@kuadrant/kuadrant-backstage-plugin-backend 0.0.2-dev-b0a6833 → 0.0.2-dev-6187a11

package/dist/router.cjs.js

@@ -18,6 +18,7 @@ var express__default = /*#__PURE__*/_interopDefaultCompat(express);
 var Router__default = /*#__PURE__*/_interopDefaultCompat(Router);
 var cors__default = /*#__PURE__*/_interopDefaultCompat(cors);
 
+const secretKey = "api_key";
 function extractNameFromEntityRef(entityRef) {
   const parts = entityRef.split("/");
   return parts[parts.length - 1];
@@ -333,6 +334,10 @@ async function createRouter({
         name,
         parsed.data
       );
+      const provider = alpha.getAPIProductEntityProvider();
+      if (provider) {
+        await provider.refresh();
+      }
       return res.json(updated);
     } catch (error) {
       console.error("error updating apiproduct:", error);
@@ -562,47 +567,6 @@ async function createRouter({
       }
     }
   });
-  router.get("/requests/:namespace/:name/secret", async (req, res) => {
-    try {
-      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
-      const { namespace, name } = req.params;
-      const apiKey = await k8sClient$1.getCustomResource(
-        "devportal.kuadrant.io",
-        "v1alpha1",
-        namespace,
-        "apikeys",
-        name
-      );
-      const requestUserId = apiKey.spec?.requestedBy?.userId;
-      if (requestUserId !== userEntityRef) {
-        throw new errors.NotAllowedError("you can only read your own api key secrets");
-      }
-      if (apiKey.status?.phase !== "Approved") {
-        res.status(400).json({ error: "api key request is not approved" });
-        return;
-      }
-      const secretRef = apiKey.status?.secretRef;
-      if (!secretRef?.name || !secretRef?.key) {
-        res.status(404).json({ error: "secret not yet created by controller" });
-        return;
-      }
-      const secret = await k8sClient$1.getSecret(namespace, secretRef.name);
-      const apiKeyValue = secret.data?.[secretRef.key];
-      if (!apiKeyValue) {
-        res.status(404).json({ error: "api key not found in secret" });
-        return;
-      }
-      const decodedKey = Buffer.from(apiKeyValue, "base64").toString("utf-8");
-      res.json({ apiKey: decodedKey });
-    } catch (error) {
-      console.error("error fetching api key secret:", error);
-      if (error instanceof errors.NotAllowedError) {
-        res.status(403).json({ error: error.message });
-      } else {
-        res.status(500).json({ error: "failed to fetch api key secret" });
-      }
-    }
-  });
   const approveRejectSchema = zod.z.object({
     comment: zod.z.string().optional()
   });
@@ -1001,6 +965,93 @@ async function createRouter({
       }
     }
   });
+  router.get("/apikeys/:namespace/:name/secret", async (req, res) => {
+    try {
+      const credentials = await httpAuth.credentials(req);
+      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);
+      const { namespace, name } = req.params;
+      const readAllDecision = await permissions$1.authorize(
+        [{ permission: permissions.kuadrantApiKeyReadAllPermission }],
+        { credentials }
+      );
+      const canReadAll = readAllDecision[0].result === pluginPermissionCommon.AuthorizeResult.ALLOW;
+      if (!canReadAll) {
+        const readOwnDecision = await permissions$1.authorize(
+          [{ permission: permissions.kuadrantApiKeyReadOwnPermission }],
+          { credentials }
+        );
+        if (readOwnDecision[0].result !== pluginPermissionCommon.AuthorizeResult.ALLOW) {
+          throw new errors.NotAllowedError("unauthorised");
+        }
+      }
+      const apiKey = await k8sClient$1.getCustomResource(
+        "devportal.kuadrant.io",
+        "v1alpha1",
+        namespace,
+        "apikeys",
+        name
+      );
+      if (!canReadAll) {
+        const requestUserId = apiKey.spec?.requestedBy?.userId;
+        if (requestUserId !== userEntityRef) {
+          throw new errors.NotAllowedError("you can only read your own api key secrets");
+        }
+      }
+      if (apiKey.status?.canReadSecret !== true) {
+        res.status(403).json({
+          error: "secret has already been read and cannot be retrieved again"
+        });
+        return;
+      }
+      if (!apiKey.status?.secretRef?.name || !apiKey.status?.secretRef?.key) {
+        res.status(404).json({
+          error: "secret reference not found in apikey status"
+        });
+        return;
+      }
+      const secretName = apiKey.status.secretRef.name;
+      let secret;
+      try {
+        secret = await k8sClient$1.getSecret(namespace, secretName);
+      } catch (error) {
+        console.error("error fetching secret:", error);
+        res.status(404).json({
+          error: "secret not found"
+        });
+        return;
+      }
+      const secretData = secret.data || {};
+      const apiKeyValue = secretData[secretKey];
+      if (!apiKeyValue) {
+        res.status(404).json({
+          error: `secret key '${secretKey}' not found in secret`
+        });
+        return;
+      }
+      const decodedApiKey = Buffer.from(apiKeyValue, "base64").toString("utf-8");
+      await k8sClient$1.patchCustomResourceStatus(
+        "devportal.kuadrant.io",
+        "v1alpha1",
+        namespace,
+        "apikeys",
+        name,
+        {
+          ...apiKey.status,
+          canReadSecret: false
+        }
+      );
+      res.json({
+        apiKey: decodedApiKey
+      });
+    } catch (error) {
+      console.error("error reading api key secret:", error);
+      if (error instanceof errors.NotAllowedError) {
+        res.status(403).json({ error: error.message });
+      } else {
+        res.status(500).json({ error: "failed to read api key secret" });
+      }
+    }
+  });
   router.use(pluginPermissionNode.createPermissionIntegrationRouter({
     permissions: permissions.kuadrantPermissions
   }));

package/dist/router.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.cjs.js","sources":["../src/router.ts"],"sourcesContent":["import { HttpAuthService, RootConfigService, UserInfoService, PermissionsService } from '@backstage/backend-plugin-api';\nimport { InputError, NotAllowedError } from '@backstage/errors';\nimport { AuthorizeResult } from '@backstage/plugin-permission-common';\nimport { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';\nimport { z } from 'zod';\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport cors from 'cors';\nimport { randomBytes } from 'crypto';\nimport { KuadrantK8sClient } from './k8s-client';\nimport { getAPIProductEntityProvider } from './module';\nimport {\n  kuadrantPermissions,\n  kuadrantPlanPolicyListPermission,\n  kuadrantPlanPolicyReadPermission,\n  kuadrantApiProductListPermission,\n  kuadrantApiProductReadOwnPermission,\n  kuadrantApiProductReadAllPermission,\n  kuadrantApiProductCreatePermission,\n  kuadrantApiProductUpdateOwnPermission,\n  kuadrantApiProductUpdateAllPermission,\n  kuadrantApiProductDeleteOwnPermission,\n  kuadrantApiProductDeleteAllPermission,\n  kuadrantApiKeyRequestCreatePermission,\n  kuadrantApiKeyRequestReadOwnPermission,\n  kuadrantApiKeyRequestReadAllPermission,\n  kuadrantApiKeyRequestUpdateOwnPermission,\n  kuadrantApiKeyRequestUpdateAllPermission,\n  kuadrantApiKeyRequestDeleteOwnPermission,\n  kuadrantApiKeyRequestDeleteAllPermission,\n} from './permissions';\n\n/**\n * Extract a kubernetes-safe name from entity ref\n * e.g., \"user:default/alice\" -> \"alice\"\n * e.g., \"group:platform/api-owners\" -> \"api-owners\"\n */\nfunction extractNameFromEntityRef(entityRef: string): string {\n  const parts = entityRef.split('/');\n  return parts[parts.length - 1];\n}\n\nasync function getUserIdentity(req: express.Request, httpAuth: HttpAuthService, userInfo: UserInfoService): Promise<{\n  userEntityRef: string;\n  groups: string[];\n}> {\n  const credentials = await httpAuth.credentials(req);\n\n  if (!credentials || !credentials.principal) {\n    throw new NotAllowedError('authentication required');\n  }\n\n  // get user info from credentials\n  const info = await userInfo.getUserInfo(credentials);\n  const groups = info.ownershipEntityRefs || [];\n\n  console.log(`user identity resolved: userEntityRef=${info.userEntityRef}, groups=${groups.join(',')}`);\n  return {\n    userEntityRef: info.userEntityRef,\n    groups\n  };\n}\n\nexport async function createRouter({\n  httpAuth,\n  userInfo,\n  config,\n  permissions,\n}: {\n  httpAuth: HttpAuthService;\n  userInfo: UserInfoService;\n  config: RootConfigService;\n  permissions: PermissionsService;\n}): Promise<express.Router> {\n  const router = Router();\n\n  // enable cors for dev mode (allows frontend on :3000 to call backend on :7007)\n  router.use(cors({\n    origin: 'http://localhost:3000',\n    credentials: true,\n  }));\n\n  router.use(express.json());\n\n  const k8sClient = new KuadrantK8sClient(config);\n\n  // apiproduct endpoints\n  router.get('/apiproducts', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      const listDecision = await permissions.authorize(\n        [{ permission: kuadrantApiProductListPermission }],\n        { credentials }\n      );\n\n      if (listDecision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n      const data = await k8sClient.listCustomResources('devportal.kuadrant.io', 'v1alpha1', 'apiproducts');\n\n      // check if user has read all permission\n      const readAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiProductReadAllPermission }],\n        { credentials }\n      );\n\n      if (readAllDecision[0].result === AuthorizeResult.ALLOW) {\n        // admin - return all apiproducts\n        res.json(data);\n      } else {\n        // owner - check read own permission and filter\n        const readOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiProductReadOwnPermission }],\n          { credentials }\n        );\n\n        if (readOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // filter to only owned apiproducts\n        const ownedItems = (data.items || []).filter((item: any) => {\n          const owner = item.metadata?.annotations?.['backstage.io/owner'];\n          return owner === userEntityRef;\n        });\n\n        res.json({ ...data, items: ownedItems });\n      }\n    } catch (error) {\n      console.error('error fetching apiproducts:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch apiproducts' });\n      }\n    }\n  });\n\n  router.get('/apiproducts/:namespace/:name', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { namespace, name } = req.params;\n\n      // try read all permission first (admin)\n      const readAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiProductReadAllPermission }],\n        { credentials }\n      );\n\n      if (readAllDecision[0].result !== AuthorizeResult.ALLOW) {\n        // fallback to read own permission\n        const readOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiProductReadOwnPermission }],\n          { credentials }\n        );\n\n        if (readOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership\n        const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n        const data = await k8sClient.getCustomResource('devportal.kuadrant.io', 'v1alpha1', namespace, 'apiproducts', name);\n        const owner = data.metadata?.annotations?.['backstage.io/owner'];\n\n        if (owner !== userEntityRef) {\n          throw new NotAllowedError('you can only read your own api products');\n        }\n\n        res.json(data);\n      } else {\n        // admin - read any apiproduct\n        const data = await k8sClient.getCustomResource('devportal.kuadrant.io', 'v1alpha1', namespace, 'apiproducts', name);\n        res.json(data);\n      }\n    } catch (error) {\n      console.error('error fetching apiproduct:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch apiproduct' });\n      }\n    }\n  });\n\n  router.post('/apiproducts', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantApiProductCreatePermission }],\n        { credentials }\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n      const apiProduct = req.body;\n      const targetRef = apiProduct.spec?.targetRef;\n\n      if (!targetRef?.name || !targetRef?.kind || !targetRef?.namespace) {\n        throw new InputError('targetRef with name, kind, and namespace is required');\n      }\n\n      // derive namespace from httproute - apiproduct lives in same namespace as httproute\n      const namespace = targetRef.namespace;\n      apiProduct.metadata.namespace = namespace;\n\n      // set ownership annotation (backstage-specific metadata)\n      // note: creationTimestamp is automatically set by kubernetes api server\n      if (!apiProduct.metadata.annotations) {\n        apiProduct.metadata.annotations = {};\n      }\n      apiProduct.metadata.annotations['backstage.io/owner'] = userEntityRef;\n\n      const created = await k8sClient.createCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apiproducts',\n        apiProduct,\n      );\n\n      // trigger immediate catalog sync\n      const provider = getAPIProductEntityProvider();\n      if (provider) {\n        await provider.refresh();\n      }\n\n      res.status(201).json(created);\n    } catch (error) {\n      console.error('error creating apiproduct:', error);\n      const errorMessage = error instanceof Error ? error.message : String(error);\n\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else if (error instanceof InputError) {\n        res.status(400).json({ error: error.message });\n      } else {\n        // pass the detailed error message to the frontend\n        res.status(500).json({ error: errorMessage });\n      }\n    }\n  });\n\n  router.delete('/apiproducts/:namespace/:name', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { namespace, name } = req.params;\n\n      // try delete all permission first (admin)\n      const deleteAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiProductDeleteAllPermission }],\n        { credentials }\n      );\n\n      if (deleteAllDecision[0].result !== AuthorizeResult.ALLOW) {\n        // fallback to delete own permission\n        const deleteOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiProductDeleteOwnPermission }],\n          { credentials }\n        );\n\n        if (deleteOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership before deleting\n        const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n        const existing = await k8sClient.getCustomResource('devportal.kuadrant.io', 'v1alpha1', namespace, 'apiproducts', name);\n        const owner = existing.metadata?.annotations?.['backstage.io/owner'];\n\n        if (owner !== userEntityRef) {\n          throw new NotAllowedError('you can only delete your own api products');\n        }\n      }\n      console.log(`cascading delete: finding apikeys for ${namespace}/${name}`);\n\n      let allRequests;\n      try {\n        allRequests = await k8sClient.listCustomResources(\n          'devportal.kuadrant.io',\n          'v1alpha1',\n          'apikeys',\n          namespace\n        );\n      } catch (error) {\n        console.warn('failed to list apikeys during cascade delete:', error);\n        allRequests = { items: [] };\n      }\n\n      // filter requests that belong to this APIProduct\n      const relatedRequests = (allRequests.items || []).filter((req: any) =>\n        req.spec?.apiProductRef?.name === name\n      );\n\n      console.log(`found ${relatedRequests.length} apikeys to delete`);\n\n      // delete each APIKey - controller's OwnerReference handles Secret cleanup\n      const deletionResults = await Promise.allSettled(\n        relatedRequests.map(async (request: any) => {\n          const requestName = request.metadata.name;\n          console.log(`deleting apikey: ${namespace}/${requestName}`);\n          await k8sClient.deleteCustomResource(\n            'devportal.kuadrant.io',\n            'v1alpha1',\n            namespace,\n            'apikeys',\n            requestName\n          );\n        })\n      );\n\n      const failures = deletionResults.filter(r => r.status === 'rejected');\n      if (failures.length > 0) {\n        console.warn(`${failures.length} apikeys failed to delete:`,\n          failures.map((f: any) => f.reason)\n        );\n      }\n      await k8sClient.deleteCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apiproducts',\n        name\n      );\n\n      // trigger immediate catalog sync\n      const provider = getAPIProductEntityProvider();\n      if (provider) {\n        await provider.refresh();\n      }\n\n      res.status(204).send();\n    } catch (error) {\n      console.error('error deleting apiproduct:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to delete apiproduct' });\n      }\n    }\n  });\n\n  // httproute endpoints\n  router.get('/httproutes', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantApiProductListPermission }],\n        { credentials }\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const data = await k8sClient.listCustomResources('gateway.networking.k8s.io', 'v1', 'httproutes');\n\n      res.json(data);\n    } catch (error) {\n      console.error('error fetching httproutes:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch httproutes' });\n      }\n    }\n  });\n\n  router.patch('/apiproducts/:namespace/:name', async (req, res) => {\n    // whitelist allowed fields for patching\n    const patchSchema = z.object({\n      spec: z.object({\n        displayName: z.string().optional(),\n        description: z.string().optional(),\n        version: z.string().optional(),\n        publishStatus: z.enum(['Draft', 'Published']).optional(),\n        approvalMode: z.enum(['automatic', 'manual']).optional(),\n        tags: z.array(z.string()).optional(),\n        contact: z.object({\n          email: z.string().optional(),\n          team: z.string().optional(),\n          slack: z.string().optional(),\n        }).partial().optional(),\n        documentation: z.object({\n          docsURL: z.string().optional(),\n          openAPISpec: z.string().optional(),\n        }).partial().optional(),\n      }).partial(),\n    });\n\n    const parsed = patchSchema.safeParse(req.body);\n    if (!parsed.success) {\n      return res.status(400).json({ error: 'invalid patch: ' + parsed.error.toString() });\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      if (!credentials || !credentials.principal) {\n        throw new NotAllowedError('authentication required');\n      }\n\n      const { namespace, name } = req.params;\n\n      // try update all permission first (admin)\n      const updateAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiProductUpdateAllPermission }],\n        { credentials }\n      );\n\n      if (updateAllDecision[0].result !== AuthorizeResult.ALLOW) {\n        // fallback to update own permission\n        const updateOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiProductUpdateOwnPermission }],\n          { credentials }\n        );\n\n        if (updateOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership\n        const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n        const existing = await k8sClient.getCustomResource('devportal.kuadrant.io', 'v1alpha1', namespace, 'apiproducts', name);\n        const owner = existing.metadata?.annotations?.['backstage.io/owner'];\n\n        if (owner !== userEntityRef) {\n          throw new NotAllowedError('you can only update your own api products');\n        }\n      }\n\n      // prevent modification of ownership annotation\n      if (req.body.metadata?.annotations) {\n        delete req.body.metadata.annotations['backstage.io/owner'];\n      }\n\n      const updated = await k8sClient.patchCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apiproducts',\n        name,\n        parsed.data,\n      );\n\n      return res.json(updated);\n    } catch (error) {\n      console.error('error updating apiproduct:', error);\n      const errorMessage = error instanceof Error ? error.message : String(error);\n\n      if (error instanceof NotAllowedError) {\n        return res.status(403).json({ error: error.message });\n      } else if (error instanceof InputError) {\n        return res.status(400).json({ error: error.message });\n      } else {\n        return res.status(500).json({ error: errorMessage });\n      }\n    }\n  });\n\n  // planpolicy endpoints\n  router.get('/planpolicies', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantPlanPolicyListPermission }],\n        { credentials }\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const data = await k8sClient.listCustomResources('extensions.kuadrant.io', 'v1alpha1', 'planpolicies');\n\n      // only expose minimal info needed for UI association\n      const filtered = {\n        items: (data.items || []).map((policy: any) => ({\n          metadata: {\n            name: policy.metadata.name,\n            namespace: policy.metadata.namespace,\n          },\n          // only expose targetRef to allow UI to match PlanPolicy -> HTTPRoute\n          targetRef: policy.spec?.targetRef ? {\n            kind: policy.spec.targetRef.kind,\n            name: policy.spec.targetRef.name,\n            namespace: policy.spec.targetRef.namespace,\n          } : undefined,\n          // only expose plan tier info, no other spec details\n          plans: (policy.spec?.plans || []).map((plan: any) => ({\n            tier: plan.tier,\n            description: plan.description,\n            limits: plan.limits,\n          })),\n        })),\n      };\n\n      res.json(filtered);\n    } catch (error) {\n      console.error('error fetching planpolicies:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch planpolicies' });\n      }\n    }\n  });\n\n  router.get('/planpolicies/:namespace/:name', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantPlanPolicyReadPermission }],\n        { credentials }\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const { namespace, name } = req.params;\n      const data = await k8sClient.getCustomResource('extensions.kuadrant.io', 'v1alpha1', namespace, 'planpolicies', name);\n      res.json(data);\n    } catch (error) {\n      console.error('error fetching planpolicy:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch planpolicy' });\n      }\n    }\n  });\n\n  // apikey crud endpoints\n  const requestSchema = z.object({\n    apiProductName: z.string(), // name of the APIProduct\n    namespace: z.string(), // namespace where both APIProduct and APIKey live\n    planTier: z.string(),\n    useCase: z.string().optional(),\n    userEmail: z.string().optional(),\n  });\n\n  router.post('/requests', async (req, res) => {\n    const parsed = requestSchema.safeParse(req.body);\n    if (!parsed.success) {\n      throw new InputError(parsed.error.toString());\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { apiProductName, namespace, planTier, useCase, userEmail } = parsed.data;\n\n      // extract userId from authenticated credentials, not from request body\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n\n      // check permission with resource reference (per-apiproduct access control)\n      const resourceRef = `apiproduct:${namespace}/${apiProductName}`;\n      const decision = await permissions.authorize(\n        [{\n          permission: kuadrantApiKeyRequestCreatePermission,\n          resourceRef,\n        }],\n        { credentials }\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError(`not authorised to request access to ${apiProductName}`);\n      }\n      const randomSuffix = randomBytes(4).toString('hex');\n      const userName = extractNameFromEntityRef(userEntityRef);\n      const requestName = `${userName}-${apiProductName}-${randomSuffix}`.toLowerCase().replace(/[^a-z0-9-]/g, '-');\n\n      const requestedBy: any = { userId: userEntityRef };\n      if (userEmail) {\n        requestedBy.email = userEmail;\n      }\n\n      const request = {\n        apiVersion: 'devportal.kuadrant.io/v1alpha1',\n        kind: 'APIKey',\n        metadata: {\n          name: requestName,\n          namespace,\n        },\n        spec: {\n          apiProductRef: {\n            name: apiProductName,\n          },\n          planTier,\n          useCase: useCase || '',\n          requestedBy,\n        },\n      };\n\n      const created = await k8sClient.createCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        request,\n      );\n\n      // controller handles automatic approval and secret creation\n      // we just create the APIKey resource and let the controller reconcile\n\n      res.status(201).json(created);\n    } catch (error) {\n      console.error('error creating api key request:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to create api key request' });\n      }\n    }\n  });\n\n  router.get('/requests', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      // check if user can read all requests or only own\n      const readAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestReadAllPermission }],\n        { credentials }\n      );\n\n      const canReadAll = readAllDecision[0].result === AuthorizeResult.ALLOW;\n\n      if (!canReadAll) {\n        // try read own permission\n        const readOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiKeyRequestReadOwnPermission }],\n          { credentials }\n        );\n\n        if (readOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n      }\n\n      const status = req.query.status as string;\n      const namespace = req.query.namespace as string;\n\n      let data;\n      if (namespace) {\n        data = await k8sClient.listCustomResources('devportal.kuadrant.io', 'v1alpha1', 'apikeys', namespace);\n      } else {\n        data = await k8sClient.listCustomResources('devportal.kuadrant.io', 'v1alpha1', 'apikeys');\n      }\n\n      let filteredItems = data.items || [];\n\n      // if user only has read.own permission, filter by api product ownership\n      if (!canReadAll) {\n        const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n\n        // get all apiproducts owned by this user\n        const apiproducts = await k8sClient.listCustomResources('devportal.kuadrant.io', 'v1alpha1', 'apiproducts');\n        const ownedApiProducts = (apiproducts.items || [])\n          .filter((product: any) => {\n            const owner = product.metadata?.annotations?.['backstage.io/owner'];\n            return owner === userEntityRef;\n          })\n          .map((product: any) => product.metadata.name);\n\n        // filter requests to only those for owned api products\n        filteredItems = filteredItems.filter((req: any) =>\n          ownedApiProducts.includes(req.spec?.apiProductRef?.name)\n        );\n      }\n\n      if (status) {\n        filteredItems = filteredItems.filter((req: any) => {\n          const phase = req.status?.phase || 'Pending';\n          return phase === status;\n        });\n      }\n\n      res.json({ items: filteredItems });\n    } catch (error) {\n      console.error('error fetching api key requests:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch api key requests' });\n      }\n    }\n  });\n\n  router.get('/requests/my', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestReadOwnPermission }],\n        { credentials }\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      // extract userId from authenticated credentials, not from query params\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n      const namespace = req.query.namespace as string;\n\n      let data;\n      if (namespace) {\n        data = await k8sClient.listCustomResources('devportal.kuadrant.io', 'v1alpha1', 'apikeys', namespace);\n      } else {\n        data = await k8sClient.listCustomResources('devportal.kuadrant.io', 'v1alpha1', 'apikeys');\n      }\n\n      const filteredItems = (data.items || []).filter(\n        (req: any) => req.spec?.requestedBy?.userId === userEntityRef\n      );\n\n      res.json({ items: filteredItems });\n    } catch (error) {\n      console.error('error fetching user api key requests:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch user api key requests' });\n      }\n    }\n  });\n\n  // fetch api key value from secret - only for own approved requests\n  router.get('/requests/:namespace/:name/secret', async (req, res) => {\n    try {\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n      const { namespace, name } = req.params;\n\n      // get the APIKey resource\n      const apiKey = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n      );\n\n      // verify ownership - users can only read their own api key secrets\n      const requestUserId = apiKey.spec?.requestedBy?.userId;\n      if (requestUserId !== userEntityRef) {\n        throw new NotAllowedError('you can only read your own api key secrets');\n      }\n\n      // check if approved and has secretRef\n      if (apiKey.status?.phase !== 'Approved') {\n        res.status(400).json({ error: 'api key request is not approved' });\n        return;\n      }\n\n      const secretRef = apiKey.status?.secretRef;\n      if (!secretRef?.name || !secretRef?.key) {\n        res.status(404).json({ error: 'secret not yet created by controller' });\n        return;\n      }\n\n      // fetch the secret\n      const secret = await k8sClient.getSecret(namespace, secretRef.name);\n      const apiKeyValue = secret.data?.[secretRef.key];\n\n      if (!apiKeyValue) {\n        res.status(404).json({ error: 'api key not found in secret' });\n        return;\n      }\n\n      // secret data is base64 encoded\n      const decodedKey = Buffer.from(apiKeyValue, 'base64').toString('utf-8');\n\n      res.json({ apiKey: decodedKey });\n    } catch (error) {\n      console.error('error fetching api key secret:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch api key secret' });\n      }\n    }\n  });\n\n  const approveRejectSchema = z.object({\n    comment: z.string().optional(),\n  });\n\n  router.post('/requests/:namespace/:name/approve', async (req, res) => {\n    const parsed = approveRejectSchema.safeParse(req.body);\n    if (!parsed.success) {\n      throw new InputError(parsed.error.toString());\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n\n      const { namespace, name } = req.params;\n      const reviewedBy = userEntityRef;\n\n      const request = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n      );\n\n      const spec = request.spec as any;\n      const apiProductName = spec.apiProductRef?.name;\n\n      if (!apiProductName) {\n        throw new InputError('apiProductRef.name is required in APIKey spec');\n      }\n\n      // verify user owns/admins the apiproduct this request is for\n      const apiProduct = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apiproducts',\n        apiProductName,\n      );\n\n      const owner = apiProduct.metadata?.annotations?.['backstage.io/owner'];\n\n      // try update all permission first (admin)\n      const updateAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestUpdateAllPermission }],\n        { credentials },\n      );\n\n      if (updateAllDecision[0].result !== AuthorizeResult.ALLOW) {\n        // fallback to update own permission\n        const updateOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiKeyRequestUpdateOwnPermission }],\n          { credentials },\n        );\n\n        if (updateOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership of the apiproduct\n        if (owner !== userEntityRef) {\n          throw new NotAllowedError('you can only approve requests for your own api products');\n        }\n      }\n\n      // backend sets phase, controller reconciles and creates Secret\n      const status = {\n        phase: 'Approved',\n        reviewedBy,\n        reviewedAt: new Date().toISOString(),\n      };\n\n      await k8sClient.patchCustomResourceStatus(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n        status,\n      );\n\n      res.json({ success: true });\n    } catch (error) {\n      console.error('error approving api key request:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to approve api key request' });\n      }\n    }\n  });\n\n  router.post('/requests/:namespace/:name/reject', async (req, res) => {\n    const parsed = approveRejectSchema.safeParse(req.body);\n    if (!parsed.success) {\n      throw new InputError(parsed.error.toString());\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n\n      const { namespace, name } = req.params;\n      const reviewedBy = userEntityRef;\n\n      // fetch request to get apiproduct info\n      const request = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n      );\n\n      const spec = request.spec as any;\n      const apiProductName = spec.apiProductRef?.name;\n\n      if (!apiProductName) {\n        throw new InputError('apiProductRef.name is required in APIKey spec');\n      }\n\n      // verify user owns/admins the apiproduct this request is for\n      const apiProduct = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apiproducts',\n        apiProductName,\n      );\n\n      const owner = apiProduct.metadata?.annotations?.['backstage.io/owner'];\n        // owner is already in entity ref format\n\n      // try update all permission first (admin)\n      const updateAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestUpdateAllPermission }],\n        { credentials },\n      );\n\n      if (updateAllDecision[0].result !== AuthorizeResult.ALLOW) {\n        // fallback to update own permission\n        const updateOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiKeyRequestUpdateOwnPermission }],\n          { credentials },\n        );\n\n        if (updateOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership of the apiproduct\n        if (owner !== userEntityRef) {\n          throw new NotAllowedError('you can only reject requests for your own api products');\n        }\n      }\n\n      const status = {\n        phase: 'Rejected',\n        reviewedBy,\n        reviewedAt: new Date().toISOString(),\n      };\n\n      await k8sClient.patchCustomResourceStatus(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n        status,\n      );\n\n      res.status(204).send();\n    } catch (error) {\n      console.error('error rejecting api key request:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to reject api key request' });\n      }\n    }\n  });\n\n  const bulkApproveSchema = z.object({\n    requests: z.array(z.object({\n      namespace: z.string(),\n      name: z.string(),\n    })),\n    comment: z.string().optional(),\n  });\n\n  router.post('/requests/bulk-approve', async (req, res) => {\n    const parsed = bulkApproveSchema.safeParse(req.body);\n    if (!parsed.success) {\n      throw new InputError(parsed.error.toString());\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestUpdateAllPermission }],\n        { credentials },\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const { requests } = parsed.data;\n      const reviewedBy = userEntityRef;\n      const results = [];\n\n      for (const reqRef of requests) {\n        try {\n          // backend sets phase, controller reconciles and creates Secret\n          const status = {\n            phase: 'Approved',\n            reviewedBy,\n            reviewedAt: new Date().toISOString(),\n          };\n\n          await k8sClient.patchCustomResourceStatus(\n            'devportal.kuadrant.io',\n            'v1alpha1',\n            reqRef.namespace,\n            'apikeys',\n            reqRef.name,\n            status,\n          );\n\n          results.push({ namespace: reqRef.namespace, name: reqRef.name, success: true });\n        } catch (error) {\n          console.error(`error approving request ${reqRef.namespace}/${reqRef.name}:`, error);\n          results.push({\n            namespace: reqRef.namespace,\n            name: reqRef.name,\n            success: false,\n            error: error instanceof Error ? error.message : 'unknown error'\n          });\n        }\n      }\n\n      res.json({ results });\n    } catch (error) {\n      console.error('error in bulk approve:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to bulk approve api key requests' });\n      }\n    }\n  });\n\n  router.post('/requests/bulk-reject', async (req, res) => {\n    const parsed = bulkApproveSchema.safeParse(req.body);\n    if (!parsed.success) {\n      throw new InputError(parsed.error.toString());\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestUpdateAllPermission }],\n        { credentials },\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const { requests } = parsed.data;\n      const reviewedBy = userEntityRef;\n      const results = [];\n\n      for (const reqRef of requests) {\n        try {\n          // fetch request to get apiproduct info\n          const request = await k8sClient.getCustomResource(\n            'devportal.kuadrant.io',\n            'v1alpha1',\n            reqRef.namespace,\n            'apikeys',\n            reqRef.name,\n          );\n\n          const spec = request.spec as any;\n\n          // verify user owns/admins the apiproduct this request is for\n          // apikey and apiproduct are in the same namespace\n          const apiProduct = await k8sClient.getCustomResource(\n            'devportal.kuadrant.io',\n            'v1alpha1',\n            reqRef.namespace,\n            'apiproducts',\n            spec.apiProductRef?.name,\n          );\n\n          const owner = apiProduct.metadata?.annotations?.['backstage.io/owner'];\n        // owner is already in entity ref format\n\n          // try update all permission first (admin)\n          const updateAllDecision = await permissions.authorize(\n            [{ permission: kuadrantApiProductUpdateAllPermission }],\n            { credentials },\n          );\n\n          if (updateAllDecision[0].result !== AuthorizeResult.ALLOW) {\n            // fallback to update own permission\n            const updateOwnDecision = await permissions.authorize(\n              [{ permission: kuadrantApiProductUpdateOwnPermission }],\n              { credentials },\n            );\n\n            if (updateOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n              throw new NotAllowedError('unauthorised');\n            }\n\n            // verify ownership of the apiproduct\n            if (owner !== userEntityRef) {\n              throw new NotAllowedError('you can only reject requests for your own api products');\n            }\n          }\n\n          const status = {\n            phase: 'Rejected',\n            reviewedBy,\n            reviewedAt: new Date().toISOString(),\n          };\n\n          await k8sClient.patchCustomResourceStatus(\n            'devportal.kuadrant.io',\n            'v1alpha1',\n            reqRef.namespace,\n            'apikeys',\n            reqRef.name,\n            status,\n          );\n\n          results.push({ namespace: reqRef.namespace, name: reqRef.name, success: true });\n        } catch (error) {\n          console.error(`error rejecting request ${reqRef.namespace}/${reqRef.name}:`, error);\n          results.push({\n            namespace: reqRef.namespace,\n            name: reqRef.name,\n            success: false,\n            error: error instanceof Error ? error.message : 'unknown error'\n          });\n        }\n      }\n\n      res.json({ results });\n    } catch (error) {\n      console.error('error in bulk reject:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to bulk reject api key requests' });\n      }\n    }\n  });\n\n  router.delete('/requests/:namespace/:name', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n      const { namespace, name } = req.params;\n\n      // get request to verify ownership\n      const request = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n      );\n\n      const requestUserId = request.spec?.requestedBy?.userId;\n\n      // check if user can delete all requests or just their own\n      const deleteAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestDeleteAllPermission }],\n        { credentials }\n      );\n\n      const canDeleteAll = deleteAllDecision[0].result === AuthorizeResult.ALLOW;\n\n      if (!canDeleteAll) {\n        // check if user can delete their own requests\n        const deleteOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiKeyRequestDeleteOwnPermission }],\n          { credentials }\n        );\n\n        if (deleteOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership\n        if (requestUserId !== userEntityRef) {\n          throw new NotAllowedError('you can only delete your own api key requests');\n        }\n      }\n\n      // controller owns the Secret via OwnerReference - it will be garbage collected\n      await k8sClient.deleteCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n      );\n      res.status(204).send();\n    } catch (error) {\n      console.error('error deleting api key request:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to delete api key request' });\n      }\n    }\n  });\n\n  router.patch('/requests/:namespace/:name', async (req, res) => {\n    // whitelist allowed fields for patching\n    const patchSchema = z.object({\n      spec: z.object({\n        useCase: z.string().optional(),\n        planTier: z.string().optional(),\n      }).partial(),\n    });\n\n    const parsed = patchSchema.safeParse(req.body);\n    if (!parsed.success) {\n      throw new InputError('invalid patch: ' + parsed.error.toString());\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n      const { namespace, name } = req.params;\n\n      // get existing request to check ownership and status\n      const existing = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n      );\n\n      const requestUserId = existing.spec?.requestedBy?.userId;\n      const currentPhase = existing.status?.phase || 'Pending';\n\n      // only pending requests can be edited\n      if (currentPhase !== 'Pending') {\n        throw new NotAllowedError('only pending requests can be edited');\n      }\n\n      // check if user can update all requests or just their own\n      const updateAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestUpdateAllPermission }],\n        { credentials }\n      );\n\n      if (updateAllDecision[0].result !== AuthorizeResult.ALLOW) {\n        // check if user can update their own requests\n        const updateOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiKeyRequestUpdateOwnPermission }],\n          { credentials }\n        );\n\n        if (updateOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership\n        if (requestUserId !== userEntityRef) {\n          throw new NotAllowedError('you can only update your own api key requests');\n        }\n      }\n\n      // apply validated patch\n      const updated = await k8sClient.patchCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n        parsed.data,\n      );\n\n      res.json(updated);\n    } catch (error) {\n      console.error('error updating api key request:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else if (error instanceof InputError) {\n        res.status(400).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to update api key request' });\n      }\n    }\n  });\n\n  // expose permissions for backstage permission framework\n  router.use(createPermissionIntegrationRouter({\n    permissions: kuadrantPermissions,\n  }));\n\n  return router;\n}\n"],"names":["NotAllowedError","permissions","Router","cors","express","k8sClient","KuadrantK8sClient","kuadrantApiProductListPermission","AuthorizeResult","kuadrantApiProductReadAllPermission","kuadrantApiProductReadOwnPermission","kuadrantApiProductCreatePermission","InputError","getAPIProductEntityProvider","kuadrantApiProductDeleteAllPermission","kuadrantApiProductDeleteOwnPermission","req","z","kuadrantApiProductUpdateAllPermission","kuadrantApiProductUpdateOwnPermission","kuadrantPlanPolicyListPermission","kuadrantPlanPolicyReadPermission","kuadrantApiKeyRequestCreatePermission","randomBytes","kuadrantApiKeyRequestReadAllPermission","kuadrantApiKeyRequestReadOwnPermission","kuadrantApiKeyRequestUpdateAllPermission","kuadrantApiKeyRequestUpdateOwnPermission","kuadrantApiKeyRequestDeleteAllPermission","kuadrantApiKeyRequestDeleteOwnPermission","createPermissionIntegrationRouter","kuadrantPermissions"],"mappings":";;;;;;;;;;;;;;;;;;;;AAqCA,SAAS,yBAAyB,SAA2B,EAAA;AAC3D,EAAM,MAAA,KAAA,GAAQ,SAAU,CAAA,KAAA,CAAM,GAAG,CAAA;AACjC,EAAO,OAAA,KAAA,CAAM,KAAM,CAAA,MAAA,GAAS,CAAC,CAAA;AAC/B;AAEA,eAAe,eAAA,CAAgB,GAAsB,EAAA,QAAA,EAA2B,QAG7E,EAAA;AACD,EAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,EAAA,IAAI,CAAC,WAAA,IAAe,CAAC,WAAA,CAAY,SAAW,EAAA;AAC1C,IAAM,MAAA,IAAIA,uBAAgB,yBAAyB,CAAA;AAAA;AAIrD,EAAA,MAAM,IAAO,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,WAAW,CAAA;AACnD,EAAM,MAAA,MAAA,GAAS,IAAK,CAAA,mBAAA,IAAuB,EAAC;AAE5C,EAAQ,OAAA,CAAA,GAAA,CAAI,yCAAyC,IAAK,CAAA,aAAa,YAAY,MAAO,CAAA,IAAA,CAAK,GAAG,CAAC,CAAE,CAAA,CAAA;AACrG,EAAO,OAAA;AAAA,IACL,eAAe,IAAK,CAAA,aAAA;AAAA,IACpB;AAAA,GACF;AACF;AAEA,eAAsB,YAAa,CAAA;AAAA,EACjC,QAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,eACAC;AACF,CAK4B,EAAA;AAC1B,EAAA,MAAM,SAASC,uBAAO,EAAA;AAGtB,EAAA,MAAA,CAAO,IAAIC,qBAAK,CAAA;AAAA,IACd,MAAQ,EAAA,uBAAA;AAAA,IACR,WAAa,EAAA;AAAA,GACd,CAAC,CAAA;AAEF,EAAO,MAAA,CAAA,GAAA,CAAIC,wBAAQ,CAAA,IAAA,EAAM,CAAA;AAEzB,EAAM,MAAAC,WAAA,GAAY,IAAIC,2BAAA,CAAkB,MAAM,CAAA;AAG9C,EAAA,MAAA,CAAO,GAAI,CAAA,cAAA,EAAgB,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC7C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAM,MAAA,YAAA,GAAe,MAAML,aAAY,CAAA,SAAA;AAAA,QACrC,CAAC,EAAE,UAAY,EAAAM,4CAAA,EAAkC,CAAA;AAAA,QACjD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,YAAa,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWC,uCAAgB,KAAO,EAAA;AACpD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,MAAA,MAAM,OAAO,MAAMK,WAAA,CAAU,mBAAoB,CAAA,uBAAA,EAAyB,YAAY,aAAa,CAAA;AAGnG,MAAM,MAAA,eAAA,GAAkB,MAAMJ,aAAY,CAAA,SAAA;AAAA,QACxC,CAAC,EAAE,UAAY,EAAAQ,+CAAA,EAAqC,CAAA;AAAA,QACpD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,eAAgB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWD,uCAAgB,KAAO,EAAA;AAEvD,QAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,OACR,MAAA;AAEL,QAAM,MAAA,eAAA,GAAkB,MAAMP,aAAY,CAAA,SAAA;AAAA,UACxC,CAAC,EAAE,UAAY,EAAAS,+CAAA,EAAqC,CAAA;AAAA,UACpD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,eAAgB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWF,uCAAgB,KAAO,EAAA;AACvD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,MAAM,cAAc,IAAK,CAAA,KAAA,IAAS,EAAI,EAAA,MAAA,CAAO,CAAC,IAAc,KAAA;AAC1D,UAAA,MAAM,KAAQ,GAAA,IAAA,CAAK,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAC/D,UAAA,OAAO,KAAU,KAAA,aAAA;AAAA,SAClB,CAAA;AAED,QAAA,GAAA,CAAI,KAAK,EAAE,GAAG,IAAM,EAAA,KAAA,EAAO,YAAY,CAAA;AAAA;AACzC,aACO,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,+BAA+B,KAAK,CAAA;AAClD,MAAA,IAAI,iBAAiBA,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,+BAA+B,CAAA;AAAA;AAC/D;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,GAAI,CAAA,+BAAA,EAAiC,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC9D,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAGhC,MAAM,MAAA,eAAA,GAAkB,MAAMC,aAAY,CAAA,SAAA;AAAA,QACxC,CAAC,EAAE,UAAY,EAAAQ,+CAAA,EAAqC,CAAA;AAAA,QACpD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,eAAgB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWD,uCAAgB,KAAO,EAAA;AAEvD,QAAM,MAAA,eAAA,GAAkB,MAAMP,aAAY,CAAA,SAAA;AAAA,UACxC,CAAC,EAAE,UAAY,EAAAS,+CAAA,EAAqC,CAAA;AAAA,UACpD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,eAAgB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWF,uCAAgB,KAAO,EAAA;AACvD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,QAAM,MAAA,IAAA,GAAO,MAAMK,WAAU,CAAA,iBAAA,CAAkB,yBAAyB,UAAY,EAAA,SAAA,EAAW,eAAe,IAAI,CAAA;AAClH,QAAA,MAAM,KAAQ,GAAA,IAAA,CAAK,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAE/D,QAAA,IAAI,UAAU,aAAe,EAAA;AAC3B,UAAM,MAAA,IAAIL,uBAAgB,yCAAyC,CAAA;AAAA;AAGrE,QAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,OACR,MAAA;AAEL,QAAM,MAAA,IAAA,GAAO,MAAMK,WAAU,CAAA,iBAAA,CAAkB,yBAAyB,UAAY,EAAA,SAAA,EAAW,eAAe,IAAI,CAAA;AAClH,QAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA;AACf,aACO,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAA8B,CAAA;AAAA;AAC9D;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,IAAK,CAAA,cAAA,EAAgB,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAM,MAAA,QAAA,GAAW,MAAMC,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAU,8CAAA,EAAoC,CAAA;AAAA,QACnD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWH,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,MAAA,MAAM,aAAa,GAAI,CAAA,IAAA;AACvB,MAAM,MAAA,SAAA,GAAY,WAAW,IAAM,EAAA,SAAA;AAEnC,MAAI,IAAA,CAAC,WAAW,IAAQ,IAAA,CAAC,WAAW,IAAQ,IAAA,CAAC,WAAW,SAAW,EAAA;AACjE,QAAM,MAAA,IAAIY,kBAAW,sDAAsD,CAAA;AAAA;AAI7E,MAAA,MAAM,YAAY,SAAU,CAAA,SAAA;AAC5B,MAAA,UAAA,CAAW,SAAS,SAAY,GAAA,SAAA;AAIhC,MAAI,IAAA,CAAC,UAAW,CAAA,QAAA,CAAS,WAAa,EAAA;AACpC,QAAW,UAAA,CAAA,QAAA,CAAS,cAAc,EAAC;AAAA;AAErC,MAAW,UAAA,CAAA,QAAA,CAAS,WAAY,CAAA,oBAAoB,CAAI,GAAA,aAAA;AAExD,MAAM,MAAA,OAAA,GAAU,MAAMP,WAAU,CAAA,oBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA;AAAA,OACF;AAGA,MAAA,MAAM,WAAWQ,iCAA4B,EAAA;AAC7C,MAAA,IAAI,QAAU,EAAA;AACZ,QAAA,MAAM,SAAS,OAAQ,EAAA;AAAA;AAGzB,MAAA,GAAA,CAAI,MAAO,CAAA,GAAG,CAAE,CAAA,IAAA,CAAK,OAAO,CAAA;AAAA,aACrB,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,MAAA,MAAM,eAAe,KAAiB,YAAA,KAAA,GAAQ,KAAM,CAAA,OAAA,GAAU,OAAO,KAAK,CAAA;AAE1E,MAAA,IAAI,iBAAiBb,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OAC/C,MAAA,IAAW,iBAAiBY,iBAAY,EAAA;AACtC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AAEL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAc,CAAA;AAAA;AAC9C;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,MAAO,CAAA,+BAAA,EAAiC,OAAO,GAAA,EAAK,GAAQ,KAAA;AACjE,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAGhC,MAAM,MAAA,iBAAA,GAAoB,MAAMX,aAAY,CAAA,SAAA;AAAA,QAC1C,CAAC,EAAE,UAAY,EAAAa,iDAAA,EAAuC,CAAA;AAAA,QACtD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWN,uCAAgB,KAAO,EAAA;AAEzD,QAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,UAC1C,CAAC,EAAE,UAAY,EAAAc,iDAAA,EAAuC,CAAA;AAAA,UACtD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWP,uCAAgB,KAAO,EAAA;AACzD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,QAAM,MAAA,QAAA,GAAW,MAAMK,WAAU,CAAA,iBAAA,CAAkB,yBAAyB,UAAY,EAAA,SAAA,EAAW,eAAe,IAAI,CAAA;AACtH,QAAA,MAAM,KAAQ,GAAA,QAAA,CAAS,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAEnE,QAAA,IAAI,UAAU,aAAe,EAAA;AAC3B,UAAM,MAAA,IAAIL,uBAAgB,2CAA2C,CAAA;AAAA;AACvE;AAEF,MAAA,OAAA,CAAQ,GAAI,CAAA,CAAA,sCAAA,EAAyC,SAAS,CAAA,CAAA,EAAI,IAAI,CAAE,CAAA,CAAA;AAExE,MAAI,IAAA,WAAA;AACJ,MAAI,IAAA;AACF,QAAA,WAAA,GAAc,MAAMK,WAAU,CAAA,mBAAA;AAAA,UAC5B,uBAAA;AAAA,UACA,UAAA;AAAA,UACA,SAAA;AAAA,UACA;AAAA,SACF;AAAA,eACO,KAAO,EAAA;AACd,QAAQ,OAAA,CAAA,IAAA,CAAK,iDAAiD,KAAK,CAAA;AACnE,QAAc,WAAA,GAAA,EAAE,KAAO,EAAA,EAAG,EAAA;AAAA;AAI5B,MAAA,MAAM,eAAmB,GAAA,CAAA,WAAA,CAAY,KAAS,IAAA,EAAI,EAAA,MAAA;AAAA,QAAO,CAACW,IAAAA,KACxDA,IAAI,CAAA,IAAA,EAAM,eAAe,IAAS,KAAA;AAAA,OACpC;AAEA,MAAA,OAAA,CAAQ,GAAI,CAAA,CAAA,MAAA,EAAS,eAAgB,CAAA,MAAM,CAAoB,kBAAA,CAAA,CAAA;AAG/D,MAAM,MAAA,eAAA,GAAkB,MAAM,OAAQ,CAAA,UAAA;AAAA,QACpC,eAAA,CAAgB,GAAI,CAAA,OAAO,OAAiB,KAAA;AAC1C,UAAM,MAAA,WAAA,GAAc,QAAQ,QAAS,CAAA,IAAA;AACrC,UAAA,OAAA,CAAQ,GAAI,CAAA,CAAA,iBAAA,EAAoB,SAAS,CAAA,CAAA,EAAI,WAAW,CAAE,CAAA,CAAA;AAC1D,UAAA,MAAMX,WAAU,CAAA,oBAAA;AAAA,YACd,uBAAA;AAAA,YACA,UAAA;AAAA,YACA,SAAA;AAAA,YACA,SAAA;AAAA,YACA;AAAA,WACF;AAAA,SACD;AAAA,OACH;AAEA,MAAA,MAAM,WAAW,eAAgB,CAAA,MAAA,CAAO,CAAK,CAAA,KAAA,CAAA,CAAE,WAAW,UAAU,CAAA;AACpE,MAAI,IAAA,QAAA,CAAS,SAAS,CAAG,EAAA;AACvB,QAAQ,OAAA,CAAA,IAAA;AAAA,UAAK,CAAA,EAAG,SAAS,MAAM,CAAA,0BAAA,CAAA;AAAA,UAC7B,QAAS,CAAA,GAAA,CAAI,CAAC,CAAA,KAAW,EAAE,MAAM;AAAA,SACnC;AAAA;AAEF,MAAA,MAAMA,WAAU,CAAA,oBAAA;AAAA,QACd,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA;AAAA,OACF;AAGA,MAAA,MAAM,WAAWQ,iCAA4B,EAAA;AAC7C,MAAA,IAAI,QAAU,EAAA;AACZ,QAAA,MAAM,SAAS,OAAQ,EAAA;AAAA;AAGzB,MAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,EAAA;AAAA,aACd,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,MAAA,IAAI,iBAAiBb,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,+BAA+B,CAAA;AAAA;AAC/D;AACF,GACD,CAAA;AAGD,EAAA,MAAA,CAAO,GAAI,CAAA,aAAA,EAAe,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC5C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAM,MAAA,QAAA,GAAW,MAAMC,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAM,4CAAA,EAAkC,CAAA;AAAA,QACjD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWC,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAA,MAAM,OAAO,MAAMK,WAAA,CAAU,mBAAoB,CAAA,2BAAA,EAA6B,MAAM,YAAY,CAAA;AAEhG,MAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,aACN,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAA8B,CAAA;AAAA;AAC9D;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,KAAM,CAAA,+BAAA,EAAiC,OAAO,GAAA,EAAK,GAAQ,KAAA;AAEhE,IAAM,MAAA,WAAA,GAAciB,MAAE,MAAO,CAAA;AAAA,MAC3B,IAAA,EAAMA,MAAE,MAAO,CAAA;AAAA,QACb,WAAa,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,QACjC,WAAa,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,QACjC,OAAS,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,QAC7B,aAAA,EAAeA,MAAE,IAAK,CAAA,CAAC,SAAS,WAAW,CAAC,EAAE,QAAS,EAAA;AAAA,QACvD,YAAA,EAAcA,MAAE,IAAK,CAAA,CAAC,aAAa,QAAQ,CAAC,EAAE,QAAS,EAAA;AAAA,QACvD,MAAMA,KAAE,CAAA,KAAA,CAAMA,MAAE,MAAO,EAAC,EAAE,QAAS,EAAA;AAAA,QACnC,OAAA,EAASA,MAAE,MAAO,CAAA;AAAA,UAChB,KAAO,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,UAC3B,IAAM,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,UAC1B,KAAO,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS;AAAA,SAC5B,CAAA,CAAE,OAAQ,EAAA,CAAE,QAAS,EAAA;AAAA,QACtB,aAAA,EAAeA,MAAE,MAAO,CAAA;AAAA,UACtB,OAAS,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,UAC7B,WAAa,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS;AAAA,SAClC,CAAA,CAAE,OAAQ,EAAA,CAAE,QAAS;AAAA,OACvB,EAAE,OAAQ;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,MAAS,GAAA,WAAA,CAAY,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AAC7C,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,OAAO,GAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,CAAA,EAAE,KAAO,EAAA,iBAAA,GAAoB,MAAO,CAAA,KAAA,CAAM,QAAS,EAAA,EAAG,CAAA;AAAA;AAGpF,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAA,IAAI,CAAC,WAAA,IAAe,CAAC,WAAA,CAAY,SAAW,EAAA;AAC1C,QAAM,MAAA,IAAIjB,uBAAgB,yBAAyB,CAAA;AAAA;AAGrD,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAGhC,MAAM,MAAA,iBAAA,GAAoB,MAAMC,aAAY,CAAA,SAAA;AAAA,QAC1C,CAAC,EAAE,UAAY,EAAAiB,iDAAA,EAAuC,CAAA;AAAA,QACtD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWV,uCAAgB,KAAO,EAAA;AAEzD,QAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,UAC1C,CAAC,EAAE,UAAY,EAAAkB,iDAAA,EAAuC,CAAA;AAAA,UACtD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWX,uCAAgB,KAAO,EAAA;AACzD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,QAAM,MAAA,QAAA,GAAW,MAAMK,WAAU,CAAA,iBAAA,CAAkB,yBAAyB,UAAY,EAAA,SAAA,EAAW,eAAe,IAAI,CAAA;AACtH,QAAA,MAAM,KAAQ,GAAA,QAAA,CAAS,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAEnE,QAAA,IAAI,UAAU,aAAe,EAAA;AAC3B,UAAM,MAAA,IAAIL,uBAAgB,2CAA2C,CAAA;AAAA;AACvE;AAIF,MAAI,IAAA,GAAA,CAAI,IAAK,CAAA,QAAA,EAAU,WAAa,EAAA;AAClC,QAAA,OAAO,GAAI,CAAA,IAAA,CAAK,QAAS,CAAA,WAAA,CAAY,oBAAoB,CAAA;AAAA;AAG3D,MAAM,MAAA,OAAA,GAAU,MAAMK,WAAU,CAAA,mBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA,IAAA;AAAA,QACA,MAAO,CAAA;AAAA,OACT;AAEA,MAAO,OAAA,GAAA,CAAI,KAAK,OAAO,CAAA;AAAA,aAChB,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,MAAA,MAAM,eAAe,KAAiB,YAAA,KAAA,GAAQ,KAAM,CAAA,OAAA,GAAU,OAAO,KAAK,CAAA;AAE1E,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAO,OAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,KAAM,CAAA,OAAA,EAAS,CAAA;AAAA,OACtD,MAAA,IAAW,iBAAiBY,iBAAY,EAAA;AACtC,QAAO,OAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,KAAM,CAAA,OAAA,EAAS,CAAA;AAAA,OAC/C,MAAA;AACL,QAAO,OAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAc,CAAA;AAAA;AACrD;AACF,GACD,CAAA;AAGD,EAAA,MAAA,CAAO,GAAI,CAAA,eAAA,EAAiB,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAM,MAAA,QAAA,GAAW,MAAMX,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAmB,4CAAA,EAAkC,CAAA;AAAA,QACjD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWZ,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAA,MAAM,OAAO,MAAMK,WAAA,CAAU,mBAAoB,CAAA,wBAAA,EAA0B,YAAY,cAAc,CAAA;AAGrG,MAAA,MAAM,QAAW,GAAA;AAAA,QACf,QAAQ,IAAK,CAAA,KAAA,IAAS,EAAI,EAAA,GAAA,CAAI,CAAC,MAAiB,MAAA;AAAA,UAC9C,QAAU,EAAA;AAAA,YACR,IAAA,EAAM,OAAO,QAAS,CAAA,IAAA;AAAA,YACtB,SAAA,EAAW,OAAO,QAAS,CAAA;AAAA,WAC7B;AAAA;AAAA,UAEA,SAAA,EAAW,MAAO,CAAA,IAAA,EAAM,SAAY,GAAA;AAAA,YAClC,IAAA,EAAM,MAAO,CAAA,IAAA,CAAK,SAAU,CAAA,IAAA;AAAA,YAC5B,IAAA,EAAM,MAAO,CAAA,IAAA,CAAK,SAAU,CAAA,IAAA;AAAA,YAC5B,SAAA,EAAW,MAAO,CAAA,IAAA,CAAK,SAAU,CAAA;AAAA,WAC/B,GAAA,KAAA,CAAA;AAAA;AAAA,UAEJ,KAAA,EAAA,CAAQ,OAAO,IAAM,EAAA,KAAA,IAAS,EAAI,EAAA,GAAA,CAAI,CAAC,IAAe,MAAA;AAAA,YACpD,MAAM,IAAK,CAAA,IAAA;AAAA,YACX,aAAa,IAAK,CAAA,WAAA;AAAA,YAClB,QAAQ,IAAK,CAAA;AAAA,WACb,CAAA;AAAA,SACF,CAAA;AAAA,OACJ;AAEA,MAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,aACV,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,gCAAgC,KAAK,CAAA;AACnD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gCAAgC,CAAA;AAAA;AAChE;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,GAAI,CAAA,gCAAA,EAAkC,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC/D,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAM,MAAA,QAAA,GAAW,MAAMC,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAoB,4CAAA,EAAkC,CAAA;AAAA,QACjD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWb,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAChC,MAAM,MAAA,IAAA,GAAO,MAAMK,WAAU,CAAA,iBAAA,CAAkB,0BAA0B,UAAY,EAAA,SAAA,EAAW,gBAAgB,IAAI,CAAA;AACpH,MAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,aACN,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAA8B,CAAA;AAAA;AAC9D;AACF,GACD,CAAA;AAGD,EAAM,MAAA,aAAA,GAAgBiB,MAAE,MAAO,CAAA;AAAA,IAC7B,cAAA,EAAgBA,MAAE,MAAO,EAAA;AAAA;AAAA,IACzB,SAAA,EAAWA,MAAE,MAAO,EAAA;AAAA;AAAA,IACpB,QAAA,EAAUA,MAAE,MAAO,EAAA;AAAA,IACnB,OAAS,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,IAC7B,SAAW,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS;AAAA,GAChC,CAAA;AAED,EAAA,MAAA,CAAO,IAAK,CAAA,WAAA,EAAa,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC3C,IAAA,MAAM,MAAS,GAAA,aAAA,CAAc,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AAC/C,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,MAAM,IAAIL,iBAAA,CAAW,MAAO,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAG9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,cAAgB,EAAA,SAAA,EAAW,UAAU,OAAS,EAAA,SAAA,KAAc,MAAO,CAAA,IAAA;AAG3E,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AAGvE,MAAA,MAAM,WAAc,GAAA,CAAA,WAAA,EAAc,SAAS,CAAA,CAAA,EAAI,cAAc,CAAA,CAAA;AAC7D,MAAM,MAAA,QAAA,GAAW,MAAMX,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC;AAAA,UACC,UAAY,EAAAqB,iDAAA;AAAA,UACZ;AAAA,SACD,CAAA;AAAA,QACD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWd,uCAAgB,KAAO,EAAA;AAChD,QAAA,MAAM,IAAIR,sBAAA,CAAgB,CAAuC,oCAAA,EAAA,cAAc,CAAE,CAAA,CAAA;AAAA;AAEnF,MAAA,MAAM,YAAe,GAAAuB,kBAAA,CAAY,CAAC,CAAA,CAAE,SAAS,KAAK,CAAA;AAClD,MAAM,MAAA,QAAA,GAAW,yBAAyB,aAAa,CAAA;AACvD,MAAA,MAAM,WAAc,GAAA,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,cAAc,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA,CAAG,WAAY,EAAA,CAAE,OAAQ,CAAA,aAAA,EAAe,GAAG,CAAA;AAE5G,MAAM,MAAA,WAAA,GAAmB,EAAE,MAAA,EAAQ,aAAc,EAAA;AACjD,MAAA,IAAI,SAAW,EAAA;AACb,QAAA,WAAA,CAAY,KAAQ,GAAA,SAAA;AAAA;AAGtB,MAAA,MAAM,OAAU,GAAA;AAAA,QACd,UAAY,EAAA,gCAAA;AAAA,QACZ,IAAM,EAAA,QAAA;AAAA,QACN,QAAU,EAAA;AAAA,UACR,IAAM,EAAA,WAAA;AAAA,UACN;AAAA,SACF;AAAA,QACA,IAAM,EAAA;AAAA,UACJ,aAAe,EAAA;AAAA,YACb,IAAM,EAAA;AAAA,WACR;AAAA,UACA,QAAA;AAAA,UACA,SAAS,OAAW,IAAA,EAAA;AAAA,UACpB;AAAA;AACF,OACF;AAEA,MAAM,MAAA,OAAA,GAAU,MAAMlB,WAAU,CAAA,oBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAKA,MAAA,GAAA,CAAI,MAAO,CAAA,GAAG,CAAE,CAAA,IAAA,CAAK,OAAO,CAAA;AAAA,aACrB,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,mCAAmC,KAAK,CAAA;AACtD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,oCAAoC,CAAA;AAAA;AACpE;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,GAAI,CAAA,WAAA,EAAa,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC1C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAGlD,MAAM,MAAA,eAAA,GAAkB,MAAMC,aAAY,CAAA,SAAA;AAAA,QACxC,CAAC,EAAE,UAAY,EAAAuB,kDAAA,EAAwC,CAAA;AAAA,QACvD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,MAAM,UAAa,GAAA,eAAA,CAAgB,CAAC,CAAA,CAAE,WAAWhB,sCAAgB,CAAA,KAAA;AAEjE,MAAA,IAAI,CAAC,UAAY,EAAA;AAEf,QAAM,MAAA,eAAA,GAAkB,MAAMP,aAAY,CAAA,SAAA;AAAA,UACxC,CAAC,EAAE,UAAY,EAAAwB,kDAAA,EAAwC,CAAA;AAAA,UACvD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,eAAgB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWjB,uCAAgB,KAAO,EAAA;AACvD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAC1C;AAGF,MAAM,MAAA,MAAA,GAAS,IAAI,KAAM,CAAA,MAAA;AACzB,MAAM,MAAA,SAAA,GAAY,IAAI,KAAM,CAAA,SAAA;AAE5B,MAAI,IAAA,IAAA;AACJ,MAAA,IAAI,SAAW,EAAA;AACb,QAAA,IAAA,GAAO,MAAMK,WAAU,CAAA,mBAAA,CAAoB,uBAAyB,EAAA,UAAA,EAAY,WAAW,SAAS,CAAA;AAAA,OAC/F,MAAA;AACL,QAAA,IAAA,GAAO,MAAMA,WAAA,CAAU,mBAAoB,CAAA,uBAAA,EAAyB,YAAY,SAAS,CAAA;AAAA;AAG3F,MAAI,IAAA,aAAA,GAAgB,IAAK,CAAA,KAAA,IAAS,EAAC;AAGnC,MAAA,IAAI,CAAC,UAAY,EAAA;AACf,QAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AAGvE,QAAA,MAAM,cAAc,MAAMA,WAAA,CAAU,mBAAoB,CAAA,uBAAA,EAAyB,YAAY,aAAa,CAAA;AAC1G,QAAA,MAAM,oBAAoB,WAAY,CAAA,KAAA,IAAS,EAC5C,EAAA,MAAA,CAAO,CAAC,OAAiB,KAAA;AACxB,UAAA,MAAM,KAAQ,GAAA,OAAA,CAAQ,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAClE,UAAA,OAAO,KAAU,KAAA,aAAA;AAAA,SAClB,CACA,CAAA,GAAA,CAAI,CAAC,OAAiB,KAAA,OAAA,CAAQ,SAAS,IAAI,CAAA;AAG9C,QAAA,aAAA,GAAgB,aAAc,CAAA,MAAA;AAAA,UAAO,CAACW,IACpC,KAAA,gBAAA,CAAiB,SAASA,IAAI,CAAA,IAAA,EAAM,eAAe,IAAI;AAAA,SACzD;AAAA;AAGF,MAAA,IAAI,MAAQ,EAAA;AACV,QAAgB,aAAA,GAAA,aAAA,CAAc,MAAO,CAAA,CAACA,IAAa,KAAA;AACjD,UAAM,MAAA,KAAA,GAAQA,IAAI,CAAA,MAAA,EAAQ,KAAS,IAAA,SAAA;AACnC,UAAA,OAAO,KAAU,KAAA,MAAA;AAAA,SAClB,CAAA;AAAA;AAGH,MAAA,GAAA,CAAI,IAAK,CAAA,EAAE,KAAO,EAAA,aAAA,EAAe,CAAA;AAAA,aAC1B,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,oCAAoC,KAAK,CAAA;AACvD,MAAA,IAAI,iBAAiBhB,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,oCAAoC,CAAA;AAAA;AACpE;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,GAAI,CAAA,cAAA,EAAgB,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC7C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAM,MAAA,QAAA,GAAW,MAAMC,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAwB,kDAAA,EAAwC,CAAA;AAAA,QACvD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWjB,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,MAAM,MAAA,SAAA,GAAY,IAAI,KAAM,CAAA,SAAA;AAE5B,MAAI,IAAA,IAAA;AACJ,MAAA,IAAI,SAAW,EAAA;AACb,QAAA,IAAA,GAAO,MAAMK,WAAU,CAAA,mBAAA,CAAoB,uBAAyB,EAAA,UAAA,EAAY,WAAW,SAAS,CAAA;AAAA,OAC/F,MAAA;AACL,QAAA,IAAA,GAAO,MAAMA,WAAA,CAAU,mBAAoB,CAAA,uBAAA,EAAyB,YAAY,SAAS,CAAA;AAAA;AAG3F,MAAA,MAAM,aAAiB,GAAA,CAAA,IAAA,CAAK,KAAS,IAAA,EAAI,EAAA,MAAA;AAAA,QACvC,CAACW,IAAAA,KAAaA,IAAI,CAAA,IAAA,EAAM,aAAa,MAAW,KAAA;AAAA,OAClD;AAEA,MAAA,GAAA,CAAI,IAAK,CAAA,EAAE,KAAO,EAAA,aAAA,EAAe,CAAA;AAAA,aAC1B,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,yCAAyC,KAAK,CAAA;AAC5D,MAAA,IAAI,iBAAiBhB,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,yCAAyC,CAAA;AAAA;AACzE;AACF,GACD,CAAA;AAGD,EAAA,MAAA,CAAO,GAAI,CAAA,mCAAA,EAAqC,OAAO,GAAA,EAAK,GAAQ,KAAA;AAClE,IAAI,IAAA;AACF,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAGhC,MAAM,MAAA,MAAA,GAAS,MAAMK,WAAU,CAAA,iBAAA;AAAA,QAC7B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAGA,MAAM,MAAA,aAAA,GAAgB,MAAO,CAAA,IAAA,EAAM,WAAa,EAAA,MAAA;AAChD,MAAA,IAAI,kBAAkB,aAAe,EAAA;AACnC,QAAM,MAAA,IAAIL,uBAAgB,4CAA4C,CAAA;AAAA;AAIxE,MAAI,IAAA,MAAA,CAAO,MAAQ,EAAA,KAAA,KAAU,UAAY,EAAA;AACvC,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,mCAAmC,CAAA;AACjE,QAAA;AAAA;AAGF,MAAM,MAAA,SAAA,GAAY,OAAO,MAAQ,EAAA,SAAA;AACjC,MAAA,IAAI,CAAC,SAAA,EAAW,IAAQ,IAAA,CAAC,WAAW,GAAK,EAAA;AACvC,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,wCAAwC,CAAA;AACtE,QAAA;AAAA;AAIF,MAAA,MAAM,SAAS,MAAMK,WAAA,CAAU,SAAU,CAAA,SAAA,EAAW,UAAU,IAAI,CAAA;AAClE,MAAA,MAAM,WAAc,GAAA,MAAA,CAAO,IAAO,GAAA,SAAA,CAAU,GAAG,CAAA;AAE/C,MAAA,IAAI,CAAC,WAAa,EAAA;AAChB,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,+BAA+B,CAAA;AAC7D,QAAA;AAAA;AAIF,MAAA,MAAM,aAAa,MAAO,CAAA,IAAA,CAAK,aAAa,QAAQ,CAAA,CAAE,SAAS,OAAO,CAAA;AAEtE,MAAA,GAAA,CAAI,IAAK,CAAA,EAAE,MAAQ,EAAA,UAAA,EAAY,CAAA;AAAA,aACxB,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,kCAAkC,KAAK,CAAA;AACrD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,kCAAkC,CAAA;AAAA;AAClE;AACF,GACD,CAAA;AAED,EAAM,MAAA,mBAAA,GAAsBiB,MAAE,MAAO,CAAA;AAAA,IACnC,OAAS,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS;AAAA,GAC9B,CAAA;AAED,EAAA,MAAA,CAAO,IAAK,CAAA,oCAAA,EAAsC,OAAO,GAAA,EAAK,GAAQ,KAAA;AACpE,IAAA,MAAM,MAAS,GAAA,mBAAA,CAAoB,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AACrD,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,MAAM,IAAIL,iBAAA,CAAW,MAAO,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAG9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AAEvE,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAChC,MAAA,MAAM,UAAa,GAAA,aAAA;AAEnB,MAAM,MAAA,OAAA,GAAU,MAAMP,WAAU,CAAA,iBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,MAAM,OAAO,OAAQ,CAAA,IAAA;AACrB,MAAM,MAAA,cAAA,GAAiB,KAAK,aAAe,EAAA,IAAA;AAE3C,MAAA,IAAI,CAAC,cAAgB,EAAA;AACnB,QAAM,MAAA,IAAIO,kBAAW,+CAA+C,CAAA;AAAA;AAItE,MAAM,MAAA,UAAA,GAAa,MAAMP,WAAU,CAAA,iBAAA;AAAA,QACjC,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,MAAM,KAAQ,GAAA,UAAA,CAAW,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAGrE,MAAM,MAAA,iBAAA,GAAoB,MAAMJ,aAAY,CAAA,SAAA;AAAA,QAC1C,CAAC,EAAE,UAAY,EAAAyB,oDAAA,EAA0C,CAAA;AAAA,QACzD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWlB,uCAAgB,KAAO,EAAA;AAEzD,QAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,UAC1C,CAAC,EAAE,UAAY,EAAA0B,oDAAA,EAA0C,CAAA;AAAA,UACzD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWnB,uCAAgB,KAAO,EAAA;AACzD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,IAAI,UAAU,aAAe,EAAA;AAC3B,UAAM,MAAA,IAAIA,uBAAgB,yDAAyD,CAAA;AAAA;AACrF;AAIF,MAAA,MAAM,MAAS,GAAA;AAAA,QACb,KAAO,EAAA,UAAA;AAAA,QACP,UAAA;AAAA,QACA,UAAY,EAAA,iBAAA,IAAI,IAAK,EAAA,EAAE,WAAY;AAAA,OACrC;AAEA,MAAA,MAAMK,WAAU,CAAA,yBAAA;AAAA,QACd,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,GAAA,CAAI,IAAK,CAAA,EAAE,OAAS,EAAA,IAAA,EAAM,CAAA;AAAA,aACnB,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,oCAAoC,KAAK,CAAA;AACvD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qCAAqC,CAAA;AAAA;AACrE;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,IAAK,CAAA,mCAAA,EAAqC,OAAO,GAAA,EAAK,GAAQ,KAAA;AACnE,IAAA,MAAM,MAAS,GAAA,mBAAA,CAAoB,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AACrD,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,MAAM,IAAIY,iBAAA,CAAW,MAAO,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAG9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AAEvE,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAChC,MAAA,MAAM,UAAa,GAAA,aAAA;AAGnB,MAAM,MAAA,OAAA,GAAU,MAAMP,WAAU,CAAA,iBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,MAAM,OAAO,OAAQ,CAAA,IAAA;AACrB,MAAM,MAAA,cAAA,GAAiB,KAAK,aAAe,EAAA,IAAA;AAE3C,MAAA,IAAI,CAAC,cAAgB,EAAA;AACnB,QAAM,MAAA,IAAIO,kBAAW,+CAA+C,CAAA;AAAA;AAItE,MAAM,MAAA,UAAA,GAAa,MAAMP,WAAU,CAAA,iBAAA;AAAA,QACjC,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,MAAM,KAAQ,GAAA,UAAA,CAAW,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAIrE,MAAM,MAAA,iBAAA,GAAoB,MAAMJ,aAAY,CAAA,SAAA;AAAA,QAC1C,CAAC,EAAE,UAAY,EAAAyB,oDAAA,EAA0C,CAAA;AAAA,QACzD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWlB,uCAAgB,KAAO,EAAA;AAEzD,QAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,UAC1C,CAAC,EAAE,UAAY,EAAA0B,oDAAA,EAA0C,CAAA;AAAA,UACzD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWnB,uCAAgB,KAAO,EAAA;AACzD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,IAAI,UAAU,aAAe,EAAA;AAC3B,UAAM,MAAA,IAAIA,uBAAgB,wDAAwD,CAAA;AAAA;AACpF;AAGF,MAAA,MAAM,MAAS,GAAA;AAAA,QACb,KAAO,EAAA,UAAA;AAAA,QACP,UAAA;AAAA,QACA,UAAY,EAAA,iBAAA,IAAI,IAAK,EAAA,EAAE,WAAY;AAAA,OACrC;AAEA,MAAA,MAAMK,WAAU,CAAA,yBAAA;AAAA,QACd,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,EAAA;AAAA,aACd,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,oCAAoC,KAAK,CAAA;AACvD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,oCAAoC,CAAA;AAAA;AACpE;AACF,GACD,CAAA;AAED,EAAM,MAAA,iBAAA,GAAoBiB,MAAE,MAAO,CAAA;AAAA,IACjC,QAAU,EAAAA,KAAA,CAAE,KAAM,CAAAA,KAAA,CAAE,MAAO,CAAA;AAAA,MACzB,SAAA,EAAWA,MAAE,MAAO,EAAA;AAAA,MACpB,IAAA,EAAMA,MAAE,MAAO;AAAA,KAChB,CAAC,CAAA;AAAA,IACF,OAAS,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS;AAAA,GAC9B,CAAA;AAED,EAAA,MAAA,CAAO,IAAK,CAAA,wBAAA,EAA0B,OAAO,GAAA,EAAK,GAAQ,KAAA;AACxD,IAAA,MAAM,MAAS,GAAA,iBAAA,CAAkB,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AACnD,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,MAAM,IAAIL,iBAAA,CAAW,MAAO,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAG9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AAEvE,MAAM,MAAA,QAAA,GAAW,MAAMX,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAyB,oDAAA,EAA0C,CAAA;AAAA,QACzD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWlB,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAM,MAAA,EAAE,QAAS,EAAA,GAAI,MAAO,CAAA,IAAA;AAC5B,MAAA,MAAM,UAAa,GAAA,aAAA;AACnB,MAAA,MAAM,UAAU,EAAC;AAEjB,MAAA,KAAA,MAAW,UAAU,QAAU,EAAA;AAC7B,QAAI,IAAA;AAEF,UAAA,MAAM,MAAS,GAAA;AAAA,YACb,KAAO,EAAA,UAAA;AAAA,YACP,UAAA;AAAA,YACA,UAAY,EAAA,iBAAA,IAAI,IAAK,EAAA,EAAE,WAAY;AAAA,WACrC;AAEA,UAAA,MAAMK,WAAU,CAAA,yBAAA;AAAA,YACd,uBAAA;AAAA,YACA,UAAA;AAAA,YACA,MAAO,CAAA,SAAA;AAAA,YACP,SAAA;AAAA,YACA,MAAO,CAAA,IAAA;AAAA,YACP;AAAA,WACF;AAEA,UAAQ,OAAA,CAAA,IAAA,CAAK,EAAE,SAAA,EAAW,MAAO,CAAA,SAAA,EAAW,MAAM,MAAO,CAAA,IAAA,EAAM,OAAS,EAAA,IAAA,EAAM,CAAA;AAAA,iBACvE,KAAO,EAAA;AACd,UAAQ,OAAA,CAAA,KAAA,CAAM,2BAA2B,MAAO,CAAA,SAAS,IAAI,MAAO,CAAA,IAAI,KAAK,KAAK,CAAA;AAClF,UAAA,OAAA,CAAQ,IAAK,CAAA;AAAA,YACX,WAAW,MAAO,CAAA,SAAA;AAAA,YAClB,MAAM,MAAO,CAAA,IAAA;AAAA,YACb,OAAS,EAAA,KAAA;AAAA,YACT,KAAO,EAAA,KAAA,YAAiB,KAAQ,GAAA,KAAA,CAAM,OAAU,GAAA;AAAA,WACjD,CAAA;AAAA;AACH;AAGF,MAAI,GAAA,CAAA,IAAA,CAAK,EAAE,OAAA,EAAS,CAAA;AAAA,aACb,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,0BAA0B,KAAK,CAAA;AAC7C,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,2CAA2C,CAAA;AAAA;AAC3E;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,IAAK,CAAA,uBAAA,EAAyB,OAAO,GAAA,EAAK,GAAQ,KAAA;AACvD,IAAA,MAAM,MAAS,GAAA,iBAAA,CAAkB,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AACnD,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,MAAM,IAAIY,iBAAA,CAAW,MAAO,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAG9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AAEvE,MAAM,MAAA,QAAA,GAAW,MAAMX,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAyB,oDAAA,EAA0C,CAAA;AAAA,QACzD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWlB,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAM,MAAA,EAAE,QAAS,EAAA,GAAI,MAAO,CAAA,IAAA;AAC5B,MAAA,MAAM,UAAa,GAAA,aAAA;AACnB,MAAA,MAAM,UAAU,EAAC;AAEjB,MAAA,KAAA,MAAW,UAAU,QAAU,EAAA;AAC7B,QAAI,IAAA;AAEF,UAAM,MAAA,OAAA,GAAU,MAAMK,WAAU,CAAA,iBAAA;AAAA,YAC9B,uBAAA;AAAA,YACA,UAAA;AAAA,YACA,MAAO,CAAA,SAAA;AAAA,YACP,SAAA;AAAA,YACA,MAAO,CAAA;AAAA,WACT;AAEA,UAAA,MAAM,OAAO,OAAQ,CAAA,IAAA;AAIrB,UAAM,MAAA,UAAA,GAAa,MAAMA,WAAU,CAAA,iBAAA;AAAA,YACjC,uBAAA;AAAA,YACA,UAAA;AAAA,YACA,MAAO,CAAA,SAAA;AAAA,YACP,aAAA;AAAA,YACA,KAAK,aAAe,EAAA;AAAA,WACtB;AAEA,UAAA,MAAM,KAAQ,GAAA,UAAA,CAAW,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAIrE,UAAM,MAAA,iBAAA,GAAoB,MAAMJ,aAAY,CAAA,SAAA;AAAA,YAC1C,CAAC,EAAE,UAAY,EAAAiB,iDAAA,EAAuC,CAAA;AAAA,YACtD,EAAE,WAAY;AAAA,WAChB;AAEA,UAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWV,uCAAgB,KAAO,EAAA;AAEzD,YAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,cAC1C,CAAC,EAAE,UAAY,EAAAkB,iDAAA,EAAuC,CAAA;AAAA,cACtD,EAAE,WAAY;AAAA,aAChB;AAEA,YAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWX,uCAAgB,KAAO,EAAA;AACzD,cAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,YAAA,IAAI,UAAU,aAAe,EAAA;AAC3B,cAAM,MAAA,IAAIA,uBAAgB,wDAAwD,CAAA;AAAA;AACpF;AAGF,UAAA,MAAM,MAAS,GAAA;AAAA,YACb,KAAO,EAAA,UAAA;AAAA,YACP,UAAA;AAAA,YACA,UAAY,EAAA,iBAAA,IAAI,IAAK,EAAA,EAAE,WAAY;AAAA,WACrC;AAEA,UAAA,MAAMK,WAAU,CAAA,yBAAA;AAAA,YACd,uBAAA;AAAA,YACA,UAAA;AAAA,YACA,MAAO,CAAA,SAAA;AAAA,YACP,SAAA;AAAA,YACA,MAAO,CAAA,IAAA;AAAA,YACP;AAAA,WACF;AAEA,UAAQ,OAAA,CAAA,IAAA,CAAK,EAAE,SAAA,EAAW,MAAO,CAAA,SAAA,EAAW,MAAM,MAAO,CAAA,IAAA,EAAM,OAAS,EAAA,IAAA,EAAM,CAAA;AAAA,iBACvE,KAAO,EAAA;AACd,UAAQ,OAAA,CAAA,KAAA,CAAM,2BAA2B,MAAO,CAAA,SAAS,IAAI,MAAO,CAAA,IAAI,KAAK,KAAK,CAAA;AAClF,UAAA,OAAA,CAAQ,IAAK,CAAA;AAAA,YACX,WAAW,MAAO,CAAA,SAAA;AAAA,YAClB,MAAM,MAAO,CAAA,IAAA;AAAA,YACb,OAAS,EAAA,KAAA;AAAA,YACT,KAAO,EAAA,KAAA,YAAiB,KAAQ,GAAA,KAAA,CAAM,OAAU,GAAA;AAAA,WACjD,CAAA;AAAA;AACH;AAGF,MAAI,GAAA,CAAA,IAAA,CAAK,EAAE,OAAA,EAAS,CAAA;AAAA,aACb,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,yBAAyB,KAAK,CAAA;AAC5C,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,0CAA0C,CAAA;AAAA;AAC1E;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,MAAO,CAAA,4BAAA,EAA8B,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC9D,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAGhC,MAAM,MAAA,OAAA,GAAU,MAAMK,WAAU,CAAA,iBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAM,MAAA,aAAA,GAAgB,OAAQ,CAAA,IAAA,EAAM,WAAa,EAAA,MAAA;AAGjD,MAAM,MAAA,iBAAA,GAAoB,MAAMJ,aAAY,CAAA,SAAA;AAAA,QAC1C,CAAC,EAAE,UAAY,EAAA2B,oDAAA,EAA0C,CAAA;AAAA,QACzD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,MAAM,YAAe,GAAA,iBAAA,CAAkB,CAAC,CAAA,CAAE,WAAWpB,sCAAgB,CAAA,KAAA;AAErE,MAAA,IAAI,CAAC,YAAc,EAAA;AAEjB,QAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,UAC1C,CAAC,EAAE,UAAY,EAAA4B,oDAAA,EAA0C,CAAA;AAAA,UACzD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWrB,uCAAgB,KAAO,EAAA;AACzD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,IAAI,kBAAkB,aAAe,EAAA;AACnC,UAAM,MAAA,IAAIA,uBAAgB,+CAA+C,CAAA;AAAA;AAC3E;AAIF,MAAA,MAAMK,WAAU,CAAA,oBAAA;AAAA,QACd,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AACA,MAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,EAAA;AAAA,aACd,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,mCAAmC,KAAK,CAAA;AACtD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,oCAAoC,CAAA;AAAA;AACpE;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,KAAM,CAAA,4BAAA,EAA8B,OAAO,GAAA,EAAK,GAAQ,KAAA;AAE7D,IAAM,MAAA,WAAA,GAAciB,MAAE,MAAO,CAAA;AAAA,MAC3B,IAAA,EAAMA,MAAE,MAAO,CAAA;AAAA,QACb,OAAS,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,QAC7B,QAAU,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS;AAAA,OAC/B,EAAE,OAAQ;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,MAAS,GAAA,WAAA,CAAY,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AAC7C,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,MAAM,IAAIL,iBAAW,CAAA,iBAAA,GAAoB,MAAO,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAGlE,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAGhC,MAAM,MAAA,QAAA,GAAW,MAAMP,WAAU,CAAA,iBAAA;AAAA,QAC/B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAM,MAAA,aAAA,GAAgB,QAAS,CAAA,IAAA,EAAM,WAAa,EAAA,MAAA;AAClD,MAAM,MAAA,YAAA,GAAe,QAAS,CAAA,MAAA,EAAQ,KAAS,IAAA,SAAA;AAG/C,MAAA,IAAI,iBAAiB,SAAW,EAAA;AAC9B,QAAM,MAAA,IAAIL,uBAAgB,qCAAqC,CAAA;AAAA;AAIjE,MAAM,MAAA,iBAAA,GAAoB,MAAMC,aAAY,CAAA,SAAA;AAAA,QAC1C,CAAC,EAAE,UAAY,EAAAyB,oDAAA,EAA0C,CAAA;AAAA,QACzD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWlB,uCAAgB,KAAO,EAAA;AAEzD,QAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,UAC1C,CAAC,EAAE,UAAY,EAAA0B,oDAAA,EAA0C,CAAA;AAAA,UACzD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWnB,uCAAgB,KAAO,EAAA;AACzD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,IAAI,kBAAkB,aAAe,EAAA;AACnC,UAAM,MAAA,IAAIA,uBAAgB,+CAA+C,CAAA;AAAA;AAC3E;AAIF,MAAM,MAAA,OAAA,GAAU,MAAMK,WAAU,CAAA,mBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAA;AAAA,QACA,MAAO,CAAA;AAAA,OACT;AAEA,MAAA,GAAA,CAAI,KAAK,OAAO,CAAA;AAAA,aACT,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,mCAAmC,KAAK,CAAA;AACtD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OAC/C,MAAA,IAAW,iBAAiBY,iBAAY,EAAA;AACtC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,oCAAoC,CAAA;AAAA;AACpE;AACF,GACD,CAAA;AAGD,EAAA,MAAA,CAAO,IAAIkB,sDAAkC,CAAA;AAAA,IAC3C,WAAa,EAAAC;AAAA,GACd,CAAC,CAAA;AAEF,EAAO,OAAA,MAAA;AACT;;;;"}
+{"version":3,"file":"router.cjs.js","sources":["../src/router.ts"],"sourcesContent":["import { HttpAuthService, RootConfigService, UserInfoService, PermissionsService } from '@backstage/backend-plugin-api';\nimport { InputError, NotAllowedError } from '@backstage/errors';\nimport { AuthorizeResult } from '@backstage/plugin-permission-common';\nimport { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';\nimport { z } from 'zod';\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport cors from 'cors';\nimport { randomBytes } from 'crypto';\nimport { KuadrantK8sClient } from './k8s-client';\nimport { getAPIProductEntityProvider } from './module';\nimport {\n  kuadrantPermissions,\n  kuadrantPlanPolicyListPermission,\n  kuadrantPlanPolicyReadPermission,\n  kuadrantApiProductListPermission,\n  kuadrantApiProductReadOwnPermission,\n  kuadrantApiProductReadAllPermission,\n  kuadrantApiProductCreatePermission,\n  kuadrantApiProductUpdateOwnPermission,\n  kuadrantApiProductUpdateAllPermission,\n  kuadrantApiProductDeleteOwnPermission,\n  kuadrantApiProductDeleteAllPermission,\n  kuadrantApiKeyRequestCreatePermission,\n  kuadrantApiKeyRequestReadOwnPermission,\n  kuadrantApiKeyRequestReadAllPermission,\n  kuadrantApiKeyRequestUpdateOwnPermission,\n  kuadrantApiKeyRequestUpdateAllPermission,\n  kuadrantApiKeyRequestDeleteOwnPermission,\n  kuadrantApiKeyRequestDeleteAllPermission,\n  kuadrantApiKeyReadOwnPermission,\n  kuadrantApiKeyReadAllPermission,\n} from './permissions';\n\nconst secretKey = 'api_key';\n\n/**\n * Extract a kubernetes-safe name from entity ref\n * e.g., \"user:default/alice\" -> \"alice\"\n * e.g., \"group:platform/api-owners\" -> \"api-owners\"\n */\nfunction extractNameFromEntityRef(entityRef: string): string {\n  const parts = entityRef.split('/');\n  return parts[parts.length - 1];\n}\n\nasync function getUserIdentity(req: express.Request, httpAuth: HttpAuthService, userInfo: UserInfoService): Promise<{\n  userEntityRef: string;\n  groups: string[];\n}> {\n  const credentials = await httpAuth.credentials(req);\n\n  if (!credentials || !credentials.principal) {\n    throw new NotAllowedError('authentication required');\n  }\n\n  // get user info from credentials\n  const info = await userInfo.getUserInfo(credentials);\n  const groups = info.ownershipEntityRefs || [];\n\n  console.log(`user identity resolved: userEntityRef=${info.userEntityRef}, groups=${groups.join(',')}`);\n  return {\n    userEntityRef: info.userEntityRef,\n    groups\n  };\n}\n\nexport async function createRouter({\n  httpAuth,\n  userInfo,\n  config,\n  permissions,\n}: {\n  httpAuth: HttpAuthService;\n  userInfo: UserInfoService;\n  config: RootConfigService;\n  permissions: PermissionsService;\n}): Promise<express.Router> {\n  const router = Router();\n\n  // enable cors for dev mode (allows frontend on :3000 to call backend on :7007)\n  router.use(cors({\n    origin: 'http://localhost:3000',\n    credentials: true,\n  }));\n\n  router.use(express.json());\n\n  const k8sClient = new KuadrantK8sClient(config);\n\n  // apiproduct endpoints\n  router.get('/apiproducts', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      const listDecision = await permissions.authorize(\n        [{ permission: kuadrantApiProductListPermission }],\n        { credentials }\n      );\n\n      if (listDecision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n      const data = await k8sClient.listCustomResources('devportal.kuadrant.io', 'v1alpha1', 'apiproducts');\n\n      // check if user has read all permission\n      const readAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiProductReadAllPermission }],\n        { credentials }\n      );\n\n      if (readAllDecision[0].result === AuthorizeResult.ALLOW) {\n        // admin - return all apiproducts\n        res.json(data);\n      } else {\n        // owner - check read own permission and filter\n        const readOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiProductReadOwnPermission }],\n          { credentials }\n        );\n\n        if (readOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // filter to only owned apiproducts\n        const ownedItems = (data.items || []).filter((item: any) => {\n          const owner = item.metadata?.annotations?.['backstage.io/owner'];\n          return owner === userEntityRef;\n        });\n\n        res.json({ ...data, items: ownedItems });\n      }\n    } catch (error) {\n      console.error('error fetching apiproducts:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch apiproducts' });\n      }\n    }\n  });\n\n  router.get('/apiproducts/:namespace/:name', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { namespace, name } = req.params;\n\n      // try read all permission first (admin)\n      const readAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiProductReadAllPermission }],\n        { credentials }\n      );\n\n      if (readAllDecision[0].result !== AuthorizeResult.ALLOW) {\n        // fallback to read own permission\n        const readOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiProductReadOwnPermission }],\n          { credentials }\n        );\n\n        if (readOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership\n        const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n        const data = await k8sClient.getCustomResource('devportal.kuadrant.io', 'v1alpha1', namespace, 'apiproducts', name);\n        const owner = data.metadata?.annotations?.['backstage.io/owner'];\n\n        if (owner !== userEntityRef) {\n          throw new NotAllowedError('you can only read your own api products');\n        }\n\n        res.json(data);\n      } else {\n        // admin - read any apiproduct\n        const data = await k8sClient.getCustomResource('devportal.kuadrant.io', 'v1alpha1', namespace, 'apiproducts', name);\n        res.json(data);\n      }\n    } catch (error) {\n      console.error('error fetching apiproduct:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch apiproduct' });\n      }\n    }\n  });\n\n  router.post('/apiproducts', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantApiProductCreatePermission }],\n        { credentials }\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n      const apiProduct = req.body;\n      const targetRef = apiProduct.spec?.targetRef;\n\n      if (!targetRef?.name || !targetRef?.kind || !targetRef?.namespace) {\n        throw new InputError('targetRef with name, kind, and namespace is required');\n      }\n\n      // derive namespace from httproute - apiproduct lives in same namespace as httproute\n      const namespace = targetRef.namespace;\n      apiProduct.metadata.namespace = namespace;\n\n      // set ownership annotation (backstage-specific metadata)\n      // note: creationTimestamp is automatically set by kubernetes api server\n      if (!apiProduct.metadata.annotations) {\n        apiProduct.metadata.annotations = {};\n      }\n      apiProduct.metadata.annotations['backstage.io/owner'] = userEntityRef;\n\n      const created = await k8sClient.createCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apiproducts',\n        apiProduct,\n      );\n\n      // trigger immediate catalog sync\n      const provider = getAPIProductEntityProvider();\n      if (provider) {\n        await provider.refresh();\n      }\n\n      res.status(201).json(created);\n    } catch (error) {\n      console.error('error creating apiproduct:', error);\n      const errorMessage = error instanceof Error ? error.message : String(error);\n\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else if (error instanceof InputError) {\n        res.status(400).json({ error: error.message });\n      } else {\n        // pass the detailed error message to the frontend\n        res.status(500).json({ error: errorMessage });\n      }\n    }\n  });\n\n  router.delete('/apiproducts/:namespace/:name', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { namespace, name } = req.params;\n\n      // try delete all permission first (admin)\n      const deleteAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiProductDeleteAllPermission }],\n        { credentials }\n      );\n\n      if (deleteAllDecision[0].result !== AuthorizeResult.ALLOW) {\n        // fallback to delete own permission\n        const deleteOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiProductDeleteOwnPermission }],\n          { credentials }\n        );\n\n        if (deleteOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership before deleting\n        const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n        const existing = await k8sClient.getCustomResource('devportal.kuadrant.io', 'v1alpha1', namespace, 'apiproducts', name);\n        const owner = existing.metadata?.annotations?.['backstage.io/owner'];\n\n        if (owner !== userEntityRef) {\n          throw new NotAllowedError('you can only delete your own api products');\n        }\n      }\n      console.log(`cascading delete: finding apikeys for ${namespace}/${name}`);\n\n      let allRequests;\n      try {\n        allRequests = await k8sClient.listCustomResources(\n          'devportal.kuadrant.io',\n          'v1alpha1',\n          'apikeys',\n          namespace\n        );\n      } catch (error) {\n        console.warn('failed to list apikeys during cascade delete:', error);\n        allRequests = { items: [] };\n      }\n\n      // filter requests that belong to this APIProduct\n      const relatedRequests = (allRequests.items || []).filter((req: any) =>\n        req.spec?.apiProductRef?.name === name\n      );\n\n      console.log(`found ${relatedRequests.length} apikeys to delete`);\n\n      // delete each APIKey - controller's OwnerReference handles Secret cleanup\n      const deletionResults = await Promise.allSettled(\n        relatedRequests.map(async (request: any) => {\n          const requestName = request.metadata.name;\n          console.log(`deleting apikey: ${namespace}/${requestName}`);\n          await k8sClient.deleteCustomResource(\n            'devportal.kuadrant.io',\n            'v1alpha1',\n            namespace,\n            'apikeys',\n            requestName\n          );\n        })\n      );\n\n      const failures = deletionResults.filter(r => r.status === 'rejected');\n      if (failures.length > 0) {\n        console.warn(`${failures.length} apikeys failed to delete:`,\n          failures.map((f: any) => f.reason)\n        );\n      }\n      await k8sClient.deleteCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apiproducts',\n        name\n      );\n\n      // trigger immediate catalog sync\n      const provider = getAPIProductEntityProvider();\n      if (provider) {\n        await provider.refresh();\n      }\n\n      res.status(204).send();\n    } catch (error) {\n      console.error('error deleting apiproduct:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to delete apiproduct' });\n      }\n    }\n  });\n\n  // httproute endpoints\n  router.get('/httproutes', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantApiProductListPermission }],\n        { credentials }\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const data = await k8sClient.listCustomResources('gateway.networking.k8s.io', 'v1', 'httproutes');\n\n      res.json(data);\n    } catch (error) {\n      console.error('error fetching httproutes:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch httproutes' });\n      }\n    }\n  });\n\n  router.patch('/apiproducts/:namespace/:name', async (req, res) => {\n    // whitelist allowed fields for patching\n    const patchSchema = z.object({\n      spec: z.object({\n        displayName: z.string().optional(),\n        description: z.string().optional(),\n        version: z.string().optional(),\n        publishStatus: z.enum(['Draft', 'Published']).optional(),\n        approvalMode: z.enum(['automatic', 'manual']).optional(),\n        tags: z.array(z.string()).optional(),\n        contact: z.object({\n          email: z.string().optional(),\n          team: z.string().optional(),\n          slack: z.string().optional(),\n        }).partial().optional(),\n        documentation: z.object({\n          docsURL: z.string().optional(),\n          openAPISpec: z.string().optional(),\n        }).partial().optional(),\n      }).partial(),\n    });\n\n    const parsed = patchSchema.safeParse(req.body);\n    if (!parsed.success) {\n      return res.status(400).json({ error: 'invalid patch: ' + parsed.error.toString() });\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      if (!credentials || !credentials.principal) {\n        throw new NotAllowedError('authentication required');\n      }\n\n      const { namespace, name } = req.params;\n\n      // try update all permission first (admin)\n      const updateAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiProductUpdateAllPermission }],\n        { credentials }\n      );\n\n      if (updateAllDecision[0].result !== AuthorizeResult.ALLOW) {\n        // fallback to update own permission\n        const updateOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiProductUpdateOwnPermission }],\n          { credentials }\n        );\n\n        if (updateOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership\n        const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n        const existing = await k8sClient.getCustomResource('devportal.kuadrant.io', 'v1alpha1', namespace, 'apiproducts', name);\n        const owner = existing.metadata?.annotations?.['backstage.io/owner'];\n\n        if (owner !== userEntityRef) {\n          throw new NotAllowedError('you can only update your own api products');\n        }\n      }\n\n      // prevent modification of ownership annotation\n      if (req.body.metadata?.annotations) {\n        delete req.body.metadata.annotations['backstage.io/owner'];\n      }\n\n      const updated = await k8sClient.patchCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apiproducts',\n        name,\n        parsed.data,\n      );\n\n      // trigger immediate catalog sync\n      const provider = getAPIProductEntityProvider();\n      if (provider) {\n        await provider.refresh();\n      }\n\n      return res.json(updated);\n    } catch (error) {\n      console.error('error updating apiproduct:', error);\n      const errorMessage = error instanceof Error ? error.message : String(error);\n\n      if (error instanceof NotAllowedError) {\n        return res.status(403).json({ error: error.message });\n      } else if (error instanceof InputError) {\n        return res.status(400).json({ error: error.message });\n      } else {\n        return res.status(500).json({ error: errorMessage });\n      }\n    }\n  });\n\n  // planpolicy endpoints\n  router.get('/planpolicies', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantPlanPolicyListPermission }],\n        { credentials }\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const data = await k8sClient.listCustomResources('extensions.kuadrant.io', 'v1alpha1', 'planpolicies');\n\n      // only expose minimal info needed for UI association\n      const filtered = {\n        items: (data.items || []).map((policy: any) => ({\n          metadata: {\n            name: policy.metadata.name,\n            namespace: policy.metadata.namespace,\n          },\n          // only expose targetRef to allow UI to match PlanPolicy -> HTTPRoute\n          targetRef: policy.spec?.targetRef ? {\n            kind: policy.spec.targetRef.kind,\n            name: policy.spec.targetRef.name,\n            namespace: policy.spec.targetRef.namespace,\n          } : undefined,\n          // only expose plan tier info, no other spec details\n          plans: (policy.spec?.plans || []).map((plan: any) => ({\n            tier: plan.tier,\n            description: plan.description,\n            limits: plan.limits,\n          })),\n        })),\n      };\n\n      res.json(filtered);\n    } catch (error) {\n      console.error('error fetching planpolicies:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch planpolicies' });\n      }\n    }\n  });\n\n  router.get('/planpolicies/:namespace/:name', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantPlanPolicyReadPermission }],\n        { credentials }\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const { namespace, name } = req.params;\n      const data = await k8sClient.getCustomResource('extensions.kuadrant.io', 'v1alpha1', namespace, 'planpolicies', name);\n      res.json(data);\n    } catch (error) {\n      console.error('error fetching planpolicy:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch planpolicy' });\n      }\n    }\n  });\n\n  // apikey crud endpoints\n  const requestSchema = z.object({\n    apiProductName: z.string(), // name of the APIProduct\n    namespace: z.string(), // namespace where both APIProduct and APIKey live\n    planTier: z.string(),\n    useCase: z.string().optional(),\n    userEmail: z.string().optional(),\n  });\n\n  router.post('/requests', async (req, res) => {\n    const parsed = requestSchema.safeParse(req.body);\n    if (!parsed.success) {\n      throw new InputError(parsed.error.toString());\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { apiProductName, namespace, planTier, useCase, userEmail } = parsed.data;\n\n      // extract userId from authenticated credentials, not from request body\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n\n      // check permission with resource reference (per-apiproduct access control)\n      const resourceRef = `apiproduct:${namespace}/${apiProductName}`;\n      const decision = await permissions.authorize(\n        [{\n          permission: kuadrantApiKeyRequestCreatePermission,\n          resourceRef,\n        }],\n        { credentials }\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError(`not authorised to request access to ${apiProductName}`);\n      }\n      const randomSuffix = randomBytes(4).toString('hex');\n      const userName = extractNameFromEntityRef(userEntityRef);\n      const requestName = `${userName}-${apiProductName}-${randomSuffix}`.toLowerCase().replace(/[^a-z0-9-]/g, '-');\n\n      const requestedBy: any = { userId: userEntityRef };\n      if (userEmail) {\n        requestedBy.email = userEmail;\n      }\n\n      const request = {\n        apiVersion: 'devportal.kuadrant.io/v1alpha1',\n        kind: 'APIKey',\n        metadata: {\n          name: requestName,\n          namespace,\n        },\n        spec: {\n          apiProductRef: {\n            name: apiProductName,\n          },\n          planTier,\n          useCase: useCase || '',\n          requestedBy,\n        },\n      };\n\n      const created = await k8sClient.createCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        request,\n      );\n\n      // controller handles automatic approval and secret creation\n      // we just create the APIKey resource and let the controller reconcile\n\n      res.status(201).json(created);\n    } catch (error) {\n      console.error('error creating api key request:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to create api key request' });\n      }\n    }\n  });\n\n  router.get('/requests', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      // check if user can read all requests or only own\n      const readAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestReadAllPermission }],\n        { credentials }\n      );\n\n      const canReadAll = readAllDecision[0].result === AuthorizeResult.ALLOW;\n\n      if (!canReadAll) {\n        // try read own permission\n        const readOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiKeyRequestReadOwnPermission }],\n          { credentials }\n        );\n\n        if (readOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n      }\n\n      const status = req.query.status as string;\n      const namespace = req.query.namespace as string;\n\n      let data;\n      if (namespace) {\n        data = await k8sClient.listCustomResources('devportal.kuadrant.io', 'v1alpha1', 'apikeys', namespace);\n      } else {\n        data = await k8sClient.listCustomResources('devportal.kuadrant.io', 'v1alpha1', 'apikeys');\n      }\n\n      let filteredItems = data.items || [];\n\n      // if user only has read.own permission, filter by api product ownership\n      if (!canReadAll) {\n        const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n\n        // get all apiproducts owned by this user\n        const apiproducts = await k8sClient.listCustomResources('devportal.kuadrant.io', 'v1alpha1', 'apiproducts');\n        const ownedApiProducts = (apiproducts.items || [])\n          .filter((product: any) => {\n            const owner = product.metadata?.annotations?.['backstage.io/owner'];\n            return owner === userEntityRef;\n          })\n          .map((product: any) => product.metadata.name);\n\n        // filter requests to only those for owned api products\n        filteredItems = filteredItems.filter((req: any) =>\n          ownedApiProducts.includes(req.spec?.apiProductRef?.name)\n        );\n      }\n\n      if (status) {\n        filteredItems = filteredItems.filter((req: any) => {\n          const phase = req.status?.phase || 'Pending';\n          return phase === status;\n        });\n      }\n\n      res.json({ items: filteredItems });\n    } catch (error) {\n      console.error('error fetching api key requests:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch api key requests' });\n      }\n    }\n  });\n\n  router.get('/requests/my', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestReadOwnPermission }],\n        { credentials }\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      // extract userId from authenticated credentials, not from query params\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n      const namespace = req.query.namespace as string;\n\n      let data;\n      if (namespace) {\n        data = await k8sClient.listCustomResources('devportal.kuadrant.io', 'v1alpha1', 'apikeys', namespace);\n      } else {\n        data = await k8sClient.listCustomResources('devportal.kuadrant.io', 'v1alpha1', 'apikeys');\n      }\n\n      const filteredItems = (data.items || []).filter(\n        (req: any) => req.spec?.requestedBy?.userId === userEntityRef\n      );\n\n      res.json({ items: filteredItems });\n    } catch (error) {\n      console.error('error fetching user api key requests:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to fetch user api key requests' });\n      }\n    }\n  });\n\n  const approveRejectSchema = z.object({\n    comment: z.string().optional(),\n  });\n\n  router.post('/requests/:namespace/:name/approve', async (req, res) => {\n    const parsed = approveRejectSchema.safeParse(req.body);\n    if (!parsed.success) {\n      throw new InputError(parsed.error.toString());\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n\n      const { namespace, name } = req.params;\n      const reviewedBy = userEntityRef;\n\n      const request = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n      );\n\n      const spec = request.spec as any;\n      const apiProductName = spec.apiProductRef?.name;\n\n      if (!apiProductName) {\n        throw new InputError('apiProductRef.name is required in APIKey spec');\n      }\n\n      // verify user owns/admins the apiproduct this request is for\n      const apiProduct = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apiproducts',\n        apiProductName,\n      );\n\n      const owner = apiProduct.metadata?.annotations?.['backstage.io/owner'];\n\n      // try update all permission first (admin)\n      const updateAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestUpdateAllPermission }],\n        { credentials },\n      );\n\n      if (updateAllDecision[0].result !== AuthorizeResult.ALLOW) {\n        // fallback to update own permission\n        const updateOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiKeyRequestUpdateOwnPermission }],\n          { credentials },\n        );\n\n        if (updateOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership of the apiproduct\n        if (owner !== userEntityRef) {\n          throw new NotAllowedError('you can only approve requests for your own api products');\n        }\n      }\n\n      // backend sets phase, controller reconciles and creates Secret\n      const status = {\n        phase: 'Approved',\n        reviewedBy,\n        reviewedAt: new Date().toISOString(),\n      };\n\n      await k8sClient.patchCustomResourceStatus(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n        status,\n      );\n\n      res.json({ success: true });\n    } catch (error) {\n      console.error('error approving api key request:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to approve api key request' });\n      }\n    }\n  });\n\n  router.post('/requests/:namespace/:name/reject', async (req, res) => {\n    const parsed = approveRejectSchema.safeParse(req.body);\n    if (!parsed.success) {\n      throw new InputError(parsed.error.toString());\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n\n      const { namespace, name } = req.params;\n      const reviewedBy = userEntityRef;\n\n      // fetch request to get apiproduct info\n      const request = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n      );\n\n      const spec = request.spec as any;\n      const apiProductName = spec.apiProductRef?.name;\n\n      if (!apiProductName) {\n        throw new InputError('apiProductRef.name is required in APIKey spec');\n      }\n\n      // verify user owns/admins the apiproduct this request is for\n      const apiProduct = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apiproducts',\n        apiProductName,\n      );\n\n      const owner = apiProduct.metadata?.annotations?.['backstage.io/owner'];\n        // owner is already in entity ref format\n\n      // try update all permission first (admin)\n      const updateAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestUpdateAllPermission }],\n        { credentials },\n      );\n\n      if (updateAllDecision[0].result !== AuthorizeResult.ALLOW) {\n        // fallback to update own permission\n        const updateOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiKeyRequestUpdateOwnPermission }],\n          { credentials },\n        );\n\n        if (updateOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership of the apiproduct\n        if (owner !== userEntityRef) {\n          throw new NotAllowedError('you can only reject requests for your own api products');\n        }\n      }\n\n      const status = {\n        phase: 'Rejected',\n        reviewedBy,\n        reviewedAt: new Date().toISOString(),\n      };\n\n      await k8sClient.patchCustomResourceStatus(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n        status,\n      );\n\n      res.status(204).send();\n    } catch (error) {\n      console.error('error rejecting api key request:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to reject api key request' });\n      }\n    }\n  });\n\n  const bulkApproveSchema = z.object({\n    requests: z.array(z.object({\n      namespace: z.string(),\n      name: z.string(),\n    })),\n    comment: z.string().optional(),\n  });\n\n  router.post('/requests/bulk-approve', async (req, res) => {\n    const parsed = bulkApproveSchema.safeParse(req.body);\n    if (!parsed.success) {\n      throw new InputError(parsed.error.toString());\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestUpdateAllPermission }],\n        { credentials },\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const { requests } = parsed.data;\n      const reviewedBy = userEntityRef;\n      const results = [];\n\n      for (const reqRef of requests) {\n        try {\n          // backend sets phase, controller reconciles and creates Secret\n          const status = {\n            phase: 'Approved',\n            reviewedBy,\n            reviewedAt: new Date().toISOString(),\n          };\n\n          await k8sClient.patchCustomResourceStatus(\n            'devportal.kuadrant.io',\n            'v1alpha1',\n            reqRef.namespace,\n            'apikeys',\n            reqRef.name,\n            status,\n          );\n\n          results.push({ namespace: reqRef.namespace, name: reqRef.name, success: true });\n        } catch (error) {\n          console.error(`error approving request ${reqRef.namespace}/${reqRef.name}:`, error);\n          results.push({\n            namespace: reqRef.namespace,\n            name: reqRef.name,\n            success: false,\n            error: error instanceof Error ? error.message : 'unknown error'\n          });\n        }\n      }\n\n      res.json({ results });\n    } catch (error) {\n      console.error('error in bulk approve:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to bulk approve api key requests' });\n      }\n    }\n  });\n\n  router.post('/requests/bulk-reject', async (req, res) => {\n    const parsed = bulkApproveSchema.safeParse(req.body);\n    if (!parsed.success) {\n      throw new InputError(parsed.error.toString());\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n\n      const decision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestUpdateAllPermission }],\n        { credentials },\n      );\n\n      if (decision[0].result !== AuthorizeResult.ALLOW) {\n        throw new NotAllowedError('unauthorised');\n      }\n\n      const { requests } = parsed.data;\n      const reviewedBy = userEntityRef;\n      const results = [];\n\n      for (const reqRef of requests) {\n        try {\n          // fetch request to get apiproduct info\n          const request = await k8sClient.getCustomResource(\n            'devportal.kuadrant.io',\n            'v1alpha1',\n            reqRef.namespace,\n            'apikeys',\n            reqRef.name,\n          );\n\n          const spec = request.spec as any;\n\n          // verify user owns/admins the apiproduct this request is for\n          // apikey and apiproduct are in the same namespace\n          const apiProduct = await k8sClient.getCustomResource(\n            'devportal.kuadrant.io',\n            'v1alpha1',\n            reqRef.namespace,\n            'apiproducts',\n            spec.apiProductRef?.name,\n          );\n\n          const owner = apiProduct.metadata?.annotations?.['backstage.io/owner'];\n        // owner is already in entity ref format\n\n          // try update all permission first (admin)\n          const updateAllDecision = await permissions.authorize(\n            [{ permission: kuadrantApiProductUpdateAllPermission }],\n            { credentials },\n          );\n\n          if (updateAllDecision[0].result !== AuthorizeResult.ALLOW) {\n            // fallback to update own permission\n            const updateOwnDecision = await permissions.authorize(\n              [{ permission: kuadrantApiProductUpdateOwnPermission }],\n              { credentials },\n            );\n\n            if (updateOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n              throw new NotAllowedError('unauthorised');\n            }\n\n            // verify ownership of the apiproduct\n            if (owner !== userEntityRef) {\n              throw new NotAllowedError('you can only reject requests for your own api products');\n            }\n          }\n\n          const status = {\n            phase: 'Rejected',\n            reviewedBy,\n            reviewedAt: new Date().toISOString(),\n          };\n\n          await k8sClient.patchCustomResourceStatus(\n            'devportal.kuadrant.io',\n            'v1alpha1',\n            reqRef.namespace,\n            'apikeys',\n            reqRef.name,\n            status,\n          );\n\n          results.push({ namespace: reqRef.namespace, name: reqRef.name, success: true });\n        } catch (error) {\n          console.error(`error rejecting request ${reqRef.namespace}/${reqRef.name}:`, error);\n          results.push({\n            namespace: reqRef.namespace,\n            name: reqRef.name,\n            success: false,\n            error: error instanceof Error ? error.message : 'unknown error'\n          });\n        }\n      }\n\n      res.json({ results });\n    } catch (error) {\n      console.error('error in bulk reject:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to bulk reject api key requests' });\n      }\n    }\n  });\n\n  router.delete('/requests/:namespace/:name', async (req, res) => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n      const { namespace, name } = req.params;\n\n      // get request to verify ownership\n      const request = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n      );\n\n      const requestUserId = request.spec?.requestedBy?.userId;\n\n      // check if user can delete all requests or just their own\n      const deleteAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestDeleteAllPermission }],\n        { credentials }\n      );\n\n      const canDeleteAll = deleteAllDecision[0].result === AuthorizeResult.ALLOW;\n\n      if (!canDeleteAll) {\n        // check if user can delete their own requests\n        const deleteOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiKeyRequestDeleteOwnPermission }],\n          { credentials }\n        );\n\n        if (deleteOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership\n        if (requestUserId !== userEntityRef) {\n          throw new NotAllowedError('you can only delete your own api key requests');\n        }\n      }\n\n      // controller owns the Secret via OwnerReference - it will be garbage collected\n      await k8sClient.deleteCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n      );\n      res.status(204).send();\n    } catch (error) {\n      console.error('error deleting api key request:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to delete api key request' });\n      }\n    }\n  });\n\n  router.patch('/requests/:namespace/:name', async (req, res) => {\n    // whitelist allowed fields for patching\n    const patchSchema = z.object({\n      spec: z.object({\n        useCase: z.string().optional(),\n        planTier: z.string().optional(),\n      }).partial(),\n    });\n\n    const parsed = patchSchema.safeParse(req.body);\n    if (!parsed.success) {\n      throw new InputError('invalid patch: ' + parsed.error.toString());\n    }\n\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n      const { namespace, name } = req.params;\n\n      // get existing request to check ownership and status\n      const existing = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n      );\n\n      const requestUserId = existing.spec?.requestedBy?.userId;\n      const currentPhase = existing.status?.phase || 'Pending';\n\n      // only pending requests can be edited\n      if (currentPhase !== 'Pending') {\n        throw new NotAllowedError('only pending requests can be edited');\n      }\n\n      // check if user can update all requests or just their own\n      const updateAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyRequestUpdateAllPermission }],\n        { credentials }\n      );\n\n      if (updateAllDecision[0].result !== AuthorizeResult.ALLOW) {\n        // check if user can update their own requests\n        const updateOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiKeyRequestUpdateOwnPermission }],\n          { credentials }\n        );\n\n        if (updateOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n\n        // verify ownership\n        if (requestUserId !== userEntityRef) {\n          throw new NotAllowedError('you can only update your own api key requests');\n        }\n      }\n\n      // apply validated patch\n      const updated = await k8sClient.patchCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n        parsed.data,\n      );\n\n      res.json(updated);\n    } catch (error) {\n      console.error('error updating api key request:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else if (error instanceof InputError) {\n        res.status(400).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to update api key request' });\n      }\n    }\n  });\n\n  // get api key secret (show once)\n  router.get('/apikeys/:namespace/:name/secret', async (req, res): Promise<void> => {\n    try {\n      const credentials = await httpAuth.credentials(req);\n      const { userEntityRef } = await getUserIdentity(req, httpAuth, userInfo);\n      const { namespace, name } = req.params;\n\n      // check if user can read all api keys or only own\n      const readAllDecision = await permissions.authorize(\n        [{ permission: kuadrantApiKeyReadAllPermission }],\n        { credentials }\n      );\n\n      const canReadAll = readAllDecision[0].result === AuthorizeResult.ALLOW;\n\n      if (!canReadAll) {\n        // try read own permission\n        const readOwnDecision = await permissions.authorize(\n          [{ permission: kuadrantApiKeyReadOwnPermission }],\n          { credentials }\n        );\n\n        if (readOwnDecision[0].result !== AuthorizeResult.ALLOW) {\n          throw new NotAllowedError('unauthorised');\n        }\n      }\n\n      // get the apikey resource\n      const apiKey = await k8sClient.getCustomResource(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n      );\n\n      // verify ownership if not admin\n      if (!canReadAll) {\n        const requestUserId = apiKey.spec?.requestedBy?.userId;\n        if (requestUserId !== userEntityRef) {\n          throw new NotAllowedError('you can only read your own api key secrets');\n        }\n      }\n\n      // check if secret can be read\n      if (apiKey.status?.canReadSecret !== true) {\n        res.status(403).json({\n          error: 'secret has already been read and cannot be retrieved again',\n        });\n        return;\n      }\n\n      // check if secretRef is set\n      if (!apiKey.status?.secretRef?.name || !apiKey.status?.secretRef?.key) {\n        res.status(404).json({\n          error: 'secret reference not found in apikey status',\n        });\n        return;\n      }\n\n      // get the secret\n      const secretName = apiKey.status.secretRef.name;\n\n      let secret;\n      try {\n        secret = await k8sClient.getSecret(namespace, secretName);\n      } catch (error) {\n        console.error('error fetching secret:', error);\n        res.status(404).json({\n          error: 'secret not found',\n        });\n        return;\n      }\n\n      // extract the api key value from secret\n      const secretData = secret.data || {};\n      const apiKeyValue = secretData[secretKey];\n\n      if (!apiKeyValue) {\n        res.status(404).json({\n          error: `secret key '${secretKey}' not found in secret`,\n        });\n        return;\n      }\n\n      // decode base64\n      const decodedApiKey = Buffer.from(apiKeyValue, 'base64').toString('utf-8');\n\n      // update canReadSecret to false\n      await k8sClient.patchCustomResourceStatus(\n        'devportal.kuadrant.io',\n        'v1alpha1',\n        namespace,\n        'apikeys',\n        name,\n        {\n          ...apiKey.status,\n          canReadSecret: false,\n        },\n      );\n\n      res.json({\n        apiKey: decodedApiKey,\n      });\n    } catch (error) {\n      console.error('error reading api key secret:', error);\n      if (error instanceof NotAllowedError) {\n        res.status(403).json({ error: error.message });\n      } else {\n        res.status(500).json({ error: 'failed to read api key secret' });\n      }\n    }\n  });\n\n  router.use(createPermissionIntegrationRouter({\n    permissions: kuadrantPermissions,\n  }));\n\n  return router;\n}\n"],"names":["NotAllowedError","permissions","Router","cors","express","k8sClient","KuadrantK8sClient","kuadrantApiProductListPermission","AuthorizeResult","kuadrantApiProductReadAllPermission","kuadrantApiProductReadOwnPermission","kuadrantApiProductCreatePermission","InputError","getAPIProductEntityProvider","kuadrantApiProductDeleteAllPermission","kuadrantApiProductDeleteOwnPermission","req","z","kuadrantApiProductUpdateAllPermission","kuadrantApiProductUpdateOwnPermission","kuadrantPlanPolicyListPermission","kuadrantPlanPolicyReadPermission","kuadrantApiKeyRequestCreatePermission","randomBytes","kuadrantApiKeyRequestReadAllPermission","kuadrantApiKeyRequestReadOwnPermission","kuadrantApiKeyRequestUpdateAllPermission","kuadrantApiKeyRequestUpdateOwnPermission","kuadrantApiKeyRequestDeleteAllPermission","kuadrantApiKeyRequestDeleteOwnPermission","kuadrantApiKeyReadAllPermission","kuadrantApiKeyReadOwnPermission","createPermissionIntegrationRouter","kuadrantPermissions"],"mappings":";;;;;;;;;;;;;;;;;;;;AAkCA,MAAM,SAAY,GAAA,SAAA;AAOlB,SAAS,yBAAyB,SAA2B,EAAA;AAC3D,EAAM,MAAA,KAAA,GAAQ,SAAU,CAAA,KAAA,CAAM,GAAG,CAAA;AACjC,EAAO,OAAA,KAAA,CAAM,KAAM,CAAA,MAAA,GAAS,CAAC,CAAA;AAC/B;AAEA,eAAe,eAAA,CAAgB,GAAsB,EAAA,QAAA,EAA2B,QAG7E,EAAA;AACD,EAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,EAAA,IAAI,CAAC,WAAA,IAAe,CAAC,WAAA,CAAY,SAAW,EAAA;AAC1C,IAAM,MAAA,IAAIA,uBAAgB,yBAAyB,CAAA;AAAA;AAIrD,EAAA,MAAM,IAAO,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,WAAW,CAAA;AACnD,EAAM,MAAA,MAAA,GAAS,IAAK,CAAA,mBAAA,IAAuB,EAAC;AAE5C,EAAQ,OAAA,CAAA,GAAA,CAAI,yCAAyC,IAAK,CAAA,aAAa,YAAY,MAAO,CAAA,IAAA,CAAK,GAAG,CAAC,CAAE,CAAA,CAAA;AACrG,EAAO,OAAA;AAAA,IACL,eAAe,IAAK,CAAA,aAAA;AAAA,IACpB;AAAA,GACF;AACF;AAEA,eAAsB,YAAa,CAAA;AAAA,EACjC,QAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,eACAC;AACF,CAK4B,EAAA;AAC1B,EAAA,MAAM,SAASC,uBAAO,EAAA;AAGtB,EAAA,MAAA,CAAO,IAAIC,qBAAK,CAAA;AAAA,IACd,MAAQ,EAAA,uBAAA;AAAA,IACR,WAAa,EAAA;AAAA,GACd,CAAC,CAAA;AAEF,EAAO,MAAA,CAAA,GAAA,CAAIC,wBAAQ,CAAA,IAAA,EAAM,CAAA;AAEzB,EAAM,MAAAC,WAAA,GAAY,IAAIC,2BAAA,CAAkB,MAAM,CAAA;AAG9C,EAAA,MAAA,CAAO,GAAI,CAAA,cAAA,EAAgB,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC7C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAM,MAAA,YAAA,GAAe,MAAML,aAAY,CAAA,SAAA;AAAA,QACrC,CAAC,EAAE,UAAY,EAAAM,4CAAA,EAAkC,CAAA;AAAA,QACjD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,YAAa,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWC,uCAAgB,KAAO,EAAA;AACpD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,MAAA,MAAM,OAAO,MAAMK,WAAA,CAAU,mBAAoB,CAAA,uBAAA,EAAyB,YAAY,aAAa,CAAA;AAGnG,MAAM,MAAA,eAAA,GAAkB,MAAMJ,aAAY,CAAA,SAAA;AAAA,QACxC,CAAC,EAAE,UAAY,EAAAQ,+CAAA,EAAqC,CAAA;AAAA,QACpD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,eAAgB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWD,uCAAgB,KAAO,EAAA;AAEvD,QAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,OACR,MAAA;AAEL,QAAM,MAAA,eAAA,GAAkB,MAAMP,aAAY,CAAA,SAAA;AAAA,UACxC,CAAC,EAAE,UAAY,EAAAS,+CAAA,EAAqC,CAAA;AAAA,UACpD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,eAAgB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWF,uCAAgB,KAAO,EAAA;AACvD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,MAAM,cAAc,IAAK,CAAA,KAAA,IAAS,EAAI,EAAA,MAAA,CAAO,CAAC,IAAc,KAAA;AAC1D,UAAA,MAAM,KAAQ,GAAA,IAAA,CAAK,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAC/D,UAAA,OAAO,KAAU,KAAA,aAAA;AAAA,SAClB,CAAA;AAED,QAAA,GAAA,CAAI,KAAK,EAAE,GAAG,IAAM,EAAA,KAAA,EAAO,YAAY,CAAA;AAAA;AACzC,aACO,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,+BAA+B,KAAK,CAAA;AAClD,MAAA,IAAI,iBAAiBA,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,+BAA+B,CAAA;AAAA;AAC/D;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,GAAI,CAAA,+BAAA,EAAiC,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC9D,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAGhC,MAAM,MAAA,eAAA,GAAkB,MAAMC,aAAY,CAAA,SAAA;AAAA,QACxC,CAAC,EAAE,UAAY,EAAAQ,+CAAA,EAAqC,CAAA;AAAA,QACpD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,eAAgB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWD,uCAAgB,KAAO,EAAA;AAEvD,QAAM,MAAA,eAAA,GAAkB,MAAMP,aAAY,CAAA,SAAA;AAAA,UACxC,CAAC,EAAE,UAAY,EAAAS,+CAAA,EAAqC,CAAA;AAAA,UACpD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,eAAgB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWF,uCAAgB,KAAO,EAAA;AACvD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,QAAM,MAAA,IAAA,GAAO,MAAMK,WAAU,CAAA,iBAAA,CAAkB,yBAAyB,UAAY,EAAA,SAAA,EAAW,eAAe,IAAI,CAAA;AAClH,QAAA,MAAM,KAAQ,GAAA,IAAA,CAAK,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAE/D,QAAA,IAAI,UAAU,aAAe,EAAA;AAC3B,UAAM,MAAA,IAAIL,uBAAgB,yCAAyC,CAAA;AAAA;AAGrE,QAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,OACR,MAAA;AAEL,QAAM,MAAA,IAAA,GAAO,MAAMK,WAAU,CAAA,iBAAA,CAAkB,yBAAyB,UAAY,EAAA,SAAA,EAAW,eAAe,IAAI,CAAA;AAClH,QAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA;AACf,aACO,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAA8B,CAAA;AAAA;AAC9D;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,IAAK,CAAA,cAAA,EAAgB,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAM,MAAA,QAAA,GAAW,MAAMC,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAU,8CAAA,EAAoC,CAAA;AAAA,QACnD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWH,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,MAAA,MAAM,aAAa,GAAI,CAAA,IAAA;AACvB,MAAM,MAAA,SAAA,GAAY,WAAW,IAAM,EAAA,SAAA;AAEnC,MAAI,IAAA,CAAC,WAAW,IAAQ,IAAA,CAAC,WAAW,IAAQ,IAAA,CAAC,WAAW,SAAW,EAAA;AACjE,QAAM,MAAA,IAAIY,kBAAW,sDAAsD,CAAA;AAAA;AAI7E,MAAA,MAAM,YAAY,SAAU,CAAA,SAAA;AAC5B,MAAA,UAAA,CAAW,SAAS,SAAY,GAAA,SAAA;AAIhC,MAAI,IAAA,CAAC,UAAW,CAAA,QAAA,CAAS,WAAa,EAAA;AACpC,QAAW,UAAA,CAAA,QAAA,CAAS,cAAc,EAAC;AAAA;AAErC,MAAW,UAAA,CAAA,QAAA,CAAS,WAAY,CAAA,oBAAoB,CAAI,GAAA,aAAA;AAExD,MAAM,MAAA,OAAA,GAAU,MAAMP,WAAU,CAAA,oBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA;AAAA,OACF;AAGA,MAAA,MAAM,WAAWQ,iCAA4B,EAAA;AAC7C,MAAA,IAAI,QAAU,EAAA;AACZ,QAAA,MAAM,SAAS,OAAQ,EAAA;AAAA;AAGzB,MAAA,GAAA,CAAI,MAAO,CAAA,GAAG,CAAE,CAAA,IAAA,CAAK,OAAO,CAAA;AAAA,aACrB,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,MAAA,MAAM,eAAe,KAAiB,YAAA,KAAA,GAAQ,KAAM,CAAA,OAAA,GAAU,OAAO,KAAK,CAAA;AAE1E,MAAA,IAAI,iBAAiBb,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OAC/C,MAAA,IAAW,iBAAiBY,iBAAY,EAAA;AACtC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AAEL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAc,CAAA;AAAA;AAC9C;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,MAAO,CAAA,+BAAA,EAAiC,OAAO,GAAA,EAAK,GAAQ,KAAA;AACjE,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAGhC,MAAM,MAAA,iBAAA,GAAoB,MAAMX,aAAY,CAAA,SAAA;AAAA,QAC1C,CAAC,EAAE,UAAY,EAAAa,iDAAA,EAAuC,CAAA;AAAA,QACtD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWN,uCAAgB,KAAO,EAAA;AAEzD,QAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,UAC1C,CAAC,EAAE,UAAY,EAAAc,iDAAA,EAAuC,CAAA;AAAA,UACtD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWP,uCAAgB,KAAO,EAAA;AACzD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,QAAM,MAAA,QAAA,GAAW,MAAMK,WAAU,CAAA,iBAAA,CAAkB,yBAAyB,UAAY,EAAA,SAAA,EAAW,eAAe,IAAI,CAAA;AACtH,QAAA,MAAM,KAAQ,GAAA,QAAA,CAAS,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAEnE,QAAA,IAAI,UAAU,aAAe,EAAA;AAC3B,UAAM,MAAA,IAAIL,uBAAgB,2CAA2C,CAAA;AAAA;AACvE;AAEF,MAAA,OAAA,CAAQ,GAAI,CAAA,CAAA,sCAAA,EAAyC,SAAS,CAAA,CAAA,EAAI,IAAI,CAAE,CAAA,CAAA;AAExE,MAAI,IAAA,WAAA;AACJ,MAAI,IAAA;AACF,QAAA,WAAA,GAAc,MAAMK,WAAU,CAAA,mBAAA;AAAA,UAC5B,uBAAA;AAAA,UACA,UAAA;AAAA,UACA,SAAA;AAAA,UACA;AAAA,SACF;AAAA,eACO,KAAO,EAAA;AACd,QAAQ,OAAA,CAAA,IAAA,CAAK,iDAAiD,KAAK,CAAA;AACnE,QAAc,WAAA,GAAA,EAAE,KAAO,EAAA,EAAG,EAAA;AAAA;AAI5B,MAAA,MAAM,eAAmB,GAAA,CAAA,WAAA,CAAY,KAAS,IAAA,EAAI,EAAA,MAAA;AAAA,QAAO,CAACW,IAAAA,KACxDA,IAAI,CAAA,IAAA,EAAM,eAAe,IAAS,KAAA;AAAA,OACpC;AAEA,MAAA,OAAA,CAAQ,GAAI,CAAA,CAAA,MAAA,EAAS,eAAgB,CAAA,MAAM,CAAoB,kBAAA,CAAA,CAAA;AAG/D,MAAM,MAAA,eAAA,GAAkB,MAAM,OAAQ,CAAA,UAAA;AAAA,QACpC,eAAA,CAAgB,GAAI,CAAA,OAAO,OAAiB,KAAA;AAC1C,UAAM,MAAA,WAAA,GAAc,QAAQ,QAAS,CAAA,IAAA;AACrC,UAAA,OAAA,CAAQ,GAAI,CAAA,CAAA,iBAAA,EAAoB,SAAS,CAAA,CAAA,EAAI,WAAW,CAAE,CAAA,CAAA;AAC1D,UAAA,MAAMX,WAAU,CAAA,oBAAA;AAAA,YACd,uBAAA;AAAA,YACA,UAAA;AAAA,YACA,SAAA;AAAA,YACA,SAAA;AAAA,YACA;AAAA,WACF;AAAA,SACD;AAAA,OACH;AAEA,MAAA,MAAM,WAAW,eAAgB,CAAA,MAAA,CAAO,CAAK,CAAA,KAAA,CAAA,CAAE,WAAW,UAAU,CAAA;AACpE,MAAI,IAAA,QAAA,CAAS,SAAS,CAAG,EAAA;AACvB,QAAQ,OAAA,CAAA,IAAA;AAAA,UAAK,CAAA,EAAG,SAAS,MAAM,CAAA,0BAAA,CAAA;AAAA,UAC7B,QAAS,CAAA,GAAA,CAAI,CAAC,CAAA,KAAW,EAAE,MAAM;AAAA,SACnC;AAAA;AAEF,MAAA,MAAMA,WAAU,CAAA,oBAAA;AAAA,QACd,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA;AAAA,OACF;AAGA,MAAA,MAAM,WAAWQ,iCAA4B,EAAA;AAC7C,MAAA,IAAI,QAAU,EAAA;AACZ,QAAA,MAAM,SAAS,OAAQ,EAAA;AAAA;AAGzB,MAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,EAAA;AAAA,aACd,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,MAAA,IAAI,iBAAiBb,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,+BAA+B,CAAA;AAAA;AAC/D;AACF,GACD,CAAA;AAGD,EAAA,MAAA,CAAO,GAAI,CAAA,aAAA,EAAe,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC5C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAM,MAAA,QAAA,GAAW,MAAMC,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAM,4CAAA,EAAkC,CAAA;AAAA,QACjD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWC,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAA,MAAM,OAAO,MAAMK,WAAA,CAAU,mBAAoB,CAAA,2BAAA,EAA6B,MAAM,YAAY,CAAA;AAEhG,MAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,aACN,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAA8B,CAAA;AAAA;AAC9D;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,KAAM,CAAA,+BAAA,EAAiC,OAAO,GAAA,EAAK,GAAQ,KAAA;AAEhE,IAAM,MAAA,WAAA,GAAciB,MAAE,MAAO,CAAA;AAAA,MAC3B,IAAA,EAAMA,MAAE,MAAO,CAAA;AAAA,QACb,WAAa,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,QACjC,WAAa,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,QACjC,OAAS,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,QAC7B,aAAA,EAAeA,MAAE,IAAK,CAAA,CAAC,SAAS,WAAW,CAAC,EAAE,QAAS,EAAA;AAAA,QACvD,YAAA,EAAcA,MAAE,IAAK,CAAA,CAAC,aAAa,QAAQ,CAAC,EAAE,QAAS,EAAA;AAAA,QACvD,MAAMA,KAAE,CAAA,KAAA,CAAMA,MAAE,MAAO,EAAC,EAAE,QAAS,EAAA;AAAA,QACnC,OAAA,EAASA,MAAE,MAAO,CAAA;AAAA,UAChB,KAAO,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,UAC3B,IAAM,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,UAC1B,KAAO,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS;AAAA,SAC5B,CAAA,CAAE,OAAQ,EAAA,CAAE,QAAS,EAAA;AAAA,QACtB,aAAA,EAAeA,MAAE,MAAO,CAAA;AAAA,UACtB,OAAS,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,UAC7B,WAAa,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS;AAAA,SAClC,CAAA,CAAE,OAAQ,EAAA,CAAE,QAAS;AAAA,OACvB,EAAE,OAAQ;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,MAAS,GAAA,WAAA,CAAY,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AAC7C,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,OAAO,GAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,CAAA,EAAE,KAAO,EAAA,iBAAA,GAAoB,MAAO,CAAA,KAAA,CAAM,QAAS,EAAA,EAAG,CAAA;AAAA;AAGpF,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAA,IAAI,CAAC,WAAA,IAAe,CAAC,WAAA,CAAY,SAAW,EAAA;AAC1C,QAAM,MAAA,IAAIjB,uBAAgB,yBAAyB,CAAA;AAAA;AAGrD,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAGhC,MAAM,MAAA,iBAAA,GAAoB,MAAMC,aAAY,CAAA,SAAA;AAAA,QAC1C,CAAC,EAAE,UAAY,EAAAiB,iDAAA,EAAuC,CAAA;AAAA,QACtD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWV,uCAAgB,KAAO,EAAA;AAEzD,QAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,UAC1C,CAAC,EAAE,UAAY,EAAAkB,iDAAA,EAAuC,CAAA;AAAA,UACtD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWX,uCAAgB,KAAO,EAAA;AACzD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,QAAM,MAAA,QAAA,GAAW,MAAMK,WAAU,CAAA,iBAAA,CAAkB,yBAAyB,UAAY,EAAA,SAAA,EAAW,eAAe,IAAI,CAAA;AACtH,QAAA,MAAM,KAAQ,GAAA,QAAA,CAAS,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAEnE,QAAA,IAAI,UAAU,aAAe,EAAA;AAC3B,UAAM,MAAA,IAAIL,uBAAgB,2CAA2C,CAAA;AAAA;AACvE;AAIF,MAAI,IAAA,GAAA,CAAI,IAAK,CAAA,QAAA,EAAU,WAAa,EAAA;AAClC,QAAA,OAAO,GAAI,CAAA,IAAA,CAAK,QAAS,CAAA,WAAA,CAAY,oBAAoB,CAAA;AAAA;AAG3D,MAAM,MAAA,OAAA,GAAU,MAAMK,WAAU,CAAA,mBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA,IAAA;AAAA,QACA,MAAO,CAAA;AAAA,OACT;AAGA,MAAA,MAAM,WAAWQ,iCAA4B,EAAA;AAC7C,MAAA,IAAI,QAAU,EAAA;AACZ,QAAA,MAAM,SAAS,OAAQ,EAAA;AAAA;AAGzB,MAAO,OAAA,GAAA,CAAI,KAAK,OAAO,CAAA;AAAA,aAChB,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,MAAA,MAAM,eAAe,KAAiB,YAAA,KAAA,GAAQ,KAAM,CAAA,OAAA,GAAU,OAAO,KAAK,CAAA;AAE1E,MAAA,IAAI,iBAAiBb,sBAAiB,EAAA;AACpC,QAAO,OAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,KAAM,CAAA,OAAA,EAAS,CAAA;AAAA,OACtD,MAAA,IAAW,iBAAiBY,iBAAY,EAAA;AACtC,QAAO,OAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,KAAM,CAAA,OAAA,EAAS,CAAA;AAAA,OAC/C,MAAA;AACL,QAAO,OAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,cAAc,CAAA;AAAA;AACrD;AACF,GACD,CAAA;AAGD,EAAA,MAAA,CAAO,GAAI,CAAA,eAAA,EAAiB,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAM,MAAA,QAAA,GAAW,MAAMX,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAmB,4CAAA,EAAkC,CAAA;AAAA,QACjD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWZ,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAA,MAAM,OAAO,MAAMK,WAAA,CAAU,mBAAoB,CAAA,wBAAA,EAA0B,YAAY,cAAc,CAAA;AAGrG,MAAA,MAAM,QAAW,GAAA;AAAA,QACf,QAAQ,IAAK,CAAA,KAAA,IAAS,EAAI,EAAA,GAAA,CAAI,CAAC,MAAiB,MAAA;AAAA,UAC9C,QAAU,EAAA;AAAA,YACR,IAAA,EAAM,OAAO,QAAS,CAAA,IAAA;AAAA,YACtB,SAAA,EAAW,OAAO,QAAS,CAAA;AAAA,WAC7B;AAAA;AAAA,UAEA,SAAA,EAAW,MAAO,CAAA,IAAA,EAAM,SAAY,GAAA;AAAA,YAClC,IAAA,EAAM,MAAO,CAAA,IAAA,CAAK,SAAU,CAAA,IAAA;AAAA,YAC5B,IAAA,EAAM,MAAO,CAAA,IAAA,CAAK,SAAU,CAAA,IAAA;AAAA,YAC5B,SAAA,EAAW,MAAO,CAAA,IAAA,CAAK,SAAU,CAAA;AAAA,WAC/B,GAAA,KAAA,CAAA;AAAA;AAAA,UAEJ,KAAA,EAAA,CAAQ,OAAO,IAAM,EAAA,KAAA,IAAS,EAAI,EAAA,GAAA,CAAI,CAAC,IAAe,MAAA;AAAA,YACpD,MAAM,IAAK,CAAA,IAAA;AAAA,YACX,aAAa,IAAK,CAAA,WAAA;AAAA,YAClB,QAAQ,IAAK,CAAA;AAAA,WACb,CAAA;AAAA,SACF,CAAA;AAAA,OACJ;AAEA,MAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,aACV,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,gCAAgC,KAAK,CAAA;AACnD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gCAAgC,CAAA;AAAA;AAChE;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,GAAI,CAAA,gCAAA,EAAkC,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC/D,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAM,MAAA,QAAA,GAAW,MAAMC,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAoB,4CAAA,EAAkC,CAAA;AAAA,QACjD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWb,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAChC,MAAM,MAAA,IAAA,GAAO,MAAMK,WAAU,CAAA,iBAAA,CAAkB,0BAA0B,UAAY,EAAA,SAAA,EAAW,gBAAgB,IAAI,CAAA;AACpH,MAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,aACN,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,8BAA8B,CAAA;AAAA;AAC9D;AACF,GACD,CAAA;AAGD,EAAM,MAAA,aAAA,GAAgBiB,MAAE,MAAO,CAAA;AAAA,IAC7B,cAAA,EAAgBA,MAAE,MAAO,EAAA;AAAA;AAAA,IACzB,SAAA,EAAWA,MAAE,MAAO,EAAA;AAAA;AAAA,IACpB,QAAA,EAAUA,MAAE,MAAO,EAAA;AAAA,IACnB,OAAS,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,IAC7B,SAAW,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS;AAAA,GAChC,CAAA;AAED,EAAA,MAAA,CAAO,IAAK,CAAA,WAAA,EAAa,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC3C,IAAA,MAAM,MAAS,GAAA,aAAA,CAAc,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AAC/C,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,MAAM,IAAIL,iBAAA,CAAW,MAAO,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAG9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,cAAgB,EAAA,SAAA,EAAW,UAAU,OAAS,EAAA,SAAA,KAAc,MAAO,CAAA,IAAA;AAG3E,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AAGvE,MAAA,MAAM,WAAc,GAAA,CAAA,WAAA,EAAc,SAAS,CAAA,CAAA,EAAI,cAAc,CAAA,CAAA;AAC7D,MAAM,MAAA,QAAA,GAAW,MAAMX,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC;AAAA,UACC,UAAY,EAAAqB,iDAAA;AAAA,UACZ;AAAA,SACD,CAAA;AAAA,QACD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWd,uCAAgB,KAAO,EAAA;AAChD,QAAA,MAAM,IAAIR,sBAAA,CAAgB,CAAuC,oCAAA,EAAA,cAAc,CAAE,CAAA,CAAA;AAAA;AAEnF,MAAA,MAAM,YAAe,GAAAuB,kBAAA,CAAY,CAAC,CAAA,CAAE,SAAS,KAAK,CAAA;AAClD,MAAM,MAAA,QAAA,GAAW,yBAAyB,aAAa,CAAA;AACvD,MAAA,MAAM,WAAc,GAAA,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,cAAc,CAAA,CAAA,EAAI,YAAY,CAAA,CAAA,CAAG,WAAY,EAAA,CAAE,OAAQ,CAAA,aAAA,EAAe,GAAG,CAAA;AAE5G,MAAM,MAAA,WAAA,GAAmB,EAAE,MAAA,EAAQ,aAAc,EAAA;AACjD,MAAA,IAAI,SAAW,EAAA;AACb,QAAA,WAAA,CAAY,KAAQ,GAAA,SAAA;AAAA;AAGtB,MAAA,MAAM,OAAU,GAAA;AAAA,QACd,UAAY,EAAA,gCAAA;AAAA,QACZ,IAAM,EAAA,QAAA;AAAA,QACN,QAAU,EAAA;AAAA,UACR,IAAM,EAAA,WAAA;AAAA,UACN;AAAA,SACF;AAAA,QACA,IAAM,EAAA;AAAA,UACJ,aAAe,EAAA;AAAA,YACb,IAAM,EAAA;AAAA,WACR;AAAA,UACA,QAAA;AAAA,UACA,SAAS,OAAW,IAAA,EAAA;AAAA,UACpB;AAAA;AACF,OACF;AAEA,MAAM,MAAA,OAAA,GAAU,MAAMlB,WAAU,CAAA,oBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAKA,MAAA,GAAA,CAAI,MAAO,CAAA,GAAG,CAAE,CAAA,IAAA,CAAK,OAAO,CAAA;AAAA,aACrB,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,mCAAmC,KAAK,CAAA;AACtD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,oCAAoC,CAAA;AAAA;AACpE;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,GAAI,CAAA,WAAA,EAAa,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC1C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAGlD,MAAM,MAAA,eAAA,GAAkB,MAAMC,aAAY,CAAA,SAAA;AAAA,QACxC,CAAC,EAAE,UAAY,EAAAuB,kDAAA,EAAwC,CAAA;AAAA,QACvD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,MAAM,UAAa,GAAA,eAAA,CAAgB,CAAC,CAAA,CAAE,WAAWhB,sCAAgB,CAAA,KAAA;AAEjE,MAAA,IAAI,CAAC,UAAY,EAAA;AAEf,QAAM,MAAA,eAAA,GAAkB,MAAMP,aAAY,CAAA,SAAA;AAAA,UACxC,CAAC,EAAE,UAAY,EAAAwB,kDAAA,EAAwC,CAAA;AAAA,UACvD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,eAAgB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWjB,uCAAgB,KAAO,EAAA;AACvD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAC1C;AAGF,MAAM,MAAA,MAAA,GAAS,IAAI,KAAM,CAAA,MAAA;AACzB,MAAM,MAAA,SAAA,GAAY,IAAI,KAAM,CAAA,SAAA;AAE5B,MAAI,IAAA,IAAA;AACJ,MAAA,IAAI,SAAW,EAAA;AACb,QAAA,IAAA,GAAO,MAAMK,WAAU,CAAA,mBAAA,CAAoB,uBAAyB,EAAA,UAAA,EAAY,WAAW,SAAS,CAAA;AAAA,OAC/F,MAAA;AACL,QAAA,IAAA,GAAO,MAAMA,WAAA,CAAU,mBAAoB,CAAA,uBAAA,EAAyB,YAAY,SAAS,CAAA;AAAA;AAG3F,MAAI,IAAA,aAAA,GAAgB,IAAK,CAAA,KAAA,IAAS,EAAC;AAGnC,MAAA,IAAI,CAAC,UAAY,EAAA;AACf,QAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AAGvE,QAAA,MAAM,cAAc,MAAMA,WAAA,CAAU,mBAAoB,CAAA,uBAAA,EAAyB,YAAY,aAAa,CAAA;AAC1G,QAAA,MAAM,oBAAoB,WAAY,CAAA,KAAA,IAAS,EAC5C,EAAA,MAAA,CAAO,CAAC,OAAiB,KAAA;AACxB,UAAA,MAAM,KAAQ,GAAA,OAAA,CAAQ,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAClE,UAAA,OAAO,KAAU,KAAA,aAAA;AAAA,SAClB,CACA,CAAA,GAAA,CAAI,CAAC,OAAiB,KAAA,OAAA,CAAQ,SAAS,IAAI,CAAA;AAG9C,QAAA,aAAA,GAAgB,aAAc,CAAA,MAAA;AAAA,UAAO,CAACW,IACpC,KAAA,gBAAA,CAAiB,SAASA,IAAI,CAAA,IAAA,EAAM,eAAe,IAAI;AAAA,SACzD;AAAA;AAGF,MAAA,IAAI,MAAQ,EAAA;AACV,QAAgB,aAAA,GAAA,aAAA,CAAc,MAAO,CAAA,CAACA,IAAa,KAAA;AACjD,UAAM,MAAA,KAAA,GAAQA,IAAI,CAAA,MAAA,EAAQ,KAAS,IAAA,SAAA;AACnC,UAAA,OAAO,KAAU,KAAA,MAAA;AAAA,SAClB,CAAA;AAAA;AAGH,MAAA,GAAA,CAAI,IAAK,CAAA,EAAE,KAAO,EAAA,aAAA,EAAe,CAAA;AAAA,aAC1B,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,oCAAoC,KAAK,CAAA;AACvD,MAAA,IAAI,iBAAiBhB,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,oCAAoC,CAAA;AAAA;AACpE;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,GAAI,CAAA,cAAA,EAAgB,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC7C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAElD,MAAM,MAAA,QAAA,GAAW,MAAMC,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAwB,kDAAA,EAAwC,CAAA;AAAA,QACvD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWjB,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,MAAM,MAAA,SAAA,GAAY,IAAI,KAAM,CAAA,SAAA;AAE5B,MAAI,IAAA,IAAA;AACJ,MAAA,IAAI,SAAW,EAAA;AACb,QAAA,IAAA,GAAO,MAAMK,WAAU,CAAA,mBAAA,CAAoB,uBAAyB,EAAA,UAAA,EAAY,WAAW,SAAS,CAAA;AAAA,OAC/F,MAAA;AACL,QAAA,IAAA,GAAO,MAAMA,WAAA,CAAU,mBAAoB,CAAA,uBAAA,EAAyB,YAAY,SAAS,CAAA;AAAA;AAG3F,MAAA,MAAM,aAAiB,GAAA,CAAA,IAAA,CAAK,KAAS,IAAA,EAAI,EAAA,MAAA;AAAA,QACvC,CAACW,IAAAA,KAAaA,IAAI,CAAA,IAAA,EAAM,aAAa,MAAW,KAAA;AAAA,OAClD;AAEA,MAAA,GAAA,CAAI,IAAK,CAAA,EAAE,KAAO,EAAA,aAAA,EAAe,CAAA;AAAA,aAC1B,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,yCAAyC,KAAK,CAAA;AAC5D,MAAA,IAAI,iBAAiBhB,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,yCAAyC,CAAA;AAAA;AACzE;AACF,GACD,CAAA;AAED,EAAM,MAAA,mBAAA,GAAsBiB,MAAE,MAAO,CAAA;AAAA,IACnC,OAAS,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS;AAAA,GAC9B,CAAA;AAED,EAAA,MAAA,CAAO,IAAK,CAAA,oCAAA,EAAsC,OAAO,GAAA,EAAK,GAAQ,KAAA;AACpE,IAAA,MAAM,MAAS,GAAA,mBAAA,CAAoB,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AACrD,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,MAAM,IAAIL,iBAAA,CAAW,MAAO,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAG9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AAEvE,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAChC,MAAA,MAAM,UAAa,GAAA,aAAA;AAEnB,MAAM,MAAA,OAAA,GAAU,MAAMP,WAAU,CAAA,iBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,MAAM,OAAO,OAAQ,CAAA,IAAA;AACrB,MAAM,MAAA,cAAA,GAAiB,KAAK,aAAe,EAAA,IAAA;AAE3C,MAAA,IAAI,CAAC,cAAgB,EAAA;AACnB,QAAM,MAAA,IAAIO,kBAAW,+CAA+C,CAAA;AAAA;AAItE,MAAM,MAAA,UAAA,GAAa,MAAMP,WAAU,CAAA,iBAAA;AAAA,QACjC,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,MAAM,KAAQ,GAAA,UAAA,CAAW,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAGrE,MAAM,MAAA,iBAAA,GAAoB,MAAMJ,aAAY,CAAA,SAAA;AAAA,QAC1C,CAAC,EAAE,UAAY,EAAAyB,oDAAA,EAA0C,CAAA;AAAA,QACzD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWlB,uCAAgB,KAAO,EAAA;AAEzD,QAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,UAC1C,CAAC,EAAE,UAAY,EAAA0B,oDAAA,EAA0C,CAAA;AAAA,UACzD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWnB,uCAAgB,KAAO,EAAA;AACzD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,IAAI,UAAU,aAAe,EAAA;AAC3B,UAAM,MAAA,IAAIA,uBAAgB,yDAAyD,CAAA;AAAA;AACrF;AAIF,MAAA,MAAM,MAAS,GAAA;AAAA,QACb,KAAO,EAAA,UAAA;AAAA,QACP,UAAA;AAAA,QACA,UAAY,EAAA,iBAAA,IAAI,IAAK,EAAA,EAAE,WAAY;AAAA,OACrC;AAEA,MAAA,MAAMK,WAAU,CAAA,yBAAA;AAAA,QACd,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,GAAA,CAAI,IAAK,CAAA,EAAE,OAAS,EAAA,IAAA,EAAM,CAAA;AAAA,aACnB,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,oCAAoC,KAAK,CAAA;AACvD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qCAAqC,CAAA;AAAA;AACrE;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,IAAK,CAAA,mCAAA,EAAqC,OAAO,GAAA,EAAK,GAAQ,KAAA;AACnE,IAAA,MAAM,MAAS,GAAA,mBAAA,CAAoB,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AACrD,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,MAAM,IAAIY,iBAAA,CAAW,MAAO,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAG9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AAEvE,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAChC,MAAA,MAAM,UAAa,GAAA,aAAA;AAGnB,MAAM,MAAA,OAAA,GAAU,MAAMP,WAAU,CAAA,iBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,MAAM,OAAO,OAAQ,CAAA,IAAA;AACrB,MAAM,MAAA,cAAA,GAAiB,KAAK,aAAe,EAAA,IAAA;AAE3C,MAAA,IAAI,CAAC,cAAgB,EAAA;AACnB,QAAM,MAAA,IAAIO,kBAAW,+CAA+C,CAAA;AAAA;AAItE,MAAM,MAAA,UAAA,GAAa,MAAMP,WAAU,CAAA,iBAAA;AAAA,QACjC,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,aAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,MAAM,KAAQ,GAAA,UAAA,CAAW,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAIrE,MAAM,MAAA,iBAAA,GAAoB,MAAMJ,aAAY,CAAA,SAAA;AAAA,QAC1C,CAAC,EAAE,UAAY,EAAAyB,oDAAA,EAA0C,CAAA;AAAA,QACzD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWlB,uCAAgB,KAAO,EAAA;AAEzD,QAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,UAC1C,CAAC,EAAE,UAAY,EAAA0B,oDAAA,EAA0C,CAAA;AAAA,UACzD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWnB,uCAAgB,KAAO,EAAA;AACzD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,IAAI,UAAU,aAAe,EAAA;AAC3B,UAAM,MAAA,IAAIA,uBAAgB,wDAAwD,CAAA;AAAA;AACpF;AAGF,MAAA,MAAM,MAAS,GAAA;AAAA,QACb,KAAO,EAAA,UAAA;AAAA,QACP,UAAA;AAAA,QACA,UAAY,EAAA,iBAAA,IAAI,IAAK,EAAA,EAAE,WAAY;AAAA,OACrC;AAEA,MAAA,MAAMK,WAAU,CAAA,yBAAA;AAAA,QACd,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,EAAA;AAAA,aACd,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,oCAAoC,KAAK,CAAA;AACvD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,oCAAoC,CAAA;AAAA;AACpE;AACF,GACD,CAAA;AAED,EAAM,MAAA,iBAAA,GAAoBiB,MAAE,MAAO,CAAA;AAAA,IACjC,QAAU,EAAAA,KAAA,CAAE,KAAM,CAAAA,KAAA,CAAE,MAAO,CAAA;AAAA,MACzB,SAAA,EAAWA,MAAE,MAAO,EAAA;AAAA,MACpB,IAAA,EAAMA,MAAE,MAAO;AAAA,KAChB,CAAC,CAAA;AAAA,IACF,OAAS,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS;AAAA,GAC9B,CAAA;AAED,EAAA,MAAA,CAAO,IAAK,CAAA,wBAAA,EAA0B,OAAO,GAAA,EAAK,GAAQ,KAAA;AACxD,IAAA,MAAM,MAAS,GAAA,iBAAA,CAAkB,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AACnD,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,MAAM,IAAIL,iBAAA,CAAW,MAAO,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAG9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AAEvE,MAAM,MAAA,QAAA,GAAW,MAAMX,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAyB,oDAAA,EAA0C,CAAA;AAAA,QACzD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWlB,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAM,MAAA,EAAE,QAAS,EAAA,GAAI,MAAO,CAAA,IAAA;AAC5B,MAAA,MAAM,UAAa,GAAA,aAAA;AACnB,MAAA,MAAM,UAAU,EAAC;AAEjB,MAAA,KAAA,MAAW,UAAU,QAAU,EAAA;AAC7B,QAAI,IAAA;AAEF,UAAA,MAAM,MAAS,GAAA;AAAA,YACb,KAAO,EAAA,UAAA;AAAA,YACP,UAAA;AAAA,YACA,UAAY,EAAA,iBAAA,IAAI,IAAK,EAAA,EAAE,WAAY;AAAA,WACrC;AAEA,UAAA,MAAMK,WAAU,CAAA,yBAAA;AAAA,YACd,uBAAA;AAAA,YACA,UAAA;AAAA,YACA,MAAO,CAAA,SAAA;AAAA,YACP,SAAA;AAAA,YACA,MAAO,CAAA,IAAA;AAAA,YACP;AAAA,WACF;AAEA,UAAQ,OAAA,CAAA,IAAA,CAAK,EAAE,SAAA,EAAW,MAAO,CAAA,SAAA,EAAW,MAAM,MAAO,CAAA,IAAA,EAAM,OAAS,EAAA,IAAA,EAAM,CAAA;AAAA,iBACvE,KAAO,EAAA;AACd,UAAQ,OAAA,CAAA,KAAA,CAAM,2BAA2B,MAAO,CAAA,SAAS,IAAI,MAAO,CAAA,IAAI,KAAK,KAAK,CAAA;AAClF,UAAA,OAAA,CAAQ,IAAK,CAAA;AAAA,YACX,WAAW,MAAO,CAAA,SAAA;AAAA,YAClB,MAAM,MAAO,CAAA,IAAA;AAAA,YACb,OAAS,EAAA,KAAA;AAAA,YACT,KAAO,EAAA,KAAA,YAAiB,KAAQ,GAAA,KAAA,CAAM,OAAU,GAAA;AAAA,WACjD,CAAA;AAAA;AACH;AAGF,MAAI,GAAA,CAAA,IAAA,CAAK,EAAE,OAAA,EAAS,CAAA;AAAA,aACb,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,0BAA0B,KAAK,CAAA;AAC7C,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,2CAA2C,CAAA;AAAA;AAC3E;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,IAAK,CAAA,uBAAA,EAAyB,OAAO,GAAA,EAAK,GAAQ,KAAA;AACvD,IAAA,MAAM,MAAS,GAAA,iBAAA,CAAkB,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AACnD,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,MAAM,IAAIY,iBAAA,CAAW,MAAO,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAG9C,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AAEvE,MAAM,MAAA,QAAA,GAAW,MAAMX,aAAY,CAAA,SAAA;AAAA,QACjC,CAAC,EAAE,UAAY,EAAAyB,oDAAA,EAA0C,CAAA;AAAA,QACzD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,QAAS,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWlB,uCAAgB,KAAO,EAAA;AAChD,QAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAG1C,MAAM,MAAA,EAAE,QAAS,EAAA,GAAI,MAAO,CAAA,IAAA;AAC5B,MAAA,MAAM,UAAa,GAAA,aAAA;AACnB,MAAA,MAAM,UAAU,EAAC;AAEjB,MAAA,KAAA,MAAW,UAAU,QAAU,EAAA;AAC7B,QAAI,IAAA;AAEF,UAAM,MAAA,OAAA,GAAU,MAAMK,WAAU,CAAA,iBAAA;AAAA,YAC9B,uBAAA;AAAA,YACA,UAAA;AAAA,YACA,MAAO,CAAA,SAAA;AAAA,YACP,SAAA;AAAA,YACA,MAAO,CAAA;AAAA,WACT;AAEA,UAAA,MAAM,OAAO,OAAQ,CAAA,IAAA;AAIrB,UAAM,MAAA,UAAA,GAAa,MAAMA,WAAU,CAAA,iBAAA;AAAA,YACjC,uBAAA;AAAA,YACA,UAAA;AAAA,YACA,MAAO,CAAA,SAAA;AAAA,YACP,aAAA;AAAA,YACA,KAAK,aAAe,EAAA;AAAA,WACtB;AAEA,UAAA,MAAM,KAAQ,GAAA,UAAA,CAAW,QAAU,EAAA,WAAA,GAAc,oBAAoB,CAAA;AAIrE,UAAM,MAAA,iBAAA,GAAoB,MAAMJ,aAAY,CAAA,SAAA;AAAA,YAC1C,CAAC,EAAE,UAAY,EAAAiB,iDAAA,EAAuC,CAAA;AAAA,YACtD,EAAE,WAAY;AAAA,WAChB;AAEA,UAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWV,uCAAgB,KAAO,EAAA;AAEzD,YAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,cAC1C,CAAC,EAAE,UAAY,EAAAkB,iDAAA,EAAuC,CAAA;AAAA,cACtD,EAAE,WAAY;AAAA,aAChB;AAEA,YAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWX,uCAAgB,KAAO,EAAA;AACzD,cAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,YAAA,IAAI,UAAU,aAAe,EAAA;AAC3B,cAAM,MAAA,IAAIA,uBAAgB,wDAAwD,CAAA;AAAA;AACpF;AAGF,UAAA,MAAM,MAAS,GAAA;AAAA,YACb,KAAO,EAAA,UAAA;AAAA,YACP,UAAA;AAAA,YACA,UAAY,EAAA,iBAAA,IAAI,IAAK,EAAA,EAAE,WAAY;AAAA,WACrC;AAEA,UAAA,MAAMK,WAAU,CAAA,yBAAA;AAAA,YACd,uBAAA;AAAA,YACA,UAAA;AAAA,YACA,MAAO,CAAA,SAAA;AAAA,YACP,SAAA;AAAA,YACA,MAAO,CAAA,IAAA;AAAA,YACP;AAAA,WACF;AAEA,UAAQ,OAAA,CAAA,IAAA,CAAK,EAAE,SAAA,EAAW,MAAO,CAAA,SAAA,EAAW,MAAM,MAAO,CAAA,IAAA,EAAM,OAAS,EAAA,IAAA,EAAM,CAAA;AAAA,iBACvE,KAAO,EAAA;AACd,UAAQ,OAAA,CAAA,KAAA,CAAM,2BAA2B,MAAO,CAAA,SAAS,IAAI,MAAO,CAAA,IAAI,KAAK,KAAK,CAAA;AAClF,UAAA,OAAA,CAAQ,IAAK,CAAA;AAAA,YACX,WAAW,MAAO,CAAA,SAAA;AAAA,YAClB,MAAM,MAAO,CAAA,IAAA;AAAA,YACb,OAAS,EAAA,KAAA;AAAA,YACT,KAAO,EAAA,KAAA,YAAiB,KAAQ,GAAA,KAAA,CAAM,OAAU,GAAA;AAAA,WACjD,CAAA;AAAA;AACH;AAGF,MAAI,GAAA,CAAA,IAAA,CAAK,EAAE,OAAA,EAAS,CAAA;AAAA,aACb,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,yBAAyB,KAAK,CAAA;AAC5C,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,0CAA0C,CAAA;AAAA;AAC1E;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,MAAO,CAAA,4BAAA,EAA8B,OAAO,GAAA,EAAK,GAAQ,KAAA;AAC9D,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAGhC,MAAM,MAAA,OAAA,GAAU,MAAMK,WAAU,CAAA,iBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAM,MAAA,aAAA,GAAgB,OAAQ,CAAA,IAAA,EAAM,WAAa,EAAA,MAAA;AAGjD,MAAM,MAAA,iBAAA,GAAoB,MAAMJ,aAAY,CAAA,SAAA;AAAA,QAC1C,CAAC,EAAE,UAAY,EAAA2B,oDAAA,EAA0C,CAAA;AAAA,QACzD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,MAAM,YAAe,GAAA,iBAAA,CAAkB,CAAC,CAAA,CAAE,WAAWpB,sCAAgB,CAAA,KAAA;AAErE,MAAA,IAAI,CAAC,YAAc,EAAA;AAEjB,QAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,UAC1C,CAAC,EAAE,UAAY,EAAA4B,oDAAA,EAA0C,CAAA;AAAA,UACzD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWrB,uCAAgB,KAAO,EAAA;AACzD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,IAAI,kBAAkB,aAAe,EAAA;AACnC,UAAM,MAAA,IAAIA,uBAAgB,+CAA+C,CAAA;AAAA;AAC3E;AAIF,MAAA,MAAMK,WAAU,CAAA,oBAAA;AAAA,QACd,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AACA,MAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,EAAA;AAAA,aACd,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,mCAAmC,KAAK,CAAA;AACtD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,oCAAoC,CAAA;AAAA;AACpE;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,KAAM,CAAA,4BAAA,EAA8B,OAAO,GAAA,EAAK,GAAQ,KAAA;AAE7D,IAAM,MAAA,WAAA,GAAciB,MAAE,MAAO,CAAA;AAAA,MAC3B,IAAA,EAAMA,MAAE,MAAO,CAAA;AAAA,QACb,OAAS,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS,EAAA;AAAA,QAC7B,QAAU,EAAAA,KAAA,CAAE,MAAO,EAAA,CAAE,QAAS;AAAA,OAC/B,EAAE,OAAQ;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,MAAS,GAAA,WAAA,CAAY,SAAU,CAAA,GAAA,CAAI,IAAI,CAAA;AAC7C,IAAI,IAAA,CAAC,OAAO,OAAS,EAAA;AACnB,MAAA,MAAM,IAAIL,iBAAW,CAAA,iBAAA,GAAoB,MAAO,CAAA,KAAA,CAAM,UAAU,CAAA;AAAA;AAGlE,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAGhC,MAAM,MAAA,QAAA,GAAW,MAAMP,WAAU,CAAA,iBAAA;AAAA,QAC/B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAM,MAAA,aAAA,GAAgB,QAAS,CAAA,IAAA,EAAM,WAAa,EAAA,MAAA;AAClD,MAAM,MAAA,YAAA,GAAe,QAAS,CAAA,MAAA,EAAQ,KAAS,IAAA,SAAA;AAG/C,MAAA,IAAI,iBAAiB,SAAW,EAAA;AAC9B,QAAM,MAAA,IAAIL,uBAAgB,qCAAqC,CAAA;AAAA;AAIjE,MAAM,MAAA,iBAAA,GAAoB,MAAMC,aAAY,CAAA,SAAA;AAAA,QAC1C,CAAC,EAAE,UAAY,EAAAyB,oDAAA,EAA0C,CAAA;AAAA,QACzD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWlB,uCAAgB,KAAO,EAAA;AAEzD,QAAM,MAAA,iBAAA,GAAoB,MAAMP,aAAY,CAAA,SAAA;AAAA,UAC1C,CAAC,EAAE,UAAY,EAAA0B,oDAAA,EAA0C,CAAA;AAAA,UACzD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,iBAAkB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWnB,uCAAgB,KAAO,EAAA;AACzD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAI1C,QAAA,IAAI,kBAAkB,aAAe,EAAA;AACnC,UAAM,MAAA,IAAIA,uBAAgB,+CAA+C,CAAA;AAAA;AAC3E;AAIF,MAAM,MAAA,OAAA,GAAU,MAAMK,WAAU,CAAA,mBAAA;AAAA,QAC9B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAA;AAAA,QACA,MAAO,CAAA;AAAA,OACT;AAEA,MAAA,GAAA,CAAI,KAAK,OAAO,CAAA;AAAA,aACT,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,mCAAmC,KAAK,CAAA;AACtD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OAC/C,MAAA,IAAW,iBAAiBY,iBAAY,EAAA;AACtC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,oCAAoC,CAAA;AAAA;AACpE;AACF,GACD,CAAA;AAGD,EAAA,MAAA,CAAO,GAAI,CAAA,kCAAA,EAAoC,OAAO,GAAA,EAAK,GAAuB,KAAA;AAChF,IAAI,IAAA;AACF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,EAAE,aAAc,EAAA,GAAI,MAAM,eAAgB,CAAA,GAAA,EAAK,UAAU,QAAQ,CAAA;AACvE,MAAA,MAAM,EAAE,SAAA,EAAW,IAAK,EAAA,GAAI,GAAI,CAAA,MAAA;AAGhC,MAAM,MAAA,eAAA,GAAkB,MAAMX,aAAY,CAAA,SAAA;AAAA,QACxC,CAAC,EAAE,UAAY,EAAA6B,2CAAA,EAAiC,CAAA;AAAA,QAChD,EAAE,WAAY;AAAA,OAChB;AAEA,MAAA,MAAM,UAAa,GAAA,eAAA,CAAgB,CAAC,CAAA,CAAE,WAAWtB,sCAAgB,CAAA,KAAA;AAEjE,MAAA,IAAI,CAAC,UAAY,EAAA;AAEf,QAAM,MAAA,eAAA,GAAkB,MAAMP,aAAY,CAAA,SAAA;AAAA,UACxC,CAAC,EAAE,UAAY,EAAA8B,2CAAA,EAAiC,CAAA;AAAA,UAChD,EAAE,WAAY;AAAA,SAChB;AAEA,QAAA,IAAI,eAAgB,CAAA,CAAC,CAAE,CAAA,MAAA,KAAWvB,uCAAgB,KAAO,EAAA;AACvD,UAAM,MAAA,IAAIR,uBAAgB,cAAc,CAAA;AAAA;AAC1C;AAIF,MAAM,MAAA,MAAA,GAAS,MAAMK,WAAU,CAAA,iBAAA;AAAA,QAC7B,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAGA,MAAA,IAAI,CAAC,UAAY,EAAA;AACf,QAAM,MAAA,aAAA,GAAgB,MAAO,CAAA,IAAA,EAAM,WAAa,EAAA,MAAA;AAChD,QAAA,IAAI,kBAAkB,aAAe,EAAA;AACnC,UAAM,MAAA,IAAIL,uBAAgB,4CAA4C,CAAA;AAAA;AACxE;AAIF,MAAI,IAAA,MAAA,CAAO,MAAQ,EAAA,aAAA,KAAkB,IAAM,EAAA;AACzC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,CAAA;AAAA,UACnB,KAAO,EAAA;AAAA,SACR,CAAA;AACD,QAAA;AAAA;AAIF,MAAI,IAAA,CAAC,OAAO,MAAQ,EAAA,SAAA,EAAW,QAAQ,CAAC,MAAA,CAAO,MAAQ,EAAA,SAAA,EAAW,GAAK,EAAA;AACrE,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,CAAA;AAAA,UACnB,KAAO,EAAA;AAAA,SACR,CAAA;AACD,QAAA;AAAA;AAIF,MAAM,MAAA,UAAA,GAAa,MAAO,CAAA,MAAA,CAAO,SAAU,CAAA,IAAA;AAE3C,MAAI,IAAA,MAAA;AACJ,MAAI,IAAA;AACF,QAAA,MAAA,GAAS,MAAMK,WAAA,CAAU,SAAU,CAAA,SAAA,EAAW,UAAU,CAAA;AAAA,eACjD,KAAO,EAAA;AACd,QAAQ,OAAA,CAAA,KAAA,CAAM,0BAA0B,KAAK,CAAA;AAC7C,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,CAAA;AAAA,UACnB,KAAO,EAAA;AAAA,SACR,CAAA;AACD,QAAA;AAAA;AAIF,MAAM,MAAA,UAAA,GAAa,MAAO,CAAA,IAAA,IAAQ,EAAC;AACnC,MAAM,MAAA,WAAA,GAAc,WAAW,SAAS,CAAA;AAExC,MAAA,IAAI,CAAC,WAAa,EAAA;AAChB,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,CAAA;AAAA,UACnB,KAAA,EAAO,eAAe,SAAS,CAAA,qBAAA;AAAA,SAChC,CAAA;AACD,QAAA;AAAA;AAIF,MAAA,MAAM,gBAAgB,MAAO,CAAA,IAAA,CAAK,aAAa,QAAQ,CAAA,CAAE,SAAS,OAAO,CAAA;AAGzE,MAAA,MAAMA,WAAU,CAAA,yBAAA;AAAA,QACd,uBAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAA;AAAA,QACA;AAAA,UACE,GAAG,MAAO,CAAA,MAAA;AAAA,UACV,aAAe,EAAA;AAAA;AACjB,OACF;AAEA,MAAA,GAAA,CAAI,IAAK,CAAA;AAAA,QACP,MAAQ,EAAA;AAAA,OACT,CAAA;AAAA,aACM,KAAO,EAAA;AACd,MAAQ,OAAA,CAAA,KAAA,CAAM,iCAAiC,KAAK,CAAA;AACpD,MAAA,IAAI,iBAAiBL,sBAAiB,EAAA;AACpC,QAAI,GAAA,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,EAAE,KAAO,EAAA,KAAA,CAAM,SAAS,CAAA;AAAA,OACxC,MAAA;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,iCAAiC,CAAA;AAAA;AACjE;AACF,GACD,CAAA;AAED,EAAA,MAAA,CAAO,IAAIgC,sDAAkC,CAAA;AAAA,IAC3C,WAAa,EAAAC;AAAA,GACd,CAAC,CAAA;AAEF,EAAO,OAAA,MAAA;AACT;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kuadrant/kuadrant-backstage-plugin-backend",
-  "version": "0.0.2-dev-b0a6833",
+  "version": "0.0.2-dev-6187a11",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",