@tekki-forge/runtime-api 0.1.0

package/README.md

@@ -0,0 +1,5 @@
+# @tekki-forge/runtime-api
+
+Forge API runtime: generic, IR-driven CRUD on NestJS with auth, RBAC, tenancy, audit and hooks.
+
+Part of [Tekki Forge](https://www.npmjs.com/package/tekki-forge), which turns a `forge.config.ts` into a production-ready full-stack app. Apps created with `forge new` install this package for you; see the [tekki-forge](https://www.npmjs.com/package/tekki-forge) package for the documentation.

package/dist/access.d.ts

@@ -0,0 +1,15 @@
+import type { EntityIR, FieldIR } from "@tekki-forge/compiler";
+import { type PolicyCheck, type Principal } from "@tekki-forge/runtime-permissions";
+type Row = Record<string, any>;
+/** Can `principal` read field `f` of this record? (Entity-level read is checked separately.) */
+export declare function canReadField(entity: EntityIR, f: FieldIR, principal: Principal | null, record: Row, check?: PolicyCheck): Promise<boolean>;
+/** Field names this caller may not read on this record. */
+export declare function unreadableFields(entity: EntityIR, principal: Principal | null, record: Row, check?: PolicyCheck): Promise<Set<string>>;
+/**
+ * Fields the caller may use in filters, sorting and search. A field restricted per record (owner/policy)
+ * cannot be queried, otherwise its values would leak through result counts.
+ */
+export declare function queryableFields(entity: EntityIR, principal: Principal | null): Set<string>;
+/** Fields in `data` (Prisma-shaped write data) the caller is not allowed to write on `record`. */
+export declare function unwritableFields(entity: EntityIR, data: Row, principal: Principal | null, record: Row, check?: PolicyCheck): Promise<FieldIR[]>;
+export {};

package/dist/access.js

@@ -0,0 +1,51 @@
+import { allowsRecord, evaluate } from "@tekki-forge/runtime-permissions";
+/** Can `principal` read field `f` of this record? (Entity-level read is checked separately.) */
+export async function canReadField(entity, f, principal, record, check) {
+    const rule = f.access?.read;
+    if (!rule)
+        return true;
+    return allowsRecord(entity, evaluate(rule, principal), principal, record, check);
+}
+/** Field names this caller may not read on this record. */
+export async function unreadableFields(entity, principal, record, check) {
+    const out = new Set();
+    for (const f of entity.fields) {
+        if (f.access?.read && !(await canReadField(entity, f, principal, record, check)))
+            out.add(f.name);
+    }
+    return out;
+}
+/**
+ * Fields the caller may use in filters, sorting and search. A field restricted per record (owner/policy)
+ * cannot be queried, otherwise its values would leak through result counts.
+ */
+export function queryableFields(entity, principal) {
+    const out = new Set();
+    for (const f of entity.fields) {
+        const rule = f.access?.read;
+        if (!rule)
+            out.add(f.name);
+        else {
+            const d = evaluate(rule, principal);
+            if (d.allowed && d.scope === "all")
+                out.add(f.name);
+        }
+    }
+    return out;
+}
+/** Fields in `data` (Prisma-shaped write data) the caller is not allowed to write on `record`. */
+export async function unwritableFields(entity, data, principal, record, check) {
+    const denied = [];
+    for (const f of entity.fields) {
+        const rule = f.access?.write;
+        if (!rule)
+            continue;
+        const keys = f.kind === "location" ? [`${f.name}Lat`, `${f.name}Lng`] : f.relation?.type === "many-to-many" ? [f.name] : [f.apiName];
+        if (!keys.some((k) => k in data))
+            continue;
+        if (!(await allowsRecord(entity, evaluate(rule, principal), principal, record, check)))
+            denied.push(f);
+    }
+    return denied;
+}
+//# sourceMappingURL=access.js.map

package/dist/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAoC,MAAM,kCAAkC,CAAC;AAI5G,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAgB,EAAE,CAAU,EAAE,SAA2B,EAAE,MAAW,EAAE,KAAmB;IAC5H,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAgB,EAAE,SAA2B,EAAE,MAAW,EAAE,KAAmB;IACpH,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAgB,EAAE,SAA2B;IAC3E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACtB,CAAC;YACJ,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAgB,EAChB,IAAS,EACT,SAA2B,EAC3B,MAAW,EACX,KAAmB;IAEnB,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,GAA6B,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACrI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/api-keys.d.ts

@@ -0,0 +1,140 @@
+import type { AppIR } from "@tekki-forge/compiler";
+import type { ForgeRequestContext } from "./extension.js";
+type Row = Record<string, any>;
+/**
+ * Scoped API keys: `Authorization: Bearer fk_<prefix>_<secret>`.
+ * The prefix (12 hex chars) is a public lookup id; only a SHA-256 hash of the secret is stored.
+ * A key is a service principal of its organization: the role chosen at creation (never above the
+ * creator's, re-checked on every request) intersected with its scopes.
+ */
+export declare const API_KEY_PATTERN: RegExp;
+export declare function generateApiKey(): {
+    key: string;
+    prefix: string;
+    hash: string;
+};
+export declare function hashSecret(secret: string): string;
+export declare function parseApiKey(token: string): {
+    prefix: string;
+    secret: string;
+} | null;
+/** Constant-time comparison of a presented secret with the stored hash. */
+export declare function secretMatches(secret: string, hash: string): boolean;
+/**
+ * Validate and normalize scopes: `<resource>:read|write|*`, `*:read`, `*:write`, `*`.
+ * `<resource>` is an entity path (e.g. "invoices"). Returns the issues found.
+ */
+export declare function normalizeScopes(app: AppIR, input: unknown): {
+    scopes: string[];
+    issues: string[];
+};
+/** Simple fixed-window limiter per key, in memory (per API process — use a proxy limit too when you run several). */
+export declare class RateLimiter {
+    readonly limit: number;
+    readonly windowMs: number;
+    private readonly windows;
+    constructor(limit: number, windowMs?: number);
+    /** Returns seconds to wait when over the limit, else 0. */
+    hit(key: string, now?: number): number;
+}
+export interface ApiKeyInput {
+    name: string;
+    scopes: unknown;
+    role: string;
+    /** ISO date or Date; null/undefined = never. */
+    expiresAt?: string | Date | null;
+    organizationId: string | null;
+    createdById: string;
+}
+/** Public view of a key (never the hash). */
+export declare function presentApiKey(k: Row): {
+    id: any;
+    name: any;
+    prefix: any;
+    scopes: any;
+    role: any;
+    expiresAt: any;
+    lastUsedAt: any;
+    revokedAt: any;
+    createdAt: any;
+    createdBy: {
+        id: any;
+        name: any;
+        email: any;
+    } | null;
+    status: string;
+};
+/**
+ * Create a key (used by the admin API and `forge apikey create`). `creatorRoles` are the creator's
+ * effective roles: the key's role may not exceed them. Returns the plain key once.
+ */
+export declare function issueApiKey(app: AppIR, prisma: any, input: ApiKeyInput, creatorRoles: string[]): Promise<{
+    key: string;
+    apiKey: ReturnType<typeof presentApiKey>;
+}>;
+export interface ApiKeyServiceOptions {
+    /** Requests per minute per key (FORGE_API_KEY_RATE_LIMIT, default 600; 0 disables). */
+    rateLimit?: number;
+}
+export declare class ApiKeyService {
+    private readonly app;
+    private readonly prisma;
+    readonly limiter: RateLimiter;
+    constructor(app: AppIR, prisma: any, options?: ApiKeyServiceOptions);
+    /** Request context for a bearer token; 401 for unknown, revoked or expired keys, 429 over the rate limit. */
+    resolve(token: string, ip?: string): Promise<ForgeRequestContext>;
+    private adminScope;
+    list(ctx: ForgeRequestContext): Promise<{
+        data: {
+            id: any;
+            name: any;
+            prefix: any;
+            scopes: any;
+            role: any;
+            expiresAt: any;
+            lastUsedAt: any;
+            revokedAt: any;
+            createdAt: any;
+            createdBy: {
+                id: any;
+                name: any;
+                email: any;
+            } | null;
+            status: string;
+        }[];
+    }>;
+    create(body: Row, ctx: ForgeRequestContext): Promise<{
+        key: string;
+        apiKey: ReturnType<typeof presentApiKey>;
+    }>;
+    revoke(id: string, ctx: ForgeRequestContext): Promise<{
+        id: any;
+        name: any;
+        prefix: any;
+        scopes: any;
+        role: any;
+        expiresAt: any;
+        lastUsedAt: any;
+        revokedAt: any;
+        createdAt: any;
+        createdBy: {
+            id: any;
+            name: any;
+            email: any;
+        } | null;
+        status: string;
+    }>;
+}
+/** "30d", "12w", "6m", "1y" or an ISO date → Date. */
+export declare function parseExpiry(v: string, now?: Date): Date | null;
+/**
+ * `forge apikey create|list|revoke` against the app's database (apps/api/src/scripts/apikey.ts).
+ * Returns the process exit code.
+ */
+export declare function runApiKeyCommand(argv: string[], deps: {
+    app: AppIR;
+    prisma: any;
+    log?: (line: string) => void;
+    error?: (line: string) => void;
+}): Promise<number>;
+export {};

package/dist/api-keys.js

@@ -0,0 +1,361 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { parseArgs } from "node:util";
+import { effectiveRoles } from "@tekki-forge/runtime-permissions";
+import { BadRequestException, ForbiddenException, HttpException, NotFoundException, UnauthorizedException } from "@nestjs/common";
+/**
+ * Scoped API keys: `Authorization: Bearer fk_<prefix>_<secret>`.
+ * The prefix (12 hex chars) is a public lookup id; only a SHA-256 hash of the secret is stored.
+ * A key is a service principal of its organization: the role chosen at creation (never above the
+ * creator's, re-checked on every request) intersected with its scopes.
+ */
+export const API_KEY_PATTERN = /^fk_([0-9a-f]{12})_([A-Za-z0-9_-]{32,64})$/;
+export function generateApiKey() {
+    const prefix = randomBytes(6).toString("hex");
+    const secret = randomBytes(24).toString("base64url");
+    return { key: `fk_${prefix}_${secret}`, prefix, hash: hashSecret(secret) };
+}
+export function hashSecret(secret) {
+    return createHash("sha256").update(secret, "utf8").digest("hex");
+}
+export function parseApiKey(token) {
+    const m = API_KEY_PATTERN.exec(token.trim());
+    return m ? { prefix: m[1], secret: m[2] } : null;
+}
+/** Constant-time comparison of a presented secret with the stored hash. */
+export function secretMatches(secret, hash) {
+    const a = Buffer.from(hashSecret(secret), "hex");
+    const b = Buffer.from(hash, "hex");
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/**
+ * Validate and normalize scopes: `<resource>:read|write|*`, `*:read`, `*:write`, `*`.
+ * `<resource>` is an entity path (e.g. "invoices"). Returns the issues found.
+ */
+export function normalizeScopes(app, input) {
+    const raw = Array.isArray(input) ? input : typeof input === "string" ? input.split(/[\s,]+/) : [];
+    const paths = new Set(app.entities.map((e) => e.path));
+    const scopes = [];
+    const issues = [];
+    for (const item of raw) {
+        const s = String(item).trim();
+        if (!s)
+            continue;
+        const m = /^([a-z0-9*][a-z0-9-]*|\*):(read|write|\*)$/.exec(s);
+        if (s === "*")
+            scopes.push(s);
+        else if (!m)
+            issues.push(`"${s}" is not a scope — use <resource>:read, <resource>:write, *:read or *`);
+        else if (m[1] !== "*" && !paths.has(m[1]))
+            issues.push(`unknown resource "${m[1]}" in "${s}" (resources: ${[...paths].join(", ")})`);
+        else
+            scopes.push(s);
+    }
+    if (!scopes.length && !issues.length)
+        issues.push("at least one scope is required, e.g. invoices:read");
+    return { scopes: [...new Set(scopes)], issues };
+}
+/** Simple fixed-window limiter per key, in memory (per API process — use a proxy limit too when you run several). */
+export class RateLimiter {
+    limit;
+    windowMs;
+    windows = new Map();
+    constructor(limit, windowMs = 60_000) {
+        this.limit = limit;
+        this.windowMs = windowMs;
+    }
+    /** Returns seconds to wait when over the limit, else 0. */
+    hit(key, now = Date.now()) {
+        if (this.limit <= 0)
+            return 0;
+        let w = this.windows.get(key);
+        if (!w || now - w.start >= this.windowMs) {
+            w = { start: now, count: 0 };
+            this.windows.set(key, w);
+            if (this.windows.size > 10_000)
+                for (const [k, v] of this.windows)
+                    if (now - v.start >= this.windowMs)
+                        this.windows.delete(k);
+        }
+        w.count++;
+        return w.count > this.limit ? Math.ceil((w.start + this.windowMs - now) / 1000) : 0;
+    }
+}
+const invalid = (issues) => new BadRequestException({ statusCode: 400, error: "Bad Request", message: "Validation failed", issues });
+/** Public view of a key (never the hash). */
+export function presentApiKey(k) {
+    return {
+        id: k.id,
+        name: k.name,
+        prefix: k.prefix,
+        scopes: k.scopes,
+        role: k.role,
+        expiresAt: k.expiresAt ?? null,
+        lastUsedAt: k.lastUsedAt ?? null,
+        revokedAt: k.revokedAt ?? null,
+        createdAt: k.createdAt,
+        createdBy: k.createdBy ? { id: k.createdBy.id, name: k.createdBy.name, email: k.createdBy.email } : null,
+        status: k.revokedAt ? "revoked" : k.expiresAt && new Date(k.expiresAt).getTime() <= Date.now() ? "expired" : "active",
+    };
+}
+/**
+ * Create a key (used by the admin API and `forge apikey create`). `creatorRoles` are the creator's
+ * effective roles: the key's role may not exceed them. Returns the plain key once.
+ */
+export async function issueApiKey(app, prisma, input, creatorRoles) {
+    const issues = [];
+    const name = typeof input.name === "string" ? input.name.trim().slice(0, 100) : "";
+    if (!name)
+        issues.push({ path: "name", message: "Required" });
+    const { scopes, issues: scopeIssues } = normalizeScopes(app, input.scopes);
+    for (const m of scopeIssues)
+        issues.push({ path: "scopes", message: m });
+    const role = typeof input.role === "string" ? input.role.trim() : "";
+    const assignable = app.roles.filter((r) => r !== "user" || !app.tenancy.enabled);
+    if (!assignable.includes(role))
+        issues.push({ path: "role", message: `must be one of ${assignable.join(", ")}` });
+    else if (!creatorRoles.includes("admin") && !creatorRoles.includes(role))
+        issues.push({ path: "role", message: `you do not have the "${role}" role yourself` });
+    let expiresAt = null;
+    if (input.expiresAt) {
+        expiresAt = input.expiresAt instanceof Date ? input.expiresAt : new Date(String(input.expiresAt));
+        if (Number.isNaN(expiresAt.getTime()))
+            issues.push({ path: "expiresAt", message: "must be a date" });
+        else if (expiresAt.getTime() <= Date.now())
+            issues.push({ path: "expiresAt", message: "must be in the future" });
+    }
+    if (app.tenancy.enabled && !input.organizationId)
+        issues.push({ path: "organizationId", message: "an organization is required" });
+    if (issues.length)
+        throw invalid(issues);
+    const { key, prefix, hash } = generateApiKey();
+    const row = await prisma.apiKey.create({
+        data: {
+            name,
+            prefix,
+            hash,
+            scopes,
+            role,
+            expiresAt,
+            createdById: input.createdById,
+            ...(app.tenancy.enabled ? { organizationId: input.organizationId } : {}),
+        },
+        include: { createdBy: { select: { id: true, name: true, email: true } } },
+    });
+    return { key, apiKey: presentApiKey(row) };
+}
+export class ApiKeyService {
+    app;
+    prisma;
+    limiter;
+    constructor(app, prisma, options = {}) {
+        this.app = app;
+        this.prisma = prisma;
+        const env = Number(process.env.FORGE_API_KEY_RATE_LIMIT);
+        this.limiter = new RateLimiter(options.rateLimit ?? (Number.isFinite(env) && process.env.FORGE_API_KEY_RATE_LIMIT !== "" ? env : 600));
+    }
+    /** Request context for a bearer token; 401 for unknown, revoked or expired keys, 429 over the rate limit. */
+    async resolve(token, ip) {
+        const parsed = parseApiKey(token);
+        const deny = () => new UnauthorizedException("Invalid, expired or revoked API key");
+        if (!parsed)
+            throw deny();
+        const key = await this.prisma.apiKey.findUnique({ where: { prefix: parsed.prefix }, include: { createdBy: { select: { id: true, role: true, banned: true } } } });
+        if (!key || !secretMatches(parsed.secret, key.hash))
+            throw deny();
+        if (key.revokedAt || (key.expiresAt && new Date(key.expiresAt).getTime() <= Date.now()))
+            throw deny();
+        // The key never exceeds its creator: a creator who left the organization, was banned or deleted disables it.
+        const creator = key.createdBy;
+        if (!creator || creator.banned)
+            throw deny();
+        const tenancy = this.app.tenancy.enabled;
+        let creatorRoles;
+        if (tenancy) {
+            const member = key.organizationId ? await this.prisma.member.findFirst({ where: { organizationId: key.organizationId, userId: creator.id } }) : null;
+            if (!member)
+                throw deny();
+            creatorRoles = effectiveRoles(creator.role, member.role, true);
+        }
+        else
+            creatorRoles = effectiveRoles(creator.role, null, false);
+        const keyRoles = tenancy ? effectiveRoles(null, key.role, true) : effectiveRoles(key.role, null, false);
+        const roles = creatorRoles.includes("admin") ? keyRoles : keyRoles.filter((r) => creatorRoles.includes(r));
+        const wait = this.limiter.hit(key.id);
+        if (wait > 0)
+            throw new HttpException({ statusCode: 429, error: "Too Many Requests", message: `Rate limit of ${this.limiter.limit} requests per minute exceeded — retry in ${wait}s` }, 429);
+        if (!key.lastUsedAt || Date.now() - new Date(key.lastUsedAt).getTime() > 60_000) {
+            await this.prisma.apiKey.update({ where: { id: key.id }, data: { lastUsedAt: new Date() } }).catch(() => undefined);
+        }
+        return {
+            principal: { id: `apikey:${key.id}`, roles, organizationId: tenancy ? key.organizationId : null, scopes: key.scopes, apiKeyId: key.id, teamIds: [] },
+            user: null,
+            session: null,
+            apiKey: { id: key.id, name: key.name, prefix: key.prefix, createdById: creator.id },
+            ...(ip ? { ip } : {}),
+        };
+    }
+    adminScope(ctx) {
+        if (!ctx.principal || !ctx.user)
+            throw new UnauthorizedException("Sign in to continue");
+        if (ctx.principal.apiKeyId)
+            throw new ForbiddenException("API keys cannot manage API keys");
+        if (!ctx.principal.roles.includes("admin"))
+            throw new ForbiddenException("Only admins can manage API keys");
+        if (this.app.tenancy.enabled) {
+            if (!ctx.principal.organizationId)
+                throw new ForbiddenException("No active organization — create or select an organization first");
+            return { organizationId: ctx.principal.organizationId };
+        }
+        return {};
+    }
+    async list(ctx) {
+        const where = this.adminScope(ctx);
+        const rows = await this.prisma.apiKey.findMany({ where, orderBy: { createdAt: "desc" }, include: { createdBy: { select: { id: true, name: true, email: true } } } });
+        return { data: rows.map(presentApiKey) };
+    }
+    async create(body, ctx) {
+        this.adminScope(ctx);
+        return issueApiKey(this.app, this.prisma, { name: body?.name, scopes: body?.scopes, role: body?.role, expiresAt: body?.expiresAt ?? null, organizationId: ctx.principal.organizationId ?? null, createdById: ctx.user.id }, ctx.principal.roles);
+    }
+    async revoke(id, ctx) {
+        const where = this.adminScope(ctx);
+        const key = /^[0-9a-f-]{36}$/i.test(id) ? await this.prisma.apiKey.findFirst({ where: { ...where, id } }) : null;
+        if (!key)
+            throw new NotFoundException("API key not found");
+        const row = key.revokedAt ? key : await this.prisma.apiKey.update({ where: { id }, data: { revokedAt: new Date() } });
+        return presentApiKey(row);
+    }
+}
+/** "30d", "12w", "6m", "1y" or an ISO date → Date. */
+export function parseExpiry(v, now = new Date()) {
+    const m = /^(\d+)([dwmy])$/.exec(v.trim());
+    if (m) {
+        const d = new Date(now);
+        const n = Number(m[1]);
+        if (m[2] === "d")
+            d.setUTCDate(d.getUTCDate() + n);
+        if (m[2] === "w")
+            d.setUTCDate(d.getUTCDate() + 7 * n);
+        if (m[2] === "m")
+            d.setUTCMonth(d.getUTCMonth() + n);
+        if (m[2] === "y")
+            d.setUTCFullYear(d.getUTCFullYear() + n);
+        return d;
+    }
+    const d = new Date(v);
+    return Number.isNaN(d.getTime()) ? null : d;
+}
+/**
+ * `forge apikey create|list|revoke` against the app's database (apps/api/src/scripts/apikey.ts).
+ * Returns the process exit code.
+ */
+export async function runApiKeyCommand(argv, deps) {
+    const log = deps.log ?? ((l) => console.log(l));
+    const error = deps.error ?? ((l) => console.error(l));
+    const { app, prisma } = deps;
+    const { positionals, values } = parseArgs({
+        args: argv,
+        allowPositionals: true,
+        options: { name: { type: "string" }, scopes: { type: "string" }, role: { type: "string" }, expires: { type: "string" }, org: { type: "string" }, user: { type: "string" }, json: { type: "boolean", default: false } },
+    });
+    const [command, target] = positionals;
+    const usage = "Usage: forge apikey create --name <name> --scopes <invoices:read,*:read> [--role member] [--expires 90d|2027-01-01] [--org <slug>] [--user <creator email>]\n       forge apikey list [--org <slug>]\n       forge apikey revoke <id|prefix>";
+    const findOrg = async () => {
+        if (!app.tenancy.enabled)
+            return null;
+        if (values.org) {
+            const org = await prisma.organization.findFirst({ where: { OR: [{ slug: values.org }, { id: values.org }] } });
+            if (!org)
+                throw new Error(`No organization "${values.org}"`);
+            return org;
+        }
+        const orgs = await prisma.organization.findMany({ take: 10, orderBy: { createdAt: "asc" } });
+        if (orgs.length === 1)
+            return orgs[0];
+        throw new Error(orgs.length ? `Several organizations — pass --org (${orgs.map((o) => o.slug).join(", ")})` : "No organization yet — sign up first");
+    };
+    try {
+        if (command === "create") {
+            if (!values.name || !values.scopes) {
+                error(usage);
+                return 1;
+            }
+            const org = await findOrg();
+            // The creator: --user, else the first admin of the organization (or a global admin without tenancy).
+            let creator = null;
+            if (values.user)
+                creator = await prisma.user.findUnique({ where: { email: values.user } });
+            else if (org)
+                creator = (await prisma.member.findFirst({ where: { organizationId: org.id, role: { in: ["owner", "admin"] } }, orderBy: { createdAt: "asc" }, include: { user: true } }))?.user ?? null;
+            else
+                creator = await prisma.user.findFirst({ where: { role: { contains: "admin" } }, orderBy: { createdAt: "asc" } });
+            if (!creator)
+                throw new Error(values.user ? `No user ${values.user}` : "No admin user found — pass --user <email>");
+            let creatorRoles;
+            if (org) {
+                const member = await prisma.member.findFirst({ where: { organizationId: org.id, userId: creator.id } });
+                if (!member)
+                    throw new Error(`${creator.email} is not a member of ${org.slug}`);
+                creatorRoles = effectiveRoles(creator.role, member.role, true);
+            }
+            else
+                creatorRoles = effectiveRoles(creator.role, null, false);
+            const expiresAt = values.expires ? parseExpiry(values.expires) : null;
+            if (values.expires && !expiresAt)
+                throw new Error(`--expires: "${values.expires}" is not a date or a duration like 90d`);
+            const { key, apiKey } = await issueApiKey(app, prisma, { name: values.name, scopes: values.scopes, role: values.role ?? (app.tenancy.enabled ? "member" : "user"), expiresAt, organizationId: org?.id ?? null, createdById: creator.id }, creatorRoles);
+            if (values.json)
+                log(JSON.stringify({ key, apiKey }));
+            else {
+                const expires = apiKey.expiresAt ? `, expires ${new Date(apiKey.expiresAt).toISOString().slice(0, 10)}` : "";
+                log(`Created API key "${apiKey.name}" (${apiKey.id}) — role ${apiKey.role}, scopes ${apiKey.scopes.join(" ")}${expires}${org ? `, organization ${org.slug}` : ""}`);
+                log("");
+                log(`  ${key}`);
+                log("");
+                log("Store it now: it is not shown again. Send it as `Authorization: Bearer <key>`.");
+            }
+            return 0;
+        }
+        if (command === "list") {
+            // The operator sees every key unless --org narrows it.
+            const org = values.org ? await findOrg() : null;
+            const rows = await prisma.apiKey.findMany({ where: org ? { organizationId: org.id } : {}, orderBy: { createdAt: "desc" }, include: { createdBy: { select: { id: true, name: true, email: true } } } });
+            const keys = rows.map(presentApiKey);
+            if (values.json)
+                log(JSON.stringify(keys));
+            else if (!keys.length)
+                log("No API keys.");
+            else
+                for (const k of keys)
+                    log(`${k.id}  fk_${k.prefix}_…  ${k.status.padEnd(7)}  ${k.name}  role=${k.role}  scopes=${k.scopes.join(",")}  last used ${k.lastUsedAt ? new Date(k.lastUsedAt).toISOString() : "never"}`);
+            return 0;
+        }
+        if (command === "revoke") {
+            if (!target) {
+                error(usage);
+                return 1;
+            }
+            const prefix = /^fk_([0-9a-f]{12})/.exec(target)?.[1] ?? (/^[0-9a-f]{12}$/.test(target) ? target : null);
+            let where = null;
+            if (prefix)
+                where = { prefix };
+            else if (/^[0-9a-f-]{36}$/i.test(target))
+                where = { id: target };
+            const key = where ? await prisma.apiKey.findFirst({ where }) : null;
+            if (!key)
+                throw new Error(`No API key ${target}`);
+            if (!key.revokedAt)
+                await prisma.apiKey.update({ where: { id: key.id }, data: { revokedAt: new Date() } });
+            log(`Revoked API key "${key.name}" (fk_${key.prefix}_…)`);
+            return 0;
+        }
+        error(usage);
+        return 1;
+    }
+    catch (e) {
+        const issues = e.getResponse?.()?.issues;
+        error(issues?.length ? issues.map((i) => `${i.path}: ${i.message}`).join("\n") : e.message);
+        return 1;
+    }
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../src/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAKlI;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,4CAA4C,CAAC;AAE5E,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,IAAI,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,IAAY;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAU,EAAE,KAAc;IACxD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,GAAG,4CAA4C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACzB,IAAI,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;aAClG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YACjI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACxG,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AAClD,CAAC;AAED,qHAAqH;AACrH,MAAM,OAAO,WAAW;IAGX;IACA;IAHM,OAAO,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC/E,YACW,KAAa,EACb,WAAW,MAAM;QADjB,UAAK,GAAL,KAAK,CAAQ;QACb,aAAQ,GAAR,QAAQ,CAAS;IACzB,CAAC;IAEJ,2DAA2D;IAC3D,GAAG,CAAC,GAAW,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC/B,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzC,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM;gBAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO;oBAAE,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ;wBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChI,CAAC;QACD,CAAC,CAAC,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;CACF;AAYD,MAAM,OAAO,GAAG,CAAC,MAA2C,EAAE,EAAE,CAC9D,IAAI,mBAAmB,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAC;AAE3G,6CAA6C;AAC7C,MAAM,UAAU,aAAa,CAAC,CAAM;IAClC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QAChC,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;QACxG,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;KACtH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAU,EAAE,MAAW,EAAE,KAAkB,EAAE,YAAsB;IACnG,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,IAAI,CAAC,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3E,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;SAC7G,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,IAAI,iBAAiB,EAAE,CAAC,CAAC;IAChK,IAAI,SAAS,GAAgB,IAAI,CAAC;IAClC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,SAAS,GAAG,KAAK,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAClG,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;aAChG,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAClI,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QACrC,IAAI,EAAE;YACJ,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,SAAS;YACT,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;KAC1E,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7C,CAAC;AAOD,MAAM,OAAO,aAAa;IAIL;IACA;IAJV,OAAO,CAAc;IAE9B,YACmB,GAAU,EACV,MAAW,EAC5B,UAAgC,EAAE;QAFjB,QAAG,GAAH,GAAG,CAAO;QACV,WAAM,GAAN,MAAM,CAAK;QAG5B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzI,CAAC;IAED,6GAA6G;IAC7G,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,EAAW;QACtC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,qBAAqB,CAAC,qCAAqC,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAe,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9K,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,EAAE,CAAC;QAClE,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,MAAM,IAAI,EAAE,CAAC;QACtG,6GAA6G;QAC7G,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;QACzC,IAAI,YAAsB,CAAC;QAC3B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrJ,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,EAAE,CAAC;YAC1B,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjE,CAAC;;YAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACxG,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAE3G,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,IAAI,GAAG,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,IAAI,CAAC,OAAO,CAAC,KAAK,4CAA4C,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7L,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;YAChF,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtH,CAAC;QACD,OAAO;YACL,SAAS,EAAE,EAAE,EAAE,EAAE,UAAU,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACpJ,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE;YACnF,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtB,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,GAAwB;QACzC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QACxF,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;QAC5F,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;QAC5G,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc;gBAAE,MAAM,IAAI,kBAAkB,CAAC,iEAAiE,CAAC,CAAC;YACnI,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAwB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,IAAI,GAAU,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5K,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAS,EAAE,GAAwB;QAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,WAAW,CAChB,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,MAAM,EACX,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,SAAU,CAAC,cAAc,IAAI,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,IAAK,CAAC,EAAE,EAAE,EAClL,GAAG,CAAC,SAAU,CAAC,KAAK,CACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,GAAwB;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjH,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACtH,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,sDAAsD;AACtD,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACrD,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAc,EAAE,IAA+F;IACpJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;KACvN,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,WAAW,CAAC;IACtC,MAAM,KAAK,GAAG,8OAA8O,CAAC;IAE7P,MAAM,OAAO,GAAG,KAAK,IAAyB,EAAE;QAC9C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/G,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;YAC7D,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,IAAI,GAAU,MAAM,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACpG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,uCAAuC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC;IACtJ,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACb,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;YAC5B,qGAAqG;YACrG,IAAI,OAAO,GAAe,IAAI,CAAC;YAC/B,IAAI,MAAM,CAAC,IAAI;gBAAE,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;iBACtF,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;;gBAClM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACtH,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC;YACpH,IAAI,YAAsB,CAAC;YAC3B,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,uBAAuB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAChF,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjE,CAAC;;gBAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAChE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACtE,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,CAAC,OAAO,wCAAwC,CAAC,CAAC;YACzH,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CACvC,GAAG,EACH,MAAM,EACN,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,IAAI,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,EACjL,YAAY,CACb,CAAC;YACF,IAAI,MAAM,CAAC,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;iBACjD,CAAC;gBACJ,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7G,GAAG,CAAC,oBAAoB,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,EAAE,YAAY,MAAM,CAAC,IAAI,YAAY,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpK,GAAG,CAAC,EAAE,CAAC,CAAC;gBACR,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;gBAChB,GAAG,CAAC,EAAE,CAAC,CAAC;gBACR,GAAG,CAAC,gFAAgF,CAAC,CAAC;YACxF,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,uDAAuD;YACvD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAChD,MAAM,IAAI,GAAU,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9M,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACrC,IAAI,MAAM,CAAC,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;iBACtC,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,GAAG,CAAC,cAAc,CAAC,CAAC;;gBACtC,KAAK,MAAM,CAAC,IAAI,IAAI;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACxN,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,KAAK,CAAC,KAAK,CAAC,CAAC;gBACb,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACzG,IAAI,KAAK,GAAe,IAAI,CAAC;YAC7B,IAAI,MAAM;gBAAE,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC;iBAC1B,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,KAAK,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;YACjE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACpE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,SAAS;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3G,GAAG,CAAC,oBAAoB,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,GAAI,CAA8E,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC;QACvH,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;QACvG,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}