@vertesia/ui 1.3.0 → 1.4.0-dev.20260615.042549Z

package/lib/vertesia-ui-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"vertesia-ui-session.js","sources":["esm/session/constants.js","esm/session/auth/firebase.js","esm/session/auth/composable.js","esm/i18n/instance.js","esm/session/auth/useCurrentTenant.js","esm/session/auth/useAuthState.js","esm/session/auth/domainRouting.js","esm/session/UserSession.js","esm/session/UserSessionProvider.js","esm/session/useUXTracking.js"],"sourcesContent":["export const LastSelectedAccountId_KEY = 'composableai.lastSelectedAccountId';\nexport const LastSelectedProjectId_KEY = 'composableai.lastSelectedProjectId';\n//# sourceMappingURL=constants.js.map","import { Env } from \"@vertesia/ui/env\";\nimport { getAnalytics } from \"firebase/analytics\";\nimport { initializeApp } from \"firebase/app\";\nimport { getAuth } from \"firebase/auth\";\n// Use lazy initialization to avoid accessing Env before it's initialized\nlet _firebaseApp = null;\nlet _analytics = null;\nlet _firebaseAuth = null;\n// Getters that lazily initialize Firebase components when first accessed\nexport function getFirebaseApp() {\n    if (!_firebaseApp) {\n        try {\n            if (!Env.firebase) {\n                throw new Error(\"Firebase configuration is not available in the environment\");\n            }\n            _firebaseApp = initializeApp(Env.firebase);\n        }\n        catch (error) {\n            console.error(\"Failed to initialize Firebase app:\", error);\n            throw new Error(\"Firebase initialization failed - environment may not be properly initialized\", { cause: error });\n        }\n    }\n    return _firebaseApp;\n}\nexport function getFirebaseAnalytics() {\n    if (!_analytics) {\n        _analytics = getAnalytics(getFirebaseApp());\n    }\n    return _analytics;\n}\nexport function getFirebaseAuth() {\n    if (!_firebaseAuth) {\n        _firebaseAuth = getAuth(getFirebaseApp());\n    }\n    return _firebaseAuth;\n}\nexport async function setFirebaseTenant(tenantEmail) {\n    if (!tenantEmail) {\n        console.log(\"No tenant name or email specified, skipping tenant setup\");\n        return;\n    }\n    if (!Env.firebase) {\n        console.log(\"Firebase configuration is not available in the environment\");\n        return;\n    }\n    try {\n        if (tenantEmail)\n            console.log(`Resolving tenant ID from email: ${tenantEmail}`);\n        // Add retry logic with exponential backoff\n        let retries = 3;\n        let retryDelay = 250; // Start with 250ms delay\n        while (retries > 0) {\n            try {\n                // Call the API endpoint to resolve the tenant ID\n                const response = await fetch(\"/api/resolve-tenant\", {\n                    method: \"POST\",\n                    headers: {\n                        \"Content-Type\": \"application/json\",\n                    },\n                    body: JSON.stringify({\n                        tenantEmail: tenantEmail,\n                    }),\n                    // Add timeout to prevent hanging requests\n                    signal: AbortSignal.timeout(5000),\n                });\n                // Check for network errors\n                if (!response) {\n                    throw new Error(\"No response received from tenant API\");\n                }\n                // Handle HTTP error responses\n                if (!response.ok) {\n                    // Try to parse the error response\n                    try {\n                        const errorData = await response.json();\n                        console.error(\"Failed to resolve tenant ID:\", errorData.error);\n                    }\n                    catch (parseError) {\n                        console.error(`Failed to resolve tenant ID: HTTP ${response.status}`);\n                    }\n                    // If the error is 404 Not Found, no need to retry\n                    if (response.status === 404) {\n                        console.warn(`Tenant not found for ${tenantEmail}`);\n                        return;\n                    }\n                    throw new Error(`HTTP error ${response.status}`);\n                }\n                // Successfully got a response, parse it\n                const data = (await response.json());\n                if (data && data.firebaseTenantId) {\n                    const auth = getFirebaseAuth();\n                    auth.tenantId = data.firebaseTenantId;\n                    Env.firebase.providerType = data.provider ?? \"oidc\";\n                    console.log(`Tenant ID set to ${auth.tenantId}`);\n                    return data;\n                }\n                else {\n                    console.error(`Invalid response format, missing tenantId for ${tenantEmail}`);\n                    return; // No need to retry for invalid response format\n                }\n            }\n            catch (fetchError) {\n                // Only retry for network-related errors\n                if (retries > 1) {\n                    console.warn(`Tenant resolution failed, retrying in ${retryDelay}ms...`, fetchError);\n                    await new Promise((resolve) => setTimeout(resolve, retryDelay));\n                    retryDelay *= 2; // Exponential backoff\n                    retries--;\n                }\n                else {\n                    throw fetchError; // Last retry failed, propagate error\n                }\n            }\n        }\n    }\n    catch (error) {\n        // Final error handler\n        console.error(\"Error setting Firebase tenant:\", error instanceof Error ? error.message : \"Unknown error\");\n        // Continue without tenant ID - authentication will work without multi-tenancy\n        // but the user will access the default tenant\n    }\n}\nexport async function getFirebaseAuthToken(refresh) {\n    const auth = getFirebaseAuth();\n    const user = auth.currentUser;\n    if (user) {\n        return user\n            .getIdToken(refresh)\n            .then((token) => {\n            Env.logger.info(\"Got Firebase token\", {\n                vertesia: {\n                    user_email: user.email,\n                    user_name: user.displayName,\n                    user_id: user.uid,\n                    refresh: refresh,\n                },\n            });\n            return token;\n        })\n            .catch((err) => {\n            Env.logger.error(\"Failed to get Firebase token\", {\n                vertesia: {\n                    user_email: user.email,\n                    user_name: user.displayName,\n                    user_id: user.uid,\n                    refresh: refresh,\n                    error: err,\n                },\n            });\n            console.error(\"Failed to get access token\", err);\n            return null;\n        });\n    }\n    else {\n        Env.logger.warn(\"No user found\");\n        return Promise.resolve(null);\n    }\n}\n//# sourceMappingURL=firebase.js.map","import { jwtDecode } from \"jwt-decode\";\nimport { Env } from '@vertesia/ui/env';\nimport { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY } from '../constants';\nimport { getFirebaseAuth, getFirebaseAuthToken } from './firebase';\nlet AUTH_TOKEN_RAW;\nlet AUTH_TOKEN;\nexport async function fetchComposableToken(getIdToken, accountId, projectId, ttl, retryCount = 0) {\n    console.log(`Getting/refreshing composable token for account ${accountId} and project ${projectId} `);\n    Env.logger.info('Getting/refreshing composable token', {\n        vertesia: {\n            account_id: accountId,\n            project_id: projectId,\n            retry_count: retryCount,\n        },\n    });\n    const idToken = await getIdToken(); //get from firebase\n    if (!idToken) {\n        console.log('No id token found - using cookie auth');\n        throw new Error('No id token found');\n    }\n    // Use STS endpoint - either configured or default to sts.vertesia.io\n    const stsEndpoint = Env.endpoints.sts;\n    console.log('Using STS for token generation:', stsEndpoint);\n    Env.logger.info('Using STS for token generation', {\n        vertesia: {\n            account_id: accountId,\n            project_id: projectId,\n            sts_url: stsEndpoint,\n        },\n    });\n    try {\n        // Call STS to generate a user token\n        const stsUrl = new URL(stsEndpoint + '/token/issue');\n        const requestBody = {\n            type: 'user',\n            account_id: accountId,\n            project_id: projectId,\n            expires_at: ttl ? Math.floor(Date.now() / 1000) + ttl : undefined,\n        };\n        const stsRes = await fetch(stsUrl, {\n            method: 'POST',\n            headers: {\n                'Content-Type': 'application/json',\n                'Authorization': `Bearer ${idToken}` // Firebase token for authentication\n            },\n            body: JSON.stringify(requestBody)\n        }).catch((error) => {\n            console.error('Failed to call STS endpoint', error);\n            Env.logger.error('Failed to call STS endpoint', {\n                vertesia: {\n                    account_id: accountId,\n                    project_id: projectId,\n                    error: error,\n                },\n            });\n            throw new STSError('Failed to call STS endpoint', stsEndpoint);\n        });\n        if (idToken && stsRes?.status === 404) {\n            // User not found in token-server - call ensure-user endpoint\n            console.log('404: User not found - calling ensure-user endpoint');\n            Env.logger.info('404: User not found - calling ensure-user endpoint', {\n                vertesia: {\n                    account_id: accountId,\n                    project_id: projectId,\n                    status: stsRes?.status\n                },\n            });\n            const ensureResponse = await fetch(Env.endpoints.studio + '/auth/ensure-user', {\n                method: 'POST',\n                headers: {\n                    'Authorization': `Bearer ${idToken}`,\n                    'Content-Type': 'application/json'\n                }\n            });\n            if (ensureResponse.status === 412) {\n                // No invite - trigger signup\n                console.log('412: No invite found - signup required');\n                Env.logger.info('412: No invite found - signup required', {\n                    vertesia: {\n                        account_id: accountId,\n                        project_id: projectId,\n                    }\n                });\n                const idTokenDecoded = jwtDecode(idToken);\n                if (!idTokenDecoded?.email) {\n                    Env.logger.error('No email found in id token');\n                    throw new Error('No email found in id token');\n                }\n                throw new UserNotFoundError('User not found - signup required', idTokenDecoded.email);\n            }\n            if (!ensureResponse.ok) {\n                console.error('Failed to ensure user exists', ensureResponse.status);\n                Env.logger.error('Failed to ensure user exists', {\n                    vertesia: {\n                        account_id: accountId,\n                        project_id: projectId,\n                        status: ensureResponse.status,\n                    },\n                });\n                throw new Error('Failed to ensure user exists');\n            }\n            // User created/exists - retry token generation\n            console.log('User ensured - retrying token generation');\n            Env.logger.info('User ensured - retrying token generation', {\n                vertesia: {\n                    account_id: accountId,\n                    project_id: projectId,\n                }\n            });\n            return fetchComposableToken(getIdToken, accountId, projectId, ttl, retryCount);\n        }\n        if (idToken && stsRes?.status === 412) {\n            console.log(\"412: auth succeeded but user doesn't exist - signup required\", stsRes?.status);\n            Env.logger.error(\"412: auth succeeded but user doesn't exist - signup required\", {\n                vertesia: {\n                    account_id: accountId,\n                    project_id: projectId,\n                    status: stsRes?.status\n                },\n            });\n            const idTokenDecoded = jwtDecode(idToken);\n            if (!idTokenDecoded?.email) {\n                Env.logger.error('No email found in id token');\n                throw new Error('No email found in id token');\n            }\n            Env.logger.error('User not found', {\n                vertesia: {\n                    account_id: accountId,\n                    project_id: projectId,\n                    email: idTokenDecoded.email\n                }\n            });\n            throw new UserNotFoundError('User not found', idTokenDecoded.email);\n        }\n        if (stsRes.status === 403) {\n            // User doesn't have access to the requested account/project, or has no accounts\n            // This can happen with:\n            // 1. Stale localStorage from previous user\n            // 2. User invited to a new account (doesn't have access yet)\n            // 3. User exists but has no accounts at all\n            if (retryCount > 0) {\n                // Already retried without account scope - this is a real authorization failure\n                console.error('403: Access denied even without account scope - user may have no accounts');\n                Env.logger.error('403: Access denied after retry - authorization failure', {\n                    vertesia: {\n                        account_id: accountId,\n                        project_id: projectId,\n                        status: stsRes.status,\n                        retry_count: retryCount\n                    },\n                });\n                throw new Error('Access denied - user may not have access to any accounts');\n            }\n            console.log('403: Access denied - clearing cached account and retrying without account scope');\n            Env.logger.warn('403: Access denied - clearing cached account and retrying', {\n                vertesia: {\n                    account_id: accountId,\n                    project_id: projectId,\n                    status: stsRes.status,\n                    retry_count: retryCount\n                },\n            });\n            // Clear any stale account/project from localStorage\n            localStorage.removeItem(LastSelectedAccountId_KEY);\n            if (accountId) {\n                localStorage.removeItem(LastSelectedProjectId_KEY + '-' + accountId);\n            }\n            // Retry without account/project scope - let user log in to their default account\n            return fetchComposableToken(getIdToken, undefined, undefined, ttl, retryCount + 1);\n        }\n        if (!stsRes.ok) {\n            const errorText = await stsRes.text();\n            console.error('STS token generation failed:', stsRes.status, errorText);\n            Env.logger.error('STS token generation failed', {\n                vertesia: {\n                    status: stsRes.status,\n                    error: errorText,\n                    account_id: accountId,\n                    project_id: projectId,\n                },\n            });\n            throw new Error(`Failed to get token from STS: ${stsRes.status}`);\n        }\n        const { token } = await stsRes.json();\n        console.log('Successfully got token from STS');\n        Env.logger.info('Successfully got token from STS');\n        return token;\n    }\n    catch (error) {\n        if (error instanceof UserNotFoundError || error instanceof STSError) {\n            throw error; // Re-throw UserNotFoundError and STSError to be handled separately in the caller\n        }\n        // Clear any stale account/project from localStorage on error\n        localStorage.removeItem(LastSelectedAccountId_KEY);\n        if (accountId) {\n            localStorage.removeItem(LastSelectedProjectId_KEY + '-' + accountId);\n        }\n        console.error('Failed to get composable token from STS', error);\n        Env.logger.error('Failed to get composable token from STS', {\n            vertesia: {\n                account_id: accountId,\n                project_id: projectId,\n                error: error,\n            },\n        });\n        throw new Error('Failed to get composable token', { cause: error });\n    }\n}\n/**\n *\n * @param accountId\n * @param projectId\n * @param ttl time to live for the token in seconds\n * @returns\n */\nexport async function fetchComposableTokenFromFirebaseToken(accountId, projectId, ttl) {\n    return fetchComposableToken(getFirebaseAuthToken, accountId, projectId, ttl);\n}\nexport async function getComposableToken(accountId, projectId, initToken, forceRefresh = false, useInternalAuth = false) {\n    const selectedAccount = accountId ?? localStorage.getItem(LastSelectedAccountId_KEY) ?? undefined;\n    const selectedProject = projectId ?? localStorage.getItem(LastSelectedProjectId_KEY + '-' + selectedAccount) ?? undefined;\n    //token is still valid for more than 5 minutes\n    if (!forceRefresh && AUTH_TOKEN_RAW && AUTH_TOKEN && AUTH_TOKEN.exp > (Date.now() / 1000 + 300)) {\n        return { rawToken: AUTH_TOKEN_RAW, token: AUTH_TOKEN, error: false };\n    }\n    //token is close to expire, refresh it\n    if (!useInternalAuth && getFirebaseAuth().currentUser) {\n        //we have a firebase user, get the token from there\n        AUTH_TOKEN_RAW = await fetchComposableTokenFromFirebaseToken(selectedAccount, selectedProject);\n    }\n    else if (initToken || AUTH_TOKEN_RAW) {\n        // we have a token already and no firebase user, refresh it\n        AUTH_TOKEN_RAW = await fetchComposableToken(() => Promise.resolve(initToken ?? AUTH_TOKEN_RAW), selectedAccount, selectedProject);\n    }\n    if (!AUTH_TOKEN_RAW) {\n        Env.logger.error('Cannot acquire a composable token', {\n            vertesia: {\n                account_id: selectedAccount,\n                project_id: selectedProject,\n            },\n        });\n        throw new Error('Cannot acquire a composable token');\n    }\n    AUTH_TOKEN = jwtDecode(AUTH_TOKEN_RAW);\n    if (!AUTH_TOKEN || !AUTH_TOKEN.exp || !AUTH_TOKEN_RAW) {\n        console.error('Invalid composable token', AUTH_TOKEN);\n        Env.logger.error('Invalid composable token', {\n            vertesia: {\n                account_id: selectedAccount,\n                project_id: selectedProject,\n            },\n        });\n        throw new Error('Invalid composable token');\n    }\n    return { rawToken: AUTH_TOKEN_RAW, token: AUTH_TOKEN, error: false };\n}\nexport class UserNotFoundError extends Error {\n    email;\n    constructor(message, email) {\n        super(message);\n        this.name = 'UserNotFoundError';\n        this.email = email;\n    }\n}\nexport class STSError extends Error {\n    stsURL;\n    constructor(message, stsURL) {\n        super(message);\n        this.name = 'STSError';\n        this.stsURL = stsURL;\n    }\n}\n//# sourceMappingURL=composable.js.map","import i18next from 'i18next';\nimport { initReactI18next } from 'react-i18next';\nimport ar from './locales/ar.json';\nimport de from './locales/de.json';\nimport en from './locales/en.json';\nimport es from './locales/es.json';\nimport fr from './locales/fr.json';\nimport it from './locales/it.json';\nimport ja from './locales/ja.json';\nimport ko from './locales/ko.json';\nimport pt from './locales/pt.json';\nimport ru from './locales/ru.json';\nimport tr from './locales/tr.json';\nimport zh from './locales/zh.json';\nimport zhTW from './locales/zh-TW.json';\nexport const NAMESPACE = 'vertesia.ui';\n// Scoped instance — does NOT touch the global i18next singleton\nconst i18nInstance = i18next.createInstance();\nvoid i18nInstance.use(initReactI18next).init({\n    resources: {\n        ar: { [NAMESPACE]: ar },\n        de: { [NAMESPACE]: de },\n        en: { [NAMESPACE]: en },\n        es: { [NAMESPACE]: es },\n        fr: { [NAMESPACE]: fr },\n        it: { [NAMESPACE]: it },\n        ja: { [NAMESPACE]: ja },\n        ko: { [NAMESPACE]: ko },\n        pt: { [NAMESPACE]: pt },\n        ru: { [NAMESPACE]: ru },\n        tr: { [NAMESPACE]: tr },\n        zh: { [NAMESPACE]: zh },\n        'zh-TW': { [NAMESPACE]: zhTW },\n    },\n    fallbackLng: 'en',\n    ns: [NAMESPACE],\n    defaultNS: NAMESPACE,\n    interpolation: {\n        escapeValue: false, // React already escapes\n    },\n    react: {\n        useSuspense: false, // Translations are bundled, no async loading\n    },\n});\nexport { i18nInstance };\n//# sourceMappingURL=instance.js.map","import { useState, useEffect } from 'react';\nimport { useUserSession } from \"@vertesia/ui/session\";\nimport { i18nInstance, NAMESPACE } from '../../i18n/instance.js';\nexport function useCurrentTenant() {\n    const t = i18nInstance.getFixedT(null, NAMESPACE);\n    const { user } = useUserSession();\n    const [currentTenant, setCurrentTenant] = useState(null);\n    const [isLoading, setIsLoading] = useState(true);\n    const [error, setError] = useState(null);\n    useEffect(() => {\n        const loadCurrentTenant = async () => {\n            if (!user?.email) {\n                setCurrentTenant(null);\n                setIsLoading(false);\n                return;\n            }\n            try {\n                const response = await fetch('/api/resolve-tenant', {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    },\n                    body: JSON.stringify({\n                        tenantEmail: user.email\n                    })\n                });\n                if (response.ok) {\n                    const tenantData = await response.json();\n                    if (tenantData) {\n                        // Convert the resolved tenant data to our TenantConfig format\n                        setCurrentTenant({\n                            tenantKey: tenantData.name || 'unknown',\n                            name: tenantData.label || tenantData.name || 'Unknown',\n                            domain: tenantData.domain || [],\n                            firebaseTenantId: tenantData.firebaseTenantId,\n                            provider: tenantData.provider,\n                            logo: tenantData.logo\n                        });\n                    }\n                    else {\n                        setCurrentTenant(null);\n                    }\n                }\n                else {\n                    setCurrentTenant(null);\n                }\n            }\n            catch (error) {\n                console.error('Error loading current tenant:', error);\n                setError(t('errors.failedToLoadTenantConfig'));\n                setCurrentTenant(null);\n            }\n            finally {\n                setIsLoading(false);\n            }\n        };\n        loadCurrentTenant();\n    }, [user?.email]);\n    return {\n        currentTenant,\n        isLoading,\n        error\n    };\n}\n//# sourceMappingURL=useCurrentTenant.js.map","/**\n * This hook is used to generate and verify state for OAuth2 authorization requests.\n * @returns\n */\nimport { useCallback } from \"react\";\nconst AUTH_STATE_KEY = 'auth_state';\nconst STATE_EXPIRY_KEY = 'auth_state_expiry';\nconst STATE_TTL = 5 * 60 * 1000; // 5 min\nexport function useAuthState() {\n    // Generate new state\n    const generateState = useCallback(() => {\n        const state = crypto.randomUUID();\n        const expiryTime = Date.now() + STATE_TTL;\n        // Store state and expiry\n        sessionStorage.setItem(AUTH_STATE_KEY, state);\n        sessionStorage.setItem(STATE_EXPIRY_KEY, expiryTime.toString());\n        return state;\n    }, []);\n    // Verify returned state\n    const verifyState = useCallback((returnedState) => {\n        if (!returnedState) {\n            return 'Missing state';\n        }\n        const savedState = sessionStorage.getItem(AUTH_STATE_KEY);\n        const expiryTime = parseInt(sessionStorage.getItem(STATE_EXPIRY_KEY) || '0');\n        let reason;\n        // Verify state matches and hasn't expired\n        if (savedState !== returnedState) {\n            reason = `State mismatched (${savedState} !== ${returnedState})`;\n        }\n        else if (Date.now() > expiryTime) {\n            reason = 'State expired';\n        }\n        else {\n            reason = undefined; // No errors\n        }\n        return reason;\n    }, []);\n    // Clear state (useful for cleanup)\n    const clearState = useCallback(() => {\n        sessionStorage.removeItem(AUTH_STATE_KEY);\n        sessionStorage.removeItem(STATE_EXPIRY_KEY);\n    }, []);\n    return { generateState, verifyState, clearState };\n}\n//# sourceMappingURL=useAuthState.js.map","export function shouldUseFirebaseAuth(_hostname) {\n    return window.AUTH_MODE === 'firebase';\n}\nexport function shouldRedirectToCentralAuth(_hostname) {\n    return !shouldUseFirebaseAuth();\n}\n//# sourceMappingURL=domainRouting.js.map","import { jwtDecode } from 'jwt-decode';\nimport { createContext, useContext } from 'react';\nimport { VertesiaClient } from '@vertesia/client';\nimport { Env } from '@vertesia/ui/env';\nimport { getComposableToken } from './auth/composable';\nimport { shouldRedirectToCentralAuth } from './auth/domainRouting';\nimport { getFirebaseAuth } from './auth/firebase';\nimport { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY } from './constants';\nexport { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY };\nconst CENTRAL_AUTH_REDIRECT = \"https://internal-auth.vertesia.app/\";\nclass UserSession {\n    isLoading = true;\n    client;\n    authError;\n    authToken;\n    setSession;\n    lastSelectedAccount;\n    lastSelectedProject;\n    onboardingComplete;\n    constructor(client, setSession) {\n        if (client) {\n            this.client = client;\n        }\n        else {\n            this.client = new VertesiaClient({\n                serverUrl: Env.endpoints.studio,\n                storeUrl: Env.endpoints.zeno,\n                tokenServerUrl: Env.endpoints.sts\n            });\n        }\n        if (setSession) {\n            this.setSession = setSession;\n        }\n        this.logout = this.logout.bind(this);\n    }\n    get store() {\n        return this.client.store;\n    }\n    get user() {\n        return this.authToken;\n    }\n    get account() {\n        return this.authToken?.account;\n    }\n    get project() {\n        return this.authToken?.project;\n    }\n    get accounts() {\n        return this.authToken?.accounts;\n    }\n    get authCallback() {\n        return this.rawAuthToken.then(token => `Bearer ${token}`);\n    }\n    get rawAuthToken() {\n        return getComposableToken().then(res => {\n            const token = res?.rawToken;\n            if (!token) {\n                throw new Error('No token available');\n            }\n            this.authToken = jwtDecode(token);\n            return token;\n        });\n    }\n    signOut() {\n        this.logout();\n    }\n    getAccount() {\n        return this.authToken?.account;\n    }\n    async login(token) {\n        this.authError = undefined;\n        this.isLoading = false;\n        this.client.withAuthCallback(() => this.authCallback);\n        this.authToken = jwtDecode(token);\n        console.log(`Logging in as ${this.authToken?.name} with account ${this.authToken?.account.name} (${this.authToken?.account.id}, and project ${this.authToken?.project?.name} (${this.authToken?.project?.id})`);\n        //store selected account in local storage\n        localStorage.setItem(LastSelectedAccountId_KEY, this.authToken.account.id);\n        localStorage.setItem(LastSelectedProjectId_KEY + '-' + this.authToken.account.id, this.authToken.project?.id ?? '');\n        // notify the host app of the login\n        Env.onLogin?.(this.authToken);\n        await this.fetchOnboardingStatus();\n        return Promise.resolve();\n    }\n    isLoggedIn() {\n        return !!this.authToken;\n    }\n    logout() {\n        console.log('Logging out');\n        if (shouldRedirectToCentralAuth()) {\n            // Redirect to central auth for logout\n            // Central auth will handle Firebase logout\n            console.log('Using central auth logout');\n            this.authError = undefined;\n            this.isLoading = false;\n            this.authToken = undefined;\n            this.setSession = undefined;\n            this.client.withAuthCallback(undefined);\n            const logoutUrl = new URL(CENTRAL_AUTH_REDIRECT);\n            const currentUrl = new URL(window.location.href);\n            currentUrl.hash = \"\";\n            logoutUrl.pathname = \"/logout\";\n            logoutUrl.searchParams.set(\"redirect_uri\", currentUrl.toString());\n            location.replace(logoutUrl.toString());\n        }\n        else {\n            // Use Firebase logout directly\n            console.log('Using Firebase logout');\n            const wasLoggedIn = !!this.authToken;\n            if (this.authToken) {\n                getFirebaseAuth().signOut();\n            }\n            this.authError = undefined;\n            this.isLoading = false;\n            this.authToken = undefined;\n            this.setSession = undefined;\n            this.client.withAuthCallback(undefined);\n            // Navigate to root to avoid React rendering errors when\n            // unmounting deeply nested route components during logout.\n            // Only navigate if user was actually logged in to avoid\n            // infinite reload loop on fresh/incognito sessions.\n            if (wasLoggedIn) {\n                location.replace(\"/\");\n            }\n        }\n    }\n    async switchAccount(targetAccountId) {\n        localStorage.setItem(LastSelectedAccountId_KEY, targetAccountId);\n        if (this) {\n            if (this.account && this.project) {\n                localStorage.setItem(LastSelectedProjectId_KEY + '-' + this.account.id, this.project.id);\n            }\n            else if (this.account) {\n                localStorage.removeItem(LastSelectedProjectId_KEY + '-' + this.account.id);\n            }\n        }\n        window.location.replace('/?a=' + targetAccountId);\n    }\n    async switchProject(targetProjectId) {\n        if (this.account) {\n            localStorage.setItem(LastSelectedProjectId_KEY + '-' + this.account.id, targetProjectId);\n        }\n        window.location.replace('/?a=' + this.account?.id + '&p=' + targetProjectId);\n    }\n    async fetchAccounts() {\n        return this.client.accounts.list().then(accounts => {\n            if (!this.authToken) {\n                throw new Error('No token available');\n            }\n            this.authToken.accounts = accounts;\n            this.setSession?.(this.clone());\n        }).catch(err => {\n            console.error('Failed to fetch accounts', err);\n            throw err;\n        });\n    }\n    async fetchProjects(accountId) {\n        return this.client.projects.list([accountId]).then(projects => {\n            if (!this.authToken) {\n                throw new Error('No token available');\n            }\n            this.authToken = {\n                ...this.authToken,\n                accounts: this.authToken.accounts?.map(account => {\n                    if (account.id === accountId) {\n                        return {\n                            ...account,\n                            projects: projects.filter(project => project.account === accountId)\n                        };\n                    }\n                    return account;\n                })\n            };\n            this.setSession?.(this.clone());\n        }).catch(err => {\n            console.error('Failed to fetch projects', err);\n            throw err;\n        });\n    }\n    async fetchOnboardingStatus() {\n        if (this.onboardingComplete) {\n            console.log('Onboarding already completed');\n            return false;\n        }\n        const previousStatus = this.onboardingComplete;\n        try {\n            const onboarding = await this.client.account.onboardingProgress();\n            this.onboardingComplete = Object.values(onboarding).every(value => value === true);\n            if (previousStatus !== this.onboardingComplete) {\n                return true;\n            }\n            this.setSession?.(this.clone());\n        }\n        catch (error) {\n            console.error('Error fetching onboarding status:', error);\n            this.onboardingComplete = false;\n            this.setSession?.(this.clone());\n        }\n        return false;\n    }\n    clone() {\n        const session = new UserSession(this.client);\n        session.isLoading = this.isLoading;\n        session.authError = this.authError;\n        session.authToken = this.authToken;\n        session.setSession = this.setSession;\n        session.lastSelectedAccount = this.lastSelectedAccount;\n        session.switchAccount = this.switchAccount;\n        session.onboardingComplete = this.onboardingComplete;\n        return session;\n    }\n}\nconst UserSessionContext = createContext(undefined);\nexport function useUserSession() {\n    const session = useContext(UserSessionContext);\n    if (!session) {\n        throw new Error('useUserSession must be used within a UserSessionProvider');\n    }\n    return session;\n}\nexport { UserSession, UserSessionContext };\n//# sourceMappingURL=UserSession.js.map","import { jsx as _jsx } from \"react/jsx-runtime\";\nimport { Env } from \"@vertesia/ui/env\";\nimport { onAuthStateChanged } from \"firebase/auth\";\nimport { useEffect, useRef, useState } from \"react\";\nimport { STSError, UserNotFoundError, getComposableToken } from \"./auth/composable\";\nimport { shouldRedirectToCentralAuth } from \"./auth/domainRouting\";\nimport { getFirebaseAuth } from \"./auth/firebase\";\nimport { useAuthState } from \"./auth/useAuthState\";\nimport { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY, UserSession, UserSessionContext } from \"./UserSession\";\nconst CENTRAL_AUTH_REDIRECT = \"https://internal-auth.vertesia.app/\";\nexport function UserSessionProvider({ children }) {\n    const hashParams = new URLSearchParams(location.hash.substring(1));\n    const token = hashParams.get(\"token\");\n    const state = hashParams.get(\"state\");\n    const [session, setSession] = useState(new UserSession());\n    const { generateState, verifyState, clearState } = useAuthState();\n    const hasInitiatedAuthRef = useRef(false);\n    const redirectToCentralAuth = (projectId, accountId) => {\n        const url = new URL(`${CENTRAL_AUTH_REDIRECT}?sts=${Env.endpoints.sts ?? \"https://sts.vertesia.io\"}`);\n        const currentUrl = new URL(window.location.href);\n        currentUrl.hash = \"\";\n        if (projectId)\n            currentUrl.searchParams.set(\"p\", projectId);\n        if (accountId)\n            currentUrl.searchParams.set(\"a\", accountId);\n        url.searchParams.set(\"redirect_uri\", currentUrl.toString());\n        url.searchParams.set(\"state\", generateState());\n        location.replace(url.toString());\n    };\n    useEffect(() => {\n        // Make this effect idempotent - only run auth flow once\n        if (hasInitiatedAuthRef.current) {\n            console.log(\"Auth: skipping duplicate auth flow initiation\");\n            return;\n        }\n        hasInitiatedAuthRef.current = true;\n        console.log(\"Auth: starting auth flow\");\n        Env.logger.info(\"Starting auth flow\");\n        const currentUrl = new URL(window.location.href);\n        const selectedAccount = currentUrl.searchParams.get(\"a\") ?? localStorage.getItem(LastSelectedAccountId_KEY) ?? undefined;\n        const selectedProject = currentUrl.searchParams.get(\"p\") ??\n            localStorage.getItem(LastSelectedProjectId_KEY + \"-\" + selectedAccount) ??\n            undefined;\n        console.log(\"Auth: selected account\", selectedAccount);\n        console.log(\"Auth: selected project\", selectedProject);\n        Env.logger.info(\"Selected account and project\", {\n            vertesia: {\n                account_id: selectedAccount,\n                project_id: selectedProject,\n            },\n        });\n        if (token && state) {\n            session.setSession = setSession;\n            const validationError = verifyState(state);\n            if (validationError) {\n                console.error(`Auth: invalid state: ${validationError}`);\n                Env.logger.error(`Invalid state: ${validationError}`, {\n                    vertesia: {\n                        state: state,\n                    },\n                });\n                redirectToCentralAuth();\n            }\n            else {\n                clearState();\n            }\n            getComposableToken(selectedAccount, selectedProject, token, false, shouldRedirectToCentralAuth())\n                .then((res) => {\n                session.login(res.rawToken).then(() => {\n                    setSession(session.clone());\n                    //cleanup the hash\n                    window.location.hash = \"\";\n                });\n            })\n                .catch((err) => {\n                // Don't redirect to central auth for UserNotFoundError - let signup flow handle it\n                if (err instanceof UserNotFoundError) {\n                    console.log(\"User not found - will trigger signup flow\", err);\n                    session.isLoading = false;\n                    session.authError = err;\n                    setSession(session.clone());\n                    return;\n                }\n                if (err instanceof STSError) {\n                    console.error(\"STS error during token exchange\", err);\n                    Env.logger.error(\"STS error during token exchange\", {\n                        vertesia: {\n                            account_id: selectedAccount,\n                            project_id: selectedProject,\n                            sts_url: err.stsURL,\n                            error: err,\n                        },\n                    });\n                    window.alert(\"Authentication failed due to an issue with the authentication service. Please try again later.\");\n                    session.logout();\n                    setSession(session.clone());\n                    window.location.hash = \"\";\n                    return;\n                }\n                console.error(\"Failed to fetch user token from studio, redirecting to central auth\", err);\n                Env.logger.error(\"Failed to fetch user token from studio, redirecting to central auth\", {\n                    vertesia: {\n                        error: err,\n                    },\n                });\n                redirectToCentralAuth();\n            });\n            return;\n        }\n        else {\n            // If the current host is not in the Firebase allowlist, central auth owns sign-in.\n            if (!session.isLoggedIn()) {\n                console.log(\"Auth: not logged in & no token/state\");\n                Env.logger.info(\"Not logged in & no token/state\", {\n                    vertesia: {\n                        account_id: selectedAccount,\n                        project_id: selectedProject,\n                    },\n                });\n                if (shouldRedirectToCentralAuth()) {\n                    console.log(\"Auth: host is not in Firebase auth allowlist, redirecting to central auth with selection\", selectedAccount, selectedProject);\n                    Env.logger.info(\"Redirecting to central auth with selection\", {\n                        vertesia: {\n                            account_id: selectedAccount,\n                            project_id: selectedProject,\n                        },\n                    });\n                    redirectToCentralAuth();\n                    return; // Don't register onAuthStateChanged listener when redirecting\n                }\n                else {\n                    console.log(\"Auth: host is in Firebase auth allowlist\");\n                    Env.logger.info(\"Host is in Firebase auth allowlist\", {\n                        vertesia: {\n                            account_id: selectedAccount,\n                            project_id: selectedProject,\n                        },\n                    });\n                }\n            }\n        }\n        return onAuthStateChanged(getFirebaseAuth(), async (firebaseUser) => {\n            if (firebaseUser) {\n                console.log(\"Auth: successful login with firebase\");\n                Env.logger.info(\"Successful login with firebase\", {\n                    vertesia: {\n                        account_id: selectedAccount,\n                        project_id: selectedProject,\n                    },\n                });\n                session.setSession = setSession;\n                await getComposableToken(selectedAccount, selectedProject, undefined, false, shouldRedirectToCentralAuth())\n                    .then((res) => {\n                    session.login(res.rawToken).then(() => setSession(session.clone()));\n                })\n                    .catch((err) => {\n                    console.error(\"Failed to fetch user token from studio\", err);\n                    Env.logger.error(\"Failed to fetch user token from studio\", {\n                        vertesia: {\n                            account_id: selectedAccount,\n                            project_id: selectedProject,\n                            error: err,\n                        },\n                    });\n                    if (!(err instanceof UserNotFoundError))\n                        session.logout();\n                    session.isLoading = false;\n                    session.authError = err;\n                    setSession(session.clone());\n                });\n            }\n            else {\n                // anonymous user\n                console.log(\"Auth: using anonymous user\");\n                Env.logger.info(\"Using anonymous user\", {\n                    vertesia: {\n                        account_id: selectedAccount,\n                        project_id: selectedProject,\n                    },\n                });\n                session.client.withAuthCallback(undefined);\n                session.logout();\n                setSession(session.clone());\n            }\n        });\n    }, []);\n    return _jsx(UserSessionContext.Provider, { value: session, children: children });\n}\n//# sourceMappingURL=UserSessionProvider.js.map","import { Env } from '@vertesia/ui/env';\nimport { logEvent } from \"firebase/analytics\";\nimport { getFirebaseAnalytics } from \"./auth/firebase\";\nexport function useUXTracking() {\n    //identify user in monitoring and UX systems\n    const tagUserSession = async (user) => {\n        const signupData = window.localStorage.getItem(\"composableSignupData\");\n        if (!user) {\n            console.error('No user found -- skipping tagging');\n            return;\n        }\n        if (signupData) {\n            window.localStorage.removeItem(\"composableSignupData\");\n        }\n    };\n    //send event to analytics and UX systems\n    const trackEvent = (eventName, eventProperties) => {\n        if (!Env.isProd) {\n            console.debug('track event', eventName, eventProperties);\n        }\n        //GA via firebase\n        logEvent(getFirebaseAnalytics(), eventName, { ...eventProperties, debug_mode: !Env.isProd });\n    };\n    return {\n        tagUserSession,\n        trackEvent\n    };\n}\n//# sourceMappingURL=useUXTracking.js.map"],"names":["LastSelectedAccountId_KEY","LastSelectedProjectId_KEY","AUTH_TOKEN_RAW","AUTH_TOKEN","_firebaseApp","_analytics","_firebaseAuth","getFirebaseApp","Env","firebase","Error","initializeApp","error","console","cause","getFirebaseAnalytics","getAnalytics","getFirebaseAuth","getAuth","async","setFirebaseTenant","tenantEmail","log","retries","retryDelay","response","fetch","method","headers","body","JSON","stringify","signal","AbortSignal","timeout","ok","errorData","json","parseError","status","warn","data","firebaseTenantId","auth","tenantId","providerType","provider","fetchError","Promise","resolve","setTimeout","message","getFirebaseAuthToken","refresh","user","currentUser","getIdToken","then","token","logger","info","vertesia","user_email","email","user_name","displayName","user_id","uid","catch","err","fetchComposableToken","accountId","projectId","ttl","retryCount","account_id","project_id","retry_count","idToken","stsEndpoint","endpoints","sts","sts_url","stsUrl","URL","requestBody","type","expires_at","Math","floor","Date","now","undefined","stsRes","Authorization","STSError","ensureResponse","studio","idTokenDecoded","jwtDecode","UserNotFoundError","localStorage","removeItem","errorText","text","fetchComposableTokenFromFirebaseToken","getComposableToken","initToken","forceRefresh","useInternalAuth","selectedAccount","getItem","selectedProject","exp","rawToken","constructor","super","this","name","stsURL","NAMESPACE","i18nInstance","i18next","createInstance","useCurrentTenant","t","getFixedT","useUserSession","currentTenant","setCurrentTenant","useState","isLoading","setIsLoading","setError","useEffect","tenantData","tenantKey","label","domain","logo","loadCurrentTenant","use","initReactI18next","init","resources","ar","de","en","es","fr","it","ja","ko","pt","ru","tr","zh","fallbackLng","ns","defaultNS","interpolation","escapeValue","react","useSuspense","AUTH_STATE_KEY","STATE_EXPIRY_KEY","useAuthState","generateState","useCallback","state","crypto","randomUUID","expiryTime","sessionStorage","setItem","toString","verifyState","returnedState","savedState","parseInt","reason","clearState","shouldRedirectToCentralAuth","_hostname","window","AUTH_MODE","UserSession","client","authError","authToken","setSession","lastSelectedAccount","lastSelectedProject","onboardingComplete","VertesiaClient","serverUrl","storeUrl","zeno","tokenServerUrl","logout","bind","store","account","project","accounts","authCallback","rawAuthToken","res","signOut","getAccount","login","withAuthCallback","id","onLogin","fetchOnboardingStatus","isLoggedIn","logoutUrl","currentUrl","location","href","hash","pathname","searchParams","set","replace","wasLoggedIn","switchAccount","targetAccountId","switchProject","targetProjectId","fetchAccounts","list","clone","fetchProjects","projects","map","filter","previousStatus","onboarding","onboardingProgress","Object","values","every","value","session","UserSessionContext","createContext","useContext","UserSessionProvider","children","hashParams","URLSearchParams","substring","get","hasInitiatedAuthRef","useRef","redirectToCentralAuth","url","current","validationError","alert","onAuthStateChanged","firebaseUser","_jsx","Provider","useUXTracking","tagUserSession","signupData","trackEvent","eventName","eventProperties","isProd","debug","logEvent","debug_mode"],"mappings":"mkBAAY,MAACA,EAA4B,qCAC5BC,EAA4B,qCCIzC,ICDIC,EACAC,EDAAC,EAAe,KACfC,EAAa,KACbC,EAAgB,KAEb,SAASC,IACZ,IAAKH,EACD,IACI,IAAKI,EAAIC,SACL,MAAM,IAAIC,MAAM,8DAEpBN,EAAeO,EAAcH,EAAIC,SACrC,CACA,MAAOG,GAEH,MADAC,QAAQD,MAAM,qCAAsCA,GAC9C,IAAIF,MAAM,+EAAgF,CAAEI,MAAOF,GAC7G,CAEJ,OAAOR,CACX,CACO,SAASW,IAIZ,OAHKV,IACDA,EAAaW,EAAaT,MAEvBF,CACX,CACO,SAASY,IAIZ,OAHKX,IACDA,EAAgBY,EAAQX,MAErBD,CACX,CACOa,eAAeC,EAAkBC,GACpC,GAAKA,EAIL,GAAKb,EAAIC,SAIT,IACQY,GACAR,QAAQS,IAAI,mCAAmCD,KAEnD,IAAIE,EAAU,EACVC,EAAa,IACjB,KAAOD,EAAU,GACb,IAEI,MAAME,QAAiBC,MAAM,sBAAuB,CAChDC,OAAQ,OACRC,QAAS,CACL,eAAgB,oBAEpBC,KAAMC,KAAKC,UAAU,CACjBV,YAAaA,IAGjBW,OAAQC,YAAYC,QAAQ,OAGhC,IAAKT,EACD,MAAM,IAAIf,MAAM,wCAGpB,IAAKe,EAASU,GAAI,CAEd,IACI,MAAMC,QAAkBX,EAASY,OACjCxB,QAAQD,MAAM,+BAAgCwB,EAAUxB,MAC5D,CACA,MAAO0B,GACHzB,QAAQD,MAAM,qCAAqCa,EAASc,SAChE,CAEA,GAAwB,MAApBd,EAASc,OAET,YADA1B,QAAQ2B,KAAK,wBAAwBnB,KAGzC,MAAM,IAAIX,MAAM,cAAce,EAASc,SAC3C,CAEA,MAAME,QAAchB,EAASY,OAC7B,GAAII,GAAQA,EAAKC,iBAAkB,CAC/B,MAAMC,EAAO1B,IAIb,OAHA0B,EAAKC,SAAWH,EAAKC,iBACrBlC,EAAIC,SAASoC,aAAeJ,EAAKK,UAAY,OAC7CjC,QAAQS,IAAI,oBAAoBqB,EAAKC,YAC9BH,CACX,CAGI,YADA5B,QAAQD,MAAM,iDAAiDS,IAGvE,CACA,MAAO0B,GAEH,KAAIxB,EAAU,GAOV,MAAMwB,EANNlC,QAAQ2B,KAAK,yCAAyChB,SAAmBuB,SACnE,IAAIC,QAASC,GAAYC,WAAWD,EAASzB,IACnDA,GAAc,EACdD,GAKR,CAER,CACA,MAAOX,GAEHC,QAAQD,MAAM,iCAAkCA,aAAiBF,MAAQE,EAAMuC,QAAU,gBAG7F,MA7EItC,QAAQS,IAAI,mEAJZT,QAAQS,IAAI,2DAkFpB,CACOH,eAAeiC,EAAqBC,GACvC,MACMC,EADOrC,IACKsC,YAClB,OAAID,EACOA,EACFE,WAAWH,GACXI,KAAMC,IACPlD,EAAImD,OAAOC,KAAK,qBAAsB,CAClCC,SAAU,CACNC,WAAYR,EAAKS,MACjBC,UAAWV,EAAKW,YAChBC,QAASZ,EAAKa,IACdd,QAASA,KAGVK,IAENU,MAAOC,IACR7D,EAAImD,OAAO/C,MAAM,+BAAgC,CAC7CiD,SAAU,CACNC,WAAYR,EAAKS,MACjBC,UAAWV,EAAKW,YAChBC,QAASZ,EAAKa,IACdd,QAASA,EACTzC,MAAOyD,KAGfxD,QAAQD,MAAM,6BAA8ByD,GACrC,QAIX7D,EAAImD,OAAOnB,KAAK,iBACTQ,QAAQC,QAAQ,MAE/B,CCtJO9B,eAAemD,EAAqBd,EAAYe,EAAWC,EAAWC,EAAKC,EAAa,GAC3F7D,QAAQS,IAAI,mDAAmDiD,iBAAyBC,MACxFhE,EAAImD,OAAOC,KAAK,sCAAuC,CACnDC,SAAU,CACNc,WAAYJ,EACZK,WAAYJ,EACZK,YAAaH,KAGrB,MAAMI,QAAgBtB,IACtB,IAAKsB,EAED,MADAjE,QAAQS,IAAI,yCACN,IAAIZ,MAAM,qBAGpB,MAAMqE,EAAcvE,EAAIwE,UAAUC,IAClCpE,QAAQS,IAAI,kCAAmCyD,GAC/CvE,EAAImD,OAAOC,KAAK,iCAAkC,CAC9CC,SAAU,CACNc,WAAYJ,EACZK,WAAYJ,EACZU,QAASH,KAGjB,IAEI,MAAMI,EAAS,IAAIC,IAAIL,EAAc,gBAC/BM,EAAc,CAChBC,KAAM,OACNX,WAAYJ,EACZK,WAAYJ,EACZe,WAAYd,EAAMe,KAAKC,MAAMC,KAAKC,MAAQ,KAAQlB,OAAMmB,GAEtDC,QAAenE,MAAMyD,EAAQ,CAC/BxD,OAAQ,OACRC,QAAS,CACL,eAAgB,mBAChBkE,cAAiB,UAAUhB,KAE/BjD,KAAMC,KAAKC,UAAUsD,KACtBjB,MAAOxD,IASN,MARAC,QAAQD,MAAM,8BAA+BA,GAC7CJ,EAAImD,OAAO/C,MAAM,8BAA+B,CAC5CiD,SAAU,CACNc,WAAYJ,EACZK,WAAYJ,EACZ5D,MAAOA,KAGT,IAAImF,EAAS,8BAA+BhB,KAEtD,GAAID,GAA8B,MAAnBe,GAAQtD,OAAgB,CAEnC1B,QAAQS,IAAI,sDACZd,EAAImD,OAAOC,KAAK,qDAAsD,CAClEC,SAAU,CACNc,WAAYJ,EACZK,WAAYJ,EACZjC,OAAQsD,GAAQtD,UAGxB,MAAMyD,QAAuBtE,MAAMlB,EAAIwE,UAAUiB,OAAS,oBAAqB,CAC3EtE,OAAQ,OACRC,QAAS,CACLkE,cAAiB,UAAUhB,IAC3B,eAAgB,sBAGxB,GAA8B,MAA1BkB,EAAezD,OAAgB,CAE/B1B,QAAQS,IAAI,0CACZd,EAAImD,OAAOC,KAAK,yCAA0C,CACtDC,SAAU,CACNc,WAAYJ,EACZK,WAAYJ,KAGpB,MAAM0B,EAAiBC,EAAUrB,GACjC,IAAKoB,GAAgBnC,MAEjB,MADAvD,EAAImD,OAAO/C,MAAM,8BACX,IAAIF,MAAM,8BAEpB,MAAM,IAAI0F,EAAkB,mCAAoCF,EAAenC,MACnF,CACA,IAAKiC,EAAe7D,GAShB,MARAtB,QAAQD,MAAM,+BAAgCoF,EAAezD,QAC7D/B,EAAImD,OAAO/C,MAAM,+BAAgC,CAC7CiD,SAAU,CACNc,WAAYJ,EACZK,WAAYJ,EACZjC,OAAQyD,EAAezD,UAGzB,IAAI7B,MAAM,gCAUpB,OAPAG,QAAQS,IAAI,4CACZd,EAAImD,OAAOC,KAAK,2CAA4C,CACxDC,SAAU,CACNc,WAAYJ,EACZK,WAAYJ,KAGbF,EAAqBd,EAAYe,EAAWC,EAAWC,EAAKC,EACvE,CACA,GAAII,GAA8B,MAAnBe,GAAQtD,OAAgB,CACnC1B,QAAQS,IAAI,+DAAgEuE,GAAQtD,QACpF/B,EAAImD,OAAO/C,MAAM,+DAAgE,CAC7EiD,SAAU,CACNc,WAAYJ,EACZK,WAAYJ,EACZjC,OAAQsD,GAAQtD,UAGxB,MAAM2D,EAAiBC,EAAUrB,GACjC,IAAKoB,GAAgBnC,MAEjB,MADAvD,EAAImD,OAAO/C,MAAM,8BACX,IAAIF,MAAM,8BASpB,MAPAF,EAAImD,OAAO/C,MAAM,iBAAkB,CAC/BiD,SAAU,CACNc,WAAYJ,EACZK,WAAYJ,EACZT,MAAOmC,EAAenC,SAGxB,IAAIqC,EAAkB,iBAAkBF,EAAenC,MACjE,CACA,GAAsB,MAAlB8B,EAAOtD,OAAgB,CAMvB,GAAImC,EAAa,EAWb,MATA7D,QAAQD,MAAM,6EACdJ,EAAImD,OAAO/C,MAAM,yDAA0D,CACvEiD,SAAU,CACNc,WAAYJ,EACZK,WAAYJ,EACZjC,OAAQsD,EAAOtD,OACfsC,YAAaH,KAGf,IAAIhE,MAAM,4DAiBpB,OAfAG,QAAQS,IAAI,mFACZd,EAAImD,OAAOnB,KAAK,4DAA6D,CACzEqB,SAAU,CACNc,WAAYJ,EACZK,WAAYJ,EACZjC,OAAQsD,EAAOtD,OACfsC,YAAaH,KAIrB2B,aAAaC,WAAWtG,GACpBuE,GACA8B,aAAaC,WAAWrG,EAA4B,IAAMsE,GAGvDD,EAAqBd,OAAYoC,OAAWA,EAAWnB,EAAKC,EAAa,EACpF,CACA,IAAKmB,EAAO1D,GAAI,CACZ,MAAMoE,QAAkBV,EAAOW,OAU/B,MATA3F,QAAQD,MAAM,+BAAgCiF,EAAOtD,OAAQgE,GAC7D/F,EAAImD,OAAO/C,MAAM,8BAA+B,CAC5CiD,SAAU,CACNtB,OAAQsD,EAAOtD,OACf3B,MAAO2F,EACP5B,WAAYJ,EACZK,WAAYJ,KAGd,IAAI9D,MAAM,iCAAiCmF,EAAOtD,SAC5D,CACA,MAAMmB,MAAEA,SAAgBmC,EAAOxD,OAG/B,OAFAxB,QAAQS,IAAI,mCACZd,EAAImD,OAAOC,KAAK,mCACTF,CACX,CACA,MAAO9C,GACH,GAAIA,aAAiBwF,GAAqBxF,aAAiBmF,EACvD,MAAMnF,EAeV,MAZAyF,aAAaC,WAAWtG,GACpBuE,GACA8B,aAAaC,WAAWrG,EAA4B,IAAMsE,GAE9D1D,QAAQD,MAAM,0CAA2CA,GACzDJ,EAAImD,OAAO/C,MAAM,0CAA2C,CACxDiD,SAAU,CACNc,WAAYJ,EACZK,WAAYJ,EACZ5D,MAAOA,KAGT,IAAIF,MAAM,iCAAkC,CAAEI,MAAOF,GAC/D,CACJ,CAQOO,eAAesF,EAAsClC,EAAWC,EAAWC,GAC9E,OAAOH,EAAqBlB,EAAsBmB,EAAWC,EAAWC,EAC5E,CACOtD,eAAeuF,EAAmBnC,EAAWC,EAAWmC,EAAWC,GAAe,EAAOC,GAAkB,GAC9G,MAAMC,EAAkBvC,GAAa8B,aAAaU,QAAQ/G,SAA8B4F,EAClFoB,EAAkBxC,GAAa6B,aAAaU,QAAQ9G,EAA4B,IAAM6G,SAAoBlB,EAEhH,IAAKgB,GAAgB1G,GAAkBC,GAAcA,EAAW8G,IAAOvB,KAAKC,MAAQ,IAAO,IACvF,MAAO,CAAEuB,SAAUhH,EAAgBwD,MAAOvD,EAAYS,OAAO,GAWjE,IARKiG,GAAmB5F,IAAkBsC,YAEtCrD,QAAuBuG,EAAsCK,EAAiBE,IAEzEL,GAAazG,KAElBA,QAAuBoE,EAAqB,IAAMtB,QAAQC,QAAQ0D,GAAazG,GAAiB4G,EAAiBE,KAEhH9G,EAOD,MANAM,EAAImD,OAAO/C,MAAM,oCAAqC,CAClDiD,SAAU,CACNc,WAAYmC,EACZlC,WAAYoC,KAGd,IAAItG,MAAM,qCAGpB,GADAP,EAAagG,EAAUjG,IAClBC,IAAeA,EAAW8G,MAAQ/G,EAQnC,MAPAW,QAAQD,MAAM,2BAA4BT,GAC1CK,EAAImD,OAAO/C,MAAM,2BAA4B,CACzCiD,SAAU,CACNc,WAAYmC,EACZlC,WAAYoC,KAGd,IAAItG,MAAM,4BAEpB,MAAO,CAAEwG,SAAUhH,EAAgBwD,MAAOvD,EAAYS,OAAO,EACjE,CACO,MAAMwF,UAA0B1F,MACnCqD,MACA,WAAAoD,CAAYhE,EAASY,GACjBqD,MAAMjE,GACNkE,KAAKC,KAAO,oBACZD,KAAKtD,MAAQA,CACjB,EAEG,MAAMgC,UAAiBrF,MAC1B6G,OACA,WAAAJ,CAAYhE,EAASoE,GACjBH,MAAMjE,GACNkE,KAAKC,KAAO,WACZD,KAAKE,OAASA,CAClB,EC/PG,MAAMC,EAAY,cAEnBC,EAAeC,EAAQC,iBCdtB,SAASC,IACZ,MAAMC,EAAIJ,EAAaK,UAAU,KAAMN,IACjClE,KAAEA,GAASyE,KACVC,EAAeC,GAAoBC,EAAS,OAC5CC,EAAWC,GAAgBF,GAAS,IACpCtH,EAAOyH,GAAYH,EAAS,MAkDnC,OAjDAI,EAAU,KACoBnH,WACtB,IAAKmC,GAAMS,MAGP,OAFAkE,EAAiB,WACjBG,GAAa,GAGjB,IACI,MAAM3G,QAAiBC,MAAM,sBAAuB,CAChDC,OAAQ,OACRC,QAAS,CACL,eAAgB,oBAEpBC,KAAMC,KAAKC,UAAU,CACjBV,YAAaiC,EAAKS,UAG1B,GAAItC,EAASU,GAAI,CACb,MAAMoG,QAAmB9G,EAASY,OAG9B4F,EAFAM,EAEiB,CACbC,UAAWD,EAAWjB,MAAQ,UAC9BA,KAAMiB,EAAWE,OAASF,EAAWjB,MAAQ,UAC7CoB,OAAQH,EAAWG,QAAU,GAC7BhG,iBAAkB6F,EAAW7F,iBAC7BI,SAAUyF,EAAWzF,SACrB6F,KAAMJ,EAAWI,MAIJ,KAEzB,MAEIV,EAAiB,KAEzB,CACA,MAAOrH,GACHC,QAAQD,MAAM,gCAAiCA,GAC/CyH,EAASR,EAAE,oCACXI,EAAiB,KACrB,CACZ,QACgBG,GAAa,EACjB,GAEJQ,IACD,CAACtF,GAAMS,QACH,CACHiE,gBACAG,YACAvH,QAER,CD7CK6G,EAAaoB,IAAIC,GAAkBC,KAAK,CACzCC,UAAW,CACPC,GAAI,CAAEzB,CAACA,ipiCACP0B,GAAI,CAAE1B,CAACA,4roCACP2B,GAAI,CAAE3B,CAACA,yshCACP4B,GAAI,CAAE5B,CAACA,oxoCACP6B,GAAI,CAAE7B,CAACA,ikqCACP8B,GAAI,CAAE9B,CAACA,kwoCACP+B,GAAI,CAAE/B,CAACA,4k0BACPgC,GAAI,CAAEhC,CAACA,41yBACPiC,GAAI,CAAEjC,CAACA,+rnCACPkC,GAAI,CAAElC,CAACA,iinCACPmC,GAAI,CAAEnC,CAACA,iiiCACPoC,GAAI,CAAEpC,CAACA,o5sBACP,QAAS,CAAEA,CAACA,w7sBAEhBqC,YAAa,KACbC,GAAI,CAACtC,GACLuC,UAAWvC,EACXwC,cAAe,CACXC,aAAa,GAEjBC,MAAO,CACHC,aAAa,KEpCrB,MAAMC,EAAiB,aACjBC,EAAmB,oBAElB,SAASC,IAmCZ,MAAO,CAAEC,cAjCaC,EAAY,KAC9B,MAAMC,EAAQC,OAAOC,aACfC,EAAalF,KAAKC,MALd,IASV,OAFAkF,eAAeC,QAAQV,EAAgBK,GACvCI,eAAeC,QAAQT,EAAkBO,EAAWG,YAC7CN,GACR,IA0BqBO,YAxBJR,EAAaS,IAC7B,IAAKA,EACD,MAAO,gBAEX,MAAMC,EAAaL,eAAe9D,QAAQqD,GACpCQ,EAAaO,SAASN,eAAe9D,QAAQsD,IAAqB,KACxE,IAAIe,EAWJ,OARIA,EADAF,IAAeD,EACN,qBAAqBC,SAAkBD,KAE3CvF,KAAKC,MAAQiF,EACT,qBAGAhF,EAENwF,GACR,IAMkCC,WAJlBb,EAAY,KAC3BK,eAAevE,WAAW8D,GAC1BS,eAAevE,WAAW+D,IAC3B,IAEP,CCzCO,SAASiB,EAA4BC,GACxC,QAH4B,aAArBC,OAAOC,UAIlB,CCKA,MAAMC,EACFvD,WAAY,EACZwD,OACAC,UACAC,UACAC,WACAC,oBACAC,oBACAC,mBACA,WAAA9E,CAAYwE,EAAQG,GAEZzE,KAAKsE,OADLA,GAIc,IAAIO,EAAe,CAC7BC,UAAW3L,EAAIwE,UAAUiB,OACzBmG,SAAU5L,EAAIwE,UAAUqH,KACxBC,eAAgB9L,EAAIwE,UAAUC,MAGlC6G,IACAzE,KAAKyE,WAAaA,GAEtBzE,KAAKkF,OAASlF,KAAKkF,OAAOC,KAAKnF,KACnC,CACA,SAAIoF,GACA,OAAOpF,KAAKsE,OAAOc,KACvB,CACA,QAAInJ,GACA,OAAO+D,KAAKwE,SAChB,CACA,WAAIa,GACA,OAAOrF,KAAKwE,WAAWa,OAC3B,CACA,WAAIC,GACA,OAAOtF,KAAKwE,WAAWc,OAC3B,CACA,YAAIC,GACA,OAAOvF,KAAKwE,WAAWe,QAC3B,CACA,gBAAIC,GACA,OAAOxF,KAAKyF,aAAarJ,KAAKC,GAAS,UAAUA,IACrD,CACA,gBAAIoJ,GACA,OAAOpG,IAAqBjD,KAAKsJ,IAC7B,MAAMrJ,EAAQqJ,GAAK7F,SACnB,IAAKxD,EACD,MAAM,IAAIhD,MAAM,sBAGpB,OADA2G,KAAKwE,UAAY1F,EAAUzC,GACpBA,GAEf,CACA,OAAAsJ,GACI3F,KAAKkF,QACT,CACA,UAAAU,GACI,OAAO5F,KAAKwE,WAAWa,OAC3B,CACA,WAAMQ,CAAMxJ,GAYR,OAXA2D,KAAKuE,eAAYhG,EACjByB,KAAKc,WAAY,EACjBd,KAAKsE,OAAOwB,iBAAiB,IAAM9F,KAAKwF,cACxCxF,KAAKwE,UAAY1F,EAAUzC,GAC3B7C,QAAQS,IAAI,iBAAiB+F,KAAKwE,WAAWvE,qBAAqBD,KAAKwE,WAAWa,QAAQpF,SAASD,KAAKwE,WAAWa,QAAQU,mBAAmB/F,KAAKwE,WAAWc,SAASrF,SAASD,KAAKwE,WAAWc,SAASS,OAEzM/G,aAAayE,QAAQ9K,EAA2BqH,KAAKwE,UAAUa,QAAQU,IACvE/G,aAAayE,QAAQ7K,EAA4B,IAAMoH,KAAKwE,UAAUa,QAAQU,GAAI/F,KAAKwE,UAAUc,SAASS,IAAM,IAEhH5M,EAAI6M,UAAUhG,KAAKwE,iBACbxE,KAAKiG,wBACJtK,QAAQC,SACnB,CACA,UAAAsK,GACI,QAASlG,KAAKwE,SAClB,CACA,MAAAU,GAEI,GADA1L,QAAQS,IAAI,eACRgK,IAA+B,CAG/BzK,QAAQS,IAAI,6BACZ+F,KAAKuE,eAAYhG,EACjByB,KAAKc,WAAY,EACjBd,KAAKwE,eAAYjG,EACjByB,KAAKyE,gBAAalG,EAClByB,KAAKsE,OAAOwB,sBAAiBvH,GAC7B,MAAM4H,EAAY,IAAIpI,IAxFJ,uCAyFZqI,EAAa,IAAIrI,IAAIoG,OAAOkC,SAASC,MAC3CF,EAAWG,KAAO,GAClBJ,EAAUK,SAAW,UACrBL,EAAUM,aAAaC,IAAI,eAAgBN,EAAW1C,YACtD2C,SAASM,QAAQR,EAAUzC,WAC/B,KACK,CAEDlK,QAAQS,IAAI,yBACZ,MAAM2M,IAAgB5G,KAAKwE,UACvBxE,KAAKwE,WACL5K,IAAkB+L,UAEtB3F,KAAKuE,eAAYhG,EACjByB,KAAKc,WAAY,EACjBd,KAAKwE,eAAYjG,EACjByB,KAAKyE,gBAAalG,EAClByB,KAAKsE,OAAOwB,sBAAiBvH,GAKzBqI,GACAP,SAASM,QAAQ,IAEzB,CACJ,CACA,mBAAME,CAAcC,GAChB9H,aAAayE,QAAQ9K,EAA2BmO,GAC5C9G,OACIA,KAAKqF,SAAWrF,KAAKsF,QACrBtG,aAAayE,QAAQ7K,EAA4B,IAAMoH,KAAKqF,QAAQU,GAAI/F,KAAKsF,QAAQS,IAEhF/F,KAAKqF,SACVrG,aAAaC,WAAWrG,EAA4B,IAAMoH,KAAKqF,QAAQU,KAG/E5B,OAAOkC,SAASM,QAAQ,OAASG,EACrC,CACA,mBAAMC,CAAcC,GACZhH,KAAKqF,SACLrG,aAAayE,QAAQ7K,EAA4B,IAAMoH,KAAKqF,QAAQU,GAAIiB,GAE5E7C,OAAOkC,SAASM,QAAQ,OAAS3G,KAAKqF,SAASU,GAAK,MAAQiB,EAChE,CACA,mBAAMC,GACF,OAAOjH,KAAKsE,OAAOiB,SAAS2B,OAAO9K,KAAKmJ,IACpC,IAAKvF,KAAKwE,UACN,MAAM,IAAInL,MAAM,sBAEpB2G,KAAKwE,UAAUe,SAAWA,EAC1BvF,KAAKyE,aAAazE,KAAKmH,WACxBpK,MAAMC,IAEL,MADAxD,QAAQD,MAAM,2BAA4ByD,GACpCA,GAEd,CACA,mBAAMoK,CAAclK,GAChB,OAAO8C,KAAKsE,OAAO+C,SAASH,KAAK,CAAChK,IAAYd,KAAKiL,IAC/C,IAAKrH,KAAKwE,UACN,MAAM,IAAInL,MAAM,sBAEpB2G,KAAKwE,UAAY,IACVxE,KAAKwE,UACRe,SAAUvF,KAAKwE,UAAUe,UAAU+B,IAAIjC,GAC/BA,EAAQU,KAAO7I,EACR,IACAmI,EACHgC,SAAUA,EAASE,OAAOjC,GAAWA,EAAQD,UAAYnI,IAG1DmI,IAGfrF,KAAKyE,aAAazE,KAAKmH,WACxBpK,MAAMC,IAEL,MADAxD,QAAQD,MAAM,2BAA4ByD,GACpCA,GAEd,CACA,2BAAMiJ,GACF,GAAIjG,KAAK4E,mBAEL,OADApL,QAAQS,IAAI,iCACL,EAEX,MAAMuN,EAAiBxH,KAAK4E,mBAC5B,IACI,MAAM6C,QAAmBzH,KAAKsE,OAAOe,QAAQqC,qBAE7C,GADA1H,KAAK4E,mBAAqB+C,OAAOC,OAAOH,GAAYI,MAAMC,IAAmB,IAAVA,GAC/DN,IAAmBxH,KAAK4E,mBACxB,OAAO,EAEX5E,KAAKyE,aAAazE,KAAKmH,QAC3B,CACA,MAAO5N,GACHC,QAAQD,MAAM,oCAAqCA,GACnDyG,KAAK4E,oBAAqB,EAC1B5E,KAAKyE,aAAazE,KAAKmH,QAC3B,CACA,OAAO,CACX,CACA,KAAAA,GACI,MAAMY,EAAU,IAAI1D,EAAYrE,KAAKsE,QAQrC,OAPAyD,EAAQjH,UAAYd,KAAKc,UACzBiH,EAAQxD,UAAYvE,KAAKuE,UACzBwD,EAAQvD,UAAYxE,KAAKwE,UACzBuD,EAAQtD,WAAazE,KAAKyE,WAC1BsD,EAAQrD,oBAAsB1E,KAAK0E,oBACnCqD,EAAQlB,cAAgB7G,KAAK6G,cAC7BkB,EAAQnD,mBAAqB5E,KAAK4E,mBAC3BmD,CACX,EAEC,MAACC,EAAqBC,OAAc1J,GAClC,SAASmC,IACZ,MAAMqH,EAAUG,EAAWF,GAC3B,IAAKD,EACD,MAAM,IAAI1O,MAAM,4DAEpB,OAAO0O,CACX,CChNO,SAASI,GAAoBC,SAAEA,IAClC,MAAMC,EAAa,IAAIC,gBAAgBjC,SAASE,KAAKgC,UAAU,IACzDlM,EAAQgM,EAAWG,IAAI,SACvBpF,EAAQiF,EAAWG,IAAI,UACtBT,EAAStD,GAAc5D,EAAS,IAAIwD,IACrCnB,cAAEA,EAAaS,YAAEA,EAAWK,WAAEA,GAAef,IAC7CwF,EAAsBC,GAAO,GAC7BC,EAAwB,CAACxL,EAAWD,KACtC,MAAM0L,EAAM,IAAI7K,IAAI,2CAAgC5E,EAAIwE,UAAUC,KAAO,6BACnEwI,EAAa,IAAIrI,IAAIoG,OAAOkC,SAASC,MAC3CF,EAAWG,KAAO,GAKlBqC,EAAInC,aAAaC,IAAI,eAAgBN,EAAW1C,YAChDkF,EAAInC,aAAaC,IAAI,QAASxD,KAC9BmD,SAASM,QAAQiC,EAAIlF,aA+JzB,OA7JAzC,EAAU,KAEN,GAAIwH,EAAoBI,QAEpB,YADArP,QAAQS,IAAI,iDAGhBwO,EAAoBI,SAAU,EAC9BrP,QAAQS,IAAI,4BACZd,EAAImD,OAAOC,KAAK,sBAChB,MAAM6J,EAAa,IAAIrI,IAAIoG,OAAOkC,SAASC,MACrC7G,EAAkB2G,EAAWK,aAAa+B,IAAI,MAAQxJ,aAAaU,QAAQ/G,SAA8B4F,EACzGoB,EAAkByG,EAAWK,aAAa+B,IAAI,MAChDxJ,aAAaU,QAAQ9G,EAA4B,IAAM6G,SACvDlB,EASJ,GARA/E,QAAQS,IAAI,yBAA0BwF,GACtCjG,QAAQS,IAAI,yBAA0B0F,GACtCxG,EAAImD,OAAOC,KAAK,+BAAgC,CAC5CC,SAAU,CACNc,WAAYmC,EACZlC,WAAYoC,KAGhBtD,GAAS+G,EAAO,CAChB2E,EAAQtD,WAAaA,EACrB,MAAMqE,EAAkBnF,EAAYP,GAsDpC,OArDI0F,GACAtP,QAAQD,MAAM,wBAAwBuP,KACtC3P,EAAImD,OAAO/C,MAAM,kBAAkBuP,IAAmB,CAClDtM,SAAU,CACN4G,MAAOA,KAGfuF,KAGA3E,SAEJ3E,EAAmBI,EAAiBE,EAAiBtD,GAAO,EAAO4H,KAC9D7H,KAAMsJ,IACPqC,EAAQlC,MAAMH,EAAI7F,UAAUzD,KAAK,KAC7BqI,EAAWsD,EAAQZ,SAEnBhD,OAAOkC,SAASE,KAAO,OAG1BxJ,MAAOC,GAEJA,aAAe+B,GACfvF,QAAQS,IAAI,4CAA6C+C,GACzD+K,EAAQjH,WAAY,EACpBiH,EAAQxD,UAAYvH,OACpByH,EAAWsD,EAAQZ,UAGnBnK,aAAe0B,GACflF,QAAQD,MAAM,kCAAmCyD,GACjD7D,EAAImD,OAAO/C,MAAM,kCAAmC,CAChDiD,SAAU,CACNc,WAAYmC,EACZlC,WAAYoC,EACZ9B,QAASb,EAAIkD,OACb3G,MAAOyD,KAGfmH,OAAO4E,MAAM,kGACbhB,EAAQ7C,SACRT,EAAWsD,EAAQZ,cACnBhD,OAAOkC,SAASE,KAAO,MAG3B/M,QAAQD,MAAM,sEAAuEyD,GACrF7D,EAAImD,OAAO/C,MAAM,sEAAuE,CACpFiD,SAAU,CACNjD,MAAOyD,UAGf2L,KAGR,CAGI,IAAKZ,EAAQ7B,aAAc,CAQvB,GAPA1M,QAAQS,IAAI,wCACZd,EAAImD,OAAOC,KAAK,iCAAkC,CAC9CC,SAAU,CACNc,WAAYmC,EACZlC,WAAYoC,KAGhBsE,IASA,OARAzK,QAAQS,IAAI,2FAA4FwF,EAAiBE,GACzHxG,EAAImD,OAAOC,KAAK,6CAA8C,CAC1DC,SAAU,CACNc,WAAYmC,EACZlC,WAAYoC,UAGpBgJ,IAIAnP,QAAQS,IAAI,4CACZd,EAAImD,OAAOC,KAAK,qCAAsC,CAClDC,SAAU,CACNc,WAAYmC,EACZlC,WAAYoC,IAI5B,CAEJ,OAAOqJ,EAAmBpP,IAAmBE,MAAOmP,IAC5CA,GACAzP,QAAQS,IAAI,wCACZd,EAAImD,OAAOC,KAAK,iCAAkC,CAC9CC,SAAU,CACNc,WAAYmC,EACZlC,WAAYoC,KAGpBoI,EAAQtD,WAAaA,QACfpF,EAAmBI,EAAiBE,OAAiBpB,GAAW,EAAO0F,KACxE7H,KAAMsJ,IACPqC,EAAQlC,MAAMH,EAAI7F,UAAUzD,KAAK,IAAMqI,EAAWsD,EAAQZ,YAEzDpK,MAAOC,IACRxD,QAAQD,MAAM,yCAA0CyD,GACxD7D,EAAImD,OAAO/C,MAAM,yCAA0C,CACvDiD,SAAU,CACNc,WAAYmC,EACZlC,WAAYoC,EACZpG,MAAOyD,KAGTA,aAAe+B,GACjBgJ,EAAQ7C,SACZ6C,EAAQjH,WAAY,EACpBiH,EAAQxD,UAAYvH,EACpByH,EAAWsD,EAAQZ,aAKvB3N,QAAQS,IAAI,8BACZd,EAAImD,OAAOC,KAAK,uBAAwB,CACpCC,SAAU,CACNc,WAAYmC,EACZlC,WAAYoC,KAGpBoI,EAAQzD,OAAOwB,sBAAiBvH,GAChCwJ,EAAQ7C,SACRT,EAAWsD,EAAQZ,aAG5B,IACI+B,EAAKlB,EAAmBmB,SAAU,CAAErB,MAAOC,EAASK,SAAUA,GACzE,CCxLO,SAASgB,IAoBZ,MAAO,CACHC,eAnBmBvP,MAAOmC,IAC1B,MAAMqN,EAAanF,OAAOnF,aAAaU,QAAQ,wBAC1CzD,EAIDqN,GACAnF,OAAOnF,aAAaC,WAAW,wBAJ/BzF,QAAQD,MAAM,sCAiBlBgQ,WATe,CAACC,EAAWC,KACtBtQ,EAAIuQ,QACLlQ,QAAQmQ,MAAM,cAAeH,EAAWC,GAG5CG,EAASlQ,IAAwB8P,EAAW,IAAKC,EAAiBI,YAAa1Q,EAAIuQ,UAM3F"}
+{"version":3,"file":"vertesia-ui-session.js","sources":["session/constants.js","session/auth/firebase.js","session/auth/composable.js","session/auth/useAuthState.js","session/auth/domainRouting.js","session/UserSession.js","session/auth/useCurrentTenant.js","session/UserSessionProvider.js","session/useUXTracking.js"],"sourcesContent":["export const LastSelectedAccountId_KEY = 'composableai.lastSelectedAccountId';\nexport const LastSelectedProjectId_KEY = 'composableai.lastSelectedProjectId';\n//# sourceMappingURL=constants.js.map","import { Env } from '@vertesia/ui/env';\nimport { getAnalytics } from 'firebase/analytics';\nimport { initializeApp } from 'firebase/app';\nimport { getAuth } from 'firebase/auth';\n// Use lazy initialization to avoid accessing Env before it's initialized\nlet _firebaseApp = null;\nlet _analytics = null;\nlet _firebaseAuth = null;\n// Getters that lazily initialize Firebase components when first accessed\nexport function getFirebaseApp() {\n    if (!_firebaseApp) {\n        try {\n            if (!Env.firebase) {\n                throw new Error('Firebase configuration is not available in the environment');\n            }\n            _firebaseApp = initializeApp(Env.firebase);\n        }\n        catch (error) {\n            console.error('Failed to initialize Firebase app:', error);\n            throw new Error('Firebase initialization failed - environment may not be properly initialized', {\n                cause: error,\n            });\n        }\n    }\n    return _firebaseApp;\n}\nexport function getFirebaseAnalytics() {\n    if (!_analytics) {\n        _analytics = getAnalytics(getFirebaseApp());\n    }\n    return _analytics;\n}\nexport function getFirebaseAuth() {\n    if (!_firebaseAuth) {\n        _firebaseAuth = getAuth(getFirebaseApp());\n    }\n    return _firebaseAuth;\n}\nexport async function setFirebaseTenant(tenantEmail) {\n    if (!tenantEmail) {\n        console.log('No tenant name or email specified, skipping tenant setup');\n        return;\n    }\n    if (!Env.firebase) {\n        console.log('Firebase configuration is not available in the environment');\n        return;\n    }\n    try {\n        if (tenantEmail)\n            console.log(`Resolving tenant ID from email: ${tenantEmail}`);\n        // Add retry logic with exponential backoff\n        let retries = 3;\n        let retryDelay = 250; // Start with 250ms delay\n        while (retries > 0) {\n            try {\n                // Call the API endpoint to resolve the tenant ID\n                const response = await fetch('/api/resolve-tenant', {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    },\n                    body: JSON.stringify({\n                        tenantEmail: tenantEmail,\n                    }),\n                    // Add timeout to prevent hanging requests\n                    signal: AbortSignal.timeout(5000),\n                });\n                // Check for network errors\n                if (!response) {\n                    throw new Error('No response received from tenant API');\n                }\n                // Handle HTTP error responses\n                if (!response.ok) {\n                    // Try to parse the error response\n                    try {\n                        const errorData = await response.json();\n                        console.error('Failed to resolve tenant ID:', errorData.error);\n                    }\n                    catch {\n                        console.error(`Failed to resolve tenant ID: HTTP ${response.status}`);\n                    }\n                    // If the error is 404 Not Found, no need to retry\n                    if (response.status === 404) {\n                        console.warn(`Tenant not found for ${tenantEmail}`);\n                        return;\n                    }\n                    throw new Error(`HTTP error ${response.status}`);\n                }\n                // Successfully got a response, parse it\n                const data = (await response.json());\n                if (data?.firebaseTenantId) {\n                    const auth = getFirebaseAuth();\n                    auth.tenantId = data.firebaseTenantId;\n                    Env.firebase.providerType = data.provider ?? 'oidc';\n                    console.log(`Tenant ID set to ${auth.tenantId}`);\n                    return data;\n                }\n                else {\n                    console.error(`Invalid response format, missing tenantId for ${tenantEmail}`);\n                    return; // No need to retry for invalid response format\n                }\n            }\n            catch (fetchError) {\n                // Only retry for network-related errors\n                if (retries > 1) {\n                    console.warn(`Tenant resolution failed, retrying in ${retryDelay}ms...`, fetchError);\n                    await new Promise((resolve) => setTimeout(resolve, retryDelay));\n                    retryDelay *= 2; // Exponential backoff\n                    retries--;\n                }\n                else {\n                    throw fetchError; // Last retry failed, propagate error\n                }\n            }\n        }\n    }\n    catch (error) {\n        // Final error handler\n        console.error('Error setting Firebase tenant:', error instanceof Error ? error.message : 'Unknown error');\n        // Continue without tenant ID - authentication will work without multi-tenancy\n        // but the user will access the default tenant\n    }\n}\nexport async function getFirebaseAuthToken(refresh) {\n    const auth = getFirebaseAuth();\n    const user = auth.currentUser;\n    if (user) {\n        return user\n            .getIdToken(refresh)\n            .then((token) => {\n            Env.logger.info('Got Firebase token', {\n                vertesia: {\n                    user_email: user.email,\n                    user_name: user.displayName,\n                    user_id: user.uid,\n                    refresh: refresh,\n                },\n            });\n            return token;\n        })\n            .catch((err) => {\n            Env.logger.error('Failed to get Firebase token', {\n                vertesia: {\n                    user_email: user.email,\n                    user_name: user.displayName,\n                    user_id: user.uid,\n                    refresh: refresh,\n                    error: err,\n                },\n            });\n            console.error('Failed to get access token', err);\n            return null;\n        });\n    }\n    else {\n        Env.logger.warn('No user found');\n        return Promise.resolve(null);\n    }\n}\n//# sourceMappingURL=firebase.js.map","import { Env } from '@vertesia/ui/env';\nimport { jwtDecode } from 'jwt-decode';\nimport { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY } from '../constants';\nimport { getFirebaseAuth, getFirebaseAuthToken } from './firebase';\nlet AUTH_TOKEN_RAW;\nlet AUTH_TOKEN;\nfunction normalizeIssuer(value) {\n    return value?.replace(/\\/+$/, '');\n}\nfunction decodeToken(token) {\n    return jwtDecode(token);\n}\nfunction isVertesiaIssuedToken(token) {\n    if (!token)\n        return false;\n    try {\n        const decoded = decodeToken(token);\n        return normalizeIssuer(decoded.iss) === normalizeIssuer(Env.endpoints.sts);\n    }\n    catch {\n        return false;\n    }\n}\nexport async function fetchComposableToken(getIdToken, accountId, projectId, ttl, retryCount = 0) {\n    console.log(`Getting/refreshing composable token for account ${accountId} and project ${projectId} `);\n    Env.logger.info('Getting/refreshing composable token', {\n        vertesia: {\n            account_id: accountId,\n            project_id: projectId,\n            retry_count: retryCount,\n        },\n    });\n    const idToken = await getIdToken(); //get from firebase\n    if (!idToken) {\n        console.log('No id token found - using cookie auth');\n        throw new Error('No id token found');\n    }\n    // Use STS endpoint - either configured or default to sts.vertesia.io\n    const stsEndpoint = Env.endpoints.sts;\n    console.log('Using STS for token generation:', stsEndpoint);\n    Env.logger.info('Using STS for token generation', {\n        vertesia: {\n            account_id: accountId,\n            project_id: projectId,\n            sts_url: stsEndpoint,\n        },\n    });\n    try {\n        // Call STS to generate a user token\n        const stsUrl = new URL(`${stsEndpoint}/token/issue`);\n        const requestBody = {\n            type: 'user',\n            account_id: accountId,\n            project_id: projectId,\n            expires_at: ttl ? Math.floor(Date.now() / 1000) + ttl : undefined,\n        };\n        const stsRes = await fetch(stsUrl, {\n            method: 'POST',\n            headers: {\n                'Content-Type': 'application/json',\n                Authorization: `Bearer ${idToken}`, // Firebase token for authentication\n            },\n            body: JSON.stringify(requestBody),\n        }).catch((error) => {\n            console.error('Failed to call STS endpoint', error);\n            Env.logger.error('Failed to call STS endpoint', {\n                vertesia: {\n                    account_id: accountId,\n                    project_id: projectId,\n                    error: error,\n                },\n            });\n            throw new STSError('Failed to call STS endpoint', stsEndpoint);\n        });\n        if (idToken && stsRes?.status === 404) {\n            // User not found in token-server - call ensure-user endpoint\n            console.log('404: User not found - calling ensure-user endpoint');\n            Env.logger.info('404: User not found - calling ensure-user endpoint', {\n                vertesia: {\n                    account_id: accountId,\n                    project_id: projectId,\n                    status: stsRes?.status,\n                },\n            });\n            const ensureResponse = await fetch(`${Env.endpoints.studio}/auth/ensure-user`, {\n                method: 'POST',\n                headers: {\n                    Authorization: `Bearer ${idToken}`,\n                    'Content-Type': 'application/json',\n                },\n            });\n            if (ensureResponse.status === 412) {\n                // No invite - trigger signup\n                console.log('412: No invite found - signup required');\n                Env.logger.info('412: No invite found - signup required', {\n                    vertesia: {\n                        account_id: accountId,\n                        project_id: projectId,\n                    },\n                });\n                const idTokenDecoded = jwtDecode(idToken);\n                if (!idTokenDecoded?.email) {\n                    Env.logger.error('No email found in id token');\n                    throw new Error('No email found in id token');\n                }\n                throw new UserNotFoundError('User not found - signup required', idTokenDecoded.email);\n            }\n            if (ensureResponse.status === 403) {\n                // SigninScreen keys the invite-required view off this message.\n                Env.logger.warn('403: Customer-domain user requires an invite to join', {\n                    vertesia: {\n                        account_id: accountId,\n                        project_id: projectId,\n                    },\n                });\n                throw new Error('Customer-domain user requires an invite to join');\n            }\n            if (!ensureResponse.ok) {\n                console.error('Failed to ensure user exists', ensureResponse.status);\n                Env.logger.error('Failed to ensure user exists', {\n                    vertesia: {\n                        account_id: accountId,\n                        project_id: projectId,\n                        status: ensureResponse.status,\n                    },\n                });\n                throw new Error('Failed to ensure user exists');\n            }\n            // User created/exists - retry token generation\n            console.log('User ensured - retrying token generation');\n            Env.logger.info('User ensured - retrying token generation', {\n                vertesia: {\n                    account_id: accountId,\n                    project_id: projectId,\n                },\n            });\n            return fetchComposableToken(getIdToken, accountId, projectId, ttl, retryCount);\n        }\n        if (idToken && stsRes?.status === 412) {\n            console.log(\"412: auth succeeded but user doesn't exist - signup required\", stsRes?.status);\n            Env.logger.error(\"412: auth succeeded but user doesn't exist - signup required\", {\n                vertesia: {\n                    account_id: accountId,\n                    project_id: projectId,\n                    status: stsRes?.status,\n                },\n            });\n            const idTokenDecoded = jwtDecode(idToken);\n            if (!idTokenDecoded?.email) {\n                Env.logger.error('No email found in id token');\n                throw new Error('No email found in id token');\n            }\n            Env.logger.error('User not found', {\n                vertesia: {\n                    account_id: accountId,\n                    project_id: projectId,\n                    email: idTokenDecoded.email,\n                },\n            });\n            throw new UserNotFoundError('User not found', idTokenDecoded.email);\n        }\n        if (stsRes.status === 403) {\n            // User doesn't have access to the requested account/project, or has no accounts\n            // This can happen with:\n            // 1. Stale localStorage from previous user\n            // 2. User invited to a new account (doesn't have access yet)\n            // 3. User exists but has no accounts at all\n            if (retryCount > 0) {\n                // Already retried without account scope - this is a real authorization failure\n                console.error('403: Access denied even without account scope - user may have no accounts');\n                Env.logger.error('403: Access denied after retry - authorization failure', {\n                    vertesia: {\n                        account_id: accountId,\n                        project_id: projectId,\n                        status: stsRes.status,\n                        retry_count: retryCount,\n                    },\n                });\n                throw new Error('Access denied - user may not have access to any accounts');\n            }\n            console.log('403: Access denied - clearing cached account and retrying without account scope');\n            Env.logger.warn('403: Access denied - clearing cached account and retrying', {\n                vertesia: {\n                    account_id: accountId,\n                    project_id: projectId,\n                    status: stsRes.status,\n                    retry_count: retryCount,\n                },\n            });\n            // Clear any stale account/project from localStorage\n            localStorage.removeItem(LastSelectedAccountId_KEY);\n            if (accountId) {\n                localStorage.removeItem(`${LastSelectedProjectId_KEY}-${accountId}`);\n            }\n            // Retry without account/project scope - let user log in to their default account\n            return fetchComposableToken(getIdToken, undefined, undefined, ttl, retryCount + 1);\n        }\n        if (!stsRes.ok) {\n            const errorText = await stsRes.text();\n            console.error('STS token generation failed:', stsRes.status, errorText);\n            Env.logger.error('STS token generation failed', {\n                vertesia: {\n                    status: stsRes.status,\n                    error: errorText,\n                    account_id: accountId,\n                    project_id: projectId,\n                },\n            });\n            throw new Error(`Failed to get token from STS: ${stsRes.status}`);\n        }\n        const { token } = await stsRes.json();\n        console.log('Successfully got token from STS');\n        Env.logger.info('Successfully got token from STS');\n        return token;\n    }\n    catch (error) {\n        if (error instanceof UserNotFoundError || error instanceof STSError) {\n            throw error; // Re-throw UserNotFoundError and STSError to be handled separately in the caller\n        }\n        // Clear any stale account/project from localStorage on error\n        localStorage.removeItem(LastSelectedAccountId_KEY);\n        if (accountId) {\n            localStorage.removeItem(`${LastSelectedProjectId_KEY}-${accountId}`);\n        }\n        console.error('Failed to get composable token from STS', error);\n        Env.logger.error('Failed to get composable token from STS', {\n            vertesia: {\n                account_id: accountId,\n                project_id: projectId,\n                error: error,\n            },\n        });\n        throw new Error('Failed to get composable token', { cause: error });\n    }\n}\n/**\n *\n * @param accountId\n * @param projectId\n * @param ttl time to live for the token in seconds\n * @returns\n */\nexport async function fetchComposableTokenFromFirebaseToken(accountId, projectId, ttl) {\n    return fetchComposableToken(getFirebaseAuthToken, accountId, projectId, ttl);\n}\n/**\n * Mint a scoped Vertesia token from an existing Vertesia JWT. STS accepts STS-issued\n * tokens on /token/issue, so this works for sessions established via Central Auth where\n * the browser has no Firebase user.\n */\nexport async function fetchComposableTokenFromVertesiaToken(vertesiaToken, accountId, projectId, ttl) {\n    return fetchComposableToken(() => Promise.resolve(vertesiaToken), accountId, projectId, ttl);\n}\n/** Returns the cached Vertesia raw JWT, if any. Does not refresh. */\nexport function getCurrentVertesiaToken() {\n    return AUTH_TOKEN_RAW;\n}\nexport async function getComposableToken(accountId, projectId, initToken, forceRefresh = false, useInternalAuth = false) {\n    const selectedAccount = accountId ?? localStorage.getItem(LastSelectedAccountId_KEY) ?? undefined;\n    const selectedProject = projectId ?? localStorage.getItem(`${LastSelectedProjectId_KEY}-${selectedAccount}`) ?? undefined;\n    const devAuthToken = Env.isLocalDev ? Env.devAuthToken : undefined;\n    const suppliedToken = devAuthToken ?? initToken ?? AUTH_TOKEN_RAW;\n    //token is still valid for more than 5 minutes\n    if (!forceRefresh && AUTH_TOKEN_RAW && AUTH_TOKEN && AUTH_TOKEN.exp > Date.now() / 1000 + 300) {\n        return { rawToken: AUTH_TOKEN_RAW, token: AUTH_TOKEN, error: false };\n    }\n    if (!forceRefresh && isVertesiaIssuedToken(suppliedToken)) {\n        AUTH_TOKEN_RAW = suppliedToken;\n        AUTH_TOKEN = decodeToken(AUTH_TOKEN_RAW);\n        if (!AUTH_TOKEN.exp) {\n            throw new Error('Invalid composable token');\n        }\n        return { rawToken: AUTH_TOKEN_RAW, token: AUTH_TOKEN, error: false };\n    }\n    //token is close to expire, refresh it\n    if (!devAuthToken && !useInternalAuth && getFirebaseAuth().currentUser) {\n        //we have a firebase user, get the token from there\n        AUTH_TOKEN_RAW = await fetchComposableTokenFromFirebaseToken(selectedAccount, selectedProject);\n    }\n    else if (!devAuthToken && (initToken || AUTH_TOKEN_RAW)) {\n        // we have a token already and no firebase user, refresh it\n        AUTH_TOKEN_RAW = await fetchComposableToken(() => Promise.resolve(initToken ?? AUTH_TOKEN_RAW), selectedAccount, selectedProject);\n    }\n    else if (devAuthToken) {\n        AUTH_TOKEN_RAW = devAuthToken;\n    }\n    if (!AUTH_TOKEN_RAW) {\n        Env.logger.error('Cannot acquire a composable token', {\n            vertesia: {\n                account_id: selectedAccount,\n                project_id: selectedProject,\n            },\n        });\n        throw new Error('Cannot acquire a composable token');\n    }\n    AUTH_TOKEN = decodeToken(AUTH_TOKEN_RAW);\n    if (!AUTH_TOKEN?.exp || !AUTH_TOKEN_RAW) {\n        console.error('Invalid composable token', AUTH_TOKEN);\n        Env.logger.error('Invalid composable token', {\n            vertesia: {\n                account_id: selectedAccount,\n                project_id: selectedProject,\n            },\n        });\n        throw new Error('Invalid composable token');\n    }\n    return { rawToken: AUTH_TOKEN_RAW, token: AUTH_TOKEN, error: false };\n}\nexport class UserNotFoundError extends Error {\n    email;\n    constructor(message, email) {\n        super(message);\n        this.name = 'UserNotFoundError';\n        this.email = email;\n    }\n}\nexport class STSError extends Error {\n    stsURL;\n    constructor(message, stsURL) {\n        super(message);\n        this.name = 'STSError';\n        this.stsURL = stsURL;\n    }\n}\n//# sourceMappingURL=composable.js.map","/**\n * This hook is used to generate and verify state for OAuth2 authorization requests.\n * @returns\n */\nimport { useCallback } from 'react';\nconst AUTH_STATE_KEY = 'auth_state';\nconst STATE_EXPIRY_KEY = 'auth_state_expiry';\nconst STATE_TTL = 5 * 60 * 1000; // 5 min\nexport function useAuthState() {\n    // Generate new state\n    const generateState = useCallback(() => {\n        const state = crypto.randomUUID();\n        const expiryTime = Date.now() + STATE_TTL;\n        // Store state and expiry\n        sessionStorage.setItem(AUTH_STATE_KEY, state);\n        sessionStorage.setItem(STATE_EXPIRY_KEY, expiryTime.toString());\n        return state;\n    }, []);\n    // Verify returned state\n    const verifyState = useCallback((returnedState) => {\n        if (!returnedState) {\n            return 'Missing state';\n        }\n        const savedState = sessionStorage.getItem(AUTH_STATE_KEY);\n        const expiryTime = parseInt(sessionStorage.getItem(STATE_EXPIRY_KEY) || '0', 10);\n        let reason;\n        // Verify state matches and hasn't expired\n        if (savedState !== returnedState) {\n            reason = `State mismatched (${savedState} !== ${returnedState})`;\n        }\n        else if (Date.now() > expiryTime) {\n            reason = 'State expired';\n        }\n        else {\n            reason = undefined; // No errors\n        }\n        return reason;\n    }, []);\n    // Clear state (useful for cleanup)\n    const clearState = useCallback(() => {\n        sessionStorage.removeItem(AUTH_STATE_KEY);\n        sessionStorage.removeItem(STATE_EXPIRY_KEY);\n    }, []);\n    return { generateState, verifyState, clearState };\n}\n//# sourceMappingURL=useAuthState.js.map","export function shouldUseFirebaseAuth(_hostname) {\n    return window.AUTH_MODE === 'firebase';\n}\nexport function shouldRedirectToCentralAuth(_hostname) {\n    return !shouldUseFirebaseAuth();\n}\n//# sourceMappingURL=domainRouting.js.map","import { VertesiaClient } from '@vertesia/client';\nimport { Env } from '@vertesia/ui/env';\nimport { jwtDecode } from 'jwt-decode';\nimport { createContext, useContext } from 'react';\nimport { getComposableToken } from './auth/composable';\nimport { shouldRedirectToCentralAuth } from './auth/domainRouting';\nimport { getFirebaseAuth } from './auth/firebase';\nimport { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY } from './constants';\nexport { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY };\nconst CENTRAL_AUTH_REDIRECT = 'https://internal-auth.vertesia.app/';\nclass UserSession {\n    isLoading = true;\n    client;\n    authError;\n    authToken;\n    setSession;\n    lastSelectedAccount;\n    lastSelectedProject;\n    onboardingComplete;\n    constructor(client, setSession) {\n        if (client) {\n            this.client = client;\n        }\n        else {\n            this.client = new VertesiaClient({\n                serverUrl: Env.endpoints.studio,\n                storeUrl: Env.endpoints.zeno,\n                tokenServerUrl: Env.endpoints.sts,\n            });\n        }\n        if (setSession) {\n            this.setSession = setSession;\n        }\n        this.logout = this.logout.bind(this);\n    }\n    get store() {\n        return this.client.store;\n    }\n    get user() {\n        //compatibility\n        return this.authToken;\n    }\n    get account() {\n        //compatibility\n        return this.authToken?.account;\n    }\n    get project() {\n        return this.authToken?.project;\n    }\n    get accounts() {\n        //compatibility\n        return this.authToken?.accounts;\n    }\n    get authCallback() {\n        return this.rawAuthToken.then((token) => `Bearer ${token}`);\n    }\n    get rawAuthToken() {\n        return getComposableToken().then((res) => {\n            const token = res?.rawToken;\n            if (!token) {\n                throw new Error('No token available');\n            }\n            this.authToken = jwtDecode(token);\n            return token;\n        });\n    }\n    /**\n     * Force a fresh Vertesia JWT from STS, bypassing the in-memory cache.\n     * Use this when the current token's claims (e.g. `apps`) are suspected\n     * stale — STS recomputes the `apps` claim from ACEs on every issuance.\n     */\n    async refreshAuthToken() {\n        const res = await getComposableToken(undefined, undefined, undefined, true);\n        const token = res?.rawToken;\n        if (!token) {\n            throw new Error('No token available');\n        }\n        this.authToken = jwtDecode(token);\n        this.setSession?.(this.clone());\n        return this.authToken;\n    }\n    signOut() {\n        //compatibility\n        this.logout();\n    }\n    getAccount() {\n        return this.authToken?.account;\n    }\n    async login(token, options = {}) {\n        this.authError = undefined;\n        this.isLoading = false;\n        this.client.withAuthCallback(() => this.authCallback);\n        this.authToken = jwtDecode(token);\n        console.log(`Logging in as ${this.authToken?.name} with account ${this.authToken?.account.name} (${this.authToken?.account.id}, and project ${this.authToken?.project?.name} (${this.authToken?.project?.id})`);\n        //store selected account in local storage\n        localStorage.setItem(LastSelectedAccountId_KEY, this.authToken.account.id);\n        localStorage.setItem(`${LastSelectedProjectId_KEY}-${this.authToken.account.id}`, this.authToken.project?.id ?? '');\n        // notify the host app of the login\n        Env.onLogin?.(this.authToken);\n        if (options.loadOnboardingStatus ?? true) {\n            await this.fetchOnboardingStatus();\n        }\n        return Promise.resolve();\n    }\n    isLoggedIn() {\n        return !!this.authToken;\n    }\n    logout() {\n        console.log('Logging out');\n        if (shouldRedirectToCentralAuth()) {\n            // Redirect to central auth for logout\n            // Central auth will handle Firebase logout\n            console.log('Using central auth logout');\n            this.authError = undefined;\n            this.isLoading = false;\n            this.authToken = undefined;\n            this.setSession = undefined;\n            this.client.withAuthCallback(undefined);\n            const logoutUrl = new URL(CENTRAL_AUTH_REDIRECT);\n            const currentUrl = new URL(window.location.href);\n            currentUrl.hash = '';\n            logoutUrl.pathname = '/logout';\n            logoutUrl.searchParams.set('redirect_uri', currentUrl.toString());\n            location.replace(logoutUrl.toString());\n        }\n        else {\n            // Use Firebase logout directly\n            console.log('Using Firebase logout');\n            const wasLoggedIn = !!this.authToken;\n            if (this.authToken) {\n                void getFirebaseAuth().signOut();\n            }\n            this.authError = undefined;\n            this.isLoading = false;\n            this.authToken = undefined;\n            this.setSession = undefined;\n            this.client.withAuthCallback(undefined);\n            // Navigate to root to avoid React rendering errors when\n            // unmounting deeply nested route components during logout.\n            // Only navigate if user was actually logged in to avoid\n            // infinite reload loop on fresh/incognito sessions.\n            if (wasLoggedIn) {\n                location.replace('/');\n            }\n        }\n    }\n    async switchAccount(targetAccountId) {\n        localStorage.setItem(LastSelectedAccountId_KEY, targetAccountId);\n        if (this) {\n            if (this.account && this.project) {\n                localStorage.setItem(`${LastSelectedProjectId_KEY}-${this.account.id}`, this.project.id);\n            }\n            else if (this.account) {\n                localStorage.removeItem(`${LastSelectedProjectId_KEY}-${this.account.id}`);\n            }\n        }\n        window.location.replace(`/?a=${targetAccountId}`);\n    }\n    async switchProject(targetProjectId) {\n        if (this.account) {\n            localStorage.setItem(`${LastSelectedProjectId_KEY}-${this.account.id}`, targetProjectId);\n        }\n        window.location.replace(`/?a=${this.account?.id}&p=${targetProjectId}`);\n    }\n    async fetchAccounts() {\n        return this.client.accounts\n            .list()\n            .then((accounts) => {\n            if (!this.authToken) {\n                throw new Error('No token available');\n            }\n            this.authToken.accounts = accounts;\n            this.setSession?.(this.clone());\n        })\n            .catch((err) => {\n            console.error('Failed to fetch accounts', err);\n            throw err;\n        });\n    }\n    async fetchProjects(accountId) {\n        return this.client.projects\n            .list([accountId])\n            .then((projects) => {\n            if (!this.authToken) {\n                throw new Error('No token available');\n            }\n            this.authToken = {\n                ...this.authToken,\n                accounts: this.authToken.accounts?.map((account) => {\n                    if (account.id === accountId) {\n                        return {\n                            ...account,\n                            projects: projects.filter((project) => project.account === accountId),\n                        };\n                    }\n                    return account;\n                }),\n            };\n            this.setSession?.(this.clone());\n        })\n            .catch((err) => {\n            console.error('Failed to fetch projects', err);\n            throw err;\n        });\n    }\n    async fetchOnboardingStatus() {\n        if (this.onboardingComplete) {\n            console.log('Onboarding already completed');\n            return false;\n        }\n        const previousStatus = this.onboardingComplete;\n        try {\n            const onboarding = await this.client.account.onboardingProgress();\n            this.onboardingComplete = Object.values(onboarding).every((value) => value === true);\n            if (previousStatus !== this.onboardingComplete) {\n                return true;\n            }\n            this.setSession?.(this.clone());\n        }\n        catch (error) {\n            console.error('Error fetching onboarding status:', error);\n            this.onboardingComplete = false;\n            this.setSession?.(this.clone());\n        }\n        return false;\n    }\n    clone() {\n        const session = new UserSession(this.client);\n        session.isLoading = this.isLoading;\n        session.authError = this.authError;\n        session.authToken = this.authToken;\n        session.setSession = this.setSession;\n        session.lastSelectedAccount = this.lastSelectedAccount;\n        session.switchAccount = this.switchAccount;\n        session.onboardingComplete = this.onboardingComplete;\n        return session;\n    }\n}\nconst UserSessionContext = createContext(undefined);\nexport function useUserSession() {\n    const session = useContext(UserSessionContext);\n    if (!session) {\n        throw new Error('useUserSession must be used within a UserSessionProvider');\n    }\n    return session;\n}\nexport { UserSession, UserSessionContext };\n//# sourceMappingURL=UserSession.js.map","import { i18nInstance, NAMESPACE } from '@vertesia/ui/i18n';\nimport { useEffect, useState } from 'react';\nimport { useUserSession } from '../UserSession';\nexport function useCurrentTenant() {\n    const { user } = useUserSession();\n    const [currentTenant, setCurrentTenant] = useState(null);\n    const [isLoading, setIsLoading] = useState(true);\n    const [error, setError] = useState(null);\n    useEffect(() => {\n        const loadCurrentTenant = async () => {\n            if (!user?.email) {\n                setCurrentTenant(null);\n                setIsLoading(false);\n                return;\n            }\n            try {\n                const response = await fetch('/api/resolve-tenant', {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    },\n                    body: JSON.stringify({\n                        tenantEmail: user.email,\n                    }),\n                });\n                if (response.ok) {\n                    const tenantData = await response.json();\n                    if (tenantData) {\n                        // Convert the resolved tenant data to our TenantConfig format\n                        setCurrentTenant({\n                            tenantKey: tenantData.name || 'unknown',\n                            name: tenantData.label || tenantData.name || 'Unknown',\n                            domain: tenantData.domain || [],\n                            firebaseTenantId: tenantData.firebaseTenantId,\n                            provider: tenantData.provider,\n                            logo: tenantData.logo,\n                        });\n                    }\n                    else {\n                        setCurrentTenant(null);\n                    }\n                }\n                else {\n                    setCurrentTenant(null);\n                }\n            }\n            catch (error) {\n                console.error('Error loading current tenant:', error);\n                setError(i18nInstance.getFixedT(null, NAMESPACE)('errors.failedToLoadTenantConfig'));\n                setCurrentTenant(null);\n            }\n            finally {\n                setIsLoading(false);\n            }\n        };\n        void loadCurrentTenant();\n    }, [user?.email]);\n    return {\n        currentTenant,\n        isLoading,\n        error,\n    };\n}\n//# sourceMappingURL=useCurrentTenant.js.map","import { jsx as _jsx } from \"react/jsx-runtime\";\nimport { Env } from '@vertesia/ui/env';\nimport { onAuthStateChanged } from 'firebase/auth';\nimport { useEffect, useRef, useState } from 'react';\nimport { getComposableToken, STSError, UserNotFoundError } from './auth/composable';\nimport { shouldRedirectToCentralAuth } from './auth/domainRouting';\nimport { getFirebaseAuth } from './auth/firebase';\nimport { useAuthState } from './auth/useAuthState';\nimport { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY, UserSession, UserSessionContext } from './UserSession';\nconst CENTRAL_AUTH_REDIRECT = 'https://internal-auth.vertesia.app/';\nexport function UserSessionProvider({ children, loadOnboardingStatus = true }) {\n    const hashParams = new URLSearchParams(location.hash.substring(1));\n    const token = hashParams.get('token');\n    const state = hashParams.get('state');\n    const [session, setSession] = useState(new UserSession());\n    const { generateState, verifyState, clearState } = useAuthState();\n    const hasInitiatedAuthRef = useRef(false);\n    const authFlowRef = useRef(undefined);\n    const redirectToCentralAuth = (projectId, accountId) => {\n        const url = new URL(`${CENTRAL_AUTH_REDIRECT}?sts=${Env.endpoints.sts ?? 'https://sts.vertesia.io'}`);\n        const currentUrl = new URL(window.location.href);\n        currentUrl.hash = '';\n        if (projectId)\n            currentUrl.searchParams.set('p', projectId);\n        if (accountId)\n            currentUrl.searchParams.set('a', accountId);\n        url.searchParams.set('redirect_uri', currentUrl.toString());\n        url.searchParams.set('state', generateState());\n        location.replace(url.toString());\n    };\n    authFlowRef.current = () => {\n        // Make this effect idempotent - only run auth flow once\n        if (hasInitiatedAuthRef.current) {\n            console.log('Auth: skipping duplicate auth flow initiation');\n            return;\n        }\n        hasInitiatedAuthRef.current = true;\n        console.log('Auth: starting auth flow');\n        Env.logger.info('Starting auth flow');\n        const currentUrl = new URL(window.location.href);\n        const selectedAccount = currentUrl.searchParams.get('a') ?? localStorage.getItem(LastSelectedAccountId_KEY) ?? undefined;\n        const selectedProject = currentUrl.searchParams.get('p') ??\n            localStorage.getItem(`${LastSelectedProjectId_KEY}-${selectedAccount}`) ??\n            undefined;\n        console.log('Auth: selected account', selectedAccount);\n        console.log('Auth: selected project', selectedProject);\n        Env.logger.info('Selected account and project', {\n            vertesia: {\n                account_id: selectedAccount,\n                project_id: selectedProject,\n            },\n        });\n        if (Env.isLocalDev && Env.devAuthToken) {\n            session.setSession = setSession;\n            getComposableToken(selectedAccount, selectedProject, Env.devAuthToken)\n                .then((res) => {\n                session.login(res.rawToken).then(() => setSession(session.clone()));\n            })\n                .catch((err) => {\n                console.error('Failed to initialize dev auth token', err);\n                Env.logger.error('Failed to initialize dev auth token', {\n                    vertesia: {\n                        account_id: selectedAccount,\n                        project_id: selectedProject,\n                        error: err,\n                    },\n                });\n                session.isLoading = false;\n                session.authError = err instanceof Error ? err : new Error(String(err));\n                setSession(session.clone());\n            });\n            return;\n        }\n        if (token && state) {\n            session.setSession = setSession;\n            const validationError = verifyState(state);\n            if (validationError) {\n                console.error(`Auth: invalid state: ${validationError}`);\n                Env.logger.error(`Invalid state: ${validationError}`, {\n                    vertesia: {\n                        state: state,\n                    },\n                });\n                redirectToCentralAuth();\n            }\n            else {\n                clearState();\n            }\n            getComposableToken(selectedAccount, selectedProject, token, false, shouldRedirectToCentralAuth())\n                .then((res) => {\n                session.login(res.rawToken, { loadOnboardingStatus }).then(() => {\n                    setSession(session.clone());\n                    //cleanup the hash\n                    window.location.hash = '';\n                });\n            })\n                .catch((err) => {\n                // Don't redirect to central auth for UserNotFoundError - let signup flow handle it\n                if (err instanceof UserNotFoundError) {\n                    console.log('User not found - will trigger signup flow', err);\n                    session.isLoading = false;\n                    session.authError = err;\n                    setSession(session.clone());\n                    return;\n                }\n                if (err instanceof STSError) {\n                    console.error('STS error during token exchange', err);\n                    Env.logger.error('STS error during token exchange', {\n                        vertesia: {\n                            account_id: selectedAccount,\n                            project_id: selectedProject,\n                            sts_url: err.stsURL,\n                            error: err,\n                        },\n                    });\n                    window.alert('Authentication failed due to an issue with the authentication service. Please try again later.');\n                    session.logout();\n                    setSession(session.clone());\n                    window.location.hash = '';\n                    return;\n                }\n                console.error('Failed to fetch user token from studio, redirecting to central auth', err);\n                Env.logger.error('Failed to fetch user token from studio, redirecting to central auth', {\n                    vertesia: {\n                        error: err,\n                    },\n                });\n                redirectToCentralAuth();\n            });\n            return;\n        }\n        let cancelled = false;\n        let unsubscribe;\n        const startFirebaseOrCentralAuth = () => {\n            if (cancelled)\n                return;\n            // If the current host is not in the Firebase allowlist, central auth owns sign-in.\n            if (!session.isLoggedIn()) {\n                console.log('Auth: not logged in & no token/state');\n                Env.logger.info('Not logged in & no token/state', {\n                    vertesia: {\n                        account_id: selectedAccount,\n                        project_id: selectedProject,\n                    },\n                });\n                if (shouldRedirectToCentralAuth()) {\n                    console.log('Auth: host is not in Firebase auth allowlist, redirecting to central auth with selection', selectedAccount, selectedProject);\n                    Env.logger.info('Redirecting to central auth with selection', {\n                        vertesia: {\n                            account_id: selectedAccount,\n                            project_id: selectedProject,\n                        },\n                    });\n                    redirectToCentralAuth();\n                    return; // Don't register onAuthStateChanged listener when redirecting\n                }\n                console.log('Auth: host is in Firebase auth allowlist');\n                Env.logger.info('Host is in Firebase auth allowlist', {\n                    vertesia: {\n                        account_id: selectedAccount,\n                        project_id: selectedProject,\n                    },\n                });\n            }\n            unsubscribe = onAuthStateChanged(getFirebaseAuth(), async (firebaseUser) => {\n                if (firebaseUser) {\n                    console.log('Auth: successful login with firebase');\n                    Env.logger.info('Successful login with firebase', {\n                        vertesia: {\n                            account_id: selectedAccount,\n                            project_id: selectedProject,\n                        },\n                    });\n                    session.setSession = setSession;\n                    await getComposableToken(selectedAccount, selectedProject, undefined, false, shouldRedirectToCentralAuth())\n                        .then((res) => {\n                        session\n                            .login(res.rawToken, { loadOnboardingStatus })\n                            .then(() => setSession(session.clone()));\n                    })\n                        .catch((err) => {\n                        console.error('Failed to fetch user token from studio', err);\n                        Env.logger.error('Failed to fetch user token from studio', {\n                            vertesia: {\n                                account_id: selectedAccount,\n                                project_id: selectedProject,\n                                error: err,\n                            },\n                        });\n                        if (!(err instanceof UserNotFoundError))\n                            session.logout();\n                        session.isLoading = false;\n                        session.authError = err;\n                        setSession(session.clone());\n                    });\n                }\n                else {\n                    // anonymous user\n                    console.log('Auth: using anonymous user');\n                    Env.logger.info('Using anonymous user', {\n                        vertesia: {\n                            account_id: selectedAccount,\n                            project_id: selectedProject,\n                        },\n                    });\n                    session.client.withAuthCallback(undefined);\n                    session.logout();\n                    setSession(session.clone());\n                }\n            });\n        };\n        if (Env.authTokenProvider) {\n            session.setSession = setSession;\n            void Env.authTokenProvider()\n                .then(async (injectedToken) => {\n                if (!injectedToken) {\n                    startFirebaseOrCentralAuth();\n                    return;\n                }\n                const res = await getComposableToken(selectedAccount, selectedProject, injectedToken, false, shouldRedirectToCentralAuth());\n                await session.login(res.rawToken, { loadOnboardingStatus });\n                if (!cancelled)\n                    setSession(session.clone());\n            })\n                .catch((err) => {\n                console.warn('Auth: failed to initialize injected auth token', err);\n                Env.logger.warn('Failed to initialize injected auth token', {\n                    vertesia: {\n                        account_id: selectedAccount,\n                        project_id: selectedProject,\n                        error: err,\n                    },\n                });\n                startFirebaseOrCentralAuth();\n            });\n            return () => {\n                cancelled = true;\n                unsubscribe?.();\n            };\n        }\n        startFirebaseOrCentralAuth();\n        return () => {\n            cancelled = true;\n            unsubscribe?.();\n        };\n    };\n    useEffect(() => {\n        return authFlowRef.current?.();\n    }, []);\n    return _jsx(UserSessionContext.Provider, { value: session, children: children });\n}\n//# sourceMappingURL=UserSessionProvider.js.map","import { Env } from '@vertesia/ui/env';\nimport { logEvent } from 'firebase/analytics';\nimport { getFirebaseAnalytics } from './auth/firebase';\nexport function useUXTracking() {\n    //identify user in monitoring and UX systems\n    const tagUserSession = async (user) => {\n        const signupData = window.localStorage.getItem('composableSignupData');\n        if (!user) {\n            console.error('No user found -- skipping tagging');\n            return;\n        }\n        if (signupData) {\n            window.localStorage.removeItem('composableSignupData');\n        }\n    };\n    //send event to analytics and UX systems\n    const trackEvent = (eventName, eventProperties) => {\n        if (!Env.isProd) {\n            console.debug('track event', eventName, eventProperties);\n        }\n        //GA via firebase\n        logEvent(getFirebaseAnalytics(), eventName, { ...eventProperties, debug_mode: !Env.isProd });\n    };\n    return {\n        tagUserSession,\n        trackEvent,\n    };\n}\n//# sourceMappingURL=useUXTracking.js.map"],"names":["LastSelectedAccountId_KEY","LastSelectedProjectId_KEY","AUTH_TOKEN_RAW","AUTH_TOKEN","_firebaseApp","_analytics","_firebaseAuth","getFirebaseApp","Env","firebase","Error","initializeApp","error","console","cause","getFirebaseAnalytics","getAnalytics","getFirebaseAuth","getAuth","async","setFirebaseTenant","tenantEmail","log","retries","retryDelay","response","fetch","method","headers","body","JSON","stringify","signal","AbortSignal","timeout","ok","errorData","json","status","warn","data","firebaseTenantId","auth","tenantId","providerType","provider","fetchError","Promise","resolve","setTimeout","message","getFirebaseAuthToken","refresh","user","currentUser","getIdToken","then","token","logger","info","vertesia","user_email","email","user_name","displayName","user_id","uid","catch","err","normalizeIssuer","value","replace","decodeToken","jwtDecode","fetchComposableToken","accountId","projectId","ttl","retryCount","account_id","project_id","retry_count","idToken","stsEndpoint","endpoints","sts","sts_url","stsUrl","URL","requestBody","type","expires_at","Math","floor","Date","now","undefined","stsRes","Authorization","STSError","ensureResponse","studio","idTokenDecoded","UserNotFoundError","localStorage","removeItem","errorText","text","fetchComposableTokenFromFirebaseToken","fetchComposableTokenFromVertesiaToken","vertesiaToken","getCurrentVertesiaToken","getComposableToken","initToken","forceRefresh","useInternalAuth","selectedAccount","getItem","selectedProject","devAuthToken","isLocalDev","suppliedToken","exp","rawToken","iss","isVertesiaIssuedToken","constructor","super","this","name","stsURL","AUTH_STATE_KEY","STATE_EXPIRY_KEY","useAuthState","generateState","useCallback","state","crypto","randomUUID","expiryTime","sessionStorage","setItem","toString","verifyState","returnedState","savedState","parseInt","reason","clearState","shouldRedirectToCentralAuth","_hostname","window","AUTH_MODE","UserSession","isLoading","client","authError","authToken","setSession","lastSelectedAccount","lastSelectedProject","onboardingComplete","VertesiaClient","serverUrl","storeUrl","zeno","tokenServerUrl","logout","bind","store","account","project","accounts","authCallback","rawAuthToken","res","refreshAuthToken","clone","signOut","getAccount","login","options","withAuthCallback","id","onLogin","loadOnboardingStatus","fetchOnboardingStatus","isLoggedIn","logoutUrl","currentUrl","location","href","hash","pathname","searchParams","set","wasLoggedIn","switchAccount","targetAccountId","switchProject","targetProjectId","fetchAccounts","list","fetchProjects","projects","map","filter","previousStatus","onboarding","onboardingProgress","Object","values","every","session","UserSessionContext","createContext","useUserSession","useContext","useCurrentTenant","currentTenant","setCurrentTenant","useState","setIsLoading","setError","useEffect","tenantData","tenantKey","label","domain","logo","i18nInstance","getFixedT","NAMESPACE","loadCurrentTenant","UserSessionProvider","children","hashParams","URLSearchParams","substring","get","hasInitiatedAuthRef","useRef","authFlowRef","redirectToCentralAuth","url","current","String","validationError","alert","unsubscribe","cancelled","startFirebaseOrCentralAuth","onAuthStateChanged","firebaseUser","authTokenProvider","injectedToken","_jsx","Provider","useUXTracking","tagUserSession","signupData","trackEvent","eventName","eventProperties","isProd","debug","logEvent","debug_mode"],"mappings":"qgBAAY,MAACA,EAA4B,qCAC5BC,EAA4B,qCCIzC,ICDIC,EACAC,EDAAC,EAAe,KACfC,EAAa,KACbC,EAAgB,KAEb,SAASC,IACZ,IAAKH,EACD,IACI,IAAKI,EAAIC,SACL,MAAM,IAAIC,MAAM,8DAEpBN,EAAeO,EAAcH,EAAIC,SACrC,CACA,MAAOG,GAEH,MADAC,QAAQD,MAAM,qCAAsCA,GAC9C,IAAIF,MAAM,+EAAgF,CAC5FI,MAAOF,GAEf,CAEJ,OAAOR,CACX,CACO,SAASW,IAIZ,OAHKV,IACDA,EAAaW,EAAaT,MAEvBF,CACX,CACO,SAASY,IAIZ,OAHKX,IACDA,EAAgBY,EAAQX,MAErBD,CACX,CACOa,eAAeC,EAAkBC,GACpC,GAAKA,EAIL,GAAKb,EAAIC,SAIT,IACQY,GACAR,QAAQS,IAAI,mCAAmCD,KAEnD,IAAIE,EAAU,EACVC,EAAa,IACjB,KAAOD,EAAU,GACb,IAEI,MAAME,QAAiBC,MAAM,sBAAuB,CAChDC,OAAQ,OACRC,QAAS,CACL,eAAgB,oBAEpBC,KAAMC,KAAKC,UAAU,CACjBV,YAAaA,IAGjBW,OAAQC,YAAYC,QAAQ,OAGhC,IAAKT,EACD,MAAM,IAAIf,MAAM,wCAGpB,IAAKe,EAASU,GAAI,CAEd,IACI,MAAMC,QAAkBX,EAASY,OACjCxB,QAAQD,MAAM,+BAAgCwB,EAAUxB,MAC5D,CACA,MACIC,QAAQD,MAAM,qCAAqCa,EAASa,SAChE,CAEA,GAAwB,MAApBb,EAASa,OAET,YADAzB,QAAQ0B,KAAK,wBAAwBlB,KAGzC,MAAM,IAAIX,MAAM,cAAce,EAASa,SAC3C,CAEA,MAAME,QAAcf,EAASY,OAC7B,GAAIG,GAAMC,iBAAkB,CACxB,MAAMC,EAAOzB,IAIb,OAHAyB,EAAKC,SAAWH,EAAKC,iBACrBjC,EAAIC,SAASmC,aAAeJ,EAAKK,UAAY,OAC7ChC,QAAQS,IAAI,oBAAoBoB,EAAKC,YAC9BH,CACX,CAGI,YADA3B,QAAQD,MAAM,iDAAiDS,IAGvE,CACA,MAAOyB,GAEH,KAAIvB,EAAU,GAOV,MAAMuB,EANNjC,QAAQ0B,KAAK,yCAAyCf,SAAmBsB,SACnE,IAAIC,QAASC,GAAYC,WAAWD,EAASxB,IACnDA,GAAc,EACdD,GAKR,CAER,CACA,MAAOX,GAEHC,QAAQD,MAAM,iCAAkCA,aAAiBF,MAAQE,EAAMsC,QAAU,gBAG7F,MA7EIrC,QAAQS,IAAI,mEAJZT,QAAQS,IAAI,2DAkFpB,CACOH,eAAegC,EAAqBC,GACvC,MACMC,EADOpC,IACKqC,YAClB,OAAID,EACOA,EACFE,WAAWH,GACXI,KAAMC,IACPjD,EAAIkD,OAAOC,KAAK,qBAAsB,CAClCC,SAAU,CACNC,WAAYR,EAAKS,MACjBC,UAAWV,EAAKW,YAChBC,QAASZ,EAAKa,IACdd,QAASA,KAGVK,IAENU,MAAOC,IACR5D,EAAIkD,OAAO9C,MAAM,+BAAgC,CAC7CgD,SAAU,CACNC,WAAYR,EAAKS,MACjBC,UAAWV,EAAKW,YAChBC,QAASZ,EAAKa,IACdd,QAASA,EACTxC,MAAOwD,KAGfvD,QAAQD,MAAM,6BAA8BwD,GACrC,QAIX5D,EAAIkD,OAAOnB,KAAK,iBACTQ,QAAQC,QAAQ,MAE/B,CCxJA,SAASqB,EAAgBC,GACrB,OAAOA,GAAOC,QAAQ,OAAQ,GAClC,CACA,SAASC,EAAYf,GACjB,OAAOgB,EAAUhB,EACrB,CAYOtC,eAAeuD,EAAqBnB,EAAYoB,EAAWC,EAAWC,EAAKC,EAAa,GAC3FjE,QAAQS,IAAI,mDAAmDqD,iBAAyBC,MACxFpE,EAAIkD,OAAOC,KAAK,sCAAuC,CACnDC,SAAU,CACNmB,WAAYJ,EACZK,WAAYJ,EACZK,YAAaH,KAGrB,MAAMI,QAAgB3B,IACtB,IAAK2B,EAED,MADArE,QAAQS,IAAI,yCACN,IAAIZ,MAAM,qBAGpB,MAAMyE,EAAc3E,EAAI4E,UAAUC,IAClCxE,QAAQS,IAAI,kCAAmC6D,GAC/C3E,EAAIkD,OAAOC,KAAK,iCAAkC,CAC9CC,SAAU,CACNmB,WAAYJ,EACZK,WAAYJ,EACZU,QAASH,KAGjB,IAEI,MAAMI,EAAS,IAAIC,IAAI,GAAGL,iBACpBM,EAAc,CAChBC,KAAM,OACNX,WAAYJ,EACZK,WAAYJ,EACZe,WAAYd,EAAMe,KAAKC,MAAMC,KAAKC,MAAQ,KAAQlB,OAAMmB,GAEtDC,QAAevE,MAAM6D,EAAQ,CAC/B5D,OAAQ,OACRC,QAAS,CACL,eAAgB,mBAChBsE,cAAe,UAAUhB,KAE7BrD,KAAMC,KAAKC,UAAU0D,KACtBtB,MAAOvD,IASN,MARAC,QAAQD,MAAM,8BAA+BA,GAC7CJ,EAAIkD,OAAO9C,MAAM,8BAA+B,CAC5CgD,SAAU,CACNmB,WAAYJ,EACZK,WAAYJ,EACZhE,MAAOA,KAGT,IAAIuF,EAAS,8BAA+BhB,KAEtD,GAAID,GAA8B,MAAnBe,GAAQ3D,OAAgB,CAEnCzB,QAAQS,IAAI,sDACZd,EAAIkD,OAAOC,KAAK,qDAAsD,CAClEC,SAAU,CACNmB,WAAYJ,EACZK,WAAYJ,EACZtC,OAAQ2D,GAAQ3D,UAGxB,MAAM8D,QAAuB1E,MAAM,GAAGlB,EAAI4E,UAAUiB,0BAA2B,CAC3E1E,OAAQ,OACRC,QAAS,CACLsE,cAAe,UAAUhB,IACzB,eAAgB,sBAGxB,GAA8B,MAA1BkB,EAAe9D,OAAgB,CAE/BzB,QAAQS,IAAI,0CACZd,EAAIkD,OAAOC,KAAK,yCAA0C,CACtDC,SAAU,CACNmB,WAAYJ,EACZK,WAAYJ,KAGpB,MAAM0B,EAAiB7B,EAAUS,GACjC,IAAKoB,GAAgBxC,MAEjB,MADAtD,EAAIkD,OAAO9C,MAAM,8BACX,IAAIF,MAAM,8BAEpB,MAAM,IAAI6F,EAAkB,mCAAoCD,EAAexC,MACnF,CACA,GAA8B,MAA1BsC,EAAe9D,OAQf,MANA9B,EAAIkD,OAAOnB,KAAK,uDAAwD,CACpEqB,SAAU,CACNmB,WAAYJ,EACZK,WAAYJ,KAGd,IAAIlE,MAAM,mDAEpB,IAAK0F,EAAejE,GAShB,MARAtB,QAAQD,MAAM,+BAAgCwF,EAAe9D,QAC7D9B,EAAIkD,OAAO9C,MAAM,+BAAgC,CAC7CgD,SAAU,CACNmB,WAAYJ,EACZK,WAAYJ,EACZtC,OAAQ8D,EAAe9D,UAGzB,IAAI5B,MAAM,gCAUpB,OAPAG,QAAQS,IAAI,4CACZd,EAAIkD,OAAOC,KAAK,2CAA4C,CACxDC,SAAU,CACNmB,WAAYJ,EACZK,WAAYJ,KAGbF,EAAqBnB,EAAYoB,EAAWC,EAAWC,EAAKC,EACvE,CACA,GAAII,GAA8B,MAAnBe,GAAQ3D,OAAgB,CACnCzB,QAAQS,IAAI,+DAAgE2E,GAAQ3D,QACpF9B,EAAIkD,OAAO9C,MAAM,+DAAgE,CAC7EgD,SAAU,CACNmB,WAAYJ,EACZK,WAAYJ,EACZtC,OAAQ2D,GAAQ3D,UAGxB,MAAMgE,EAAiB7B,EAAUS,GACjC,IAAKoB,GAAgBxC,MAEjB,MADAtD,EAAIkD,OAAO9C,MAAM,8BACX,IAAIF,MAAM,8BASpB,MAPAF,EAAIkD,OAAO9C,MAAM,iBAAkB,CAC/BgD,SAAU,CACNmB,WAAYJ,EACZK,WAAYJ,EACZd,MAAOwC,EAAexC,SAGxB,IAAIyC,EAAkB,iBAAkBD,EAAexC,MACjE,CACA,GAAsB,MAAlBmC,EAAO3D,OAAgB,CAMvB,GAAIwC,EAAa,EAWb,MATAjE,QAAQD,MAAM,6EACdJ,EAAIkD,OAAO9C,MAAM,yDAA0D,CACvEgD,SAAU,CACNmB,WAAYJ,EACZK,WAAYJ,EACZtC,OAAQ2D,EAAO3D,OACf2C,YAAaH,KAGf,IAAIpE,MAAM,4DAiBpB,OAfAG,QAAQS,IAAI,mFACZd,EAAIkD,OAAOnB,KAAK,4DAA6D,CACzEqB,SAAU,CACNmB,WAAYJ,EACZK,WAAYJ,EACZtC,OAAQ2D,EAAO3D,OACf2C,YAAaH,KAIrB0B,aAAaC,WAAWzG,GACpB2E,GACA6B,aAAaC,WAAW,GAAGxG,KAA6B0E,KAGrDD,EAAqBnB,OAAYyC,OAAWA,EAAWnB,EAAKC,EAAa,EACpF,CACA,IAAKmB,EAAO9D,GAAI,CACZ,MAAMuE,QAAkBT,EAAOU,OAU/B,MATA9F,QAAQD,MAAM,+BAAgCqF,EAAO3D,OAAQoE,GAC7DlG,EAAIkD,OAAO9C,MAAM,8BAA+B,CAC5CgD,SAAU,CACNtB,OAAQ2D,EAAO3D,OACf1B,MAAO8F,EACP3B,WAAYJ,EACZK,WAAYJ,KAGd,IAAIlE,MAAM,iCAAiCuF,EAAO3D,SAC5D,CACA,MAAMmB,MAAEA,SAAgBwC,EAAO5D,OAG/B,OAFAxB,QAAQS,IAAI,mCACZd,EAAIkD,OAAOC,KAAK,mCACTF,CACX,CACA,MAAO7C,GACH,GAAIA,aAAiB2F,GAAqB3F,aAAiBuF,EACvD,MAAMvF,EAeV,MAZA4F,aAAaC,WAAWzG,GACpB2E,GACA6B,aAAaC,WAAW,GAAGxG,KAA6B0E,KAE5D9D,QAAQD,MAAM,0CAA2CA,GACzDJ,EAAIkD,OAAO9C,MAAM,0CAA2C,CACxDgD,SAAU,CACNmB,WAAYJ,EACZK,WAAYJ,EACZhE,MAAOA,KAGT,IAAIF,MAAM,iCAAkC,CAAEI,MAAOF,GAC/D,CACJ,CAQOO,eAAeyF,EAAsCjC,EAAWC,EAAWC,GAC9E,OAAOH,EAAqBvB,EAAsBwB,EAAWC,EAAWC,EAC5E,CAMO1D,eAAe0F,EAAsCC,EAAenC,EAAWC,EAAWC,GAC7F,OAAOH,EAAqB,IAAM3B,QAAQC,QAAQ8D,GAAgBnC,EAAWC,EAAWC,EAC5F,CAEO,SAASkC,IACZ,OAAO7G,CACX,CACOiB,eAAe6F,EAAmBrC,EAAWC,EAAWqC,EAAWC,GAAe,EAAOC,GAAkB,GAC9G,MAAMC,EAAkBzC,GAAa6B,aAAaa,QAAQrH,SAA8BgG,EAClFsB,EAAkB1C,GAAa4B,aAAaa,QAAQ,GAAGpH,KAA6BmH,WAAsBpB,EAC1GuB,EAAe/G,EAAIgH,WAAahH,EAAI+G,kBAAevB,EACnDyB,EAAgBF,GAAgBN,GAAa/G,EAEnD,IAAKgH,GAAgBhH,GAAkBC,GAAcA,EAAWuH,IAAM5B,KAAKC,MAAQ,IAAO,IACtF,MAAO,CAAE4B,SAAUzH,EAAgBuD,MAAOtD,EAAYS,OAAO,GAEjE,IAAKsG,GA9PT,SAA+BzD,GAC3B,IAAKA,EACD,OAAO,EACX,IAEI,OAAOY,EADSG,EAAYf,GACGmE,OAASvD,EAAgB7D,EAAI4E,UAAUC,IAC1E,CACA,MACI,OAAO,CACX,CACJ,CAoPyBwC,CAAsBJ,GAAgB,CAGvD,GAFAvH,EAAiBuH,EACjBtH,EAAaqE,EAAYtE,IACpBC,EAAWuH,IACZ,MAAM,IAAIhH,MAAM,4BAEpB,MAAO,CAAEiH,SAAUzH,EAAgBuD,MAAOtD,EAAYS,OAAO,EACjE,CAaA,GAXK2G,GAAiBJ,IAAmBlG,IAAkBqC,YAIjDiE,IAAiBN,IAAa/G,EAI/BqH,IACLrH,EAAiBqH,GAHjBrH,QAAuBwE,EAAqB,IAAM3B,QAAQC,QAAQiE,GAAa/G,GAAiBkH,EAAiBE,GAJjHpH,QAAuB0G,EAAsCQ,EAAiBE,IAS7EpH,EAOD,MANAM,EAAIkD,OAAO9C,MAAM,oCAAqC,CAClDgD,SAAU,CACNmB,WAAYqC,EACZpC,WAAYsC,KAGd,IAAI5G,MAAM,qCAGpB,GADAP,EAAaqE,EAAYtE,IACpBC,GAAYuH,MAAQxH,EAQrB,MAPAW,QAAQD,MAAM,2BAA4BT,GAC1CK,EAAIkD,OAAO9C,MAAM,2BAA4B,CACzCgD,SAAU,CACNmB,WAAYqC,EACZpC,WAAYsC,KAGd,IAAI5G,MAAM,4BAEpB,MAAO,CAAEiH,SAAUzH,EAAgBuD,MAAOtD,EAAYS,OAAO,EACjE,CACO,MAAM2F,UAA0B7F,MACnCoD,MACA,WAAAgE,CAAY5E,EAASY,GACjBiE,MAAM7E,GACN8E,KAAKC,KAAO,oBACZD,KAAKlE,MAAQA,CACjB,EAEG,MAAMqC,UAAiBzF,MAC1BwH,OACA,WAAAJ,CAAY5E,EAASgF,GACjBH,MAAM7E,GACN8E,KAAKC,KAAO,WACZD,KAAKE,OAASA,CAClB,EC7TJ,MAAMC,EAAiB,aACjBC,EAAmB,oBAElB,SAASC,IAmCZ,MAAO,CAAEC,cAjCaC,EAAY,KAC9B,MAAMC,EAAQC,OAAOC,aACfC,EAAa7C,KAAKC,MALd,IASV,OAFA6C,eAAeC,QAAQV,EAAgBK,GACvCI,eAAeC,QAAQT,EAAkBO,EAAWG,YAC7CN,GACR,IA0BqBO,YAxBJR,EAAaS,IAC7B,IAAKA,EACD,MAAO,gBAEX,MAAMC,EAAaL,eAAevB,QAAQc,GACpCQ,EAAaO,SAASN,eAAevB,QAAQe,IAAqB,IAAK,IAC7E,IAAIe,EAWJ,OARIA,EADAF,IAAeD,EACN,qBAAqBC,SAAkBD,KAE3ClD,KAAKC,MAAQ4C,EACT,qBAGA3C,EAENmD,GACR,IAMkCC,WAJlBb,EAAY,KAC3BK,eAAenC,WAAW0B,GAC1BS,eAAenC,WAAW2B,IAC3B,IAEP,CCzCO,SAASiB,EAA4BC,GACxC,QAH4B,aAArBC,OAAOC,UAIlB,CCKA,MAAMC,EACFC,WAAY,EACZC,OACAC,UACAC,UACAC,WACAC,oBACAC,oBACAC,mBACA,WAAAnC,CAAY6B,EAAQG,GAEZ9B,KAAK2B,OADLA,GAIc,IAAIO,EAAe,CAC7BC,UAAW3J,EAAI4E,UAAUiB,OACzB+D,SAAU5J,EAAI4E,UAAUiF,KACxBC,eAAgB9J,EAAI4E,UAAUC,MAGlCyE,IACA9B,KAAK8B,WAAaA,GAEtB9B,KAAKuC,OAASvC,KAAKuC,OAAOC,KAAKxC,KACnC,CACA,SAAIyC,GACA,OAAOzC,KAAK2B,OAAOc,KACvB,CACA,QAAIpH,GAEA,OAAO2E,KAAK6B,SAChB,CACA,WAAIa,GAEA,OAAO1C,KAAK6B,WAAWa,OAC3B,CACA,WAAIC,GACA,OAAO3C,KAAK6B,WAAWc,OAC3B,CACA,YAAIC,GAEA,OAAO5C,KAAK6B,WAAWe,QAC3B,CACA,gBAAIC,GACA,OAAO7C,KAAK8C,aAAatH,KAAMC,GAAU,UAAUA,IACvD,CACA,gBAAIqH,GACA,OAAO9D,IAAqBxD,KAAMuH,IAC9B,MAAMtH,EAAQsH,GAAKpD,SACnB,IAAKlE,EACD,MAAM,IAAI/C,MAAM,sBAGpB,OADAsH,KAAK6B,UAAYpF,EAAUhB,GACpBA,GAEf,CAMA,sBAAMuH,GACF,MAAMD,QAAY/D,OAAmBhB,OAAWA,OAAWA,GAAW,GAChEvC,EAAQsH,GAAKpD,SACnB,IAAKlE,EACD,MAAM,IAAI/C,MAAM,sBAIpB,OAFAsH,KAAK6B,UAAYpF,EAAUhB,GAC3BuE,KAAK8B,aAAa9B,KAAKiD,SAChBjD,KAAK6B,SAChB,CACA,OAAAqB,GAEIlD,KAAKuC,QACT,CACA,UAAAY,GACI,OAAOnD,KAAK6B,WAAWa,OAC3B,CACA,WAAMU,CAAM3H,EAAO4H,EAAU,IAczB,OAbArD,KAAK4B,eAAY5D,EACjBgC,KAAK0B,WAAY,EACjB1B,KAAK2B,OAAO2B,iBAAiB,IAAMtD,KAAK6C,cACxC7C,KAAK6B,UAAYpF,EAAUhB,GAC3B5C,QAAQS,IAAI,iBAAiB0G,KAAK6B,WAAW5B,qBAAqBD,KAAK6B,WAAWa,QAAQzC,SAASD,KAAK6B,WAAWa,QAAQa,mBAAmBvD,KAAK6B,WAAWc,SAAS1C,SAASD,KAAK6B,WAAWc,SAASY,OAEzM/E,aAAaqC,QAAQ7I,EAA2BgI,KAAK6B,UAAUa,QAAQa,IACvE/E,aAAaqC,QAAQ,GAAG5I,KAA6B+H,KAAK6B,UAAUa,QAAQa,KAAMvD,KAAK6B,UAAUc,SAASY,IAAM,IAEhH/K,EAAIgL,UAAUxD,KAAK6B,YACfwB,EAAQI,sBAAwB,UAC1BzD,KAAK0D,wBAER3I,QAAQC,SACnB,CACA,UAAA2I,GACI,QAAS3D,KAAK6B,SAClB,CACA,MAAAU,GAEI,GADA1J,QAAQS,IAAI,eACR+H,IAA+B,CAG/BxI,QAAQS,IAAI,6BACZ0G,KAAK4B,eAAY5D,EACjBgC,KAAK0B,WAAY,EACjB1B,KAAK6B,eAAY7D,EACjBgC,KAAK8B,gBAAa9D,EAClBgC,KAAK2B,OAAO2B,sBAAiBtF,GAC7B,MAAM4F,EAAY,IAAIpG,IA7GJ,uCA8GZqG,EAAa,IAAIrG,IAAI+D,OAAOuC,SAASC,MAC3CF,EAAWG,KAAO,GAClBJ,EAAUK,SAAW,UACrBL,EAAUM,aAAaC,IAAI,eAAgBN,EAAW/C,YACtDgD,SAASvH,QAAQqH,EAAU9C,WAC/B,KACK,CAEDjI,QAAQS,IAAI,yBACZ,MAAM8K,IAAgBpE,KAAK6B,UACvB7B,KAAK6B,WACA5I,IAAkBiK,UAE3BlD,KAAK4B,eAAY5D,EACjBgC,KAAK0B,WAAY,EACjB1B,KAAK6B,eAAY7D,EACjBgC,KAAK8B,gBAAa9D,EAClBgC,KAAK2B,OAAO2B,sBAAiBtF,GAKzBoG,GACAN,SAASvH,QAAQ,IAEzB,CACJ,CACA,mBAAM8H,CAAcC,GAChB9F,aAAaqC,QAAQ7I,EAA2BsM,GAC5CtE,OACIA,KAAK0C,SAAW1C,KAAK2C,QACrBnE,aAAaqC,QAAQ,GAAG5I,KAA6B+H,KAAK0C,QAAQa,KAAMvD,KAAK2C,QAAQY,IAEhFvD,KAAK0C,SACVlE,aAAaC,WAAW,GAAGxG,KAA6B+H,KAAK0C,QAAQa,OAG7EhC,OAAOuC,SAASvH,QAAQ,OAAO+H,IACnC,CACA,mBAAMC,CAAcC,GACZxE,KAAK0C,SACLlE,aAAaqC,QAAQ,GAAG5I,KAA6B+H,KAAK0C,QAAQa,KAAMiB,GAE5EjD,OAAOuC,SAASvH,QAAQ,OAAOyD,KAAK0C,SAASa,QAAQiB,IACzD,CACA,mBAAMC,GACF,OAAOzE,KAAK2B,OAAOiB,SACd8B,OACAlJ,KAAMoH,IACP,IAAK5C,KAAK6B,UACN,MAAM,IAAInJ,MAAM,sBAEpBsH,KAAK6B,UAAUe,SAAWA,EAC1B5C,KAAK8B,aAAa9B,KAAKiD,WAEtB9G,MAAOC,IAER,MADAvD,QAAQD,MAAM,2BAA4BwD,GACpCA,GAEd,CACA,mBAAMuI,CAAchI,GAChB,OAAOqD,KAAK2B,OAAOiD,SACdF,KAAK,CAAC/H,IACNnB,KAAMoJ,IACP,IAAK5E,KAAK6B,UACN,MAAM,IAAInJ,MAAM,sBAEpBsH,KAAK6B,UAAY,IACV7B,KAAK6B,UACRe,SAAU5C,KAAK6B,UAAUe,UAAUiC,IAAKnC,GAChCA,EAAQa,KAAO5G,EACR,IACA+F,EACHkC,SAAUA,EAASE,OAAQnC,GAAYA,EAAQD,UAAY/F,IAG5D+F,IAGf1C,KAAK8B,aAAa9B,KAAKiD,WAEtB9G,MAAOC,IAER,MADAvD,QAAQD,MAAM,2BAA4BwD,GACpCA,GAEd,CACA,2BAAMsH,GACF,GAAI1D,KAAKiC,mBAEL,OADApJ,QAAQS,IAAI,iCACL,EAEX,MAAMyL,EAAiB/E,KAAKiC,mBAC5B,IACI,MAAM+C,QAAmBhF,KAAK2B,OAAOe,QAAQuC,qBAE7C,GADAjF,KAAKiC,mBAAqBiD,OAAOC,OAAOH,GAAYI,MAAO9I,IAAoB,IAAVA,GACjEyI,IAAmB/E,KAAKiC,mBACxB,OAAO,EAEXjC,KAAK8B,aAAa9B,KAAKiD,QAC3B,CACA,MAAOrK,GACHC,QAAQD,MAAM,oCAAqCA,GACnDoH,KAAKiC,oBAAqB,EAC1BjC,KAAK8B,aAAa9B,KAAKiD,QAC3B,CACA,OAAO,CACX,CACA,KAAAA,GACI,MAAMoC,EAAU,IAAI5D,EAAYzB,KAAK2B,QAQrC,OAPA0D,EAAQ3D,UAAY1B,KAAK0B,UACzB2D,EAAQzD,UAAY5B,KAAK4B,UACzByD,EAAQxD,UAAY7B,KAAK6B,UACzBwD,EAAQvD,WAAa9B,KAAK8B,WAC1BuD,EAAQtD,oBAAsB/B,KAAK+B,oBACnCsD,EAAQhB,cAAgBrE,KAAKqE,cAC7BgB,EAAQpD,mBAAqBjC,KAAKiC,mBAC3BoD,CACX,EAEC,MAACC,EAAqBC,OAAcvH,GAClC,SAASwH,IACZ,MAAMH,EAAUI,EAAWH,GAC3B,IAAKD,EACD,MAAM,IAAI3M,MAAM,4DAEpB,OAAO2M,CACX,CClPO,SAASK,IACZ,MAAMrK,KAAEA,GAASmK,KACVG,EAAeC,GAAoBC,EAAS,OAC5CnE,EAAWoE,GAAgBD,GAAS,IACpCjN,EAAOmN,GAAYF,EAAS,MAkDnC,OAjDAG,EAAU,KACoB7M,WACtB,IAAKkC,GAAMS,MAGP,OAFA8J,EAAiB,WACjBE,GAAa,GAGjB,IACI,MAAMrM,QAAiBC,MAAM,sBAAuB,CAChDC,OAAQ,OACRC,QAAS,CACL,eAAgB,oBAEpBC,KAAMC,KAAKC,UAAU,CACjBV,YAAagC,EAAKS,UAG1B,GAAIrC,EAASU,GAAI,CACb,MAAM8L,QAAmBxM,EAASY,OAG9BuL,EAFAK,EAEiB,CACbC,UAAWD,EAAWhG,MAAQ,UAC9BA,KAAMgG,EAAWE,OAASF,EAAWhG,MAAQ,UAC7CmG,OAAQH,EAAWG,QAAU,GAC7B3L,iBAAkBwL,EAAWxL,iBAC7BI,SAAUoL,EAAWpL,SACrBwL,KAAMJ,EAAWI,MAIJ,KAEzB,MAEIT,EAAiB,KAEzB,CACA,MAAOhN,GACHC,QAAQD,MAAM,gCAAiCA,GAC/CmN,EAASO,EAAaC,UAAU,KAAMC,EAA7BF,CAAwC,oCACjDV,EAAiB,KACrB,CACZ,QACgBE,GAAa,EACjB,GAECW,IACN,CAACpL,GAAMS,QACH,CACH6J,gBACAjE,YACA9I,QAER,CCpDO,SAAS8N,GAAoBC,SAAEA,EAAQlD,qBAAEA,GAAuB,IACnE,MAAMmD,EAAa,IAAIC,gBAAgB/C,SAASE,KAAK8C,UAAU,IACzDrL,EAAQmL,EAAWG,IAAI,SACvBvG,EAAQoG,EAAWG,IAAI,UACtB1B,EAASvD,GAAc+D,EAAS,IAAIpE,IACrCnB,cAAEA,EAAaS,YAAEA,EAAWK,WAAEA,GAAef,IAC7C2G,EAAsBC,GAAO,GAC7BC,EAAcD,OAAOjJ,GACrBmJ,EAAwB,CAACvK,EAAWD,KACtC,MAAMyK,EAAM,IAAI5J,IAAI,2CAAgChF,EAAI4E,UAAUC,KAAO,6BACnEwG,EAAa,IAAIrG,IAAI+D,OAAOuC,SAASC,MAC3CF,EAAWG,KAAO,GAKlBoD,EAAIlD,aAAaC,IAAI,eAAgBN,EAAW/C,YAChDsG,EAAIlD,aAAaC,IAAI,QAAS7D,KAC9BwD,SAASvH,QAAQ6K,EAAItG,aA6NzB,OA3NAoG,EAAYG,QAAU,KAElB,GAAIL,EAAoBK,QAEpB,YADAxO,QAAQS,IAAI,iDAGhB0N,EAAoBK,SAAU,EAC9BxO,QAAQS,IAAI,4BACZd,EAAIkD,OAAOC,KAAK,sBAChB,MAAMkI,EAAa,IAAIrG,IAAI+D,OAAOuC,SAASC,MACrC3E,EAAkByE,EAAWK,aAAa6C,IAAI,MAAQvI,aAAaa,QAAQrH,SAA8BgG,EACzGsB,EAAkBuE,EAAWK,aAAa6C,IAAI,MAChDvI,aAAaa,QAAQ,GAAGpH,KAA6BmH,WACrDpB,EASJ,GARAnF,QAAQS,IAAI,yBAA0B8F,GACtCvG,QAAQS,IAAI,yBAA0BgG,GACtC9G,EAAIkD,OAAOC,KAAK,+BAAgC,CAC5CC,SAAU,CACNmB,WAAYqC,EACZpC,WAAYsC,KAGhB9G,EAAIgH,YAAchH,EAAI+G,aAmBtB,OAlBA8F,EAAQvD,WAAaA,OACrB9C,EAAmBI,EAAiBE,EAAiB9G,EAAI+G,cACpD/D,KAAMuH,IACPsC,EAAQjC,MAAML,EAAIpD,UAAUnE,KAAK,IAAMsG,EAAWuD,EAAQpC,YAEzD9G,MAAOC,IACRvD,QAAQD,MAAM,sCAAuCwD,GACrD5D,EAAIkD,OAAO9C,MAAM,sCAAuC,CACpDgD,SAAU,CACNmB,WAAYqC,EACZpC,WAAYsC,EACZ1G,MAAOwD,KAGfiJ,EAAQ3D,WAAY,EACpB2D,EAAQzD,UAAYxF,aAAe1D,MAAQ0D,EAAM,IAAI1D,MAAM4O,OAAOlL,IAClE0F,EAAWuD,EAAQpC,WAI3B,GAAIxH,GAAS+E,EAAO,CAChB6E,EAAQvD,WAAaA,EACrB,MAAMyF,EAAkBxG,EAAYP,GAsDpC,OArDI+G,GACA1O,QAAQD,MAAM,wBAAwB2O,KACtC/O,EAAIkD,OAAO9C,MAAM,kBAAkB2O,IAAmB,CAClD3L,SAAU,CACN4E,MAAOA,KAGf2G,KAGA/F,SAEJpC,EAAmBI,EAAiBE,EAAiB7D,GAAO,EAAO4F,KAC9D7F,KAAMuH,IACPsC,EAAQjC,MAAML,EAAIpD,SAAU,CAAE8D,yBAAwBjI,KAAK,KACvDsG,EAAWuD,EAAQpC,SAEnB1B,OAAOuC,SAASE,KAAO,OAG1B7H,MAAOC,GAEJA,aAAemC,GACf1F,QAAQS,IAAI,4CAA6C8C,GACzDiJ,EAAQ3D,WAAY,EACpB2D,EAAQzD,UAAYxF,OACpB0F,EAAWuD,EAAQpC,UAGnB7G,aAAe+B,GACftF,QAAQD,MAAM,kCAAmCwD,GACjD5D,EAAIkD,OAAO9C,MAAM,kCAAmC,CAChDgD,SAAU,CACNmB,WAAYqC,EACZpC,WAAYsC,EACZhC,QAASlB,EAAI8D,OACbtH,MAAOwD,KAGfmF,OAAOiG,MAAM,kGACbnC,EAAQ9C,SACRT,EAAWuD,EAAQpC,cACnB1B,OAAOuC,SAASE,KAAO,MAG3BnL,QAAQD,MAAM,sEAAuEwD,GACrF5D,EAAIkD,OAAO9C,MAAM,sEAAuE,CACpFgD,SAAU,CACNhD,MAAOwD,UAGf+K,KAGR,CACA,IACIM,EADAC,GAAY,EAEhB,MAAMC,EAA6B,KAC/B,IAAID,EAAJ,CAGA,IAAKrC,EAAQ1B,aAAc,CAQvB,GAPA9K,QAAQS,IAAI,wCACZd,EAAIkD,OAAOC,KAAK,iCAAkC,CAC9CC,SAAU,CACNmB,WAAYqC,EACZpC,WAAYsC,KAGhB+B,IASA,OARAxI,QAAQS,IAAI,2FAA4F8F,EAAiBE,GACzH9G,EAAIkD,OAAOC,KAAK,6CAA8C,CAC1DC,SAAU,CACNmB,WAAYqC,EACZpC,WAAYsC,UAGpB6H,IAGJtO,QAAQS,IAAI,4CACZd,EAAIkD,OAAOC,KAAK,qCAAsC,CAClDC,SAAU,CACNmB,WAAYqC,EACZpC,WAAYsC,IAGxB,CACAmI,EAAcG,EAAmB3O,IAAmBE,MAAO0O,IACnDA,GACAhP,QAAQS,IAAI,wCACZd,EAAIkD,OAAOC,KAAK,iCAAkC,CAC9CC,SAAU,CACNmB,WAAYqC,EACZpC,WAAYsC,KAGpB+F,EAAQvD,WAAaA,QACf9C,EAAmBI,EAAiBE,OAAiBtB,GAAW,EAAOqD,KACxE7F,KAAMuH,IACPsC,EACKjC,MAAML,EAAIpD,SAAU,CAAE8D,yBACtBjI,KAAK,IAAMsG,EAAWuD,EAAQpC,YAElC9G,MAAOC,IACRvD,QAAQD,MAAM,yCAA0CwD,GACxD5D,EAAIkD,OAAO9C,MAAM,yCAA0C,CACvDgD,SAAU,CACNmB,WAAYqC,EACZpC,WAAYsC,EACZ1G,MAAOwD,KAGTA,aAAemC,GACjB8G,EAAQ9C,SACZ8C,EAAQ3D,WAAY,EACpB2D,EAAQzD,UAAYxF,EACpB0F,EAAWuD,EAAQpC,aAKvBpK,QAAQS,IAAI,8BACZd,EAAIkD,OAAOC,KAAK,uBAAwB,CACpCC,SAAU,CACNmB,WAAYqC,EACZpC,WAAYsC,KAGpB+F,EAAQ1D,OAAO2B,sBAAiBtF,GAChCqH,EAAQ9C,SACRT,EAAWuD,EAAQpC,WAxEvB,GA4ER,OAAIzK,EAAIsP,mBACJzC,EAAQvD,WAAaA,EAChBtJ,EAAIsP,oBACJtM,KAAKrC,MAAO4O,IACb,IAAKA,EAED,YADAJ,IAGJ,MAAM5E,QAAY/D,EAAmBI,EAAiBE,EAAiByI,GAAe,EAAO1G,WACvFgE,EAAQjC,MAAML,EAAIpD,SAAU,CAAE8D,yBAC/BiE,GACD5F,EAAWuD,EAAQpC,WAEtB9G,MAAOC,IACRvD,QAAQ0B,KAAK,iDAAkD6B,GAC/D5D,EAAIkD,OAAOnB,KAAK,2CAA4C,CACxDqB,SAAU,CACNmB,WAAYqC,EACZpC,WAAYsC,EACZ1G,MAAOwD,KAGfuL,MAEG,KACHD,GAAY,EACZD,SAGRE,IACO,KACHD,GAAY,EACZD,SAGRzB,EAAU,IACCkB,EAAYG,YACpB,IACIW,EAAK1C,EAAmB2C,SAAU,CAAE3L,MAAO+I,EAASsB,SAAUA,GACzE,CCvPO,SAASuB,IAoBZ,MAAO,CACHC,eAnBmBhP,MAAOkC,IAC1B,MAAM+M,EAAa7G,OAAO/C,aAAaa,QAAQ,wBAC1ChE,EAID+M,GACA7G,OAAO/C,aAAaC,WAAW,wBAJ/B5F,QAAQD,MAAM,sCAiBlByP,WATe,CAACC,EAAWC,KACtB/P,EAAIgQ,QACL3P,QAAQ4P,MAAM,cAAeH,EAAWC,GAG5CG,EAAS3P,IAAwBuP,EAAW,IAAKC,EAAiBI,YAAanQ,EAAIgQ,UAM3F"}