@memberjunction/server 5.38.0 → 5.40.0

package/dist/auth/magicLink/MagicLinkService.js

@@ -0,0 +1,605 @@
+/**
+ * @fileoverview Imperative shell for magic links: invite creation, redemption,
+ * user provisioning, and session-token minting. The pure logic lives in
+ * `magicLinkCore.ts`; this module wires it to the DB, key manager, and
+ * communication engine.
+ *
+ * @module @memberjunction/server/auth/magicLink
+ */
+import { Metadata, RunView, UserInfo, LogError, LogStatus, } from '@memberjunction/core';
+import { UUIDsEqual } from '@memberjunction/global';
+import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { CommunicationEngine } from '@memberjunction/communication-engine';
+import { Message } from '@memberjunction/communication-types';
+import { configInfo } from '../../config.js';
+import { MagicLinkKeyManager } from './MagicLinkKeys.js';
+import { generateRawToken, generateSessionId, hashToken, evaluateInvite, buildSessionClaims, buildConsumeInviteSQL, canIssueInvites, isRoleGrantable, MAGIC_LINK_TOKEN_PREFIX } from './magicLinkCore.js';
+const INVITE_ENTITY = 'MJ: Magic Link Invites';
+const REDEMPTION_ENTITY = 'MJ: Magic Link Redemptions';
+/** Shared Anonymous principal — seeded by the Phase-4 migration; must match that UUID. */
+const ANONYMOUS_USER_ID = '273910DF-28F1-45C1-A8F8-6E9AD8E5F008';
+/**
+ * Magic-link service. One instance per server, constructed with the resolved
+ * public URL and the validated config.
+ */
+export class MagicLinkService {
+    constructor(publicUrl, config) {
+        this.publicUrl = publicUrl;
+        this.config = config;
+    }
+    /**
+     * Creates a single-use, app-scoped invite, persists its hashed token, and
+     * (when a communication provider is configured) emails the link.
+     *
+     * @param params  invite parameters
+     * @param creatingUser  the authenticated internal user issuing the invite
+     * @param provider  the request's metadata provider; falls back to the global default
+     */
+    async CreateInvite(params, creatingUser, provider) {
+        try {
+            const md = provider ?? Metadata.Provider;
+            // Authorization: only Owners (or members of configured issuer roles) may
+            // mint invites. Without this, ANY authenticated user — including an
+            // external user already holding a restricted magic-link session — could
+            // issue invites and escalate.
+            const callerRoleNames = (creatingUser.UserRoles ?? []).map((r) => r.Role).filter((n) => !!n);
+            if (!canIssueInvites(creatingUser.Type, callerRoleNames, this.config.inviteIssuerRoleNames)) {
+                return { success: false, errorCode: 'forbidden', error: 'Not authorized to issue magic-link invites.' };
+            }
+            const roleId = params.roleId ?? this.resolveRestrictedRoleId(md);
+            if (!roleId) {
+                return { success: false, error: `Restricted role '${this.config.restrictedRoleName}' not found and no roleId supplied.` };
+            }
+            // Role allow-list: an invite may only grant the restricted role (or roles
+            // the deployment explicitly opted into). Blocks the escalation where a
+            // caller supplies the roleId of a privileged role (e.g. Owner).
+            const roleToGrant = md.Roles.find((r) => UUIDsEqual(r.ID, roleId));
+            if (!roleToGrant) {
+                return { success: false, errorCode: 'invalid_role', error: `Role '${roleId}' not found.` };
+            }
+            if (!isRoleGrantable(roleToGrant.Name, this.config.restrictedRoleName, this.config.grantableRoleNames)) {
+                return {
+                    success: false,
+                    errorCode: 'invalid_role',
+                    error: `Role '${roleToGrant.Name}' is not grantable via magic-link. Add it to magicLink.grantableRoleNames to allow it.`,
+                };
+            }
+            const app = md.Applications.find((a) => UUIDsEqual(a.ID, params.applicationId));
+            if (!app) {
+                return { success: false, error: `Application '${params.applicationId}' not found.` };
+            }
+            const rawToken = generateRawToken();
+            const expiresInHours = params.expiresInHours ?? this.config.defaultExpiresInHours;
+            const expiresAt = new Date(Date.now() + expiresInHours * 3600 * 1000);
+            const invite = await md.GetEntityObject(INVITE_ENTITY, creatingUser);
+            invite.NewRecord();
+            invite.TokenHash = hashToken(rawToken);
+            invite.Email = params.email;
+            invite.ApplicationID = params.applicationId;
+            invite.RoleID = roleId;
+            invite.ExpiresAt = expiresAt;
+            invite.MaxUses = params.maxUses ?? 1;
+            invite.UseCount = 0;
+            invite.CreatedByUserID = creatingUser.ID;
+            invite.Status = 'Active';
+            if (!(await invite.Save())) {
+                return { success: false, error: `Failed to create invite: ${invite.LatestResult?.CompleteMessage ?? 'unknown error'}` };
+            }
+            // Phase 2: pre-stage the multi-scope child rows (one app + one role) mirroring
+            // the single ApplicationID/RoleID. Additive — the columns stay authoritative for
+            // redemption today; this populates the child tables for the eventual switch to
+            // multi-scope reads. Best-effort so a child-row hiccup never fails issuance.
+            await this.writeInviteScopeChildRows(invite.ID, params.applicationId, roleId, creatingUser, md);
+            const redemptionUrl = this.buildRedemptionUrl(rawToken);
+            let emailSent = false;
+            if (this.config.communicationProvider) {
+                emailSent = await this.sendInviteEmail(params.email, redemptionUrl, app.Name, creatingUser);
+            }
+            return {
+                success: true,
+                inviteId: invite.ID,
+                redemptionUrl,
+                // Surface the raw token only when we couldn't deliver it ourselves.
+                rawToken: emailSent ? undefined : rawToken,
+                emailSent,
+                expiresAt: expiresAt.toISOString(),
+            };
+        }
+        catch (e) {
+            LogError(e);
+            return { success: false, error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    /**
+     * Redeems a raw token: validates the invite, atomically consumes one use,
+     * provisions/links the user with the restricted role + app, and mints a
+     * session JWT. Runs in the public (pre-auth) path, so it uses the global
+     * provider and a configured provisioning context user.
+     *
+     * Single-use is enforced by a compare-and-swap UPDATE ({@link consumeInvite})
+     * BEFORE the token is minted — two concurrent redemptions of a single-use
+     * link race on the same row and exactly one wins. The consume is the gate:
+     * if a later step fails, the use is already burned (fail-closed). That is the
+     * correct trade-off for a single-use credential — burning a token on a server
+     * error is recoverable (re-issue); allowing replay is not.
+     */
+    async RedeemInvite(rawToken, audit) {
+        // Captured by the `done` closure below so every exit path — success or any
+        // failure — records exactly one MagicLinkRedemption row with the outcome and
+        // whatever attribution we'd resolved by then.
+        let inviteId;
+        let provisionedUserId;
+        let ctxUser = null;
+        const done = async (result) => {
+            await this.recordRedemption(result, inviteId, provisionedUserId, audit, ctxUser);
+            return result;
+        };
+        try {
+            if (!rawToken || !rawToken.startsWith(MAGIC_LINK_TOKEN_PREFIX)) {
+                return done({ success: false, errorCode: 'invalid', error: 'Malformed token.' });
+            }
+            ctxUser = this.resolveProvisioningContextUser();
+            if (!ctxUser) {
+                LogError('[MagicLink] No provisioning context user available for redemption.');
+                return done({ success: false, errorCode: 'server_error', error: 'Server not configured for provisioning.' });
+            }
+            const contextUser = ctxUser;
+            // global-provider-ok: redemption runs in the pre-auth flow, no per-request provider yet
+            const md = Metadata.Provider; // global-provider-ok: server-side magic-link service; runs under the server's single default provider
+            const provider = md;
+            const tokenHash = hashToken(rawToken);
+            const rv = new RunView();
+            const found = await rv.RunView({
+                EntityName: INVITE_ENTITY,
+                ExtraFilter: `TokenHash = '${tokenHash}'`,
+                ResultType: 'entity_object',
+            }, contextUser);
+            if (!found.Success) {
+                LogError(`[MagicLink] Invite lookup failed: ${found.ErrorMessage}`);
+                return done({ success: false, errorCode: 'server_error', error: 'Lookup failed.' });
+            }
+            const invite = found.Results?.[0];
+            if (!invite) {
+                return done({ success: false, errorCode: 'not_found', error: 'Invite not found.' });
+            }
+            inviteId = invite.ID;
+            // Fast, friendly pre-check (returns a precise reason). NOT the authority —
+            // the atomic consume below is what actually enforces single-use.
+            const eligibility = evaluateInvite(invite, Date.now());
+            if (!eligibility.ok) {
+                return done({ success: false, errorCode: eligibility.errorCode, error: `Invite is ${eligibility.errorCode}.` });
+            }
+            // Fail-closed on the inviter: if the user who issued this link is no longer
+            // an active account, the link dies with them. Without this, a deactivated
+            // employee's outstanding invites would keep working (and provisioning would
+            // silently fall back to an Owner context). The invite is only as trustworthy
+            // as the still-active person who minted it.
+            if (!this.isInviterActive(invite.CreatedByUserID)) {
+                LogError(`[MagicLink] Invite ${invite.ID} rejected: inviter ${invite.CreatedByUserID} is not an active user.`);
+                return done({ success: false, errorCode: 'invalid', error: 'The user who issued this invite is no longer active.' });
+            }
+            const role = md.Roles.find((r) => UUIDsEqual(r.ID, invite.RoleID));
+            if (!role) {
+                LogError(`[MagicLink] Invite ${invite.ID} references missing role ${invite.RoleID}.`);
+                return done({ success: false, errorCode: 'server_error', error: 'Invite role not found.' });
+            }
+            // Atomic consume BEFORE minting. If we lose the race (0 rows updated), the
+            // invite was concurrently consumed/expired — re-evaluate the now-stale
+            // in-memory copy only to surface a precise code; default to 'consumed'.
+            if (!(await this.consumeInvite(invite, provider, contextUser))) {
+                // Lost the race or the invite expired between the pre-check and the
+                // consume. The in-memory copy still looks eligible if only the DB-side
+                // use count changed, so default that case to 'consumed'.
+                const recheck = evaluateInvite(invite, Date.now());
+                return done({ success: false, errorCode: recheck.ok ? 'consumed' : recheck.errorCode, error: 'Invite already redeemed or expired.' });
+            }
+            const provision = await this.provisionUser(invite, role, contextUser);
+            if (!provision.success) {
+                // Token already consumed (fail-closed). The link cannot be reused.
+                LogError(`[MagicLink] Provisioning failed after consuming invite ${invite.ID}: ${provision.error}`);
+                return done({ success: false, errorCode: 'provisioning_failed', error: provision.error });
+            }
+            provisionedUserId = provision.userId;
+            const nowSeconds = Math.floor(Date.now() / 1000);
+            const isAnon = invite.IdentityMode === 'anonymous';
+            const claims = buildSessionClaims({
+                issuer: this.publicUrl,
+                audience: this.config.audience,
+                inviteId: invite.ID,
+                email: provision.email,
+                firstName: provision.firstName,
+                lastName: provision.lastName,
+                applicationId: invite.ApplicationID,
+                roleName: role.Name,
+                invitedByUserId: invite.CreatedByUserID,
+                anonymous: isAnon,
+                // Per-session id for anon forensics (correlates one session's activity since all
+                // anon redemptions share the Anonymous principal). Carried into the redemption audit row.
+                sessionId: isAnon ? generateSessionId() : undefined,
+                // Resource-share scope (Phase 5): the single shared resource this link grants.
+                resourceId: invite.ResourceID ?? undefined,
+                nowSeconds,
+                ttlSeconds: this.config.sessionTokenTtlHours * 3600,
+            });
+            const token = MagicLinkKeyManager.Instance.Sign(claims);
+            const app = md.Applications.find((a) => UUIDsEqual(a.ID, invite.ApplicationID));
+            return done({
+                success: true,
+                token,
+                expiresAt: new Date(claims.exp * 1000).toISOString(),
+                applicationId: invite.ApplicationID,
+                applicationName: app?.Name,
+                applicationPath: app?.Path || undefined,
+                email: provision.email,
+            });
+        }
+        catch (e) {
+            LogError(e);
+            return done({ success: false, errorCode: 'server_error', error: e instanceof Error ? e.message : String(e) });
+        }
+    }
+    /**
+     * Writes one MagicLinkRedemption audit row for a redemption attempt. Best-effort:
+     * a failure here is logged but never fails the redemption (the user already has,
+     * or has been denied, their session — losing an audit row must not change that).
+     *
+     * InviteID/ProvisionedUserID are null when the attempt didn't get far enough to
+     * resolve them (e.g. a malformed or unknown token — exactly the scan/brute-force
+     * signal we want recorded). IP/User-Agent/Origin are stored as supplied by the
+     * router per the deployment's audit policy.
+     */
+    async recordRedemption(result, inviteId, provisionedUserId, audit, contextUser) {
+        try {
+            const ctx = contextUser ?? this.resolveProvisioningContextUser();
+            if (!ctx) {
+                LogError('[MagicLink] Cannot record redemption audit row: no context user available.');
+                return;
+            }
+            // global-provider-ok: redemption runs pre-auth, no per-request provider yet.
+            const md = Metadata.Provider; // global-provider-ok: server-side magic-link service; runs under the server's single default provider
+            const row = await md.GetEntityObject(REDEMPTION_ENTITY, ctx);
+            row.NewRecord();
+            if (inviteId) {
+                row.InviteID = inviteId;
+            }
+            row.AttemptedAt = new Date();
+            row.Outcome = result.success ? 'success' : result.errorCode ?? 'server_error';
+            row.IPAddress = audit?.ipAddress ?? null;
+            row.UserAgent = audit?.userAgent ?? null;
+            row.Origin = audit?.origin ?? null;
+            if (provisionedUserId) {
+                row.ProvisionedUserID = provisionedUserId;
+            }
+            if (!(await row.Save())) {
+                LogError(`[MagicLink] Failed to write redemption audit row: ${row.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+            }
+        }
+        catch (e) {
+            LogError(`[MagicLink] Redemption audit write threw: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    /**
+     * Writes the Phase-2 multi-scope child rows (one application + one role) that
+     * mirror the invite's single ApplicationID/RoleID. The columns remain the
+     * source of truth for redemption today; these rows pre-stage the data for the
+     * eventual switch to multi-scope reads, avoiding a breaking migration later.
+     * Best-effort: a child-write failure is logged but does not fail invite
+     * issuance (the columns alone keep the one-of-each flow working).
+     */
+    async writeInviteScopeChildRows(inviteId, applicationId, roleId, creatingUser, md) {
+        try {
+            const appRow = await md.GetEntityObject('MJ: Magic Link Invite Applications', creatingUser);
+            appRow.NewRecord();
+            appRow.InviteID = inviteId;
+            appRow.ApplicationID = applicationId;
+            if (!(await appRow.Save())) {
+                LogError(`[MagicLink] Failed to write invite-application child row: ${appRow.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+            }
+            const roleRow = await md.GetEntityObject('MJ: Magic Link Invite Roles', creatingUser);
+            roleRow.NewRecord();
+            roleRow.InviteID = inviteId;
+            roleRow.RoleID = roleId;
+            if (!(await roleRow.Save())) {
+                LogError(`[MagicLink] Failed to write invite-role child row: ${roleRow.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+            }
+        }
+        catch (e) {
+            LogError(`[MagicLink] Writing invite scope child rows threw: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    /** Resolves the configured restricted role's ID, if present. */
+    resolveRestrictedRoleId(md) {
+        const name = this.config.restrictedRoleName.trim().toLowerCase();
+        const role = md.Roles.find((r) => r.Name.trim().toLowerCase() === name);
+        return role?.ID;
+    }
+    /** Builds the shareable redemption URL. */
+    buildRedemptionUrl(rawToken) {
+        const base = this.publicUrl.replace(/\/$/, '');
+        return `${base}/magic-link/redeem?token=${encodeURIComponent(rawToken)}`;
+    }
+    /**
+     * Provisions the redeeming user: finds them by email or creates them, then
+     * ensures the restricted role and the single app assignment exist.
+     */
+    async provisionUser(invite, role, contextUser) {
+        // Ensure the invite's role can ACCESS the invite's app (Application Role with
+        // CanAccess) — otherwise Explorer's app-access gate bounces the user off the
+        // scoped app to a default. The invite is the authorization for that role to
+        // reach that app. Idempotent + role/app-level (independent of the user/identity mode).
+        await this.ensureAppAccess(invite.RoleID, invite.ApplicationID, contextUser);
+        // Anonymous mode: resolve the shared Anonymous principal. CRITICALLY, we do NOT
+        // write any UserRole/UserApplication for it — the anon user must never accrete
+        // scope (that would make every anon visitor a superuser). Scope rides on the
+        // per-session JWT claims; enforcement is claims-based, not role-based.
+        if (invite.IdentityMode === 'anonymous') {
+            return this.resolveAnonymousPrincipal();
+        }
+        const email = invite.Email;
+        if (!email) {
+            return { success: false, error: 'Email-mode invite is missing an email address.' };
+        }
+        const existing = UserCache.Instance.Users.find((u) => !!u.Email && u.Email.trim().toLowerCase() === email.trim().toLowerCase());
+        if (existing) {
+            // Provisioning guard: never silently attach an external role/app to a
+            // privileged existing account (Owner, or anyone holding a role OUTSIDE the
+            // set of roles magic-link may legitimately grant). The invite's own granted
+            // role is part of that allowed set, so a prior magic-link guest holding only
+            // that role can re-redeem a multi-use link.
+            if (this.isProtectedAccount(existing, role.Name)) {
+                const detail = `existing account '${existing.Email}' is an Owner or already holds non-restricted roles`;
+                if (this.config.provisioningGuard === 'block') {
+                    LogError(`[MagicLink] Blocked provisioning onto protected account: ${detail} (provisioningGuard=block).`);
+                    return { success: false, error: 'This email matches an existing privileged account; magic-link provisioning was blocked.' };
+                }
+                LogError(`[MagicLink] WARNING: provisioning external scope onto protected account — ${detail} (provisioningGuard=warn); proceeding.`);
+            }
+            const ok = await this.ensureRoleAndApp(existing.ID, invite.RoleID, invite.ApplicationID, contextUser);
+            return ok
+                ? { success: true, userId: existing.ID, email: existing.Email, firstName: existing.FirstName ?? undefined, lastName: existing.LastName ?? undefined }
+                : { success: false, error: 'Failed to assign role/application to existing user.' };
+        }
+        return this.createScopedUser(invite, role, contextUser);
+    }
+    /**
+     * Resolves the shared Anonymous principal for an anonymous-mode redemption. This
+     * principal is an ATTRIBUTION ANCHOR only — it holds no scenario roles and gets no
+     * UserRole/UserApplication rows here, so concurrent anon visitors can never accrete
+     * scope onto a shared identity. Their actual scope lives in the per-session JWT
+     * claims (mj_scopes) and is enforced claims-side. Fail-closed if the principal was
+     * never seeded (the Phase-4 migration is required).
+     */
+    resolveAnonymousPrincipal() {
+        const anon = UserCache.Instance.Users.find((u) => UUIDsEqual(u.ID, ANONYMOUS_USER_ID));
+        if (!anon) {
+            LogError(`[MagicLink] Anonymous principal ${ANONYMOUS_USER_ID} not found in cache; run the Phase-4 migration.`);
+            return { success: false, error: 'Anonymous access is not configured on this server.' };
+        }
+        return { success: true, userId: anon.ID, email: anon.Email ?? undefined, firstName: 'Anonymous', lastName: undefined };
+    }
+    /**
+     * True if an existing account is "protected" from magic-link provisioning: an
+     * Owner, or a user holding any role OUTSIDE the set of roles magic-link may
+     * legitimately grant. That allowed set is: the configured restricted role, the
+     * deployment's `grantableRoleNames`, AND the role THIS invite grants. So a prior
+     * magic-link guest holding only magic-link-grantable roles (e.g. the invite's own
+     * granted role) is NOT protected — re-redeeming a multi-use link is the intended
+     * flow. A user holding e.g. Developer/Admin is still protected and blocked.
+     *
+     * @param user  the existing account being re-provisioned
+     * @param invitedRoleName  the role name this invite grants
+     */
+    isProtectedAccount(user, invitedRoleName) {
+        if ((user.Type ?? '').trim().toLowerCase() === 'owner') {
+            return true;
+        }
+        const allowed = new Set([this.config.restrictedRoleName, ...this.config.grantableRoleNames, invitedRoleName]
+            .filter((n) => !!n)
+            .map((n) => n.trim().toLowerCase()));
+        return (user.UserRoles ?? []).some((r) => !!r.Role && !allowed.has(r.Role.trim().toLowerCase()));
+    }
+    /** Creates a new user with exactly the restricted role + single app, transactionally. */
+    async createScopedUser(invite, role, contextUser) {
+        // Single provider for BOTH the transaction and the entity writes, so the
+        // BeginTransaction/Save/Commit are provably on the same connection.
+        // global-provider-ok: redemption runs in the pre-auth flow, no per-request provider yet.
+        const provider = Metadata.Provider; // global-provider-ok: server-side magic-link service; runs under the server's single default provider
+        const email = invite.Email;
+        // The invite does not persist a name; provision a sensible default. (The
+        // create-invite params accept first/last name but there is no column to
+        // store them yet — see types.ts CreateMagicLinkInviteParams.)
+        const firstName = 'Guest';
+        const lastName = email;
+        await provider.BeginTransaction();
+        try {
+            const user = await provider.GetEntityObject('MJ: Users', contextUser);
+            user.NewRecord();
+            user.Name = email;
+            user.Email = email;
+            user.FirstName = firstName;
+            user.LastName = lastName;
+            user.Type = 'User';
+            user.IsActive = true;
+            if (!(await user.Save())) {
+                throw new Error(`user save failed: ${user.LatestResult?.CompleteMessage ?? 'unknown'}`);
+            }
+            const userRole = await provider.GetEntityObject('MJ: User Roles', contextUser);
+            userRole.NewRecord();
+            userRole.UserID = user.ID;
+            userRole.RoleID = invite.RoleID;
+            if (!(await userRole.Save())) {
+                throw new Error(`user role save failed: ${userRole.LatestResult?.CompleteMessage ?? 'unknown'}`);
+            }
+            const userApp = await provider.GetEntityObject('MJ: User Applications', contextUser);
+            userApp.NewRecord();
+            userApp.UserID = user.ID;
+            userApp.ApplicationID = invite.ApplicationID;
+            userApp.Sequence = 0;
+            userApp.IsActive = true;
+            if (!(await userApp.Save())) {
+                throw new Error(`user application save failed: ${userApp.LatestResult?.CompleteMessage ?? 'unknown'}`);
+            }
+            await provider.CommitTransaction();
+            // Seed the UserCache so the very next request (carrying the minted JWT)
+            // resolves this user without a full cache refresh.
+            this.pushUserToCache(user, role);
+            LogStatus(`[MagicLink] Provisioned external user ${email} with role '${role.Name}'.`);
+            return { success: true, userId: user.ID, email, firstName, lastName };
+        }
+        catch (txErr) {
+            await provider.RollbackTransaction();
+            LogError(txErr);
+            return { success: false, error: txErr instanceof Error ? txErr.message : String(txErr) };
+        }
+    }
+    /** Idempotently ensures an existing user has the given role and app assignment. */
+    async ensureRoleAndApp(userId, roleId, applicationId, contextUser) {
+        try {
+            const md = new Metadata(); // global-provider-ok: server-side magic-link provisioning; runs under the server's single default provider
+            const rv = new RunView();
+            const [roleRes, appRes] = await rv.RunViews([
+                { EntityName: 'MJ: User Roles', ExtraFilter: `UserID = '${userId}' AND RoleID = '${roleId}'`, ResultType: 'simple' },
+                { EntityName: 'MJ: User Applications', ExtraFilter: `UserID = '${userId}' AND ApplicationID = '${applicationId}'`, ResultType: 'simple' },
+            ], contextUser);
+            if (roleRes.Success && (roleRes.Results?.length ?? 0) === 0) {
+                const userRole = await md.GetEntityObject('MJ: User Roles', contextUser);
+                userRole.NewRecord();
+                userRole.UserID = userId;
+                userRole.RoleID = roleId;
+                if (!(await userRole.Save())) {
+                    LogError(`[MagicLink] Failed to add role to existing user: ${userRole.LatestResult?.CompleteMessage}`);
+                    return false;
+                }
+            }
+            if (appRes.Success && (appRes.Results?.length ?? 0) === 0) {
+                const userApp = await md.GetEntityObject('MJ: User Applications', contextUser);
+                userApp.NewRecord();
+                userApp.UserID = userId;
+                userApp.ApplicationID = applicationId;
+                userApp.Sequence = 0;
+                userApp.IsActive = true;
+                if (!(await userApp.Save())) {
+                    LogError(`[MagicLink] Failed to add application to existing user: ${userApp.LatestResult?.CompleteMessage}`);
+                    return false;
+                }
+            }
+            return true;
+        }
+        catch (e) {
+            LogError(e);
+            return false;
+        }
+    }
+    /** Idempotently ensures the role has CanAccess to the application (Application Role). */
+    async ensureAppAccess(roleId, applicationId, contextUser) {
+        try {
+            const rv = new RunView();
+            const res = await rv.RunView({
+                EntityName: 'MJ: Application Roles',
+                ExtraFilter: `RoleID = '${roleId}' AND ApplicationID = '${applicationId}'`,
+                ResultType: 'simple',
+            }, contextUser);
+            if (res.Success && (res.Results?.length ?? 0) > 0) {
+                return; // already granted
+            }
+            const md = new Metadata(); // global-provider-ok: server-side magic-link provisioning; runs under the server's single default provider
+            const appRole = await md.GetEntityObject('MJ: Application Roles', contextUser);
+            appRole.NewRecord();
+            appRole.ApplicationID = applicationId;
+            appRole.RoleID = roleId;
+            appRole.CanAccess = true;
+            appRole.CanAdmin = false;
+            if (!(await appRole.Save())) {
+                LogError(`[MagicLink] Failed to grant app access: ${appRole.LatestResult?.CompleteMessage ?? 'unknown'}`);
+            }
+        }
+        catch (e) {
+            LogError(e);
+        }
+    }
+    /**
+     * Atomically consumes one use of the invite via a compare-and-swap UPDATE.
+     * The WHERE clause re-checks every eligibility condition (Active, not
+     * exhausted, not expired) at the DB level, so the increment and the guard are
+     * a single atomic operation. Returns true ONLY when this call updated the row
+     * (won the race); concurrent redemptions of a single-use link see 0 rows.
+     *
+     * Fail-closed: any DB error returns false and the redemption is rejected.
+     */
+    async consumeInvite(invite, provider, contextUser) {
+        try {
+            const entityInfo = provider.EntityByName(INVITE_ENTITY);
+            if (!entityInfo) {
+                LogError(`[MagicLink] Entity metadata for '${INVITE_ENTITY}' not found; cannot consume invite.`);
+                return false;
+            }
+            const table = `[${entityInfo.SchemaName}].[${entityInfo.BaseTable}]`;
+            // OUTPUT returns one row iff the WHERE matched — the atomic single-use gate.
+            const sql = buildConsumeInviteSQL(table);
+            const rows = await provider.ExecuteSQL(sql, [invite.ID], { isMutation: true }, contextUser);
+            return Array.isArray(rows) && rows.length === 1;
+        }
+        catch (e) {
+            LogError(`[MagicLink] Atomic consume failed for invite ${invite.ID}: ${e instanceof Error ? e.message : String(e)}`);
+            return false;
+        }
+    }
+    /** Pushes a freshly created user into the UserCache with its single role. */
+    pushUserToCache(user, role) {
+        const initData = user.GetAll();
+        initData.UserRoles = [{ UserID: user.ID, RoleName: role.Name, RoleID: role.ID }];
+        const ui = new UserInfo(Metadata.Provider, initData); // global-provider-ok: redemption runs pre-auth, seeding the shared cache
+        UserCache.Instance.Users.push(ui);
+    }
+    /**
+     * True iff the invite's creator resolves to a still-active user. Used to
+     * fail-closed at redeem time so a deactivated/removed inviter's outstanding
+     * links stop working. A missing/blank CreatedByUserID is treated as inactive.
+     */
+    isInviterActive(createdByUserId) {
+        if (!createdByUserId) {
+            return false;
+        }
+        const inviter = UserCache.Instance.Users.find((u) => UUIDsEqual(u.ID, createdByUserId));
+        return !!inviter && inviter.IsActive === true;
+    }
+    /** Resolves the user whose context provisions magic-link users. */
+    resolveProvisioningContextUser() {
+        const candidate = this.config.contextUserForProvisioning || configInfo.userHandling?.contextUserForNewUserCreation;
+        if (candidate) {
+            const byName = UserCache.Instance.UserByName(candidate);
+            if (byName) {
+                return byName;
+            }
+            LogError(`[MagicLink] Configured provisioning user '${candidate}' not found; falling back to an Owner.`);
+        }
+        return UserCache.Users.find((u) => u.Type?.trim().toLowerCase() === 'owner') ?? null;
+    }
+    /** Sends the invite email via the configured communication provider. Best-effort. */
+    async sendInviteEmail(email, redemptionUrl, appName, contextUser) {
+        try {
+            const engine = CommunicationEngine.Instance;
+            await engine.Config(false, contextUser);
+            const msg = new Message();
+            msg.From = this.config.fromAddress ?? '';
+            msg.To = email;
+            msg.Subject = `You've been invited to ${appName}`;
+            msg.Body = `You've been invited to access ${appName}. Open this link to sign in:\n\n${redemptionUrl}\n\nThis link is single-use and will expire.`;
+            msg.HTMLBody =
+                `<p>You've been invited to access <strong>${appName}</strong>.</p>` +
+                    `<p><a href="${redemptionUrl}">Click here to sign in</a></p>` +
+                    `<p>This link is single-use and will expire.</p>`;
+            const result = await engine.SendSingleMessage(this.config.communicationProvider, 'Email', msg);
+            if (!result?.Success) {
+                LogError(`[MagicLink] Email send failed: ${result?.Error ?? 'unknown error'}`);
+                return false;
+            }
+            return true;
+        }
+        catch (e) {
+            LogError(`[MagicLink] Email send threw: ${e instanceof Error ? e.message : String(e)}`);
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=MagicLinkService.js.map

package/dist/auth/magicLink/MagicLinkService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLinkService.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,SAAS,GAIV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAYpD,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAwB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,eAAe,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ1M,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AACvD,0FAA0F;AAC1F,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AAajE;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAC3B,YACmB,SAAiB,EACjB,MAAuB;QADvB,cAAS,GAAT,SAAS,CAAQ;QACjB,WAAM,GAAN,MAAM,CAAiB;IACvC,CAAC;IAEJ;;;;;;;OAOG;IACI,KAAK,CAAC,YAAY,CACvB,MAAmC,EACnC,YAAsB,EACtB,QAA4B;QAE5B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;YAEzC,yEAAyE;YACzE,oEAAoE;YACpE,wEAAwE;YACxE,8BAA8B;YAC9B,MAAM,eAAe,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1G,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAC5F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;YAC1G,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,IAAI,CAAC,MAAM,CAAC,kBAAkB,qCAAqC,EAAE,CAAC;YAC5H,CAAC;YAED,0EAA0E;YAC1E,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,WAAW,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,MAAM,cAAc,EAAE,CAAC;YAC7F,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACvG,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,cAAc;oBACzB,KAAK,EAAE,SAAS,WAAW,CAAC,IAAI,wFAAwF;iBACzH,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;YAChF,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,MAAM,CAAC,aAAa,cAAc,EAAE,CAAC;YACvF,CAAC;YAED,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;YACpC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;YAClF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;YAEtE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,eAAe,CAA0B,aAAa,EAAE,YAAY,CAAC,CAAC;YAC9F,MAAM,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;YAC5C,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;YAC7B,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACrC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;YACpB,MAAM,CAAC,eAAe,GAAG,YAAY,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;YAEzB,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,MAAM,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,EAAE,CAAC;YAC1H,CAAC;YAED,+EAA+E;YAC/E,iFAAiF;YACjF,+EAA+E;YAC/E,6EAA6E;YAC7E,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YAEhG,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAExD,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBACtC,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC9F,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,aAAa;gBACb,oEAAoE;gBACpE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;gBAC1C,SAAS;gBACT,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,KAA0B;QACpE,2EAA2E;QAC3E,6EAA6E;QAC7E,8CAA8C;QAC9C,IAAI,QAA4B,CAAC;QACjC,IAAI,iBAAqC,CAAC;QAC1C,IAAI,OAAO,GAAoB,IAAI,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,EAAE,MAA6B,EAAkC,EAAE;YACnF,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACjF,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACnF,CAAC;YAED,OAAO,GAAG,IAAI,CAAC,8BAA8B,EAAE,CAAC;YAChD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,QAAQ,CAAC,oEAAoE,CAAC,CAAC;gBAC/E,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,MAAM,WAAW,GAAG,OAAO,CAAC;YAE5B,wFAAwF;YACxF,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,sGAAsG;YACpI,MAAM,QAAQ,GAAG,EAA0B,CAAC;YAE5C,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAC5B;gBACE,UAAU,EAAE,aAAa;gBACzB,WAAW,EAAE,gBAAgB,SAAS,GAAG;gBACzC,UAAU,EAAE,eAAe;aAC5B,EACD,WAAW,CACZ,CAAC;YAEF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnB,QAAQ,CAAC,qCAAqC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC;YAErB,2EAA2E;YAC3E,iEAAiE;YACjE,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,WAAW,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;YAClH,CAAC;YAED,4EAA4E;YAC5E,0EAA0E;YAC1E,4EAA4E;YAC5E,6EAA6E;YAC7E,4CAA4C;YAC5C,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;gBAClD,QAAQ,CAAC,sBAAsB,MAAM,CAAC,EAAE,sBAAsB,MAAM,CAAC,eAAe,yBAAyB,CAAC,CAAC;gBAC/G,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,QAAQ,CAAC,sBAAsB,MAAM,CAAC,EAAE,4BAA4B,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBACtF,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC9F,CAAC;YAED,2EAA2E;YAC3E,uEAAuE;YACvE,wEAAwE;YACxE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;gBAC/D,oEAAoE;gBACpE,uEAAuE;gBACvE,yDAAyD;gBACzD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnD,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACxI,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YACtE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,mEAAmE;gBACnE,QAAQ,CAAC,0DAA0D,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;gBACpG,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,iBAAiB,GAAG,SAAS,CAAC,MAAM,CAAC;YAErC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,KAAK,WAAW,CAAC;YACnD,MAAM,MAAM,GAAG,kBAAkB,CAAC;gBAChC,MAAM,EAAE,IAAI,CAAC,SAAS;gBACtB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC9B,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,KAAK,EAAE,SAAS,CAAC,KAAM;gBACvB,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,SAAS,EAAE,MAAM;gBACjB,iFAAiF;gBACjF,0FAA0F;gBAC1F,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS;gBACnD,+EAA+E;gBAC/E,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,SAAS;gBAC1C,UAAU;gBACV,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,GAAG,IAAI;aACpD,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAExD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;YAEhF,OAAO,IAAI,CAAC;gBACV,OAAO,EAAE,IAAI;gBACb,KAAK;gBACL,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;gBACpD,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,GAAG,EAAE,IAAI;gBAC1B,eAAe,EAAE,GAAG,EAAE,IAAI,IAAI,SAAS;gBACvC,KAAK,EAAE,SAAS,CAAC,KAAK;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,gBAAgB,CAC5B,MAA6B,EAC7B,QAA4B,EAC5B,iBAAqC,EACrC,KAAqC,EACrC,WAA4B;QAE5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,WAAW,IAAI,IAAI,CAAC,8BAA8B,EAAE,CAAC;YACjE,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,QAAQ,CAAC,4EAA4E,CAAC,CAAC;gBACvF,OAAO;YACT,CAAC;YACD,6EAA6E;YAC7E,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,sGAAsG;YACpI,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,eAAe,CAA8B,iBAAiB,EAAE,GAAG,CAAC,CAAC;YAC1F,GAAG,CAAC,SAAS,EAAE,CAAC;YAChB,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC1B,CAAC;YACD,GAAG,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;YAC7B,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,cAAc,CAAC;YAC9E,GAAG,CAAC,SAAS,GAAG,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC;YACzC,GAAG,CAAC,SAAS,GAAG,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC;YACzC,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC;YACnC,IAAI,iBAAiB,EAAE,CAAC;gBACtB,GAAG,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,qDAAqD,GAAG,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,6CAA6C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,yBAAyB,CACrC,QAAgB,EAChB,aAAqB,EACrB,MAAc,EACd,YAAsB,EACtB,EAAqB;QAErB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,eAAe,CAAqC,oCAAoC,EAAE,YAAY,CAAC,CAAC;YAChI,MAAM,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC3B,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;YACrC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,6DAA6D,MAAM,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;YACnI,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAA8B,6BAA6B,EAAE,YAAY,CAAC,CAAC;YACnH,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC5B,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YACxB,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,sDAAsD,OAAO,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;YAC7H,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,sDAAsD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IAED,gEAAgE;IACxD,uBAAuB,CAAC,EAAqB;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACjE,MAAM,IAAI,GAAyB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;QAC9F,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED,2CAA2C;IACnC,kBAAkB,CAAC,QAAgB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,OAAO,GAAG,IAAI,4BAA4B,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa,CAAC,MAA+B,EAAE,IAAc,EAAE,WAAqB;QAChG,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,uFAAuF;QACvF,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAE7E,gFAAgF;QAChF,+EAA+E;QAC/E,6EAA6E;QAC7E,uEAAuE;QACvE,IAAI,MAAM,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;QACrF,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAChF,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,sEAAsE;YACtE,2EAA2E;YAC3E,4EAA4E;YAC5E,6EAA6E;YAC7E,4CAA4C;YAC5C,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,MAAM,MAAM,GAAG,qBAAqB,QAAQ,CAAC,KAAK,qDAAqD,CAAC;gBACxG,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,OAAO,EAAE,CAAC;oBAC9C,QAAQ,CAAC,4DAA4D,MAAM,6BAA6B,CAAC,CAAC;oBAC1G,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yFAAyF,EAAE,CAAC;gBAC9H,CAAC;gBACD,QAAQ,CAAC,6EAA6E,MAAM,wCAAwC,CAAC,CAAC;YACxI,CAAC;YAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YACtG,OAAO,EAAE;gBACP,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,SAAS,EAAE;gBACrJ,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC;QACvF,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACK,yBAAyB;QAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,mCAAmC,iBAAiB,iDAAiD,CAAC,CAAC;YAChH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC;QACzF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACzH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,kBAAkB,CAAC,IAAc,EAAE,eAAuB;QAChE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,eAAe,CAAC;aACjF,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CACtC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IAED,yFAAyF;IACjF,KAAK,CAAC,gBAAgB,CAAC,MAA+B,EAAE,IAAc,EAAE,WAAqB;QACnG,yEAAyE;QACzE,oEAAoE;QACpE,yFAAyF;QACzF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAgC,CAAC,CAAC,sGAAsG;QAClK,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,yEAAyE;QACzE,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,SAAS,GAAG,OAAO,CAAC;QAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC;QAEvB,MAAM,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAe,WAAW,EAAE,WAAW,CAAC,CAAC;YACpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACzB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,YAAY,EAAE,eAAe,IAAI,SAAS,EAAE,CAAC,CAAC;YAC1F,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAmB,gBAAgB,EAAE,WAAW,CAAC,CAAC;YACjG,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrB,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAChC,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,YAAY,EAAE,eAAe,IAAI,SAAS,EAAE,CAAC,CAAC;YACnG,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,CAA0B,uBAAuB,EAAE,WAAW,CAAC,CAAC;YAC9G,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;YAC7C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,CAAC,YAAY,EAAE,eAAe,IAAI,SAAS,EAAE,CAAC,CAAC;YACzG,CAAC;YAED,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAEnC,wEAAwE;YACxE,mDAAmD;YACnD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAEjC,SAAS,CAAC,yCAAyC,KAAK,eAAe,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACtF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACrC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,MAAc,EAAE,aAAqB,EAAE,WAAqB;QACzG,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAC,2GAA2G;YACtI,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;YAEzB,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,QAAQ,CACzC;gBACE,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,MAAM,mBAAmB,MAAM,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE;gBACpH,EAAE,UAAU,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,MAAM,0BAA0B,aAAa,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE;aAC1I,EACD,WAAW,CACZ,CAAC;YAEF,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5D,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,eAAe,CAAmB,gBAAgB,EAAE,WAAW,CAAC,CAAC;gBAC3F,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACrB,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;gBACzB,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;gBACzB,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC7B,QAAQ,CAAC,oDAAoD,QAAQ,CAAC,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;oBACvG,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAA0B,uBAAuB,EAAE,WAAW,CAAC,CAAC;gBACxG,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;gBACxB,OAAO,CAAC,aAAa,GAAG,aAAa,CAAC;gBACtC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACxB,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC5B,QAAQ,CAAC,2DAA2D,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;oBAC7G,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,yFAAyF;IACjF,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,aAAqB,EAAE,WAAqB;QACxF,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAC1B;gBACE,UAAU,EAAE,uBAAuB;gBACnC,WAAW,EAAE,aAAa,MAAM,0BAA0B,aAAa,GAAG;gBAC1E,UAAU,EAAE,QAAQ;aACrB,EACD,WAAW,CACZ,CAAC;YACF,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,OAAO,CAAC,kBAAkB;YAC5B,CAAC;YACD,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAC,2GAA2G;YACtI,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAA0B,uBAAuB,EAAE,WAAW,CAAC,CAAC;YACxG,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,aAAa,GAAG,aAAa,CAAC;YACtC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YACxB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YACzB,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;YACzB,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,2CAA2C,OAAO,CAAC,YAAY,EAAE,eAAe,IAAI,SAAS,EAAE,CAAC,CAAC;YAC5G,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,aAAa,CAAC,MAA+B,EAAE,QAA8B,EAAE,WAAqB;QAChH,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YACxD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,QAAQ,CAAC,oCAAoC,aAAa,qCAAqC,CAAC,CAAC;gBACjG,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,MAAM,UAAU,CAAC,SAAS,GAAG,CAAC;YACrE,6EAA6E;YAC7E,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAiB,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;YAC5G,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,gDAAgD,MAAM,CAAC,EAAE,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,6EAA6E;IACrE,eAAe,CAAC,IAAkB,EAAE,IAAc;QACxD,MAAM,QAAQ,GAA6F,IAAI,CAAC,MAAM,EAAE,CAAC;QACzH,QAAQ,CAAC,SAAS,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,yEAAyE;QAC/H,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACK,eAAe,CAAC,eAA0C;QAChE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IAChD,CAAC;IAED,mEAAmE;IAC3D,8BAA8B;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,0BAA0B,IAAI,UAAU,CAAC,YAAY,EAAE,6BAA6B,CAAC;QACnH,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,QAAQ,CAAC,6CAA6C,SAAS,wCAAwC,CAAC,CAAC;QAC3G,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;IACvF,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,aAAqB,EAAE,OAAe,EAAE,WAAqB;QACxG,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC;YAC5C,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAExC,MAAM,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;YACzC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC;YACf,GAAG,CAAC,OAAO,GAAG,0BAA0B,OAAO,EAAE,CAAC;YAClD,GAAG,CAAC,IAAI,GAAG,iCAAiC,OAAO,mCAAmC,aAAa,8CAA8C,CAAC;YAClJ,GAAG,CAAC,QAAQ;gBACV,4CAA4C,OAAO,gBAAgB;oBACnE,eAAe,aAAa,iCAAiC;oBAC7D,iDAAiD,CAAC;YAEpD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAsB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAChG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBACrB,QAAQ,CAAC,kCAAkC,MAAM,EAAE,KAAK,IAAI,eAAe,EAAE,CAAC,CAAC;gBAC/E,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,iCAAiC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}