Insufficient permissions\" \n      />\n    );\n  }\n  return (\n    <RoleBasedRouterContext.Provider value={contextValue}>\n      {children}\n      <Outlet />\n    </RoleBasedRouterContext.Provider>\n  );\n}\n\n/**\n * Hook to use role-based router context\n * \n * @returns Role-based router context\n * @throws Error if used outside of RoleBasedRouter\n */\nexport function useRoleBasedRouter(): RoleBasedRouterContextType {\n  const context = useContext(RoleBasedRouterContext);\n  \n  if (!context) {\n    throw new Error('useRoleBasedRouter must be used within a RoleBasedRouter');\n  }\n  \n  return context;\n}\n\n/**\n * Default unauthorized component\n */\nfunction DefaultUnauthorizedComponent({ route, reason }: { route: string; reason: string }) {\n  return (\n    <div className=\"flex flex-col items-center justify-center min-h-screen p-8 text-center\">\n      <div className=\"mb-4\">\n        <svg className=\"w-16 h-16 text-acc-500 mx-auto\" fill=\"none\" stroke=\"currentColor\" viewBox=\"0 0 24 24\">\n          <path strokeLinecap=\"round\" strokeLinejoin=\"round\" strokeWidth={2} d=\"M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L3.732 16.5c-.77.833.192 2.5 1.732 2.5z\" />\n        </svg>\n      </div>\n      <h2 className=\"text-xl font-semibold text-sec-900 mb-2\">Access Denied</h2>\n      <p className=\"text-sec-600 mb-4\">\n        You don't have permission to access <code className=\"bg-sec-100 px-2 py-1 rounded\">{route}</code>\n      </p>\n      <p className=\"text-sm text-sec-500 mb-4\">Reason: {reason}</p>\n      <button \n        onClick={() => window.history.back()}\n        className=\"px-4 py-2 bg-main-600 text-main-50 rounded-md hover:bg-main-700 transition-colors\"\n      >\n        Go Back\n      </button>\n    </div>\n  );\n}\n\nexport default RoleBasedRouter;\n\n","/**\n * @file Navigation Provider Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/NavigationProvider\n * @since 2.0.0\n *\n * A context provider that manages navigation permissions across the entire application.\n * This component ensures that all navigation items are properly protected and provides\n * centralized navigation permission management.\n *\n * Features:\n * - App-wide navigation permission management\n * - Strict mode to prevent bypassing\n * - Automatic audit logging\n * - Integration with existing RBAC system\n * - Navigation permission tracking\n * - Error handling and recovery\n *\n * @example\n * ```tsx\n * // Basic app setup with navigation permissions\n * <NavigationProvider strictMode={true} auditLog={true}>\n *   <App />\n * </NavigationProvider>\n * \n * // With custom configuration\n * <NavigationProvider\n *   strictMode={true}\n *   auditLog={true}\n *   onNavigationAccess={(item, allowed) => {\n *     console.log(`Navigation access: ${item} - ${allowed ? 'allowed' : 'denied'}`);\n *   }}\n * >\n *   <App />\n * </NavigationProvider>\n * ```\n *\n * @security\n * - Enforces navigation-level permissions across the app\n * - Prevents apps from bypassing navigation permission checks\n * - Automatic audit logging for all navigation access attempts\n * - Integration with existing RBAC system\n * - Navigation permission tracking and monitoring\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Efficient context updates\n * - Minimal re-renders\n * - Cached permission checks\n *\n * @dependencies\n * - React 18+ - Context and hooks\n * - useUnifiedAuth - Authentication context\n * - RBAC types - Type definitions\n */\n\nimport React, { createContext, useContext, useState, useCallback, useMemo, useEffect } from 'react';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { UUID, Scope, Permission } from '../types';\n\nexport interface NavigationItem {\n  /** Unique identifier for the navigation item */\n  id: string;\n  \n  /** Display label for the navigation item */\n  label: string;\n  \n  /** Navigation path/URL */\n  path: string;\n  \n  /** Permissions required for this navigation item */\n  permissions: Permission[];\n  \n  /** Roles that can access this navigation item */\n  roles?: string[];\n  \n  /** Minimum access level required */\n  accessLevel?: 'viewer' | 'participant' | 'planner' | 'admin' | 'super';\n  \n  /** Page ID for permission checking */\n  pageId?: string;\n  \n  /** Enable strict mode for this navigation item */\n  strictMode?: boolean;\n  \n  /** Navigation item metadata */\n  meta?: {\n    icon?: string;\n    description?: string;\n    hidden?: boolean;\n    order?: number;\n  };\n}\n\nexport interface NavigationAccessRecord {\n  navigationItem: string;\n  permissions: Permission[];\n  userId: UUID;\n  scope: Scope;\n  allowed: boolean;\n  timestamp: string;\n  pageId?: string;\n  roles?: string[];\n  accessLevel?: string;\n}\n\nexport interface NavigationContextType {\n  /** Check if user has permission for a navigation item */\n  hasNavigationPermission: (item: NavigationItem) => boolean;\n  \n  /** Get all navigation permissions for current user */\n  getNavigationPermissions: () => Record<string, string[]>;\n  \n  /** Get filtered navigation items based on permissions */\n  getFilteredNavigationItems: (items: NavigationItem[]) => NavigationItem[];\n  \n  /** Check if navigation permission checking is enabled */\n  isEnabled: boolean;\n  \n  /** Check if strict mode is enabled */\n  isStrictMode: boolean;\n  \n  /** Check if audit logging is enabled */\n  isAuditLogEnabled: boolean;\n  \n  /** Get navigation access history */\n  getNavigationAccessHistory: () => NavigationAccessRecord[];\n  \n  /** Clear navigation access history */\n  clearNavigationAccessHistory: () => void;\n}\n\nexport interface NavigationProviderProps {\n  /** Child components */\n  children: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Enable audit logging (default: true) */\n  auditLog?: boolean;\n  \n  /** Callback when navigation access is attempted */\n  onNavigationAccess?: (item: NavigationItem, allowed: boolean, record: NavigationAccessRecord) => void;\n  \n  /** Callback when strict mode violation occurs */\n  onStrictModeViolation?: (item: NavigationItem, record: NavigationAccessRecord) => void;\n  \n  /** Maximum number of access records to keep in history */\n  maxHistorySize?: number;\n}\n\nconst NavigationContext = createContext<NavigationContextType | null>(null);\n\n/**\n * NavigationProvider - Manages navigation-level permissions across the app\n * \n * This provider ensures that all navigation items are properly protected and provides\n * centralized navigation permission management with strict enforcement.\n * \n * @param props - Provider props\n * @returns React element with navigation permission context\n */\nexport function NavigationProvider({\n  children,\n  strictMode = true,\n  auditLog = true,\n  onNavigationAccess,\n  onStrictModeViolation,\n  maxHistorySize = 1000\n}: NavigationProviderProps) {\n  const { user, selectedOrganisationId, selectedEventId } = useUnifiedAuth();\n  const [navigationAccessHistory, setNavigationAccessHistory] = useState<NavigationAccessRecord[]>([]);\n  const [isEnabled, setIsEnabled] = useState(true);\n\n  // Get current scope\n  const currentScope = useMemo((): Scope | null => {\n    if (!selectedOrganisationId) return null;\n    \n    return {\n      organisationId: selectedOrganisationId,\n      eventId: selectedEventId || undefined,\n      appId: undefined\n    };\n  }, [selectedOrganisationId, selectedEventId]);\n\n  // Check if user has permission for a navigation item\n  const hasNavigationPermission = useCallback((\n    item: NavigationItem\n  ): boolean => {\n    if (!isEnabled) return true;\n    if (!user?.id) return false;\n    \n    if (!currentScope) return false;\n    \n    // Use the existing RBAC system to check navigation permissions\n    // This is a synchronous check for the context - actual permission checking\n    // happens in the individual navigation components using useCan hook\n    // For now, we'll return true and let the individual navigation components\n    // handle the actual permission checking asynchronously\n    return true;\n  }, [isEnabled, user?.id, currentScope]);\n\n  // Get all navigation permissions for current user\n  const getNavigationPermissions = useCallback((): Record<string, string[]> => {\n    if (!isEnabled || !user?.id) return {};\n    \n    // For now, return empty object - this will be enhanced with actual permission checking\n    // when we integrate with the existing RBAC system\n    return {};\n  }, [isEnabled, user?.id]);\n\n  // Get filtered navigation items based on permissions\n  const getFilteredNavigationItems = useCallback((items: NavigationItem[]): NavigationItem[] => {\n    if (!isEnabled) return items;\n    \n    return items.filter(item => hasNavigationPermission(item));\n  }, [isEnabled, hasNavigationPermission]);\n\n  // Get navigation access history\n  const getNavigationAccessHistory = useCallback((): NavigationAccessRecord[] => {\n    return [...navigationAccessHistory];\n  }, [navigationAccessHistory]);\n\n  // Clear navigation access history\n  const clearNavigationAccessHistory = useCallback(() => {\n    setNavigationAccessHistory([]);\n  }, []);\n\n  // Record navigation access attempt\n  const recordNavigationAccess = useCallback((\n    item: NavigationItem,\n    allowed: boolean\n  ) => {\n    if (!auditLog || !user?.id || !currentScope) return;\n    \n    const record: NavigationAccessRecord = {\n      navigationItem: item.id,\n      permissions: item.permissions,\n      userId: user.id,\n      scope: currentScope,\n      allowed,\n      timestamp: new Date().toISOString(),\n      pageId: item.pageId,\n      roles: item.roles,\n      accessLevel: item.accessLevel\n    };\n    \n    setNavigationAccessHistory(prev => {\n      const newHistory = [record, ...prev];\n      return newHistory.slice(0, maxHistorySize);\n    });\n    \n    if (onNavigationAccess) {\n      onNavigationAccess(item, allowed, record);\n    }\n    \n    if (strictMode && !allowed && onStrictModeViolation) {\n      onStrictModeViolation(item, record);\n    }\n  }, [auditLog, user?.id, currentScope, maxHistorySize, onNavigationAccess, onStrictModeViolation, strictMode]);\n\n  // Context value\n  const contextValue = useMemo((): NavigationContextType => ({\n    hasNavigationPermission,\n    getNavigationPermissions,\n    getFilteredNavigationItems,\n    isEnabled,\n    isStrictMode: strictMode,\n    isAuditLogEnabled: auditLog,\n    getNavigationAccessHistory,\n    clearNavigationAccessHistory\n  }), [\n    hasNavigationPermission,\n    getNavigationPermissions,\n    getFilteredNavigationItems,\n    isEnabled,\n    strictMode,\n    auditLog,\n    getNavigationAccessHistory,\n    clearNavigationAccessHistory\n  ]);\n\n  // Log strict mode violations\n  useEffect(() => {\n    if (strictMode && auditLog) {\n      console.log(`[NavigationProvider] Strict mode enabled - all navigation access attempts will be logged and enforced`);\n    }\n  }, [strictMode, auditLog]);\n\n  return (\n    <NavigationContext.Provider value={contextValue}>\n      {children}\n    </NavigationContext.Provider>\n  );\n}\n\n/**\n * Hook to use navigation permission context\n * \n * @returns Navigation permission context\n * @throws Error if used outside of NavigationProvider\n */\nexport function useNavigationPermissions(): NavigationContextType {\n  const context = useContext(NavigationContext);\n  \n  if (!context) {\n    throw new Error('useNavigationPermissions must be used within a NavigationProvider');\n  }\n  \n  return context;\n}\n\nexport default NavigationProvider;","/**\n * @file Navigation Guard Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/NavigationGuard\n * @since 2.0.0\n *\n * A component that enforces navigation-level permissions and prevents apps from bypassing\n * navigation permission checks. This is a critical security component that ensures all\n * navigation items are properly protected.\n *\n * Features:\n * - Navigation-level permission enforcement\n * - Strict mode to prevent bypassing\n * - Automatic audit logging\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized navigation\n * - TypeScript support with strict typing\n *\n * @example\n * ```tsx\n * // Basic navigation protection\n * <NavigationGuard\n *   navigationItem={navItem}\n *   fallback={<AccessDeniedNavItem />}\n * >\n *   <NavigationLink />\n * </NavigationGuard>\n * \n * // Strict mode (prevents bypassing)\n * <NavigationGuard\n *   navigationItem={adminNavItem}\n *   strictMode={true}\n *   fallback={<AccessDeniedNavItem />}\n * >\n *   <AdminNavigationLink />\n * </NavigationGuard>\n * \n * // With custom fallback\n * <NavigationGuard\n *   navigationItem={settingsNavItem}\n *   fallback={<div>You don't have permission to access settings</div>}\n * >\n *   <SettingsNavigationLink />\n * </NavigationGuard>\n * ```\n *\n * @security\n * - Enforces navigation-level permissions\n * - Prevents apps from bypassing navigation permission checks\n * - Automatic audit logging for all navigation access attempts\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized navigation\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Cached permission checks\n * - Minimal re-renders\n * - Efficient error handling\n *\n * @dependencies\n * - React 18+ - Component framework\n * - useCan hook - Permission checking\n * - useUnifiedAuth - Authentication context\n * - RBAC types - Type definitions\n */\n\nimport React, { useMemo, useCallback, useEffect, useState } from 'react';\nimport { useCan } from '../hooks';\nimport { useUnifiedAuth } from '../../providers/UnifiedAuthProvider';\nimport { UUID, Permission, Scope } from '../types';\nimport { createScopeFromEvent } from '../utils/eventContext';\nimport { NavigationItem } from './NavigationProvider';\n\nexport interface NavigationGuardProps {\n  /** Navigation item being protected */\n  navigationItem: NavigationItem;\n  \n  /** Content to render when user has permission */\n  children: React.ReactNode;\n  \n  /** Content to render when user lacks permission */\n  fallback?: React.ReactNode;\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Force audit logging for this navigation access (default: true) */\n  auditLog?: boolean;\n  \n  /** Custom scope for permission checking */\n  scope?: Scope;\n  \n  /** Callback when access is denied */\n  onDenied?: (item: NavigationItem) => void;\n  \n  /** Loading state content */\n  loading?: React.ReactNode;\n  \n  /** Require all permissions (AND) or any permission (OR) */\n  requireAll?: boolean;\n}\n\n/**\n * NavigationGuard - Enforces navigation-level permissions\n * \n * This component ensures that users can only access navigation items they have permission for.\n * It integrates with the existing RBAC system and provides strict enforcement to\n * prevent apps from bypassing navigation permission checks.\n * \n * @param props - Component props\n * @returns React element with navigation permission enforcement\n */\nexport function NavigationGuard({\n  navigationItem,\n  children,\n  fallback = <DefaultAccessDenied />,\n  strictMode = true,\n  auditLog = true,\n  scope,\n  onDenied,\n  loading = <DefaultLoading />,\n  requireAll = true\n}: NavigationGuardProps) {\n  const { user, selectedOrganisationId, selectedEventId, supabase } = useUnifiedAuth();\n  const [hasChecked, setHasChecked] = useState(false);\n  const [checkError, setCheckError] = useState<Error | null>(null);\n  const [resolvedScope, setResolvedScope] = useState<Scope | null>(null);\n\n  // Resolve scope - either use provided scope or resolve from context\n  useEffect(() => {\n    const resolveScope = async () => {\n      if (scope) {\n        setResolvedScope(scope);\n        return;\n      }\n\n      // If we have both organisation and event, use them directly\n      if (selectedOrganisationId && selectedEventId) {\n        setResolvedScope({\n          organisationId: selectedOrganisationId,\n          eventId: selectedEventId,\n          appId: undefined\n        });\n        return;\n      }\n\n      // If we only have organisation, use it\n      if (selectedOrganisationId) {\n        setResolvedScope({\n          organisationId: selectedOrganisationId,\n          eventId: selectedEventId || undefined,\n          appId: undefined\n        });\n        return;\n      }\n\n      // If we only have event, resolve organisation from event\n      if (selectedEventId && supabase) {\n        try {\n          const eventScope = await createScopeFromEvent(supabase, selectedEventId);\n          if (!eventScope) {\n            setCheckError(new Error('Could not resolve organization from event context'));\n            return;\n          }\n          setResolvedScope(eventScope);\n        } catch (error) {\n          setCheckError(error as Error);\n        }\n        return;\n      }\n\n      // No context available\n      setCheckError(new Error('Either organisation context or event context is required for navigation permission checking'));\n    };\n\n    resolveScope();\n  }, [scope, selectedOrganisationId, selectedEventId, supabase]);\n\n  // Check permissions using the first permission as a representative\n  // For multiple permissions, we'll check them sequentially\n  const representativePermission = navigationItem.permissions[0];\n  const { can, isLoading, error } = useCan(\n    user?.id || '',\n    resolvedScope || { eventId: selectedEventId || undefined },\n    representativePermission,\n    navigationItem.pageId,\n    true // Use cache\n  );\n\n  // Determine if user has required permissions\n  const hasRequiredPermissions = useMemo((): boolean => {\n    if (navigationItem.permissions.length === 0) return true;\n    \n    // For now, use the representative permission result\n    // In a future enhancement, we could check all permissions\n    // but this would require multiple useCan hooks or a custom hook\n    return can;\n  }, [navigationItem.permissions, can]);\n\n  // Handle permission check completion\n  useEffect(() => {\n    if (!isLoading && !error) {\n      setHasChecked(true);\n      setCheckError(null);\n      \n      if (!hasRequiredPermissions && onDenied) {\n        onDenied(navigationItem);\n      }\n    } else if (error) {\n      setCheckError(error);\n      setHasChecked(true);\n    }\n  }, [hasRequiredPermissions, isLoading, error, navigationItem, onDenied]);\n\n  // Log navigation access attempt for audit\n  useEffect(() => {\n    if (auditLog && hasChecked && !isLoading) {\n      console.log(`[NavigationGuard] Navigation access attempt:`, {\n        navigationItem: navigationItem.id,\n        permissions: navigationItem.permissions,\n        userId: user?.id,\n        scope: resolvedScope,\n        allowed: hasRequiredPermissions,\n        requireAll,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [auditLog, hasChecked, isLoading, navigationItem, user?.id, resolvedScope, hasRequiredPermissions, requireAll]);\n\n  // Handle strict mode violations\n  useEffect(() => {\n    if (strictMode && hasChecked && !isLoading && !hasRequiredPermissions) {\n      console.error(`[NavigationGuard] STRICT MODE VIOLATION: User attempted to access protected navigation item without permission`, {\n        navigationItem: navigationItem.id,\n        permissions: navigationItem.permissions,\n        userId: user?.id,\n        scope: resolvedScope,\n        requireAll,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [strictMode, hasChecked, isLoading, hasRequiredPermissions, navigationItem, user?.id, resolvedScope, requireAll]);\n\n  // Show loading state\n  if (isLoading || !resolvedScope || !hasChecked) {\n    return <>{loading}</>;\n  }\n\n  // Show error state\n  if (checkError) {\n    console.error(`[NavigationGuard] Permission check failed for navigation item ${navigationItem.id}:`, checkError);\n    return <>{fallback}</>;\n  }\n\n  // Show access denied\n  if (!hasRequiredPermissions) {\n    return <>{fallback}</>;\n  }\n\n  // Show protected content\n  return <>{children}</>;\n}\n\n/**\n * Default access denied component\n */\nfunction DefaultAccessDenied() {\n  return (\n    <div className=\"flex items-center justify-center p-2 text-center\">\n      <div className=\"flex items-center space-x-2\">\n        <svg className=\"w-4 h-4 text-acc-500\" fill=\"none\" stroke=\"currentColor\" viewBox=\"0 0 24 24\">\n          <path strokeLinecap=\"round\" strokeLinejoin=\"round\" strokeWidth={2} d=\"M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L3.732 16.5c-.77.833.192 2.5 1.732 2.5z\" />\n        </svg>\n        <span className=\"text-sm text-sec-600\">Access Denied</span>\n      </div>\n    </div>\n  );\n}\n\n/**\n * Default loading component\n */\nfunction DefaultLoading() {\n  return (\n    <div className=\"flex items-center justify-center p-2\">\n      <div className=\"flex items-center space-x-2\">\n        <div className=\"animate-spin rounded-full h-4 w-4 border-b-2 border-main-600\"></div>\n        <span className=\"text-sm text-sec-600\">Checking...</span>\n      </div>\n    </div>\n  );\n}\n\nexport default NavigationGuard;","/**\n * @file Enhanced Navigation Menu Component\n * @package @jmruthers/pace-core\n * @module RBAC/Components/EnhancedNavigationMenu\n * @since 2.0.0\n *\n * An enhanced navigation menu component that integrates with the RBAC system to provide\n * secure navigation with automatic permission filtering and enforcement.\n *\n * Features:\n * - Automatic permission-based filtering\n * - Strict mode enforcement\n * - Audit logging for navigation access\n * - Integration with existing RBAC system\n * - Customizable navigation items\n * - Error handling and recovery\n *\n * @example\n * ```tsx\n * // Basic enhanced navigation menu\n * <EnhancedNavigationMenu\n *   items={navigationItems}\n *   strictMode={true}\n *   auditLog={true}\n * />\n * \n * // With custom configuration\n * <EnhancedNavigationMenu\n *   items={navigationItems}\n *   strictMode={true}\n *   auditLog={true}\n *   onNavigationAccess={(item, allowed) => {\n *     console.log(`Navigation access: ${item.id} - ${allowed ? 'allowed' : 'denied'}`);\n *   }}\n * />\n * ```\n *\n * @security\n * - Enforces navigation-level permissions\n * - Prevents apps from bypassing navigation permission checks\n * - Automatic audit logging for all navigation access attempts\n * - Integration with existing RBAC system\n * - Clear error messages for unauthorized navigation\n *\n * @performance\n * - Optimized with useMemo and useCallback\n * - Cached permission checks\n * - Minimal re-renders\n * - Efficient filtering\n *\n * @dependencies\n * - React 18+ - Component framework\n * - NavigationProvider - Navigation permission context\n * - NavigationGuard - Individual navigation item protection\n * - RBAC types - Type definitions\n */\n\nimport React, { useMemo, useCallback, useEffect, useState } from 'react';\nimport { useNavigationPermissions, NavigationItem } from './NavigationProvider';\nimport NavigationGuard from './NavigationGuard';\n\nexport interface EnhancedNavigationMenuProps {\n  /** Navigation items to display */\n  items: NavigationItem[];\n  \n  /** Enable strict mode to prevent bypassing (default: true) */\n  strictMode?: boolean;\n  \n  /** Enable audit logging (default: true) */\n  auditLog?: boolean;\n  \n  /** Callback when navigation access is attempted */\n  onNavigationAccess?: (item: NavigationItem, allowed: boolean) => void;\n  \n  /** Callback when strict mode violation occurs */\n  onStrictModeViolation?: (item: NavigationItem) => void;\n  \n  /** Custom className for the navigation menu */\n  className?: string;\n  \n  /** Custom className for navigation items */\n  itemClassName?: string;\n  \n  /** Custom className for active navigation items */\n  activeItemClassName?: string;\n  \n  /** Custom className for disabled navigation items */\n  disabledItemClassName?: string;\n  \n  /** Show/hide navigation items that user doesn't have permission for */\n  hideUnauthorizedItems?: boolean;\n  \n  /** Custom render function for navigation items */\n  renderItem?: (item: NavigationItem, isAuthorized: boolean) => React.ReactNode;\n  \n  /** Current active path for highlighting */\n  activePath?: string;\n  \n  /** Navigation item click handler */\n  onItemClick?: (item: NavigationItem) => void;\n}\n\n/**\n * EnhancedNavigationMenu - Secure navigation menu with RBAC integration\n * \n * This component provides a navigation menu that automatically filters items based on\n * user permissions and enforces strict security controls.\n * \n * @param props - Component props\n * @returns React element with enhanced navigation menu\n */\nexport function EnhancedNavigationMenu({\n  items,\n  strictMode = true,\n  auditLog = true,\n  onNavigationAccess,\n  onStrictModeViolation,\n  className = 'flex flex-col space-y-1',\n  itemClassName = 'px-3 py-2 rounded-md text-sm font-medium transition-colors',\n  activeItemClassName = 'bg-main-100 text-main-700',\n  disabledItemClassName = 'text-sec-400 cursor-not-allowed',\n  hideUnauthorizedItems = false,\n  renderItem,\n  activePath,\n  onItemClick\n}: EnhancedNavigationMenuProps) {\n  const { \n    hasNavigationPermission, \n    getFilteredNavigationItems,\n    isEnabled,\n    isStrictMode,\n    isAuditLogEnabled \n  } = useNavigationPermissions();\n  \n  const [navigationHistory, setNavigationHistory] = useState<NavigationItem[]>([]);\n\n  // Get filtered navigation items based on permissions\n  const filteredItems = useMemo((): NavigationItem[] => {\n    if (!isEnabled) return items;\n    \n    return getFilteredNavigationItems(items);\n  }, [isEnabled, items, getFilteredNavigationItems]);\n\n  // Handle navigation item click\n  const handleItemClick = useCallback((item: NavigationItem) => {\n    if (onItemClick) {\n      onItemClick(item);\n    }\n    \n    // Record navigation attempt\n    if (auditLog) {\n      console.log(`[EnhancedNavigationMenu] Navigation item clicked:`, {\n        item: item.id,\n        path: item.path,\n        permissions: item.permissions,\n        timestamp: new Date().toISOString()\n      });\n    }\n    \n    // Add to navigation history\n    setNavigationHistory(prev => {\n      const newHistory = [item, ...prev.filter(i => i.id !== item.id)];\n      return newHistory.slice(0, 10); // Keep last 10 items\n    });\n  }, [onItemClick, auditLog]);\n\n  // Handle navigation access attempt\n  const handleNavigationAccess = useCallback((item: NavigationItem, allowed: boolean) => {\n    if (onNavigationAccess) {\n      onNavigationAccess(item, allowed);\n    }\n    \n    if (auditLog) {\n      console.log(`[EnhancedNavigationMenu] Navigation access attempt:`, {\n        item: item.id,\n        allowed,\n        strictMode,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [onNavigationAccess, auditLog, strictMode]);\n\n  // Handle strict mode violation\n  const handleStrictModeViolation = useCallback((item: NavigationItem) => {\n    if (onStrictModeViolation) {\n      onStrictModeViolation(item);\n    }\n    \n    if (strictMode) {\n      console.error(`[EnhancedNavigationMenu] STRICT MODE VIOLATION: User attempted to access protected navigation item without permission`, {\n        item: item.id,\n        path: item.path,\n        permissions: item.permissions,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [onStrictModeViolation, strictMode]);\n\n  // Default render function for navigation items\n  const defaultRenderItem = useCallback((item: NavigationItem, isAuthorized: boolean) => {\n    const isActive = activePath === item.path;\n    const isDisabled = !isAuthorized;\n    \n    return (\n      <NavigationGuard\n        key={item.id}\n        navigationItem={item}\n        strictMode={strictMode}\n        auditLog={auditLog}\n        onDenied={handleStrictModeViolation}\n        fallback={\n          hideUnauthorizedItems ? null : (\n            <div className={`${itemClassName} ${disabledItemClassName}`}>\n              <div className=\"flex items-center space-x-2\">\n                {item.meta?.icon && (\n                  <span className=\"text-sm\">{item.meta.icon}</span>\n                )}\n                <span>{item.label}</span>\n                <span className=\"text-xs text-sec-400\">(Access Denied)</span>\n              </div>\n            </div>\n          )\n        }\n      >\n        <button\n          onClick={() => handleItemClick(item)}\n          className={`${itemClassName} ${\n            isActive ? activeItemClassName : ''\n          } ${\n            isDisabled ? disabledItemClassName : 'hover:bg-sec-100'\n          }`}\n          disabled={isDisabled}\n        >\n          <div className=\"flex items-center space-x-2\">\n            {item.meta?.icon && (\n              <span className=\"text-sm\">{item.meta.icon}</span>\n            )}\n            <span>{item.label}</span>\n            {item.meta?.description && (\n              <span className=\"text-xs text-sec-500 ml-auto\">\n                {item.meta.description}\n              </span>\n            )}\n          </div>\n        </button>\n      </NavigationGuard>\n    );\n  }, [\n    activePath,\n    itemClassName,\n    activeItemClassName,\n    disabledItemClassName,\n    hideUnauthorizedItems,\n    strictMode,\n    auditLog,\n    handleStrictModeViolation,\n    handleItemClick\n  ]);\n\n  // Log strict mode violations\n  useEffect(() => {\n    if (strictMode && auditLog) {\n      console.log(`[EnhancedNavigationMenu] Strict mode enabled - all navigation access attempts will be logged and enforced`);\n    }\n  }, [strictMode, auditLog]);\n\n  // Log navigation menu initialization\n  useEffect(() => {\n    if (auditLog) {\n      console.log(`[EnhancedNavigationMenu] Navigation menu initialized:`, {\n        totalItems: items.length,\n        filteredItems: filteredItems.length,\n        strictMode,\n        timestamp: new Date().toISOString()\n      });\n    }\n  }, [items.length, filteredItems.length, strictMode, auditLog]);\n\n  return (\n    <nav className={className}>\n      {filteredItems.map(item => {\n        const isAuthorized = hasNavigationPermission(item);\n        \n        if (renderItem) {\n          return renderItem(item, isAuthorized);\n        }\n        \n        return defaultRenderItem(item, isAuthorized);\n      })}\n    </nav>\n  );\n}\n\nexport default EnhancedNavigationMenu;\n","/**\n * RBAC Adapters\n * @package @jmruthers/pace-core\n * @module RBAC/Adapters\n * @since 1.0.0\n * \n * This module provides adapters for different frameworks and server runtimes.\n */\n\nimport React, { ReactNode, useContext } from 'react';\nimport { UUID, Permission } from './types';\nimport { useCan } from './hooks';\nimport { rbacCache, RBACCache } from './cache';\nimport { getRBACLogger } from './config';\n\n// ============================================================================\n// REACT COMPONENTS\n// ============================================================================\n\n/**\n * Permission Guard Component\n * \n * A React component that conditionally renders children based on permissions.\n * Can auto-infer userId from context if not provided.\n * \n * @example\n * ```tsx\n * // With explicit userId and scope\n * <PermissionGuard\n *   userId=\"user-123\"\n *   scope={{ organisationId: 'org-456' }}\n *   permission=\"manage:events\"\n *   pageId=\"page-789\"\n *   fallback={<AccessDenied />}\n * >\n *   <AdminPanel />\n * </PermissionGuard>\n * \n * // With context inference (requires auth context)\n * <PermissionGuard\n *   permission=\"manage:events\"\n *   scope={{ organisationId: 'org-456' }}\n *   fallback={<AccessDenied />}\n * >\n *   <AdminPanel />\n * </PermissionGuard>\n * ```\n */\nexport function PermissionGuard({\n  userId,\n  scope,\n  permission,\n  pageId,\n  children,\n  fallback = null,\n  onDenied,\n  loading = null,\n  // NEW: Phase 1 - Enhanced Security Features\n  strictMode = true,\n  auditLog = true,\n  enforceAudit = true,\n}: {\n  userId?: UUID;\n  scope: { organisationId: UUID; eventId?: string; appId?: UUID };\n  permission: Permission;\n  pageId?: UUID;\n  children: ReactNode;\n  fallback?: ReactNode;\n  onDenied?: () => void;\n  loading?: ReactNode;\n  // NEW: Phase 1 - Enhanced Security Features\n  strictMode?: boolean;\n  auditLog?: boolean;\n  enforceAudit?: boolean;\n}): React.ReactNode {\n  const logger = getRBACLogger();\n  \n  // Always call hooks at the top level\n  const authContext = useContext(React.createContext<any>(null));\n  \n  // Try to get userId from context if not provided\n  let effectiveUserId = userId;\n  if (!effectiveUserId) {\n    try {\n      // Try to get from common auth contexts\n      if (authContext?.user?.id) {\n        effectiveUserId = authContext.user.id;\n      } else {\n        // Try to get from window or global context\n        const globalUser = (window as any).__PACE_USER__;\n        if (globalUser?.id) {\n          effectiveUserId = globalUser.id;\n        }\n      }\n    } catch (error) {\n      logger.debug('Could not infer userId from context:', error);\n    }\n  }\n\n  // Always call useCan hook, but handle the case where userId might be undefined\n  const { can, isLoading, error } = useCan(effectiveUserId || '', scope, permission, pageId);\n\n  // If still no userId, show helpful error\n  if (!effectiveUserId) {\n    logger.error('PermissionGuard: No userId provided and could not infer from context');\n    return (\n      <div className=\"rbac-error\" role=\"alert\">\n        <p>Permission check failed: User context not available</p>\n        <details>\n          <summary>Debug info</summary>\n          <p>Make sure to either:</p>\n          <ul>\n            <li>Pass userId prop explicitly</li>\n            <li>Wrap your app with an auth provider</li>\n            <li>Set window.__PACE_USER__ with user data</li>\n          </ul>\n        </details>\n      </div>\n    );\n  }\n\n  // Handle loading state\n  if (isLoading) {\n    return loading || (\n      <div className=\"rbac-loading\" role=\"status\" aria-live=\"polite\">\n        <span className=\"sr-only\">Checking permissions...</span>\n      </div>\n    );\n  }\n\n  // Handle error state\n  if (error) {\n    logger.error('Permission check failed:', error);\n    // NEW: Phase 1 - Record failed permission check for audit\n    if (auditLog) {\n      logger.info(`[PermissionGuard] Permission check failed:`, {\n        userId: effectiveUserId,\n        scope,\n        permission,\n        pageId,\n        error: error.message,\n        timestamp: new Date().toISOString()\n      });\n    }\n    return fallback;\n  }\n\n  // Handle permission denied\n  if (!can) {\n    // NEW: Phase 1 - Record denied permission check for audit\n    if (auditLog) {\n      logger.info(`[PermissionGuard] Permission denied:`, {\n        userId: effectiveUserId,\n        scope,\n        permission,\n        pageId,\n        timestamp: new Date().toISOString()\n      });\n    }\n    \n    // NEW: Phase 1 - Handle strict mode violations\n    if (strictMode) {\n      logger.error(`[PermissionGuard] STRICT MODE VIOLATION: User attempted to access protected resource without permission`, {\n        userId: effectiveUserId,\n        scope,\n        permission,\n        pageId,\n        timestamp: new Date().toISOString()\n      });\n    }\n    \n    if (onDenied) {\n      onDenied();\n    }\n    return <>{fallback}</>;\n  }\n\n  // NEW: Phase 1 - Record successful permission check for audit\n  if (auditLog) {\n    logger.info(`[PermissionGuard] Permission granted:`, {\n      userId: effectiveUserId,\n      scope,\n      permission,\n      pageId,\n      timestamp: new Date().toISOString()\n    });\n  }\n\n  // Render children if permission granted\n  return <>{children}</>;\n}\n\n/**\n * Access Level Guard Component\n * \n * A React component that conditionally renders children based on access level.\n * Can auto-infer userId from context if not provided.\n * \n * @example\n * ```tsx\n * // With explicit userId and scope\n * <AccessLevelGuard\n *   userId=\"user-123\"\n *   scope={{ organisationId: 'org-456' }}\n *   minLevel=\"admin\"\n *   fallback={<AccessDenied />}\n * >\n *   <AdminPanel />\n * </AccessLevelGuard>\n * \n * // With context inference (requires auth context)\n * <AccessLevelGuard\n *   minLevel=\"admin\"\n *   scope={{ organisationId: 'org-456' }}\n *   fallback={<AccessDenied />}\n * >\n *   <AdminPanel />\n * </AccessLevelGuard>\n * ```\n */\nexport function AccessLevelGuard({\n  userId,\n  scope,\n  minLevel,\n  children,\n  fallback = null,\n  loading = null,\n}: {\n  userId?: UUID;\n  scope: { organisationId: UUID; eventId?: string; appId?: UUID };\n  minLevel: 'viewer' | 'participant' | 'planner' | 'admin' | 'super';\n  children: ReactNode;\n  fallback?: ReactNode;\n  loading?: ReactNode;\n}): React.ReactNode {\n  const logger = getRBACLogger();\n  \n  // Always call hooks at the top level\n  const authContext = useContext(React.createContext<any>(null));\n  \n  // Try to get userId from context if not provided\n  let effectiveUserId = userId;\n  if (!effectiveUserId) {\n    try {\n      // Try to get from common auth contexts\n      if (authContext?.user?.id) {\n        effectiveUserId = authContext.user.id;\n      } else {\n        // Try to get from window or global context\n        const globalUser = (window as any).__PACE_USER__;\n        if (globalUser?.id) {\n          effectiveUserId = globalUser.id;\n        }\n      }\n    } catch (error) {\n      logger.debug('Could not infer userId from context:', error);\n    }\n  }\n\n  // Always call useAccessLevel hook, but handle the case where userId might be undefined\n  const { accessLevel, isLoading, error } = useAccessLevel(effectiveUserId || '', scope);\n\n  // If still no userId, show helpful error\n  if (!effectiveUserId) {\n    logger.error('AccessLevelGuard: No userId provided and could not infer from context');\n    return (\n      <div className=\"rbac-error\" role=\"alert\">\n        <p>Access level check failed: User context not available</p>\n        <details>\n          <summary>Debug info</summary>\n          <p>Make sure to either:</p>\n          <ul>\n            <li>Pass userId prop explicitly</li>\n            <li>Wrap your app with an auth provider</li>\n            <li>Set window.__PACE_USER__ with user data</li>\n          </ul>\n        </details>\n      </div>\n    );\n  }\n\n  // Handle loading state\n  if (isLoading) {\n    return loading || (\n      <div className=\"rbac-loading\" role=\"status\" aria-live=\"polite\">\n        <span className=\"sr-only\">Checking access level...</span>\n      </div>\n    );\n  }\n\n  // Handle error state\n  if (error) {\n    logger.error('Access level check failed:', error);\n    return fallback;\n  }\n\n  // Check access level\n  const levelHierarchy = ['viewer', 'participant', 'planner', 'admin', 'super'];\n  const userLevelIndex = accessLevel ? levelHierarchy.indexOf(accessLevel) : -1;\n  const requiredLevelIndex = levelHierarchy.indexOf(minLevel);\n\n  if (userLevelIndex < requiredLevelIndex) {\n    return <>{fallback}</>;\n  }\n\n  return <>{children}</>;\n}\n\n// ============================================================================\n// SERVER ADAPTERS\n// ============================================================================\n\n/**\n * Permission Guard for Server Handlers\n * \n * Wraps a server handler with permission checking.\n * \n * @param config - Permission guard configuration\n * @param handler - Handler function to wrap\n * @returns Wrapped handler function\n * \n * @example\n * ```typescript\n * const protectedHandler = withPermissionGuard(\n *   { permission: 'manage:events', pageId: 'page-789' },\n *   async (req, res) => {\n *     // Handler logic here\n *     res.json({ success: true });\n *   }\n * );\n * ```\n */\nexport function withPermissionGuard<T extends any[]>(\n  config: {\n    permission: Permission;\n    pageId?: UUID;\n  },\n  handler: (...args: T) => Promise<any>\n) {\n  return async (...args: T): Promise<any> => {\n    // Extract user context from request\n    const [req] = args;\n    const userId = req.user?.id;\n    const organisationId = req.organisationId;\n    const eventId = req.eventId;\n    const appId = req.appId;\n\n    if (!userId || !organisationId) {\n      throw new Error('User context required for permission check');\n    }\n\n    // Check permission\n    const { isPermitted } = await import('./api');\n    const hasPermission = await isPermitted({\n      userId,\n      scope: { organisationId, eventId, appId },\n      permission: config.permission,\n      pageId: config.pageId,\n    });\n\n    if (!hasPermission) {\n      throw new Error(`Permission denied: ${config.permission}`);\n    }\n\n    // Execute handler\n    return handler(...args);\n  };\n}\n\n/**\n * Access Level Guard for Server Handlers\n * \n * Wraps a server handler with access level checking.\n * \n * @param minLevel - Minimum access level required\n * @param handler - Handler function to wrap\n * @returns Wrapped handler function\n * \n * @example\n * ```typescript\n * const adminHandler = withAccessLevelGuard(\n *   'admin',\n *   async (req, res) => {\n *     // Admin-only logic here\n *     res.json({ success: true });\n *   }\n * );\n * ```\n */\nexport function withAccessLevelGuard<T extends any[]>(\n  minLevel: 'viewer' | 'participant' | 'planner' | 'admin' | 'super',\n  handler: (...args: T) => Promise<any>\n) {\n  return async (...args: T): Promise<any> => {\n    // Extract user context from request\n    const [req] = args;\n    const userId = req.user?.id;\n    const organisationId = req.organisationId;\n    const eventId = req.eventId;\n    const appId = req.appId;\n\n    if (!userId || !organisationId) {\n      throw new Error('User context required for access level check');\n    }\n\n    // Check access level\n    const { getAccessLevel } = await import('./api');\n    const accessLevel = await getAccessLevel({\n      userId,\n      scope: { organisationId, eventId, appId },\n    });\n\n    const levelHierarchy = ['viewer', 'participant', 'planner', 'admin', 'super'];\n    const userLevelIndex = levelHierarchy.indexOf(accessLevel);\n    const requiredLevelIndex = levelHierarchy.indexOf(minLevel);\n\n    if (userLevelIndex < requiredLevelIndex) {\n      throw new Error(`Access level required: ${minLevel}, got: ${accessLevel}`);\n    }\n\n    // Execute handler\n    return handler(...args);\n  };\n}\n\n/**\n * Role Guard for Server Handlers\n * \n * Wraps a server handler with role-based access control.\n * This is the primary middleware for routing protection as specified in the contract.\n * \n * @param config - Role guard configuration\n * @param handler - Handler function to wrap\n * @returns Wrapped handler function\n * \n * @example\n * ```typescript\n * const adminHandler = withRoleGuard(\n *   { \n *     globalRoles: ['super_admin'],\n *     organisationRoles: ['org_admin', 'leader'],\n *     eventAppRoles: ['event_admin', 'planner']\n *   },\n *   async (req, res) => {\n *     // Admin-only logic here\n *     res.json({ success: true });\n *   }\n * );\n * ```\n */\nexport function withRoleGuard<T extends any[]>(\n  config: {\n    globalRoles?: string[];\n    organisationRoles?: string[];\n    eventAppRoles?: string[];\n    requireAll?: boolean;\n  },\n  handler: (...args: T) => Promise<any>\n) {\n  return async (...args: T): Promise<any> => {\n    // Extract user context from request\n    const [req] = args;\n    const userId = req.user?.id;\n    const organisationId = req.organisationId;\n    const eventId = req.eventId;\n    const appId = req.appId;\n\n    if (!userId || !organisationId) {\n      throw new Error('User context required for role check');\n    }\n\n    // Check global roles first (super_admin bypasses all)\n    if (config.globalRoles && config.globalRoles.length > 0) {\n      const { isSuperAdmin } = await import('./api');\n      const isSuper = await isSuperAdmin(userId);\n      \n      if (isSuper) {\n        // Log bypass for super admin - only if we have a valid organisation ID\n        if (organisationId) {\n          const { emitAuditEvent } = await import('./audit');\n          await emitAuditEvent({\n            type: 'permission_check',\n            userId,\n            organisationId,\n            eventId,\n            appId,\n            permission: 'bypass:all',\n            decision: true,\n            source: 'api',\n            bypass: true,\n            duration_ms: 0,\n            metadata: {\n              operation: 'role_guard',\n              reason: 'super_admin_bypass'\n            }\n          });\n        }\n        \n        return handler(...args);\n      }\n    }\n\n    // Check organisation roles\n    if (config.organisationRoles && config.organisationRoles.length > 0) {\n      const { isOrganisationAdmin } = await import('./api');\n      const isOrgAdmin = await isOrganisationAdmin(userId, organisationId);\n      \n      if (!isOrgAdmin && config.requireAll !== false) {\n        throw new Error(`Organisation admin role required`);\n      }\n    }\n\n    // Check event-app roles if event and app context provided\n    if (config.eventAppRoles && config.eventAppRoles.length > 0 && eventId && appId) {\n      const { isEventAdmin } = await import('./api');\n      const isEventAdminUser = await isEventAdmin(userId, { organisationId, eventId, appId });\n      \n      if (!isEventAdminUser && config.requireAll !== false) {\n        throw new Error(`Event admin role required`);\n      }\n    }\n\n    // Log successful role check - only if we have a valid organisation ID\n    if (organisationId) {\n      const { emitAuditEvent } = await import('./audit');\n      await emitAuditEvent({\n        type: 'permission_check',\n        userId,\n        organisationId,\n        eventId,\n        appId,\n        permission: 'role:check',\n        decision: true,\n        source: 'api',\n        bypass: false,\n        duration_ms: 0,\n        metadata: {\n          operation: 'role_guard'\n        }\n      });\n    }\n\n    // Execute handler\n    return handler(...args);\n  };\n}\n\n// ============================================================================\n// NEXT.JS MIDDLEWARE\n// ============================================================================\n\n/**\n * Next.js Middleware for RBAC\n * \n * Middleware that checks permissions before allowing access to pages.\n * \n * @param config - Middleware configuration\n * @returns Next.js middleware function\n * \n * @example\n * ```typescript\n * // middleware.ts\n * import { createRBACMiddleware } from '@jmruthers/pace-core/rbac';\n * \n * export default createRBACMiddleware({\n *   protectedRoutes: [\n *     { path: '/admin', permission: 'manage:admin' },\n *     { path: '/events', permission: 'read:events' },\n *   ],\n *   fallbackUrl: '/access-denied',\n * });\n * ```\n */\nexport function createRBACMiddleware(config: {\n  protectedRoutes: Array<{\n    path: string;\n    permission: Permission;\n    pageId?: UUID;\n  }>;\n  fallbackUrl?: string;\n}) {\n  return async (req: { nextUrl: { pathname: string }; user?: { id: string }; organisationId?: string }, res: { redirect: (url: string) => void }, next: () => void) => {\n    const { pathname } = req.nextUrl;\n    const userId = req.user?.id;\n    const organisationId = req.organisationId;\n\n    if (!userId || !organisationId) {\n      return res.redirect(config.fallbackUrl || '/login');\n    }\n\n    // Find matching protected route\n    const protectedRoute = config.protectedRoutes.find(route => \n      pathname.startsWith(route.path)\n    );\n\n    if (protectedRoute) {\n      try {\n        const { isPermitted } = await import('./api');\n        const hasPermission = await isPermitted({\n          userId,\n          scope: { organisationId },\n          permission: protectedRoute.permission,\n          pageId: protectedRoute.pageId,\n        });\n\n        if (!hasPermission) {\n          return res.redirect(config.fallbackUrl || '/access-denied');\n        }\n    } catch (_error) {\n      // Permission check failed - error logged via RBAC logger\n      return res.redirect(config.fallbackUrl || '/access-denied');\n    }\n    }\n\n    next();\n  };\n}\n\n// ============================================================================\n// EXPRESS MIDDLEWARE\n// ============================================================================\n\n/**\n * Express Middleware for RBAC\n * \n * Middleware that checks permissions for Express routes.\n * \n * @param config - Middleware configuration\n * @returns Express middleware function\n * \n * @example\n * ```typescript\n * import { createRBACExpressMiddleware } from '@jmruthers/pace-core/rbac';\n * \n * app.use(createRBACExpressMiddleware({\n *   permission: 'read:api',\n *   pageId: 'api-page-123',\n * }));\n * ```\n */\nexport function createRBACExpressMiddleware(config: {\n  permission: Permission;\n  pageId?: UUID;\n}) {\n  return async (req: { user?: { id: string }; organisationId?: string; eventId?: string; appId?: string }, res: { status: (code: number) => { json: (data: object) => void } }, next: () => void) => {\n    const userId = req.user?.id;\n    const organisationId = req.organisationId;\n    const eventId = req.eventId;\n    const appId = req.appId;\n\n    if (!userId || !organisationId) {\n      return res.status(401).json({ error: 'User context required' });\n    }\n\n    try {\n      const { isPermitted } = await import('./api');\n      const hasPermission = await isPermitted({\n        userId,\n        scope: { organisationId, eventId, appId },\n        permission: config.permission,\n        pageId: config.pageId,\n      });\n\n      if (!hasPermission) {\n        return res.status(403).json({ error: 'Permission denied' });\n      }\n\n      next();\n    } catch (_error) {\n      // Permission check failed - error logged via RBAC logger\n      return res.status(500).json({ error: 'Permission check failed' });\n    }\n  };\n}\n\n// ============================================================================\n// UTILITY FUNCTIONS\n// ============================================================================\n\n/**\n * Check if a user has a permission (synchronous cache check only)\n * \n * @param userId - User ID\n * @param scope - Permission scope\n * @param permission - Permission to check\n * @param pageId - Optional page ID\n * @returns True if permission is cached and granted\n */\nexport function hasPermissionCached(\n  userId: UUID,\n  scope: { organisationId: UUID; eventId?: string; appId?: UUID },\n  _permission: Permission,\n  _pageId?: UUID\n): boolean {\n  const cacheKey = RBACCache.generatePermissionKey({\n    userId,\n    organisationId: scope.organisationId,\n    eventId: scope.eventId,\n    appId: scope.appId,\n  });\n  \n  return rbacCache.get<boolean>(cacheKey) || false;\n}\n\n/**\n * Check if a user has any of the specified permissions (synchronous cache check only)\n * \n * @param userId - User ID\n * @param scope - Permission scope\n * @param permissions - Array of permissions to check\n * @param pageId - Optional page ID\n * @returns True if any permission is cached and granted\n */\nexport function hasAnyPermissionCached(\n  userId: UUID,\n  scope: { organisationId: UUID; eventId?: string; appId?: UUID },\n  permissions: Permission[],\n  pageId?: UUID\n): boolean {\n  return permissions.some(permission => \n    hasPermissionCached(userId, scope, permission, pageId)\n  );\n}\n\n// Import useAccessLevel for AccessLevelGuard\nimport { useAccessLevel } from './hooks';\n","/**\n * RBAC Permissions Definitions\n * @package @jmruthers/pace-core\n * @module RBAC/Permissions\n * @since 1.0.0\n * \n * This module defines all permissions used in the RBAC system.\n * All permission strings must be imported from this file to ensure consistency.\n */\n\nimport { Permission } from './types';\n\n// ============================================================================\n// GLOBAL PERMISSIONS\n// ============================================================================\n\nexport const GLOBAL_PERMISSIONS = {\n  MANAGE_ALL: 'manage:*' as Permission,\n  READ_ALL: 'read:*' as Permission,\n  CREATE_ALL: 'create:*' as Permission,\n  UPDATE_ALL: 'update:*' as Permission,\n  DELETE_ALL: 'delete:*' as Permission,\n} as const;\n\n// ============================================================================\n// ORGANISATION PERMISSIONS\n// ============================================================================\n\nexport const ORGANISATION_PERMISSIONS = {\n  // Organisation management\n  MANAGE_ORGANISATION: 'manage:organisation' as Permission,\n  READ_ORGANISATION: 'read:organisation' as Permission,\n  UPDATE_ORGANISATION: 'update:organisation' as Permission,\n  \n  // User management\n  MANAGE_USERS: 'manage:users' as Permission,\n  READ_USERS: 'read:users' as Permission,\n  CREATE_USERS: 'create:users' as Permission,\n  UPDATE_USERS: 'update:users' as Permission,\n  DELETE_USERS: 'delete:users' as Permission,\n  \n  // Role management\n  MANAGE_ROLES: 'manage:roles' as Permission,\n  READ_ROLES: 'read:roles' as Permission,\n  CREATE_ROLES: 'create:roles' as Permission,\n  UPDATE_ROLES: 'update:roles' as Permission,\n  DELETE_ROLES: 'delete:roles' as Permission,\n  \n  // Event management\n  MANAGE_EVENTS: 'manage:events' as Permission,\n  READ_EVENTS: 'read:events' as Permission,\n  CREATE_EVENTS: 'create:events' as Permission,\n  UPDATE_EVENTS: 'update:events' as Permission,\n  DELETE_EVENTS: 'delete:events' as Permission,\n  \n  // App management\n  MANAGE_APPS: 'manage:apps' as Permission,\n  READ_APPS: 'read:apps' as Permission,\n  CREATE_APPS: 'create:apps' as Permission,\n  UPDATE_APPS: 'update:apps' as Permission,\n  DELETE_APPS: 'delete:apps' as Permission,\n} as const;\n\n// ============================================================================\n// EVENT-APP PERMISSIONS\n// ============================================================================\n\nexport const EVENT_APP_PERMISSIONS = {\n  // Event management\n  MANAGE_EVENT: 'manage:event' as Permission,\n  READ_EVENT: 'read:event' as Permission,\n  UPDATE_EVENT: 'update:event' as Permission,\n  \n  // App management\n  MANAGE_APP: 'manage:app' as Permission,\n  READ_APP: 'read:app' as Permission,\n  UPDATE_APP: 'update:app' as Permission,\n  \n  // Team management\n  MANAGE_TEAM: 'manage:team' as Permission,\n  READ_TEAM: 'read:team' as Permission,\n  CREATE_TEAM: 'create:team' as Permission,\n  UPDATE_TEAM: 'update:team' as Permission,\n  DELETE_TEAM: 'delete:team' as Permission,\n  \n  // Team members\n  MANAGE_TEAM_MEMBERS: 'manage:team.members' as Permission,\n  READ_TEAM_MEMBERS: 'read:team.members' as Permission,\n  CREATE_TEAM_MEMBERS: 'create:team.members' as Permission,\n  UPDATE_TEAM_MEMBERS: 'update:team.members' as Permission,\n  DELETE_TEAM_MEMBERS: 'delete:team.members' as Permission,\n  \n  // Event content\n  MANAGE_EVENT_CONTENT: 'manage:event.content' as Permission,\n  READ_EVENT_CONTENT: 'read:event.content' as Permission,\n  CREATE_EVENT_CONTENT: 'create:event.content' as Permission,\n  UPDATE_EVENT_CONTENT: 'update:event.content' as Permission,\n  DELETE_EVENT_CONTENT: 'delete:event.content' as Permission,\n  \n  // Event settings\n  MANAGE_EVENT_SETTINGS: 'manage:event.settings' as Permission,\n  READ_EVENT_SETTINGS: 'read:event.settings' as Permission,\n  UPDATE_EVENT_SETTINGS: 'update:event.settings' as Permission,\n} as const;\n\n// ============================================================================\n// PAGE PERMISSIONS\n// ============================================================================\n\nexport const PAGE_PERMISSIONS = {\n  // General page access\n  READ_PAGE: 'read:page' as Permission,\n  MANAGE_PAGE: 'manage:page' as Permission,\n  \n  // Admin pages\n  READ_ADMIN: 'read:admin' as Permission,\n  MANAGE_ADMIN: 'manage:admin' as Permission,\n  \n  // Dashboard pages\n  READ_DASHBOARD: 'read:dashboard' as Permission,\n  MANAGE_DASHBOARD: 'manage:dashboard' as Permission,\n  \n  // Settings pages\n  READ_SETTINGS: 'read:settings' as Permission,\n  MANAGE_SETTINGS: 'manage:settings' as Permission,\n  \n  // Reports pages\n  READ_REPORTS: 'read:reports' as Permission,\n  MANAGE_REPORTS: 'manage:reports' as Permission,\n} as const;\n\n// ============================================================================\n// PERMISSION GROUPS\n// ============================================================================\n\nexport const PERMISSION_GROUPS = {\n  // Global admin permissions\n  GLOBAL_ADMIN: [\n    GLOBAL_PERMISSIONS.MANAGE_ALL,\n    GLOBAL_PERMISSIONS.READ_ALL,\n    GLOBAL_PERMISSIONS.CREATE_ALL,\n    GLOBAL_PERMISSIONS.UPDATE_ALL,\n    GLOBAL_PERMISSIONS.DELETE_ALL,\n  ],\n  \n  // Organisation admin permissions\n  ORG_ADMIN: [\n    ORGANISATION_PERMISSIONS.MANAGE_ORGANISATION,\n    ORGANISATION_PERMISSIONS.READ_ORGANISATION,\n    ORGANISATION_PERMISSIONS.UPDATE_ORGANISATION,\n    ORGANISATION_PERMISSIONS.MANAGE_USERS,\n    ORGANISATION_PERMISSIONS.READ_USERS,\n    ORGANISATION_PERMISSIONS.CREATE_USERS,\n    ORGANISATION_PERMISSIONS.UPDATE_USERS,\n    ORGANISATION_PERMISSIONS.DELETE_USERS,\n    ORGANISATION_PERMISSIONS.MANAGE_ROLES,\n    ORGANISATION_PERMISSIONS.READ_ROLES,\n    ORGANISATION_PERMISSIONS.CREATE_ROLES,\n    ORGANISATION_PERMISSIONS.UPDATE_ROLES,\n    ORGANISATION_PERMISSIONS.DELETE_ROLES,\n    ORGANISATION_PERMISSIONS.MANAGE_EVENTS,\n    ORGANISATION_PERMISSIONS.READ_EVENTS,\n    ORGANISATION_PERMISSIONS.CREATE_EVENTS,\n    ORGANISATION_PERMISSIONS.UPDATE_EVENTS,\n    ORGANISATION_PERMISSIONS.DELETE_EVENTS,\n    ORGANISATION_PERMISSIONS.MANAGE_APPS,\n    ORGANISATION_PERMISSIONS.READ_APPS,\n    ORGANISATION_PERMISSIONS.CREATE_APPS,\n    ORGANISATION_PERMISSIONS.UPDATE_APPS,\n    ORGANISATION_PERMISSIONS.DELETE_APPS,\n  ],\n  \n  // Event admin permissions\n  EVENT_ADMIN: [\n    EVENT_APP_PERMISSIONS.MANAGE_EVENT,\n    EVENT_APP_PERMISSIONS.READ_EVENT,\n    EVENT_APP_PERMISSIONS.UPDATE_EVENT,\n    EVENT_APP_PERMISSIONS.MANAGE_APP,\n    EVENT_APP_PERMISSIONS.READ_APP,\n    EVENT_APP_PERMISSIONS.UPDATE_APP,\n    EVENT_APP_PERMISSIONS.MANAGE_TEAM,\n    EVENT_APP_PERMISSIONS.READ_TEAM,\n    EVENT_APP_PERMISSIONS.CREATE_TEAM,\n    EVENT_APP_PERMISSIONS.UPDATE_TEAM,\n    EVENT_APP_PERMISSIONS.DELETE_TEAM,\n    EVENT_APP_PERMISSIONS.MANAGE_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.READ_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.CREATE_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.UPDATE_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.DELETE_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.MANAGE_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.READ_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.CREATE_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.UPDATE_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.DELETE_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.MANAGE_EVENT_SETTINGS,\n    EVENT_APP_PERMISSIONS.READ_EVENT_SETTINGS,\n    EVENT_APP_PERMISSIONS.UPDATE_EVENT_SETTINGS,\n  ],\n  \n  // Planner permissions\n  PLANNER: [\n    EVENT_APP_PERMISSIONS.READ_EVENT,\n    EVENT_APP_PERMISSIONS.UPDATE_EVENT,\n    EVENT_APP_PERMISSIONS.READ_APP,\n    EVENT_APP_PERMISSIONS.UPDATE_APP,\n    EVENT_APP_PERMISSIONS.READ_TEAM,\n    EVENT_APP_PERMISSIONS.CREATE_TEAM,\n    EVENT_APP_PERMISSIONS.UPDATE_TEAM,\n    EVENT_APP_PERMISSIONS.READ_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.CREATE_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.UPDATE_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.READ_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.CREATE_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.UPDATE_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.READ_EVENT_SETTINGS,\n    EVENT_APP_PERMISSIONS.UPDATE_EVENT_SETTINGS,\n  ],\n  \n  // Participant permissions\n  PARTICIPANT: [\n    EVENT_APP_PERMISSIONS.READ_EVENT,\n    EVENT_APP_PERMISSIONS.READ_APP,\n    EVENT_APP_PERMISSIONS.READ_TEAM,\n    EVENT_APP_PERMISSIONS.READ_TEAM_MEMBERS,\n    EVENT_APP_PERMISSIONS.READ_EVENT_CONTENT,\n    EVENT_APP_PERMISSIONS.READ_EVENT_SETTINGS,\n  ],\n  \n  // Viewer permissions\n  VIEWER: [\n    EVENT_APP_PERMISSIONS.READ_EVENT,\n    EVENT_APP_PERMISSIONS.READ_APP,\n    EVENT_APP_PERMISSIONS.READ_TEAM,\n    EVENT_APP_PERMISSIONS.READ_EVENT_CONTENT,\n  ],\n} as const;\n\n// ============================================================================\n// PERMISSION VALIDATION\n// ============================================================================\n\n/**\n * Validate that a permission string is properly formatted\n * \n * @param permission - Permission string to validate\n * @returns True if valid, false otherwise\n */\nexport function isValidPermission(permission: string): permission is Permission {\n  // Allow wildcard only at the end: manage:* or read:events\n  // But not: read:events* or read:*events\n  // Also reject uppercase operations and resource names\n  const pattern = /^(read|create|update|delete|manage):[a-z0-9._-]+$|^(read|create|update|delete|manage):\\*$/;\n  return pattern.test(permission);\n}\n\n/**\n * Get all permissions for a role\n * \n * @param role - Role name\n * @returns Array of permissions for the role\n */\nexport function getPermissionsForRole(role: string): Permission[] {\n  switch (role) {\n    case 'super_admin':\n      return [...PERMISSION_GROUPS.GLOBAL_ADMIN];\n    case 'org_admin':\n      return [...PERMISSION_GROUPS.ORG_ADMIN];\n    case 'event_admin':\n      return [...PERMISSION_GROUPS.EVENT_ADMIN];\n    case 'planner':\n      return [...PERMISSION_GROUPS.PLANNER];\n    case 'participant':\n      return [...PERMISSION_GROUPS.PARTICIPANT];\n    case 'viewer':\n      return [...PERMISSION_GROUPS.VIEWER];\n    default:\n      return [];\n  }\n}\n\n// ============================================================================\n// EXPORTS\n// ============================================================================\n\nexport const ALL_PERMISSIONS = {\n  ...GLOBAL_PERMISSIONS,\n  ...ORGANISATION_PERMISSIONS,\n  ...EVENT_APP_PERMISSIONS,\n  ...PAGE_PERMISSIONS,\n} as const;\n\nexport type AllPermissions = typeof ALL_PERMISSIONS;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,SAAS,oBAAoC;AAWtC,IAAM,uBAAN,MAAM,sBAAqB;AAAA,EAQhC,YACE,aACA,aACA,gBACA,SACA,OACA;AACA,SAAK,cAAc;AACnB,SAAK,cAAc;AACnB,SAAK,iBAAiB;AACtB,SAAK,UAAU;AACf,SAAK,QAAQ;AAGb,SAAK,WAAW,aAAuB,aAAa,aAAa;AAAA,MAC/D,QAAQ;AAAA,QACN,SAAS;AAAA,UACP,qBAAqB;AAAA,UACrB,cAAc,WAAW;AAAA,UACzB,YAAY,SAAS;AAAA,QACvB;AAAA,MACF;AAAA,IACF,CAAC;AAGD,SAAK,sBAAsB;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKQ,wBAAwB;AAC9B,UAAM,eAAe,KAAK,SAAS,KAAK,KAAK,KAAK,QAAQ;AAE1D,SAAK,SAAS,OAAO,CAAC,UAAkB;AAEtC,WAAK,gBAAgB;AAErB,YAAM,QAAQ,aAAa,KAAK;AAGhC,aAAO,KAAK,cAAc,KAAK;AAAA,IACjC;AAEA,UAAM,cAAc,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ;AAExD,SAAK,SAAS,MAAM,CAAC,IAAY,SAAe;AAE9C,WAAK,gBAAgB;AAGrB,YAAM,cAAc;AAAA,QAClB,GAAG;AAAA,QACH,mBAAmB,KAAK;AAAA,QACxB,YAAY,KAAK;AAAA,QACjB,UAAU,KAAK;AAAA,MACjB;AAEA,aAAO,YAAY,IAAI,WAAW;AAAA,IACpC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,OAAY;AAChC,UAAM,iBAAiB,MAAM,OAAO,KAAK,KAAK;AAC9C,UAAM,iBAAiB,MAAM,OAAO,KAAK,KAAK;AAC9C,UAAM,iBAAiB,MAAM,OAAO,KAAK,KAAK;AAC9C,UAAM,iBAAiB,MAAM,OAAO,KAAK,KAAK;AAG9C,UAAM,SAAS,CAAC,YAAqB;AACnC,YAAM,SAAS,eAAe,OAAO;AACrC,aAAO,KAAK,sBAAsB,MAAM;AAAA,IAC1C;AAGA,UAAM,SAAS,CAAC,WAAgB;AAC9B,YAAM,gBAAgB,MAAM,QAAQ,MAAM,IACtC,OAAO,IAAI,QAAM,EAAE,GAAG,GAAG,iBAAiB,KAAK,eAAe,EAAE,IAChE,EAAE,GAAG,QAAQ,iBAAiB,KAAK,eAAe;AAEtD,aAAO,eAAe,aAAa;AAAA,IACrC;AAGA,UAAM,SAAS,CAAC,WAAgB;AAC9B,YAAM,SAAS,eAAe,MAAM;AACpC,aAAO,KAAK,sBAAsB,MAAM;AAAA,IAC1C;AAGA,UAAM,SAAS,MAAM;AACnB,YAAM,SAAS,eAAe;AAC9B,aAAO,KAAK,sBAAsB,MAAM;AAAA,IAC1C;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,sBAAsB,OAAY;AAExC,WAAO,MAAM,GAAG,mBAAmB,KAAK,cAAc;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB;AACxB,QAAI,CAAC,KAAK,gBAAgB;AACxB,YAAM,IAAI,iCAAiC;AAAA,IAC7C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,oBAA0B;AACxB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,aAAiC;AAC/B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,WAA6B;AAC3B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,SAIa;AACvB,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AAAA,MACL,QAAQ,kBAAkB,KAAK;AAAA,MAC/B,QAAQ,YAAY,SAAY,QAAQ,UAAU,KAAK;AAAA,MACvD,QAAQ,UAAU,SAAY,QAAQ,QAAQ,KAAK;AAAA,IACrD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAsC;AACpC,WAAO,KAAK;AAAA,EACd;AACF;AAuBO,SAAS,mBACd,aACA,aACA,gBACA,SACA,OACsB;AACtB,SAAO,IAAI,qBAAqB,aAAa,aAAa,gBAAgB,SAAS,KAAK;AAC1F;AAWO,SAAS,mBACd,QACA,gBACA,SACA,OACsB;AAGtB,QAAM,IAAI,MAAM,sEAAsE;AACxF;;;AC1LA;AADA,SAAgB,eAAe,YAAY,UAAU,aAAa,SAAS,iBAAiB;AAmMxF;AA1IJ,IAAM,wBAAwB,cAAgD,IAAI;AAW3E,SAAS,uBAAuB;AAAA,EACrC;AAAA,EACA,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,iBAAiB;AACnB,GAAgC;AAC9B,QAAM,EAAE,MAAM,wBAAwB,gBAAgB,IAAI,eAAe;AACzE,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,SAA6B,CAAC,CAAC;AACjF,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAG/C,QAAM,eAAe,QAAQ,MAAoB;AAC/C,QAAI,CAAC,uBAAwB,QAAO;AAEpC,WAAO;AAAA,MACL,gBAAgB;AAAA,MAChB,SAAS,mBAAmB;AAAA,MAC5B,OAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,wBAAwB,eAAe,CAAC;AAG5C,QAAM,oBAAoB,YAAY,CACpC,UACA,WACA,QACA,UACY;AACZ,QAAI,CAAC,UAAW,QAAO;AACvB,QAAI,CAAC,MAAM,GAAI,QAAO;AAEtB,UAAM,iBAAiB,SAAS;AAChC,QAAI,CAAC,eAAgB,QAAO;AAK5B,UAAM,aAAa,GAAG,SAAS,SAAS,QAAQ;AAKhD,WAAO;AAAA,EACT,GAAG,CAAC,WAAW,MAAM,IAAI,YAAY,CAAC;AAGtC,QAAM,qBAAqB,YAAY,MAAgC;AACrE,QAAI,CAAC,aAAa,CAAC,MAAM,GAAI,QAAO,CAAC;AAIrC,WAAO,CAAC;AAAA,EACV,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC;AAGxB,QAAM,uBAAuB,YAAY,MAA0B;AACjE,WAAO,CAAC,GAAG,iBAAiB;AAAA,EAC9B,GAAG,CAAC,iBAAiB,CAAC;AAGtB,QAAM,yBAAyB,YAAY,MAAM;AAC/C,yBAAqB,CAAC,CAAC;AAAA,EACzB,GAAG,CAAC,CAAC;AAGL,QAAM,mBAAmB,YAAY,CACnC,UACA,WACA,SACA,QACA,UACG;AACH,QAAI,CAAC,YAAY,CAAC,MAAM,GAAI;AAE5B,UAAM,SAA2B;AAAA,MAC/B;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,OAAO,SAAS,gBAAgB,EAAE,gBAAgB,GAAG;AAAA,MACrD;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC;AAAA,IACF;AAEA,yBAAqB,UAAQ;AAC3B,YAAM,aAAa,CAAC,QAAQ,GAAG,IAAI;AACnC,aAAO,WAAW,MAAM,GAAG,cAAc;AAAA,IAC3C,CAAC;AAED,QAAI,cAAc;AAChB,mBAAa,UAAU,WAAW,SAAS,MAAM;AAAA,IACnD;AAEA,QAAI,cAAc,CAAC,WAAW,uBAAuB;AACnD,4BAAsB,UAAU,WAAW,MAAM;AAAA,IACnD;AAAA,EACF,GAAG,CAAC,UAAU,MAAM,IAAI,cAAc,gBAAgB,cAAc,uBAAuB,UAAU,CAAC;AAGtG,QAAM,eAAe,QAAQ,OAAkC;AAAA,IAC7D;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,EACF,IAAI;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,YAAU,MAAM;AACd,QAAI,cAAc,UAAU;AAC1B,cAAQ,IAAI,qGAAqG;AAAA,IACnH;AAAA,EACF,GAAG,CAAC,YAAY,QAAQ,CAAC;AAEzB,SACE,oBAAC,sBAAsB,UAAtB,EAA+B,OAAO,cACpC,UACH;AAEJ;AAQO,SAAS,qBAAgD;AAC9D,QAAM,UAAU,WAAW,qBAAqB;AAEhD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AAEA,SAAO;AACT;;;AC1MA,SAAgB,WAAAA,UAAsB,aAAAC,YAAW,YAAAC,iBAAgB;AAEjE;;;AClDA,eAAsB,yBACpB,UACA,SACsB;AACtB,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,SAC3B,KAAK,OAAO,EACZ,OAAO,iBAAiB,EACxB,GAAG,YAAY,OAAO,EACtB,OAAO;AAEV,MAAI,SAAS,CAAC,MAAM;AAClB,WAAO;AAAA,EACT;AAEA,SAAO,KAAK;AACd;AAUA,eAAsB,qBACpB,UACA,SACA,OACuB;AACvB,QAAM,iBAAiB,MAAM,yBAAyB,UAAU,OAAO;AAEvE,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;ADYA;AAgDa,SA4PF,UA5PE,OAAAC,MAmRT,YAnRS;AAJN,SAAS,oBAAoB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,gBAAAA,KAAC,uBAAoB;AAAA,EAChC,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU,gBAAAA,KAAC,kBAAe;AAC5B,GAA6B;AAC3B,QAAM,EAAE,MAAM,wBAAwB,iBAAiB,SAAS,IAAI,eAAe;AACnF,QAAM,CAAC,YAAY,aAAa,IAAIC,UAAS,KAAK;AAClD,QAAM,CAAC,YAAY,aAAa,IAAIA,UAAuB,IAAI;AAC/D,QAAM,CAAC,eAAe,gBAAgB,IAAIA,UAAuB,IAAI;AAGrE,EAAAC,WAAU,MAAM;AACd,UAAM,eAAe,YAAY;AAC/B,UAAI,OAAO;AACT,yBAAiB,KAAK;AACtB;AAAA,MACF;AAGA,UAAI,QAA4B;AAGhC,UAAI,UAAU;AACZ,cAAM,UAAU,kBAAkB;AAClC,YAAI,SAAS;AACX,cAAI;AACF,oBAAQ,IAAI,mDAAmD,OAAO;AACtE,kBAAM,EAAE,MAAM,KAAK,OAAAC,OAAM,IAAI,MAAM,SAChC,KAAK,WAAW,EAChB,OAAO,qBAAqB,EAC5B,GAAG,QAAQ,OAAO,EAClB,GAAG,aAAa,IAAI,EACpB,OAAO;AAEV,gBAAIA,QAAO;AACT,sBAAQ,MAAM,0DAA0DA,MAAK;AAE7E,oBAAM,EAAE,MAAM,YAAY,IAAI,MAAM,SACjC,KAAK,WAAW,EAChB,OAAO,qBAAqB,EAC5B,GAAG,QAAQ,OAAO,EAClB,OAAO;AAEV,kBAAI,aAAa;AACf,wBAAQ,MAAM,8BAA8B,OAAO,wCAAwC,YAAY,SAAS,GAAG;AAAA,cACrH,OAAO;AACL,wBAAQ,MAAM,8BAA8B,OAAO,gCAAgC;AAAA,cACrF;AAAA,YACF,WAAW,KAAK;AACd,sBAAQ,IAAI;AACZ,sBAAQ,IAAI,uDAAuD,IAAI,EAAE;AAAA,YAC3E,OAAO;AACL,sBAAQ,MAAM,mDAAmD,OAAO;AAAA,YAC1E;AAAA,UACF,SAASA,QAAO;AACd,oBAAQ,MAAM,4DAA4DA,MAAK;AAAA,UACjF;AAAA,QACF,OAAO;AACL,kBAAQ,MAAM,gGAAgG;AAAA,QAChH;AAAA,MACF;AAGA,UAAI,0BAA0B,iBAAiB;AAC7C,YAAI,CAAC,OAAO;AAEV,cAAI,OAAiC;AACnC,oBAAQ,KAAK,sFAAsF;AAAA,UACrG,OAAO;AACL,oBAAQ,MAAM,iFAAiF;AAC/F,0BAAc,IAAI,MAAM,yDAAyD,CAAC;AAClF,6BAAiB,IAAI;AACrB;AAAA,UACF;AAAA,QACF;AAGA,YAA6C,OAAO;AAClD,gBAAM,YAAY;AAClB,cAAI,CAAC,UAAU,KAAK,KAAK,GAAG;AAC1B,oBAAQ,MAAM,+DAA+D,KAAK;AAClF,0BAAc,IAAI,MAAM,0BAA0B,KAAK,kBAAkB,CAAC;AAC1E,6BAAiB,IAAI;AACrB;AAAA,UACF;AAAA,QACF;AACA,cAAMC,iBAAgB;AAAA,UACpB,gBAAgB;AAAA,UAChB,SAAS;AAAA,UACT;AAAA,QACF;AACA,gBAAQ,IAAI,iDAAiDA,cAAa;AAC1E,yBAAiBA,cAAa;AAC9B;AAAA,MACF;AAGA,UAAI,wBAAwB;AAC1B,YAAI,CAAC,OAAO;AAEV,cAAI,OAAiC;AACnC,oBAAQ,KAAK,sFAAsF;AAAA,UACrG,OAAO;AACL,oBAAQ,MAAM,iFAAiF;AAC/F,0BAAc,IAAI,MAAM,yDAAyD,CAAC;AAClF,6BAAiB,IAAI;AACrB;AAAA,UACF;AAAA,QACF;AAGA,YAA6C,OAAO;AAClD,gBAAM,YAAY;AAClB,cAAI,CAAC,UAAU,KAAK,KAAK,GAAG;AAC1B,oBAAQ,MAAM,+DAA+D,KAAK;AAClF,0BAAc,IAAI,MAAM,0BAA0B,KAAK,kBAAkB,CAAC;AAC1E,6BAAiB,IAAI;AACrB;AAAA,UACF;AAAA,QACF;AACA,cAAMA,iBAAgB;AAAA,UACpB,gBAAgB;AAAA,UAChB,SAAS,mBAAmB;AAAA,UAC5B;AAAA,QACF;AACA,gBAAQ,IAAI,4DAA4DA,cAAa;AACrF,yBAAiBA,cAAa;AAC9B;AAAA,MACF;AAGA,UAAI,mBAAmB,UAAU;AAC/B,YAAI;AACF,gBAAM,aAAa,MAAM,qBAAqB,UAAU,eAAe;AACvE,cAAI,CAAC,YAAY;AACf,0BAAc,IAAI,MAAM,mDAAmD,CAAC;AAC5E,6BAAiB,IAAI;AACrB;AAAA,UACF;AAEA,2BAAiB;AAAA,YACf,GAAG;AAAA,YACH,OAAO,SAAS,WAAW;AAAA,UAC7B,CAAC;AAAA,QACH,SAASD,QAAO;AACd,wBAAcA,MAAc;AAC5B,2BAAiB,IAAI;AAAA,QACvB;AACA;AAAA,MACF;AAGA,oBAAc,IAAI,MAAM,uFAAuF,CAAC;AAChH,uBAAiB,IAAI;AAAA,IACvB;AAEA,iBAAa;AAAA,EACf,GAAG,CAAC,OAAO,wBAAwB,iBAAiB,QAAQ,CAAC;AAG7D,QAAM,kBAAkBE,SAAQ,MAAc;AAC5C,WAAO,UAAU;AAAA,EACnB,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAGrB,QAAM,aAAaA,SAAQ,MAAkB;AAC3C,WAAO,GAAG,SAAS,SAAS,QAAQ;AAAA,EACtC,GAAG,CAAC,WAAW,QAAQ,CAAC;AAIxB,UAAQ,IAAI,oDAAoD,aAAa;AAC7E,UAAQ,IAAI,wCAAwC,aAAa;AACjE,UAAQ,IAAI,0CAA0C,eAAe;AAErE,UAAQ,IAAI,oDAAoD;AAAA,IAC9D,QAAQ,MAAM,MAAM;AAAA,IACpB,OAAO,iBAAiB,EAAE,gBAAgB,IAAI,OAAO,IAAI,SAAS,mBAAmB,OAAU;AAAA,IAC/F;AAAA,IACA,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,EAAE,KAAK,WAAW,cAAc,OAAO,SAAS,IAAI;AAAA,IACxD,MAAM,MAAM;AAAA,IACZ,iBAAiB,EAAE,gBAAgB,IAAI,OAAO,IAAI,SAAS,mBAAmB,OAAU;AAAA,IACxF;AAAA,IACA;AAAA,IACA;AAAA;AAAA,EACF;AAEA,UAAQ,IAAI,0CAA0C,EAAE,KAAK,cAAc,SAAS,CAAC;AAGrF,QAAM,YAAY,CAAC,iBAAiB;AACpC,QAAM,QAAQ,cAAc;AAE5B,UAAQ,IAAI,yCAAyC;AAAA,IACnD;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,CAAC,CAAC;AAAA,IACvB,OAAO,OAAO;AAAA,EAChB,CAAC;AAGD,EAAAH,WAAU,MAAM;AACd,QAAI,CAAC,aAAa,CAAC,OAAO;AACxB,oBAAc,IAAI;AAClB,oBAAc,IAAI;AAElB,UAAI,CAAC,OAAO,UAAU;AACpB,iBAAS,UAAU,SAAS;AAAA,MAC9B;AAAA,IACF,WAAW,OAAO;AAChB,oBAAc,KAAK;AACnB,oBAAc,IAAI;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,KAAK,WAAW,OAAO,UAAU,WAAW,QAAQ,CAAC;AAGzD,EAAAA,WAAU,MAAM;AACd,QAAI,YAAY,cAAc,CAAC,WAAW;AACxC,cAAQ,IAAI,8CAA8C;AAAA,QACxD;AAAA,QACA;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,OAAO;AAAA,QACP,SAAS;AAAA,QACT,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,UAAU,YAAY,WAAW,UAAU,WAAW,MAAM,IAAI,eAAe,GAAG,CAAC;AAGvF,EAAAA,WAAU,MAAM;AACd,QAAI,cAAc,cAAc,CAAC,aAAa,CAAC,KAAK;AAClD,cAAQ,MAAM,2GAA2G;AAAA,QACvH;AAAA,QACA;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,OAAO;AAAA,QACP,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,YAAY,YAAY,WAAW,KAAK,UAAU,WAAW,MAAM,IAAI,aAAa,CAAC;AAGzF,MAAI,aAAa,CAAC,iBAAiB,CAAC,YAAY;AAC9C,WAAO,gBAAAF,KAAA,YAAG,mBAAQ;AAAA,EACpB;AAGA,MAAI,YAAY;AACd,YAAQ,MAAM,0DAA0D,QAAQ,KAAK,UAAU;AAC/F,WAAO,gBAAAA,KAAA,YAAG,oBAAS;AAAA,EACrB;AAGA,MAAI,CAAC,KAAK;AACR,WAAO,gBAAAA,KAAA,YAAG,oBAAS;AAAA,EACrB;AAGA,SAAO,gBAAAA,KAAA,YAAG,UAAS;AACrB;AAKA,SAAS,sBAAsB;AAC7B,SACE,qBAAC,SAAI,WAAU,2EACb;AAAA,oBAAAA,KAAC,SAAI,WAAU,QACb,0BAAAA,KAAC,SAAI,WAAU,kCAAiC,MAAK,QAAO,QAAO,gBAAe,SAAQ,aACxF,0BAAAA,KAAC,UAAK,eAAc,SAAQ,gBAAe,SAAQ,aAAa,GAAG,GAAE,6IAA4I,GACnN,GACF;AAAA,IACA,gBAAAA,KAAC,QAAG,WAAU,2CAA0C,2BAAa;AAAA,IACrE,gBAAAA,KAAC,OAAE,WAAU,qBAAoB,4DAA8C;AAAA,IAC/E,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,SAAS,MAAM,OAAO,QAAQ,KAAK;AAAA,QACnC,WAAU;AAAA,QACX;AAAA;AAAA,IAED;AAAA,KACF;AAEJ;AAKA,SAAS,iBAAiB;AACxB,SACE,gBAAAA,KAAC,SAAI,WAAU,sDACb,+BAAC,SAAI,WAAU,+BACb;AAAA,oBAAAA,KAAC,SAAI,WAAU,gEAA+D;AAAA,IAC9E,gBAAAA,KAAC,UAAK,WAAU,gBAAe,qCAAuB;AAAA,KACxD,GACF;AAEJ;;;AEhXA;AADA,SAAgB,iBAAAM,gBAAe,cAAAC,aAAY,YAAAC,WAAU,eAAAC,cAAa,WAAAC,UAAS,aAAAC,kBAAiB;AA8OxF,gBAAAC,YAAA;AA7KJ,IAAM,oBAAoBC,eAA4C,IAAI;AAWnE,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,iBAAiB;AAAA,EACjB,aAAa;AACf,GAA4B;AAC1B,QAAM,EAAE,MAAM,wBAAwB,gBAAgB,IAAI,eAAe;AACzE,QAAM,EAAE,gBAAgB,IAAI,oBAAoB;AAChD,QAAM,CAAC,mBAAmB,oBAAoB,IAAIC,UAA6B,CAAC,CAAC;AACjF,QAAM,CAAC,WAAW,YAAY,IAAIA,UAAS,IAAI;AAG/C,QAAM,eAAeC,SAAQ,MAAoB;AAC/C,QAAI,CAAC,uBAAwB,QAAO;AAEpC,WAAO;AAAA,MACL,gBAAgB;AAAA,MAChB,SAAS,mBAAmB;AAAA,MAC5B,OAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,wBAAwB,eAAe,CAAC;AAG5C,QAAM,sBAAsBC,aAAY,CACtC,OACA,WACA,UACY;AACZ,QAAI,CAAC,UAAW,QAAO;AACvB,QAAI,CAAC,MAAM,GAAI,QAAO;AAEtB,UAAM,iBAAiB,SAAS;AAChC,QAAI,CAAC,eAAgB,QAAO;AAK5B,UAAM,aAAa,GAAG,SAAS,SAAS,KAAK;AAK7C,WAAO;AAAA,EACT,GAAG,CAAC,WAAW,MAAM,IAAI,YAAY,CAAC;AAGtC,QAAM,2BAA2BA,aAAY,MAAgC;AAC3E,QAAI,CAAC,aAAa,CAAC,MAAM,GAAI,QAAO,CAAC;AAIrC,WAAO,CAAC;AAAA,EACV,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC;AAGxB,QAAM,uBAAuBA,aAAY,MAA0B;AACjE,WAAO,CAAC,GAAG,iBAAiB;AAAA,EAC9B,GAAG,CAAC,iBAAiB,CAAC;AAGtB,QAAM,yBAAyBA,aAAY,MAAM;AAC/C,yBAAqB,CAAC,CAAC;AAAA,EACzB,GAAG,CAAC,CAAC;AAGL,QAAM,qBAAqBA,aAAY,CACrC,OACA,WACA,UACY;AACZ,QAAI,CAAC,UAAW,QAAO;AACvB,QAAI,CAAC,MAAM,GAAI,QAAO;AAEtB,UAAM,iBAAiB,SAAS;AAChC,QAAI,CAAC,eAAgB,QAAO;AAG5B,QAAI;AACF,sBAAgB;AAAA,IAClB,SAAS,OAAO;AACd,cAAQ,MAAM,gEAAgE,KAAK;AACnF,aAAO;AAAA,IACT;AAEA,WAAO,oBAAoB,OAAO,WAAW,cAAc;AAAA,EAC7D,GAAG,CAAC,WAAW,MAAM,IAAI,cAAc,iBAAiB,mBAAmB,CAAC;AAG5E,QAAM,mBAAmBA,aAAY,CACnC,OACA,WACA,SACA,OACA,SACA,UACG;AACH,QAAI,CAAC,YAAY,CAAC,MAAM,GAAI;AAE5B,UAAM,SAA2B;AAAA,MAC/B;AAAA,MACA;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,OAAO,SAAS,gBAAgB,EAAE,gBAAgB,GAAG;AAAA,MACrD;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC;AAAA,MACA;AAAA,IACF;AAEA,yBAAqB,UAAQ;AAC3B,YAAM,aAAa,CAAC,QAAQ,GAAG,IAAI;AACnC,aAAO,WAAW,MAAM,GAAG,cAAc;AAAA,IAC3C,CAAC;AAED,QAAI,cAAc;AAChB,mBAAa,OAAO,WAAW,SAAS,MAAM;AAAA,IAChD;AAEA,QAAI,cAAc,CAAC,WAAW,uBAAuB;AACnD,4BAAsB,OAAO,WAAW,MAAM;AAAA,IAChD;AAAA,EACF,GAAG,CAAC,UAAU,MAAM,IAAI,cAAc,gBAAgB,cAAc,uBAAuB,UAAU,CAAC;AAGtG,QAAM,eAAeD,SAAQ,OAA8B;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,EAAAE,WAAU,MAAM;AACd,QAAI,cAAc,UAAU;AAC1B,cAAQ,IAAI,iGAAiG;AAAA,IAC/G;AAAA,EACF,GAAG,CAAC,YAAY,QAAQ,CAAC;AAGzB,EAAAA,WAAU,MAAM;AACd,QAAI,cAAc,UAAU;AAC1B,cAAQ,IAAI,8FAA8F;AAAA,IAC5G;AAAA,EACF,GAAG,CAAC,YAAY,QAAQ,CAAC;AAEzB,SACE,gBAAAL,KAAC,kBAAkB,UAAlB,EAA2B,OAAO,cAChC,UACH;AAEJ;AAQO,SAAS,gBAAuC;AACrD,QAAM,UAAUM,YAAW,iBAAiB;AAE5C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,SAAO;AACT;;;ACxPA,SAAgB,WAAAC,UAAsB,aAAAC,YAAW,YAAAC,iBAAgB;AAEjE;AAkDa,SAmIF,YAAAC,WAnIE,OAAAC,MA0JT,QAAAC,aA1JS;AAJN,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,gBAAAD,KAACE,sBAAA,EAAoB;AAAA,EAChC,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,UAAU,gBAAAF,KAACG,iBAAA,EAAe;AAAA,EAC1B,aAAa;AACf,GAA4B;AAC1B,QAAM,EAAE,MAAM,wBAAwB,iBAAiB,SAAS,IAAI,eAAe;AACnF,QAAM,CAAC,YAAY,aAAa,IAAIC,UAAS,KAAK;AAClD,QAAM,CAAC,YAAY,aAAa,IAAIA,UAAuB,IAAI;AAC/D,QAAM,CAAC,mBAAmB,oBAAoB,IAAIA,UAAkC,CAAC,CAAC;AACtF,QAAM,CAAC,eAAe,gBAAgB,IAAIA,UAAuB,IAAI;AAGrE,EAAAC,WAAU,MAAM;AACd,UAAM,eAAe,YAAY;AAC/B,UAAI,OAAO;AACT,yBAAiB,KAAK;AACtB;AAAA,MACF;AAGA,UAAI,0BAA0B,iBAAiB;AAC7C,yBAAiB;AAAA,UACf,gBAAgB;AAAA,UAChB,SAAS;AAAA,UACT,OAAO;AAAA,QACT,CAAC;AACD;AAAA,MACF;AAGA,UAAI,wBAAwB;AAC1B,yBAAiB;AAAA,UACf,gBAAgB;AAAA,UAChB,SAAS,mBAAmB;AAAA,UAC5B,OAAO;AAAA,QACT,CAAC;AACD;AAAA,MACF;AAGA,UAAI,mBAAmB,UAAU;AAC/B,YAAI;AACF,gBAAM,aAAa,MAAM,qBAAqB,UAAU,eAAe;AACvE,cAAI,CAAC,YAAY;AACf,0BAAc,IAAI,MAAM,mDAAmD,CAAC;AAC5E;AAAA,UACF;AACA,2BAAiB,UAAU;AAAA,QAC7B,SAASC,QAAO;AACd,wBAAcA,MAAc;AAAA,QAC9B;AACA;AAAA,MACF;AAGA,oBAAc,IAAI,MAAM,kFAAkF,CAAC;AAAA,IAC7G;AAEA,iBAAa;AAAA,EACf,GAAG,CAAC,OAAO,wBAAwB,iBAAiB,QAAQ,CAAC;AAI7D,QAAM,2BAA2B,YAAY,CAAC;AAC9C,QAAM,EAAE,KAAK,WAAW,MAAM,IAAI;AAAA,IAChC,MAAM,MAAM;AAAA,IACZ,iBAAiB,EAAE,SAAS,mBAAmB,OAAU;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA;AAAA,EACF;AAGA,QAAM,yBAAyBC,SAAQ,MAAe;AACpD,QAAI,YAAY,WAAW,EAAG,QAAO;AAKrC,WAAO;AAAA,EACT,GAAG,CAAC,aAAa,GAAG,CAAC;AAGrB,EAAAF,WAAU,MAAM;AACd,QAAI,CAAC,aAAa,CAAC,OAAO;AACxB,oBAAc,IAAI;AAClB,oBAAc,IAAI;AAElB,UAAI,CAAC,0BAA0B,UAAU;AACvC,iBAAS,aAAa,SAAS;AAAA,MACjC;AAAA,IACF,WAAW,OAAO;AAChB,oBAAc,KAAK;AACnB,oBAAc,IAAI;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,wBAAwB,WAAW,OAAO,aAAa,WAAW,QAAQ,CAAC;AAG/E,EAAAA,WAAU,MAAM;AACd,QAAI,YAAY,cAAc,CAAC,WAAW;AACxC,cAAQ,IAAI,kDAAkD;AAAA,QAC5D;AAAA,QACA;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,OAAO;AAAA,QACP,SAAS;AAAA,QACT;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,UAAU,YAAY,WAAW,aAAa,WAAW,MAAM,IAAI,eAAe,wBAAwB,UAAU,CAAC;AAGzH,EAAAA,WAAU,MAAM;AACd,QAAI,cAAc,cAAc,CAAC,aAAa,CAAC,wBAAwB;AACrE,cAAQ,MAAM,sGAAsG;AAAA,QAClH;AAAA,QACA;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,OAAO;AAAA,QACP;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,YAAY,YAAY,WAAW,wBAAwB,aAAa,WAAW,MAAM,IAAI,eAAe,UAAU,CAAC;AAG3H,MAAI,aAAa,CAAC,YAAY;AAC5B,WAAO,gBAAAL,KAAAD,WAAA,EAAG,mBAAQ;AAAA,EACpB;AAGA,MAAI,YAAY;AACd,YAAQ,MAAM,8DAA8D,SAAS,KAAK,UAAU;AACpG,WAAO,gBAAAC,KAAAD,WAAA,EAAG,oBAAS;AAAA,EACrB;AAGA,MAAI,CAAC,wBAAwB;AAC3B,WAAO,gBAAAC,KAAAD,WAAA,EAAG,oBAAS;AAAA,EACrB;AAGA,SAAO,gBAAAC,KAAAD,WAAA,EAAG,UAAS;AACrB;AAKA,SAASG,uBAAsB;AAC7B,SACE,gBAAAD,MAAC,SAAI,WAAU,2EACb;AAAA,oBAAAD,KAAC,SAAI,WAAU,QACb,0BAAAA,KAAC,SAAI,WAAU,kCAAiC,MAAK,QAAO,QAAO,gBAAe,SAAQ,aACxF,0BAAAA,KAAC,UAAK,eAAc,SAAQ,gBAAe,SAAQ,aAAa,GAAG,GAAE,6IAA4I,GACnN,GACF;AAAA,IACA,gBAAAA,KAAC,QAAG,WAAU,2CAA0C,2BAAa;AAAA,IACrE,gBAAAA,KAAC,OAAE,WAAU,qBAAoB,kEAAoD;AAAA,IACrF,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,SAAS,MAAM,OAAO,QAAQ,KAAK;AAAA,QACnC,WAAU;AAAA,QACX;AAAA;AAAA,IAED;AAAA,KACF;AAEJ;AAKA,SAASG,kBAAiB;AACxB,SACE,gBAAAH,KAAC,SAAI,WAAU,sDACb,0BAAAC,MAAC,SAAI,WAAU,+BACb;AAAA,oBAAAD,KAAC,SAAI,WAAU,gEAA+D;AAAA,IAC9E,gBAAAA,KAAC,UAAK,WAAU,gBAAe,qCAAuB;AAAA,KACxD,GACF;AAEJ;;;AC/OA,SAAgB,WAAAQ,UAAS,eAAAC,cAAa,aAAAC,YAAW,YAAAC,WAAU,iBAAAC,gBAAe,cAAAC,mBAAkB;AAC5F,SAAS,aAAa,aAAa,cAAc;AAEjD;AAgSQ,SACE,OAAAC,MADF,QAAAC,aAAA;AA9LR,IAAM,yBAAyBC,eAAiD,IAAI;AAW7E,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA,gBAAgB;AAAA,EAChB;AAAA,EACA,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,iBAAiB;AAAA,EACjB,uBAAuB,wBAAwB;AACjD,GAAyB;AACvB,QAAM,EAAE,MAAM,wBAAwB,gBAAgB,IAAI,eAAe;AACzE,QAAM,WAAW,YAAY;AAC7B,QAAM,WAAW,YAAY;AAC7B,QAAM,CAAC,oBAAoB,qBAAqB,IAAIC,UAA8B,CAAC,CAAC;AACpF,QAAM,CAAC,cAAc,eAAe,IAAIA,UAAiB,EAAE;AAG3D,QAAM,eAAeC,SAAQ,MAAoB;AAC/C,QAAI,CAAC,uBAAwB,QAAO;AAEpC,WAAO;AAAA,MACL,gBAAgB;AAAA,MAChB,SAAS,mBAAmB;AAAA,MAC5B,OAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,wBAAwB,eAAe,CAAC;AAG5C,QAAM,qBAAqBA,SAAQ,MAA0B;AAC3D,UAAM,cAAc,SAAS;AAC7B,WAAO,OAAO,KAAK,WAAS,MAAM,SAAS,WAAW,KAAK;AAAA,EAC7D,GAAG,CAAC,QAAQ,SAAS,QAAQ,CAAC;AAG9B,QAAM,iBAAiBC,aAAY,CAAC,SAA0B;AAC5D,QAAI,CAAC,MAAM,MAAM,CAAC,aAAc,QAAO;AAEvC,UAAM,cAAc,OAAO,KAAK,WAAS,MAAM,SAAS,IAAI;AAC5D,QAAI,CAAC,YAAa,QAAO;AAOzB,WAAO;AAAA,EACT,GAAG,CAAC,MAAM,IAAI,cAAc,MAAM,CAAC;AAGnC,QAAM,EAAE,KAAK,uBAAuB,WAAW,kBAAkB,IAAI;AAAA,IACnE,MAAM,MAAM;AAAA,IACZ,gBAAgB,EAAE,gBAAgB,IAAI,SAAS,QAAW,OAAO,OAAU;AAAA,IAC3E,oBAAoB,cAAc,CAAC,KAAK;AAAA,IACxC,oBAAoB;AAAA,EACtB;AAGA,QAAM,iBAAiB,oBAAoB,eAAe,mBAAmB,YAAY,SAAS;AAClG,QAAM,iBAAiB,iBAAiB,wBAAwB;AAChE,QAAM,eAAe,iBAAiB,oBAAoB;AAG1D,QAAM,sBAAsBA,aAAY,MAAqB;AAC3D,QAAI,CAAC,MAAM,MAAM,CAAC,aAAc,QAAO,CAAC;AAExC,WAAO,OAAO,OAAO,WAAS,eAAe,MAAM,IAAI,CAAC;AAAA,EAC1D,GAAG,CAAC,MAAM,IAAI,cAAc,QAAQ,cAAc,CAAC;AAGnD,QAAM,iBAAiBA,aAAY,CAAC,SAAqC;AACvE,WAAO,OAAO,KAAK,WAAS,MAAM,SAAS,IAAI,KAAK;AAAA,EACtD,GAAG,CAAC,MAAM,CAAC;AAGX,QAAM,wBAAwBA,aAAY,MAA2B;AACnE,WAAO,CAAC,GAAG,kBAAkB;AAAA,EAC/B,GAAG,CAAC,kBAAkB,CAAC;AAGvB,QAAM,0BAA0BA,aAAY,MAAM;AAChD,0BAAsB,CAAC,CAAC;AAAA,EAC1B,GAAG,CAAC,CAAC;AAGL,QAAM,oBAAoBA,aAAY,CACpC,OACA,SACA,gBACG;AACH,QAAI,CAAC,YAAY,CAAC,MAAM,MAAM,CAAC,aAAc;AAE7C,UAAM,SAA4B;AAAA,MAChC;AAAA,MACA,aAAa,YAAY;AAAA,MACzB,QAAQ,KAAK;AAAA,MACb,OAAO;AAAA,MACP;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,QAAQ,YAAY;AAAA,MACpB,OAAO,YAAY;AAAA,MACnB,aAAa,YAAY;AAAA,IAC3B;AAEA,0BAAsB,UAAQ;AAC5B,YAAM,aAAa,CAAC,QAAQ,GAAG,IAAI;AACnC,aAAO,WAAW,MAAM,GAAG,cAAc;AAAA,IAC3C,CAAC;AAED,QAAI,eAAe;AACjB,oBAAc,OAAO,SAAS,MAAM;AAAA,IACtC;AAEA,QAAI,cAAc,CAAC,WAAW,uBAAuB;AACnD,4BAAsB,OAAO,MAAM;AAAA,IACrC;AAAA,EACF,GAAG,CAAC,UAAU,MAAM,IAAI,cAAc,gBAAgB,eAAe,uBAAuB,UAAU,CAAC;AAGvG,EAAAC,WAAU,MAAM;AACd,UAAM,cAAc,SAAS;AAC7B,oBAAgB,WAAW;AAE3B,QAAI,CAAC,oBAAoB;AAEvB,UAAI,YAAY;AACd,gBAAQ,MAAM,6EAA6E;AAAA,UACzF,OAAO;AAAA,UACP,QAAQ,MAAM;AAAA,UACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC,CAAC;AAED,YAAI,uBAAuB;AACzB,gCAAsB,aAAa;AAAA,YACjC,OAAO;AAAA,YACP,aAAa,CAAC;AAAA,YACd,QAAQ,MAAM,MAAM;AAAA,YACpB,OAAO,gBAAgB,EAAE,gBAAgB,GAAG;AAAA,YAC5C,SAAS;AAAA,YACT,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,UACpC,CAAC;AAAA,QACH;AAAA,MACF;AACA;AAAA,IACF;AAGA,UAAM,UAAU;AAChB,sBAAkB,aAAa,SAAS,kBAAkB;AAE1D,QAAI,CAAC,SAAS;AAEZ,eAAS,eAAe,EAAE,SAAS,KAAK,CAAC;AAAA,IAC3C;AAAA,EACF,GAAG,CAAC,SAAS,UAAU,oBAAoB,uBAAuB,mBAAmB,YAAY,MAAM,IAAI,cAAc,uBAAuB,UAAU,aAAa,CAAC;AAGxK,QAAM,eAAeF,SAAQ,OAAmC;AAAA,IAC9D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,mBAAmB;AAAA,EACrB,IAAI;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,MAAI,cAAc;AAChB,WACE,gBAAAJ,KAAC,SAAI,WAAU,iDACb,0BAAAC,MAAC,SAAI,WAAU,eACb;AAAA,sBAAAD,KAAC,SAAI,WAAU,6EAA4E;AAAA,MAC3F,gBAAAA,KAAC,OAAE,WAAU,gBAAe,qCAAuB;AAAA,OACrD,GACF;AAAA,EAEJ;AAGA,MAAI,sBAAsB,CAAC,gBAAgB;AACzC,WACE,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,OAAO;AAAA,QACP,QAAO;AAAA;AAAA,IACT;AAAA,EAEJ;AACA,SACE,gBAAAC,MAAC,uBAAuB,UAAvB,EAAgC,OAAO,cACrC;AAAA;AAAA,IACD,gBAAAD,KAAC,UAAO;AAAA,KACV;AAEJ;AAQO,SAAS,qBAAiD;AAC/D,QAAM,UAAUO,YAAW,sBAAsB;AAEjD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAEA,SAAO;AACT;AAKA,SAAS,6BAA6B,EAAE,OAAO,OAAO,GAAsC;AAC1F,SACE,gBAAAN,MAAC,SAAI,WAAU,0EACb;AAAA,oBAAAD,KAAC,SAAI,WAAU,QACb,0BAAAA,KAAC,SAAI,WAAU,kCAAiC,MAAK,QAAO,QAAO,gBAAe,SAAQ,aACxF,0BAAAA,KAAC,UAAK,eAAc,SAAQ,gBAAe,SAAQ,aAAa,GAAG,GAAE,6IAA4I,GACnN,GACF;AAAA,IACA,gBAAAA,KAAC,QAAG,WAAU,2CAA0C,2BAAa;AAAA,IACrE,gBAAAC,MAAC,OAAE,WAAU,qBAAoB;AAAA;AAAA,MACK,gBAAAD,KAAC,UAAK,WAAU,gCAAgC,iBAAM;AAAA,OAC5F;AAAA,IACA,gBAAAC,MAAC,OAAE,WAAU,6BAA4B;AAAA;AAAA,MAAS;AAAA,OAAO;AAAA,IACzD,gBAAAD;AAAA,MAAC;AAAA;AAAA,QACC,SAAS,MAAM,OAAO,QAAQ,KAAK;AAAA,QACnC,WAAU;AAAA,QACX;AAAA;AAAA,IAED;AAAA,KACF;AAEJ;;;AC5WA;AADA,SAAgB,iBAAAQ,gBAAe,cAAAC,aAAY,YAAAC,WAAU,eAAAC,cAAa,WAAAC,UAAS,aAAAC,kBAAiB;AA2OxF,gBAAAC,YAAA;AA3IJ,IAAM,oBAAoBN,eAA4C,IAAI;AAWnE,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,iBAAiB;AACnB,GAA4B;AAC1B,QAAM,EAAE,MAAM,wBAAwB,gBAAgB,IAAI,eAAe;AACzE,QAAM,CAAC,yBAAyB,0BAA0B,IAAIE,UAAmC,CAAC,CAAC;AACnG,QAAM,CAAC,WAAW,YAAY,IAAIA,UAAS,IAAI;AAG/C,QAAM,eAAeE,SAAQ,MAAoB;AAC/C,QAAI,CAAC,uBAAwB,QAAO;AAEpC,WAAO;AAAA,MACL,gBAAgB;AAAA,MAChB,SAAS,mBAAmB;AAAA,MAC5B,OAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,wBAAwB,eAAe,CAAC;AAG5C,QAAM,0BAA0BD,aAAY,CAC1C,SACY;AACZ,QAAI,CAAC,UAAW,QAAO;AACvB,QAAI,CAAC,MAAM,GAAI,QAAO;AAEtB,QAAI,CAAC,aAAc,QAAO;AAO1B,WAAO;AAAA,EACT,GAAG,CAAC,WAAW,MAAM,IAAI,YAAY,CAAC;AAGtC,QAAM,2BAA2BA,aAAY,MAAgC;AAC3E,QAAI,CAAC,aAAa,CAAC,MAAM,GAAI,QAAO,CAAC;AAIrC,WAAO,CAAC;AAAA,EACV,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC;AAGxB,QAAM,6BAA6BA,aAAY,CAAC,UAA8C;AAC5F,QAAI,CAAC,UAAW,QAAO;AAEvB,WAAO,MAAM,OAAO,UAAQ,wBAAwB,IAAI,CAAC;AAAA,EAC3D,GAAG,CAAC,WAAW,uBAAuB,CAAC;AAGvC,QAAM,6BAA6BA,aAAY,MAAgC;AAC7E,WAAO,CAAC,GAAG,uBAAuB;AAAA,EACpC,GAAG,CAAC,uBAAuB,CAAC;AAG5B,QAAM,+BAA+BA,aAAY,MAAM;AACrD,+BAA2B,CAAC,CAAC;AAAA,EAC/B,GAAG,CAAC,CAAC;AAGL,QAAM,yBAAyBA,aAAY,CACzC,MACA,YACG;AACH,QAAI,CAAC,YAAY,CAAC,MAAM,MAAM,CAAC,aAAc;AAE7C,UAAM,SAAiC;AAAA,MACrC,gBAAgB,KAAK;AAAA,MACrB,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,MACb,OAAO;AAAA,MACP;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,IACpB;AAEA,+BAA2B,UAAQ;AACjC,YAAM,aAAa,CAAC,QAAQ,GAAG,IAAI;AACnC,aAAO,WAAW,MAAM,GAAG,cAAc;AAAA,IAC3C,CAAC;AAED,QAAI,oBAAoB;AACtB,yBAAmB,MAAM,SAAS,MAAM;AAAA,IAC1C;AAEA,QAAI,cAAc,CAAC,WAAW,uBAAuB;AACnD,4BAAsB,MAAM,MAAM;AAAA,IACpC;AAAA,EACF,GAAG,CAAC,UAAU,MAAM,IAAI,cAAc,gBAAgB,oBAAoB,uBAAuB,UAAU,CAAC;AAG5G,QAAM,eAAeC,SAAQ,OAA8B;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,EACF,IAAI;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,EAAAC,WAAU,MAAM;AACd,QAAI,cAAc,UAAU;AAC1B,cAAQ,IAAI,uGAAuG;AAAA,IACrH;AAAA,EACF,GAAG,CAAC,YAAY,QAAQ,CAAC;AAEzB,SACE,gBAAAC,KAAC,kBAAkB,UAAlB,EAA2B,OAAO,cAChC,UACH;AAEJ;AAQO,SAAS,2BAAkD;AAChE,QAAM,UAAUL,YAAW,iBAAiB;AAE5C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAEA,SAAO;AACT;;;ACrPA,SAAgB,WAAAM,UAAsB,aAAAC,YAAW,YAAAC,iBAAgB;AAEjE;AA+Ca,SAkIF,YAAAC,WAlIE,OAAAC,MA0JP,QAAAC,aA1JO;AAHN,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA,WAAW,gBAAAD,KAACE,sBAAA,EAAoB;AAAA,EAChC,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,UAAU,gBAAAF,KAACG,iBAAA,EAAe;AAAA,EAC1B,aAAa;AACf,GAAyB;AACvB,QAAM,EAAE,MAAM,wBAAwB,iBAAiB,SAAS,IAAI,eAAe;AACnF,QAAM,CAAC,YAAY,aAAa,IAAIC,UAAS,KAAK;AAClD,QAAM,CAAC,YAAY,aAAa,IAAIA,UAAuB,IAAI;AAC/D,QAAM,CAAC,eAAe,gBAAgB,IAAIA,UAAuB,IAAI;AAGrE,EAAAC,WAAU,MAAM;AACd,UAAM,eAAe,YAAY;AAC/B,UAAI,OAAO;AACT,yBAAiB,KAAK;AACtB;AAAA,MACF;AAGA,UAAI,0BAA0B,iBAAiB;AAC7C,yBAAiB;AAAA,UACf,gBAAgB;AAAA,UAChB,SAAS;AAAA,UACT,OAAO;AAAA,QACT,CAAC;AACD;AAAA,MACF;AAGA,UAAI,wBAAwB;AAC1B,yBAAiB;AAAA,UACf,gBAAgB;AAAA,UAChB,SAAS,mBAAmB;AAAA,UAC5B,OAAO;AAAA,QACT,CAAC;AACD;AAAA,MACF;AAGA,UAAI,mBAAmB,UAAU;AAC/B,YAAI;AACF,gBAAM,aAAa,MAAM,qBAAqB,UAAU,eAAe;AACvE,cAAI,CAAC,YAAY;AACf,0BAAc,IAAI,MAAM,mDAAmD,CAAC;AAC5E;AAAA,UACF;AACA,2BAAiB,UAAU;AAAA,QAC7B,SAASC,QAAO;AACd,wBAAcA,MAAc;AAAA,QAC9B;AACA;AAAA,MACF;AAGA,oBAAc,IAAI,MAAM,6FAA6F,CAAC;AAAA,IACxH;AAEA,iBAAa;AAAA,EACf,GAAG,CAAC,OAAO,wBAAwB,iBAAiB,QAAQ,CAAC;AAI7D,QAAM,2BAA2B,eAAe,YAAY,CAAC;AAC7D,QAAM,EAAE,KAAK,WAAW,MAAM,IAAI;AAAA,IAChC,MAAM,MAAM;AAAA,IACZ,iBAAiB,EAAE,SAAS,mBAAmB,OAAU;AAAA,IACzD;AAAA,IACA,eAAe;AAAA,IACf;AAAA;AAAA,EACF;AAGA,QAAM,yBAAyBC,SAAQ,MAAe;AACpD,QAAI,eAAe,YAAY,WAAW,EAAG,QAAO;AAKpD,WAAO;AAAA,EACT,GAAG,CAAC,eAAe,aAAa,GAAG,CAAC;AAGpC,EAAAF,WAAU,MAAM;AACd,QAAI,CAAC,aAAa,CAAC,OAAO;AACxB,oBAAc,IAAI;AAClB,oBAAc,IAAI;AAElB,UAAI,CAAC,0BAA0B,UAAU;AACvC,iBAAS,cAAc;AAAA,MACzB;AAAA,IACF,WAAW,OAAO;AAChB,oBAAc,KAAK;AACnB,oBAAc,IAAI;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,wBAAwB,WAAW,OAAO,gBAAgB,QAAQ,CAAC;AAGvE,EAAAA,WAAU,MAAM;AACd,QAAI,YAAY,cAAc,CAAC,WAAW;AACxC,cAAQ,IAAI,gDAAgD;AAAA,QAC1D,gBAAgB,eAAe;AAAA,QAC/B,aAAa,eAAe;AAAA,QAC5B,QAAQ,MAAM;AAAA,QACd,OAAO;AAAA,QACP,SAAS;AAAA,QACT;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,UAAU,YAAY,WAAW,gBAAgB,MAAM,IAAI,eAAe,wBAAwB,UAAU,CAAC;AAGjH,EAAAA,WAAU,MAAM;AACd,QAAI,cAAc,cAAc,CAAC,aAAa,CAAC,wBAAwB;AACrE,cAAQ,MAAM,kHAAkH;AAAA,QAC9H,gBAAgB,eAAe;AAAA,QAC/B,aAAa,eAAe;AAAA,QAC5B,QAAQ,MAAM;AAAA,QACd,OAAO;AAAA,QACP;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,YAAY,YAAY,WAAW,wBAAwB,gBAAgB,MAAM,IAAI,eAAe,UAAU,CAAC;AAGnH,MAAI,aAAa,CAAC,iBAAiB,CAAC,YAAY;AAC9C,WAAO,gBAAAL,KAAAD,WAAA,EAAG,mBAAQ;AAAA,EACpB;AAGA,MAAI,YAAY;AACd,YAAQ,MAAM,iEAAiE,eAAe,EAAE,KAAK,UAAU;AAC/G,WAAO,gBAAAC,KAAAD,WAAA,EAAG,oBAAS;AAAA,EACrB;AAGA,MAAI,CAAC,wBAAwB;AAC3B,WAAO,gBAAAC,KAAAD,WAAA,EAAG,oBAAS;AAAA,EACrB;AAGA,SAAO,gBAAAC,KAAAD,WAAA,EAAG,UAAS;AACrB;AAKA,SAASG,uBAAsB;AAC7B,SACE,gBAAAF,KAAC,SAAI,WAAU,oDACb,0BAAAC,MAAC,SAAI,WAAU,+BACb;AAAA,oBAAAD,KAAC,SAAI,WAAU,wBAAuB,MAAK,QAAO,QAAO,gBAAe,SAAQ,aAC9E,0BAAAA,KAAC,UAAK,eAAc,SAAQ,gBAAe,SAAQ,aAAa,GAAG,GAAE,6IAA4I,GACnN;AAAA,IACA,gBAAAA,KAAC,UAAK,WAAU,wBAAuB,2BAAa;AAAA,KACtD,GACF;AAEJ;AAKA,SAASG,kBAAiB;AACxB,SACE,gBAAAH,KAAC,SAAI,WAAU,wCACb,0BAAAC,MAAC,SAAI,WAAU,+BACb;AAAA,oBAAAD,KAAC,SAAI,WAAU,gEAA+D;AAAA,IAC9E,gBAAAA,KAAC,UAAK,WAAU,wBAAuB,yBAAW;AAAA,KACpD,GACF;AAEJ;AAEA,IAAO,0BAAQ;;;AC5Of,SAAgB,WAAAQ,UAAS,eAAAC,cAAa,aAAAC,YAAW,YAAAC,iBAAgB;AA4JnD,SAEI,OAAAC,MAFJ,QAAAC,aAAA;AAtGP,SAAS,uBAAuB;AAAA,EACrC;AAAA,EACA,aAAa;AAAA,EACb,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AACF,GAAgC;AAC9B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,yBAAyB;AAE7B,QAAM,CAAC,mBAAmB,oBAAoB,IAAIC,UAA2B,CAAC,CAAC;AAG/E,QAAM,gBAAgBC,SAAQ,MAAwB;AACpD,QAAI,CAAC,UAAW,QAAO;AAEvB,WAAO,2BAA2B,KAAK;AAAA,EACzC,GAAG,CAAC,WAAW,OAAO,0BAA0B,CAAC;AAGjD,QAAM,kBAAkBC,aAAY,CAAC,SAAyB;AAC5D,QAAI,aAAa;AACf,kBAAY,IAAI;AAAA,IAClB;AAGA,QAAI,UAAU;AACZ,cAAQ,IAAI,qDAAqD;AAAA,QAC/D,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,aAAa,KAAK;AAAA,QAClB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAGA,yBAAqB,UAAQ;AAC3B,YAAM,aAAa,CAAC,MAAM,GAAG,KAAK,OAAO,OAAK,EAAE,OAAO,KAAK,EAAE,CAAC;AAC/D,aAAO,WAAW,MAAM,GAAG,EAAE;AAAA,IAC/B,CAAC;AAAA,EACH,GAAG,CAAC,aAAa,QAAQ,CAAC;AAG1B,QAAM,yBAAyBA,aAAY,CAAC,MAAsB,YAAqB;AACrF,QAAI,oBAAoB;AACtB,yBAAmB,MAAM,OAAO;AAAA,IAClC;AAEA,QAAI,UAAU;AACZ,cAAQ,IAAI,uDAAuD;AAAA,QACjE,MAAM,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,oBAAoB,UAAU,UAAU,CAAC;AAG7C,QAAM,4BAA4BA,aAAY,CAAC,SAAyB;AACtE,QAAI,uBAAuB;AACzB,4BAAsB,IAAI;AAAA,IAC5B;AAEA,QAAI,YAAY;AACd,cAAQ,MAAM,yHAAyH;AAAA,QACrI,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,aAAa,KAAK;AAAA,QAClB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,uBAAuB,UAAU,CAAC;AAGtC,QAAM,oBAAoBA,aAAY,CAAC,MAAsB,iBAA0B;AACrF,UAAM,WAAW,eAAe,KAAK;AACrC,UAAM,aAAa,CAAC;AAEpB,WACE,gBAAAJ;AAAA,MAAC;AAAA;AAAA,QAEC,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV,UACE,wBAAwB,OACtB,gBAAAA,KAAC,SAAI,WAAW,GAAG,aAAa,IAAI,qBAAqB,IACvD,0BAAAC,MAAC,SAAI,WAAU,+BACZ;AAAA,eAAK,MAAM,QACV,gBAAAD,KAAC,UAAK,WAAU,WAAW,eAAK,KAAK,MAAK;AAAA,UAE5C,gBAAAA,KAAC,UAAM,eAAK,OAAM;AAAA,UAClB,gBAAAA,KAAC,UAAK,WAAU,wBAAuB,6BAAe;AAAA,WACxD,GACF;AAAA,QAIJ,0BAAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAS,MAAM,gBAAgB,IAAI;AAAA,YACnC,WAAW,GAAG,aAAa,IACzB,WAAW,sBAAsB,EACnC,IACE,aAAa,wBAAwB,kBACvC;AAAA,YACA,UAAU;AAAA,YAEV,0BAAAC,MAAC,SAAI,WAAU,+BACZ;AAAA,mBAAK,MAAM,QACV,gBAAAD,KAAC,UAAK,WAAU,WAAW,eAAK,KAAK,MAAK;AAAA,cAE5C,gBAAAA,KAAC,UAAM,eAAK,OAAM;AAAA,cACjB,KAAK,MAAM,eACV,gBAAAA,KAAC,UAAK,WAAU,gCACb,eAAK,KAAK,aACb;AAAA,eAEJ;AAAA;AAAA,QACF;AAAA;AAAA,MAvCK,KAAK;AAAA,IAwCZ;AAAA,EAEJ,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,EAAAK,WAAU,MAAM;AACd,QAAI,cAAc,UAAU;AAC1B,cAAQ,IAAI,2GAA2G;AAAA,IACzH;AAAA,EACF,GAAG,CAAC,YAAY,QAAQ,CAAC;AAGzB,EAAAA,WAAU,MAAM;AACd,QAAI,UAAU;AACZ,cAAQ,IAAI,yDAAyD;AAAA,QACnE,YAAY,MAAM;AAAA,QAClB,eAAe,cAAc;AAAA,QAC7B;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,GAAG,CAAC,MAAM,QAAQ,cAAc,QAAQ,YAAY,QAAQ,CAAC;AAE7D,SACE,gBAAAL,KAAC,SAAI,WACF,wBAAc,IAAI,UAAQ;AACzB,UAAM,eAAe,wBAAwB,IAAI;AAEjD,QAAI,YAAY;AACd,aAAO,WAAW,MAAM,YAAY;AAAA,IACtC;AAEA,WAAO,kBAAkB,MAAM,YAAY;AAAA,EAC7C,CAAC,GACH;AAEJ;;;AC1RA,OAAOM,UAAoB,cAAAC,mBAAkB;AAkGrC,SAmEG,YAAAC,WAnEH,OAAAC,MAIE,QAAAC,aAJF;AA3DD,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA,UAAU;AAAA;AAAA,EAEV,aAAa;AAAA,EACb,WAAW;AAAA,EACX,eAAe;AACjB,GAaoB;AAClB,QAAM,SAAS,cAAc;AAG7B,QAAM,cAAcC,YAAWC,OAAM,cAAmB,IAAI,CAAC;AAG7D,MAAI,kBAAkB;AACtB,MAAI,CAAC,iBAAiB;AACpB,QAAI;AAEF,UAAI,aAAa,MAAM,IAAI;AACzB,0BAAkB,YAAY,KAAK;AAAA,MACrC,OAAO;AAEL,cAAM,aAAc,OAAe;AACnC,YAAI,YAAY,IAAI;AAClB,4BAAkB,WAAW;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,SAASC,QAAO;AACd,aAAO,MAAM,wCAAwCA,MAAK;AAAA,IAC5D;AAAA,EACF;AAGA,QAAM,EAAE,KAAK,WAAW,MAAM,IAAI,OAAO,mBAAmB,IAAI,OAAO,YAAY,MAAM;AAGzF,MAAI,CAAC,iBAAiB;AACpB,WAAO,MAAM,sEAAsE;AACnF,WACE,gBAAAH,MAAC,SAAI,WAAU,cAAa,MAAK,SAC/B;AAAA,sBAAAD,KAAC,OAAE,iEAAmD;AAAA,MACtD,gBAAAC,MAAC,aACC;AAAA,wBAAAD,KAAC,aAAQ,wBAAU;AAAA,QACnB,gBAAAA,KAAC,OAAE,kCAAoB;AAAA,QACvB,gBAAAC,MAAC,QACC;AAAA,0BAAAD,KAAC,QAAG,yCAA2B;AAAA,UAC/B,gBAAAA,KAAC,QAAG,iDAAmC;AAAA,UACvC,gBAAAA,KAAC,QAAG,qDAAuC;AAAA,WAC7C;AAAA,SACF;AAAA,OACF;AAAA,EAEJ;AAGA,MAAI,WAAW;AACb,WAAO,WACL,gBAAAA,KAAC,SAAI,WAAU,gBAAe,MAAK,UAAS,aAAU,UACpD,0BAAAA,KAAC,UAAK,WAAU,WAAU,qCAAuB,GACnD;AAAA,EAEJ;AAGA,MAAI,OAAO;AACT,WAAO,MAAM,4BAA4B,KAAK;AAE9C,QAAI,UAAU;AACZ,aAAO,KAAK,8CAA8C;AAAA,QACxD,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,MAAM;AAAA,QACb,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAGA,MAAI,CAAC,KAAK;AAER,QAAI,UAAU;AACZ,aAAO,KAAK,wCAAwC;AAAA,QAClD,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAGA,QAAI,YAAY;AACd,aAAO,MAAM,2GAA2G;AAAA,QACtH,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,QAAI,UAAU;AACZ,eAAS;AAAA,IACX;AACA,WAAO,gBAAAA,KAAAD,WAAA,EAAG,oBAAS;AAAA,EACrB;AAGA,MAAI,UAAU;AACZ,WAAO,KAAK,yCAAyC;AAAA,MACnD,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAGA,SAAO,gBAAAC,KAAAD,WAAA,EAAG,UAAS;AACrB;AA8BO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX,UAAU;AACZ,GAOoB;AAClB,QAAM,SAAS,cAAc;AAG7B,QAAM,cAAcG,YAAWC,OAAM,cAAmB,IAAI,CAAC;AAG7D,MAAI,kBAAkB;AACtB,MAAI,CAAC,iBAAiB;AACpB,QAAI;AAEF,UAAI,aAAa,MAAM,IAAI;AACzB,0BAAkB,YAAY,KAAK;AAAA,MACrC,OAAO;AAEL,cAAM,aAAc,OAAe;AACnC,YAAI,YAAY,IAAI;AAClB,4BAAkB,WAAW;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,SAASC,QAAO;AACd,aAAO,MAAM,wCAAwCA,MAAK;AAAA,IAC5D;AAAA,EACF;AAGA,QAAM,EAAE,aAAa,WAAW,MAAM,IAAI,eAAe,mBAAmB,IAAI,KAAK;AAGrF,MAAI,CAAC,iBAAiB;AACpB,WAAO,MAAM,uEAAuE;AACpF,WACE,gBAAAH,MAAC,SAAI,WAAU,cAAa,MAAK,SAC/B;AAAA,sBAAAD,KAAC,OAAE,mEAAqD;AAAA,MACxD,gBAAAC,MAAC,aACC;AAAA,wBAAAD,KAAC,aAAQ,wBAAU;AAAA,QACnB,gBAAAA,KAAC,OAAE,kCAAoB;AAAA,QACvB,gBAAAC,MAAC,QACC;AAAA,0BAAAD,KAAC,QAAG,yCAA2B;AAAA,UAC/B,gBAAAA,KAAC,QAAG,iDAAmC;AAAA,UACvC,gBAAAA,KAAC,QAAG,qDAAuC;AAAA,WAC7C;AAAA,SACF;AAAA,OACF;AAAA,EAEJ;AAGA,MAAI,WAAW;AACb,WAAO,WACL,gBAAAA,KAAC,SAAI,WAAU,gBAAe,MAAK,UAAS,aAAU,UACpD,0BAAAA,KAAC,UAAK,WAAU,WAAU,sCAAwB,GACpD;AAAA,EAEJ;AAGA,MAAI,OAAO;AACT,WAAO,MAAM,8BAA8B,KAAK;AAChD,WAAO;AAAA,EACT;AAGA,QAAM,iBAAiB,CAAC,UAAU,eAAe,WAAW,SAAS,OAAO;AAC5E,QAAM,iBAAiB,cAAc,eAAe,QAAQ,WAAW,IAAI;AAC3E,QAAM,qBAAqB,eAAe,QAAQ,QAAQ;AAE1D,MAAI,iBAAiB,oBAAoB;AACvC,WAAO,gBAAAA,KAAAD,WAAA,EAAG,oBAAS;AAAA,EACrB;AAEA,SAAO,gBAAAC,KAAAD,WAAA,EAAG,UAAS;AACrB;AA0BO,SAAS,oBACd,QAIA,SACA;AACA,SAAO,UAAU,SAA0B;AAEzC,UAAM,CAAC,GAAG,IAAI;AACd,UAAM,SAAS,IAAI,MAAM;AACzB,UAAM,iBAAiB,IAAI;AAC3B,UAAM,UAAU,IAAI;AACpB,UAAM,QAAQ,IAAI;AAElB,QAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAGA,UAAM,EAAE,aAAAM,aAAY,IAAI,MAAM,OAAO,oBAAO;AAC5C,UAAMC,iBAAgB,MAAMD,aAAY;AAAA,MACtC;AAAA,MACA,OAAO,EAAE,gBAAgB,SAAS,MAAM;AAAA,MACxC,YAAY,OAAO;AAAA,MACnB,QAAQ,OAAO;AAAA,IACjB,CAAC;AAED,QAAI,CAACC,gBAAe;AAClB,YAAM,IAAI,MAAM,sBAAsB,OAAO,UAAU,EAAE;AAAA,IAC3D;AAGA,WAAO,QAAQ,GAAG,IAAI;AAAA,EACxB;AACF;AAsBO,SAAS,qBACd,UACA,SACA;AACA,SAAO,UAAU,SAA0B;AAEzC,UAAM,CAAC,GAAG,IAAI;AACd,UAAM,SAAS,IAAI,MAAM;AACzB,UAAM,iBAAiB,IAAI;AAC3B,UAAM,UAAU,IAAI;AACpB,UAAM,QAAQ,IAAI;AAElB,QAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAGA,UAAM,EAAE,gBAAAC,gBAAe,IAAI,MAAM,OAAO,oBAAO;AAC/C,UAAM,cAAc,MAAMA,gBAAe;AAAA,MACvC;AAAA,MACA,OAAO,EAAE,gBAAgB,SAAS,MAAM;AAAA,IAC1C,CAAC;AAED,UAAM,iBAAiB,CAAC,UAAU,eAAe,WAAW,SAAS,OAAO;AAC5E,UAAM,iBAAiB,eAAe,QAAQ,WAAW;AACzD,UAAM,qBAAqB,eAAe,QAAQ,QAAQ;AAE1D,QAAI,iBAAiB,oBAAoB;AACvC,YAAM,IAAI,MAAM,0BAA0B,QAAQ,UAAU,WAAW,EAAE;AAAA,IAC3E;AAGA,WAAO,QAAQ,GAAG,IAAI;AAAA,EACxB;AACF;AA2BO,SAAS,cACd,QAMA,SACA;AACA,SAAO,UAAU,SAA0B;AAEzC,UAAM,CAAC,GAAG,IAAI;AACd,UAAM,SAAS,IAAI,MAAM;AACzB,UAAM,iBAAiB,IAAI;AAC3B,UAAM,UAAU,IAAI;AACpB,UAAM,QAAQ,IAAI;AAElB,QAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAGA,QAAI,OAAO,eAAe,OAAO,YAAY,SAAS,GAAG;AACvD,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,oBAAO;AAC7C,YAAM,UAAU,MAAM,aAAa,MAAM;AAEzC,UAAI,SAAS;AAEX,YAAI,gBAAgB;AAClB,gBAAM,EAAE,gBAAAC,gBAAe,IAAI,MAAM,OAAO,sBAAS;AACjD,gBAAMA,gBAAe;AAAA,YACnB,MAAM;AAAA,YACN;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,YAAY;AAAA,YACZ,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,aAAa;AAAA,YACb,UAAU;AAAA,cACR,WAAW;AAAA,cACX,QAAQ;AAAA,YACV;AAAA,UACF,CAAC;AAAA,QACH;AAEA,eAAO,QAAQ,GAAG,IAAI;AAAA,MACxB;AAAA,IACF;AAGA,QAAI,OAAO,qBAAqB,OAAO,kBAAkB,SAAS,GAAG;AACnE,YAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,oBAAO;AACpD,YAAM,aAAa,MAAM,oBAAoB,QAAQ,cAAc;AAEnE,UAAI,CAAC,cAAc,OAAO,eAAe,OAAO;AAC9C,cAAM,IAAI,MAAM,kCAAkC;AAAA,MACpD;AAAA,IACF;AAGA,QAAI,OAAO,iBAAiB,OAAO,cAAc,SAAS,KAAK,WAAW,OAAO;AAC/E,YAAM,EAAE,aAAa,IAAI,MAAM,OAAO,oBAAO;AAC7C,YAAM,mBAAmB,MAAM,aAAa,QAAQ,EAAE,gBAAgB,SAAS,MAAM,CAAC;AAEtF,UAAI,CAAC,oBAAoB,OAAO,eAAe,OAAO;AACpD,cAAM,IAAI,MAAM,2BAA2B;AAAA,MAC7C;AAAA,IACF;AAGA,QAAI,gBAAgB;AAClB,YAAM,EAAE,gBAAAA,gBAAe,IAAI,MAAM,OAAO,sBAAS;AACjD,YAAMA,gBAAe;AAAA,QACnB,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,UAAU;AAAA,UACR,WAAW;AAAA,QACb;AAAA,MACF,CAAC;AAAA,IACH;AAGA,WAAO,QAAQ,GAAG,IAAI;AAAA,EACxB;AACF;AA4BO,SAAS,qBAAqB,QAOlC;AACD,SAAO,OAAO,KAAwF,KAA0C,SAAqB;AACnK,UAAM,EAAE,SAAS,IAAI,IAAI;AACzB,UAAM,SAAS,IAAI,MAAM;AACzB,UAAM,iBAAiB,IAAI;AAE3B,QAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,aAAO,IAAI,SAAS,OAAO,eAAe,QAAQ;AAAA,IACpD;AAGA,UAAM,iBAAiB,OAAO,gBAAgB;AAAA,MAAK,WACjD,SAAS,WAAW,MAAM,IAAI;AAAA,IAChC;AAEA,QAAI,gBAAgB;AAClB,UAAI;AACF,cAAM,EAAE,aAAAH,aAAY,IAAI,MAAM,OAAO,oBAAO;AAC5C,cAAMC,iBAAgB,MAAMD,aAAY;AAAA,UACtC;AAAA,UACA,OAAO,EAAE,eAAe;AAAA,UACxB,YAAY,eAAe;AAAA,UAC3B,QAAQ,eAAe;AAAA,QACzB,CAAC;AAED,YAAI,CAACC,gBAAe;AAClB,iBAAO,IAAI,SAAS,OAAO,eAAe,gBAAgB;AAAA,QAC5D;AAAA,MACJ,SAAS,QAAQ;AAEf,eAAO,IAAI,SAAS,OAAO,eAAe,gBAAgB;AAAA,MAC5D;AAAA,IACA;AAEA,SAAK;AAAA,EACP;AACF;AAwBO,SAAS,4BAA4B,QAGzC;AACD,SAAO,OAAO,KAA2F,KAAqE,SAAqB;AACjM,UAAM,SAAS,IAAI,MAAM;AACzB,UAAM,iBAAiB,IAAI;AAC3B,UAAM,UAAU,IAAI;AACpB,UAAM,QAAQ,IAAI;AAElB,QAAI,CAAC,UAAU,CAAC,gBAAgB;AAC9B,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,wBAAwB,CAAC;AAAA,IAChE;AAEA,QAAI;AACF,YAAM,EAAE,aAAAD,aAAY,IAAI,MAAM,OAAO,oBAAO;AAC5C,YAAMC,iBAAgB,MAAMD,aAAY;AAAA,QACtC;AAAA,QACA,OAAO,EAAE,gBAAgB,SAAS,MAAM;AAAA,QACxC,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,MACjB,CAAC;AAED,UAAI,CAACC,gBAAe;AAClB,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MAC5D;AAEA,WAAK;AAAA,IACP,SAAS,QAAQ;AAEf,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,0BAA0B,CAAC;AAAA,IAClE;AAAA,EACF;AACF;AAeO,SAAS,oBACd,QACA,OACA,aACA,SACS;AACT,QAAM,WAAW,UAAU,sBAAsB;AAAA,IAC/C;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,SAAS,MAAM;AAAA,IACf,OAAO,MAAM;AAAA,EACf,CAAC;AAED,SAAO,UAAU,IAAa,QAAQ,KAAK;AAC7C;AAWO,SAAS,uBACd,QACA,OACA,aACA,QACS;AACT,SAAO,YAAY;AAAA,IAAK,gBACtB,oBAAoB,QAAQ,OAAO,YAAY,MAAM;AAAA,EACvD;AACF;;;AClsBO,IAAM,qBAAqB;AAAA,EAChC,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAMO,IAAM,2BAA2B;AAAA;AAAA,EAEtC,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,qBAAqB;AAAA;AAAA,EAGrB,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EACd,cAAc;AAAA;AAAA,EAGd,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EACd,cAAc;AAAA;AAAA,EAGd,eAAe;AAAA,EACf,aAAa;AAAA,EACb,eAAe;AAAA,EACf,eAAe;AAAA,EACf,eAAe;AAAA;AAAA,EAGf,aAAa;AAAA,EACb,WAAW;AAAA,EACX,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf;AAMO,IAAM,wBAAwB;AAAA;AAAA,EAEnC,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,cAAc;AAAA;AAAA,EAGd,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,YAAY;AAAA;AAAA,EAGZ,aAAa;AAAA,EACb,WAAW;AAAA,EACX,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA;AAAA,EAGb,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,qBAAqB;AAAA,EACrB,qBAAqB;AAAA;AAAA,EAGrB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,sBAAsB;AAAA;AAAA,EAGtB,uBAAuB;AAAA,EACvB,qBAAqB;AAAA,EACrB,uBAAuB;AACzB;AAMO,IAAM,mBAAmB;AAAA;AAAA,EAE9B,WAAW;AAAA,EACX,aAAa;AAAA;AAAA,EAGb,YAAY;AAAA,EACZ,cAAc;AAAA;AAAA,EAGd,gBAAgB;AAAA,EAChB,kBAAkB;AAAA;AAAA,EAGlB,eAAe;AAAA,EACf,iBAAiB;AAAA;AAAA,EAGjB,cAAc;AAAA,EACd,gBAAgB;AAClB;AAMO,IAAM,oBAAoB;AAAA;AAAA,EAE/B,cAAc;AAAA,IACZ,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,EACrB;AAAA;AAAA,EAGA,WAAW;AAAA,IACT,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,IACzB,yBAAyB;AAAA,EAC3B;AAAA;AAAA,EAGA,aAAa;AAAA,IACX,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,EACxB;AAAA;AAAA,EAGA,SAAS;AAAA,IACP,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,EACxB;AAAA;AAAA,EAGA,aAAa;AAAA,IACX,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,EACxB;AAAA;AAAA,EAGA,QAAQ;AAAA,IACN,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,EACxB;AACF;AAYO,SAAS,kBAAkB,YAA8C;AAI9E,QAAM,UAAU;AAChB,SAAO,QAAQ,KAAK,UAAU;AAChC;AAQO,SAAS,sBAAsB,MAA4B;AAChE,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO,CAAC,GAAG,kBAAkB,YAAY;AAAA,IAC3C,KAAK;AACH,aAAO,CAAC,GAAG,kBAAkB,SAAS;AAAA,IACxC,KAAK;AACH,aAAO,CAAC,GAAG,kBAAkB,WAAW;AAAA,IAC1C,KAAK;AACH,aAAO,CAAC,GAAG,kBAAkB,OAAO;AAAA,IACtC,KAAK;AACH,aAAO,CAAC,GAAG,kBAAkB,WAAW;AAAA,IAC1C,KAAK;AACH,aAAO,CAAC,GAAG,kBAAkB,MAAM;AAAA,IACrC;AACE,aAAO,CAAC;AAAA,EACZ;AACF;AAMO,IAAM,kBAAkB;AAAA,EAC7B,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL;","names":["useMemo","useEffect","useState","jsx","useState","useEffect","error","resolvedScope","useMemo","createContext","useContext","useState","useCallback","useMemo","useEffect","jsx","createContext","useState","useMemo","useCallback","useEffect","useContext","useMemo","useEffect","useState","Fragment","jsx","jsxs","DefaultAccessDenied","DefaultLoading","useState","useEffect","error","useMemo","useMemo","useCallback","useEffect","useState","createContext","useContext","jsx","jsxs","createContext","useState","useMemo","useCallback","useEffect","useContext","createContext","useContext","useState","useCallback","useMemo","useEffect","jsx","useMemo","useEffect","useState","Fragment","jsx","jsxs","DefaultAccessDenied","DefaultLoading","useState","useEffect","error","useMemo","useMemo","useCallback","useEffect","useState","jsx","jsxs","useState","useMemo","useCallback","useEffect","React","useContext","Fragment","jsx","jsxs","useContext","React","error","isPermitted","hasPermission","getAccessLevel","emitAuditEvent"]}