@appforge-ci/core 0.1.1

package/dist/api-client.d.ts

@@ -0,0 +1,529 @@
+import type { AgentCommand, AgentInfo, ApiTokenInfo, App, BillingMode, BillingUsage, Build, BuildFailureExplanation, LedgerEntry, MonthlyInvoice, Org, OtaChannel, OtaManifest, OtaRelease, SmokeTestVerdict, TokenPack, User, VncSession } from "./types.js";
+export interface ApiClientOptions {
+    baseUrl: string;
+    /** Bearer token — either a user session JWT or a CLI/agent API token. */
+    token?: string;
+    /**
+     * Fleet management (listAgents/createEnrollmentToken/sendAgentCommand)
+     * is served by a separately-deployed admin Worker, not the customer-
+     * facing API — see apps/admin-api. Falls back to `baseUrl` if unset,
+     * which only matters for callers that never touch those three methods.
+     */
+    adminApiUrl?: string;
+    /** Test seam only — same "optional, defaults to the real thing" shape
+     *  `packages/admin-cli`'s `waitForCommandResolution`/`packages/cli`'s
+     *  `followBuildLogs` already use for their own injectable dependencies.
+     *  Every real caller (dashboard, CLI, agent) omits this and gets the
+     *  real global `fetch`. */
+    fetchImpl?: typeof fetch;
+    /** Test seam only — production callers always get the real
+     *  `DEFAULT_REQUEST_TIMEOUT_MS`. See that constant's own docblock. */
+    requestTimeoutMs?: number;
+}
+/**
+ * Every `ApiClient` call is a small JSON request/response — no file
+ * upload/download is ever routed through this client (build artifacts and
+ * OTA bundles go straight to/from R2 via a presigned URL the caller fetches
+ * separately) — but a handful of routes (`explainBuildFailure`,
+ * `analyzeSmokeTest`, `askDocsChat`, `generateAppforgeConfig`) proxy to
+ * Anthropic server-side and can legitimately take tens of seconds for a
+ * real completion, well past what a plain CRUD call needs. 60s is
+ * generous enough to cover the slowest of those with room to spare, while
+ * still being a real ceiling: without one, a connection that stalls after
+ * opening (a network partition, a proxy holding the connection open
+ * without sending further bytes, a hung Worker instance) left every
+ * caller's `fetch` promise pending forever — same shape as `packages/
+ * agent/src/lib/api.ts`'s already-fixed `AgentApi.request`, but for the
+ * single shared client every dashboard page, CLI command, and admin-cli
+ * command talks to the control plane through. */
+export declare const DEFAULT_REQUEST_TIMEOUT_MS = 60000;
+export declare class ApiError extends Error {
+    status: number;
+    body: unknown;
+    constructor(status: number, body: unknown);
+}
+/**
+ * Shared "what should the user see" extraction for a caught error from
+ * any `ApiClient` call. `ApiError` extends `Error`, so a naive
+ * `err instanceof Error ? err.message : fallback` always matches an
+ * `ApiError` too and returns *this class's own* constructor string —
+ * `API error ${status}: ${JSON.stringify(body)}`, meant for logs/
+ * debugging — instead of the server's actual user-facing text at
+ * `body.error`. This was independently found and fixed the same way in
+ * `Login.tsx`/`Signup.tsx`/`Device.tsx`/`VerifyEmail.tsx` (dashboard)
+ * and `VncViewer.tsx`'s own `vncViewerErrorMessage` before this shared
+ * helper existed; new callers (both CLIs' top-level handlers first, per
+ * ROADMAP.md) should use this instead of repeating the same extraction
+ * inline.
+ */
+export declare function apiErrorMessage(err: unknown, fallback: string): string;
+/**
+ * Small typed fetch wrapper shared by the CLI and the dashboard so both
+ * talk to the control-plane API through the same request/response shapes.
+ */
+export declare class ApiClient {
+    private opts;
+    constructor(opts: ApiClientOptions);
+    private request;
+    private adminRequest;
+    /**
+     * `twoFactor` is only needed on a second call, after a first call
+     * without it throws `ApiError(401, { requiresTotp: true })` — see
+     * apps/api/src/routes/auth.ts's login handler. `recoveryCode` is a
+     * lost-authenticator alternate to `totpCode`, never both at once.
+     */
+    login(email: string, password: string, twoFactor?: {
+        totpCode?: string;
+        recoveryCode?: string;
+    }): Promise<{
+        token: string;
+        user: User;
+    }>;
+    signup(email: string, password: string, name: string | undefined, orgName: string): Promise<{
+        token: string;
+        user: User;
+        org: Org;
+    }>;
+    me(): Promise<{
+        user: User;
+        orgs: Org[];
+    }>;
+    /**
+     * Redeems the token from the signup verification email's link
+     * (`apps/api/src/lib/email-verification.ts`'s `verifyUrl`). No auth of
+     * its own — the route this hits (`POST /auth/verify-email`) doesn't
+     * require a session, since whoever clicked the link may not be logged
+     * in on this browser at all. Was previously unreachable from any
+     * client: this method, plus a dashboard route to call it, is the fix.
+     */
+    verifyEmail(token: string): Promise<{
+        ok: true;
+    }>;
+    /** Requires an existing session — unlike `verifyEmail`, this is only
+     *  ever offered to an already-logged-in user who hasn't verified yet
+     *  (see `Security.tsx`). Rate-limited server-side. */
+    resendVerification(): Promise<{
+        ok: true;
+    }>;
+    /** Requires re-entering the current password — same reasoning as
+     *  `disableTwoFactor` below: a stolen session token alone must not be
+     *  enough to take over the account's own fallback credential.
+     *  Rate-limited server-side, keyed by user. Also revokes every other
+     *  live session for the account (a leaked token stops working
+     *  immediately) — `token` is a freshly-issued replacement for *this*
+     *  session specifically, so the caller must swap it in (e.g. into
+     *  `session.token`) or this same request's own session gets logged
+     *  out by its own success. */
+    changePassword(currentPassword: string, newPassword: string): Promise<{
+        ok: true;
+        token: string;
+    }>;
+    /** No auth of its own — this is the entry point for someone who can't
+     *  log in at all. Always resolves the same way regardless of whether
+     *  the email is actually registered (see the route's own doc
+     *  comment) — never use the response to decide whether to tell the
+     *  caller "no account with that email". */
+    forgotPassword(email: string): Promise<{
+        ok: true;
+    }>;
+    /** Redeems the token from the forgot-password email's link
+     *  (`apps/api/src/lib/password-reset.ts`'s `resetUrl`). No auth of its
+     *  own, same reasoning as `verifyEmail` above. Also revokes every
+     *  other live session for the account and returns a fresh one, same
+     *  as `changePassword`/`disableTwoFactor` — a reset is at least as
+     *  strong proof of ownership as re-entering the current password. */
+    resetPassword(token: string, newPassword: string): Promise<{
+        ok: true;
+        token: string;
+    }>;
+    /** Starts (or restarts) enrollment — the secret is only ever returned
+     *  here and from confirmTwoFactor's success, never again afterward. */
+    enrollTwoFactor(): Promise<{
+        secret: string;
+        otpauthUri: string;
+    }>;
+    /** Redeems the first code from an authenticator app to actually turn
+     *  2FA on — `recoveryCodes` is shown exactly once, same as the secret
+     *  above; the caller is responsible for surfacing it to the user now.
+     *  Also requires re-entering the account password, same reasoning and
+     *  requirement as `disableTwoFactor` below: without it, any live
+     *  session (a stolen JWT, or a CLI/webhook API token, which never
+     *  expires on its own) was enough to confirm 2FA with an
+     *  attacker-chosen secret, permanently locking the real account owner
+     *  out at their next login — see docs/security.md's "2FA (TOTP)" note. */
+    confirmTwoFactor(code: string, password: string): Promise<{
+        ok: true;
+        recoveryCodes: string[];
+    }>;
+    /** Requires re-entering the account password — see docs/security.md's
+     *  "2FA (TOTP)" note on why a session token alone isn't enough here.
+     *  Also revokes every other live session for the account, same
+     *  reasoning and `token`-swap requirement as `changePassword` above —
+     *  the JWT this very request authenticated with might be the leaked
+     *  one 2FA existed to guard against. */
+    disableTwoFactor(password: string): Promise<{
+        ok: true;
+        token: string;
+    }>;
+    /** Invalidates every existing recovery code and returns a fresh set,
+     *  shown exactly once like the original set from confirmTwoFactor.
+     *  Also requires re-entering the account password, same reasoning as
+     *  `disableTwoFactor` above: without it, a stolen session token alone
+     *  was enough to silently destroy the real owner's recovery path
+     *  (this codebase has no account-recovery flow) and hand the
+     *  attacker a fresh set of recovery codes instead — see
+     *  docs/security.md's "2FA (TOTP)" note. */
+    regenerateRecoveryCodes(password: string): Promise<{
+        ok: true;
+        recoveryCodes: string[];
+    }>;
+    /** `appforge-admin login --web`'s device-authorization flow (#5) — the CLI calls this first, no auth of its own yet. */
+    startDeviceAuth(): Promise<{
+        deviceCode: string;
+        userCode: string;
+        verificationUrl: string;
+        expiresInSeconds: number;
+        intervalSeconds: number;
+    }>;
+    /** Poll with the long deviceCode until status stops being "pending" — same shape as gh/OAuth device flow polling. */
+    pollDeviceAuth(deviceCode: string): Promise<{
+        status: "pending" | "denied" | "expired";
+    } | {
+        status: "approved";
+        token: string;
+        orgId: string;
+        orgName: string;
+    }>;
+    /** Called from the dashboard (already has a user session) with the short, human-typed userCode. */
+    approveDeviceAuth(userCode: string): Promise<{
+        ok: true;
+        orgName: string;
+    }>;
+    denyDeviceAuth(userCode: string): Promise<{
+        ok: true;
+    }>;
+    /** Drafts an appforge.yaml from real project files — see #8. `files` is path -> file contents for whatever the caller found on disk. */
+    generateAppforgeConfig(input: {
+        detectedPlatform: "ios" | "android" | "flutter" | "react-native" | null;
+        files: Record<string, string>;
+    }): Promise<{
+        yaml: string;
+    }>;
+    /** Public, unauthenticated docs Q&A widget (pricing page) — see #10. Resend the whole conversation each call; nothing is kept server-side. */
+    askDocsChat(history: {
+        role: "user" | "assistant";
+        content: string;
+    }[]): Promise<{
+        answer: string;
+    }>;
+    createApiToken(orgId: string, label: string): Promise<{
+        token: string;
+    }>;
+    /** Never includes the token value itself or its hash — see
+     *  `ApiTokenInfo`'s own docblock. */
+    listApiTokens(orgId: string, pagination?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<{
+        tokens: ApiTokenInfo[];
+    }>;
+    /** Immediate and permanent — there's no undo once a token is
+     *  revoked (a fresh one via `createApiToken` is the only way back). */
+    revokeApiToken(orgId: string, tokenId: string): Promise<{
+        revoked: true;
+        tokenId: string;
+    }>;
+    /** Fixes a typo'd or since-changed org name (e.g. a placeholder used
+     *  at signup) without any of `updateApp`'s deletion/recreation
+     *  downsides — there's nothing else to break, since unlike an app's
+     *  `webhookSecret`, an org's identity has no dependent secret tied to
+     *  it. `name` is the only updatable field; see `updateOrgSchema`'s own
+     *  docblock in `packages/core/src/schemas.ts`. */
+    updateOrg(orgId: string, input: {
+        name?: string;
+        buildWebhookUrl?: string | null;
+    }): Promise<{
+        org: Org;
+    }>;
+    listApps(orgId: string, pagination?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<{
+        apps: App[];
+    }>;
+    createApp(orgId: string, input: {
+        name: string;
+        platform: string;
+        repoUrl: string;
+        defaultBranch: string;
+    }): Promise<{
+        app: App;
+    }>;
+    /** A single app's own name/platform/etc. — `listApps` only ever returns a
+     *  whole org's apps, so a page that already knows just the `appId` (any
+     *  `/apps/:appId/*` page) needs this rather than fetching every app in
+     *  the org just to find the one it's showing. */
+    getApp(appId: string): Promise<{
+        app: App;
+    }>;
+    /** The one route that actually returns `webhookSecret` — every other
+     *  app response (`getApp`/`listApps`/`createApp`/`updateApp`)
+     *  deliberately omits it. This is the value GitHub's webhook settings
+     *  "Secret" field needs, per `docs/security.md`'s "GitHub webhooks"
+     *  note; without it there's no way to ever configure a working
+     *  webhook at all. */
+    getAppWebhookSecret(appId: string): Promise<{
+        webhookSecret: string;
+    }>;
+    /** `platform` isn't updatable — see `updateAppSchema`'s own docblock
+     *  in `packages/core/src/schemas.ts`. */
+    updateApp(appId: string, input: {
+        name?: string;
+        repoUrl?: string;
+        defaultBranch?: string;
+    }): Promise<{
+        app: App;
+    }>;
+    /** Permanently removes the app and cascades every `Build`/OTA row for
+     *  it — 409s (a plain `ApiError`) if a build is still queued/leased/
+     *  running, so an in-flight build never has its `App` row vanish out
+     *  from under it. */
+    deleteApp(appId: string): Promise<{
+        deleted: true;
+        appId: string;
+    }>;
+    /** Build-secrets v1 (ROADMAP.md, split off from #322) — sets or
+     *  overwrites a named secret for this app, injected as an env var
+     *  under that name on every build. Never returns the value back;
+     *  see `getAppSecretNames` for why. */
+    setAppSecret(appId: string, input: {
+        name: string;
+        value: string;
+    }): Promise<{
+        name: string;
+    }>;
+    /** Names only — this codebase has no route anywhere that returns a
+     *  secret's decrypted value once it's been set (same discipline
+     *  `getAppWebhookSecret` deliberately doesn't extend to). */
+    getAppSecretNames(appId: string): Promise<{
+        names: string[];
+    }>;
+    deleteAppSecret(appId: string, name: string): Promise<{
+        deleted: true;
+        name: string;
+    }>;
+    /** Fleet-secrets v1 (issue #392) — sets or overwrites one of the
+     *  org's fleet-wide infra secrets (`JWT_SECRET`,
+     *  `JWT_SECRET_PREVIOUS`, `INTERNAL_SERVICE_TOKEN`; see
+     *  `FLEET_SECRET_NAMES`). Every Mac mini enrolled in this org picks
+     *  the new value up on its next heartbeat and re-applies it locally,
+     *  so this call *is* the rotation — there's no per-machine follow-up
+     *  step. Never returns the value back, same as `setAppSecret`. */
+    setFleetSecret(orgId: string, input: {
+        name: string;
+        value: string;
+    }): Promise<{
+        name: string;
+    }>;
+    /** Names only — as with `getAppSecretNames`, no route anywhere returns
+     *  a fleet secret's decrypted value to a human-facing client; the only
+     *  decrypt-and-return path in this codebase is apps/admin-api's
+     *  `GET /agents/fleet-secrets`, which requires an agent bearer token. */
+    getFleetSecretNames(orgId: string): Promise<{
+        names: string[];
+    }>;
+    deleteFleetSecret(orgId: string, name: string): Promise<{
+        deleted: true;
+        name: string;
+    }>;
+    listBuilds(appId: string): Promise<{
+        builds: Build[];
+    }>;
+    /** Best-effort suggestions for the trigger-build form's "Workflow"
+     *  field — see `apps/api/src/lib/appforge-yaml.ts`'s own docblock for
+     *  why this can legitimately come back empty (private repo, no
+     *  appforge.yaml on this branch yet, etc.) rather than erroring. */
+    listAppWorkflows(appId: string): Promise<{
+        workflows: string[];
+    }>;
+    getBuild(buildId: string): Promise<{
+        build: Build;
+    }>;
+    triggerBuild(input: {
+        appId: string;
+        workflow: string;
+        branch?: string;
+    }): Promise<{
+        build: Build;
+    }>;
+    cancelBuild(buildId: string): Promise<{
+        build: Build;
+    }>;
+    listAgents(orgId: string): Promise<{
+        agents: AgentInfo[];
+    }>;
+    createEnrollmentToken(orgId: string): Promise<{
+        enrollmentToken: string;
+        expiresAt: string;
+    }>;
+    /** Permanently remove a Mac mini from the fleet. The daemon on the
+     *  machine itself must be stopped separately — see apps/admin-api's
+     *  DELETE handler and `appforge-admin agents decommission`. */
+    deleteAgent(orgId: string, agentId: string): Promise<{
+        deleted: true;
+        agentId: string;
+    }>;
+    /** `scriptName` is only used by RUN_MAINTENANCE_SCRIPT; `targetVersion`
+     *  only by UPDATE_AGENT (npm version or, for a repo-checkout install, a
+     *  git ref); `buildId` only by CANCEL_BUILD (which of this agent's
+     *  possibly-several concurrent builds to kill) — all three are ignored
+     *  server-side for every other command type. `buildId` was the one
+     *  missing piece keeping CANCEL_BUILD entirely unreachable from any
+     *  client despite the rest of the stack (route, schema, DB column,
+     *  agent handling) already being fully built — see ROADMAP.md. */
+    sendAgentCommand(agentId: string, type: string, scriptName?: string, targetVersion?: string, buildId?: string): Promise<{
+        command: {
+            id: string;
+        };
+    }>;
+    /** Remote-management history for one agent, newest first — how the
+     *  Fleet page shows whether a DRAIN/REBOOT/... actually landed
+     *  (`done`/`failed` + the agent's `result` string) instead of leaving
+     *  the operator guessing after a click. */
+    listAgentCommands(agentId: string, limit?: number): Promise<{
+        commands: AgentCommand[];
+    }>;
+    /** VNC "Connect" button, Phase 1c: mints a 5-minute session token plus
+     *  the `wsUrl` (`apps/device-stream`'s `/vnc` relay, see that Worker's
+     *  Phase 1b) the dashboard's viewer page dials it against. Called fresh
+     *  each time the viewer page mounts, same "no pre-fetched token sitting
+     *  in a URL or router state" shape as `startDeviceTestSession`.
+     *
+     *  `options.requestControl` (Feature 3) asks the server for a session
+     *  that can also forward mouse/keyboard input, not just watch — sent
+     *  as `{ mode: "control" }` only when true, so an omitted/false call
+     *  sends no body at all, unchanged from before this option existed.
+     *  This is only ever a *request*: the response's own `mode` field
+     *  ("view" | "control") is what the server actually granted (`403` if
+     *  control was requested but `Agent.remoteControlEnabled` isn't set —
+     *  see `apps/admin-api/src/routes/fleet.ts`), and callers must treat
+     *  that field, never their own request, as authoritative. */
+    startVncSession(orgId: string, agentId: string, options?: {
+        requestControl?: boolean;
+    }): Promise<{
+        agentId: string;
+        token: string;
+        expiresAt: string;
+        wsUrl: string;
+        mode: "view" | "control";
+    }>;
+    /** Grants or revokes `Agent.remoteControlEnabled` (Feature 3) — the
+     *  one and only way that flag changes, mirroring `deleteAgent` above's
+     *  "dedicated route with its own DB write" shape rather than the
+     *  AgentCommand queue, since this is a persisted authorization bit
+     *  `startVncSession` needs to read synchronously, not a directive for
+     *  the agent daemon to act on. See `appforge-admin agents
+     *  allow-remote-control` (`packages/admin-cli`) for the CLI surface
+     *  this same route backs. */
+    setAgentRemoteControl(orgId: string, agentId: string, enabled: boolean): Promise<{
+        agentId: string;
+        remoteControlEnabled: number;
+    }>;
+    /** The audit trail's read side — who's requested a VNC "Connect"
+     *  session for this agent and when, newest first. How a "Last VNC
+     *  session" column reads this (`apps/dashboard/src/pages/Fleet.tsx`),
+     *  same shape `listAgentCommands` above already established. */
+    listVncSessions(orgId: string, agentId: string): Promise<{
+        sessions: VncSession[];
+    }>;
+    getBalance(orgId: string): Promise<{
+        tokenBalance: number;
+        buildCostTokens: number;
+    }>;
+    listTokenPacks(): Promise<{
+        packs: TokenPack[];
+    }>;
+    /** Starts an LHV Paytech checkout session for a token top-up — also opportunistically saves a card for MIT monthly billing. */
+    createLhvCheckoutSession(orgId: string, packId: string): Promise<{
+        url: string;
+    }>;
+    isLhvConfigured(): Promise<{
+        configured: boolean;
+    }>;
+    listLedger(orgId: string): Promise<{
+        entries: LedgerEntry[];
+    }>;
+    getBillingUsage(orgId: string): Promise<BillingUsage>;
+    setBillingMode(orgId: string, mode: BillingMode): Promise<{
+        org: Org;
+    }>;
+    listMonthlyInvoices(orgId: string): Promise<{
+        invoices: MonthlyInvoice[];
+    }>;
+    /** AI triage of a failed build's log — see docs/ai-failure-triage.md.
+     *  Throws ApiError(501) if ANTHROPIC_API_KEY isn't configured on this
+     *  deployment; callers should show that as "not available here", not
+     *  as a generic error. */
+    explainBuildFailure(buildId: string): Promise<{
+        explanation: BuildFailureExplanation;
+    }>;
+    /** On-demand re-analysis of every smoke-test screenshot a build produced
+     *  (#9), one verdict per screenshot in index order — same
+     *  501-if-unconfigured contract as explainBuildFailure above. */
+    analyzeSmokeTest(buildId: string): Promise<{
+        verdicts: SmokeTestVerdict[];
+    }>;
+    startDeviceTestSession(buildId: string): Promise<{
+        sessionId: string;
+        wsUrl: string;
+        token: string;
+    }>;
+    /** `appKey` is required — the manifest endpoint has no unauthenticated
+     *  fallback (see `apps/api/src/routes/ota.ts`'s docblock on it), only
+     *  `generateOtaAppKey`'s one-time response ever reveals a usable
+     *  value. This call carries no user session (a mobile app binary has
+     *  none), so the key travels as a query param rather than the
+     *  `authorization` header `request()` already reserves for the
+     *  dashboard/CLI's bearer token. */
+    getOtaManifest(appId: string, channel: string, appKey: string, currentHash?: string, installationId?: string): Promise<OtaManifest | null>;
+    /** Generates (rotates) this app's OTA manifest key — see
+     *  `getOtaManifest`. Returned once; the server keeps only its hash. */
+    generateOtaAppKey(appId: string): Promise<{
+        appKey: string;
+    }>;
+    listOtaReleases(appId: string, channel?: string, pagination?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<{
+        releases: OtaRelease[];
+    }>;
+    listOtaChannels(appId: string, pagination?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<{
+        channels: OtaChannel[];
+    }>;
+    promoteOtaRelease(appId: string, input: {
+        buildId: string;
+        channel?: string;
+        mandatory?: boolean;
+        rollout?: number;
+    }): Promise<{
+        release: OtaRelease;
+    }>;
+    /** Progresses an existing release's rollout in place (10% -> 50% ->
+     *  100%) instead of re-promoting the same build, which would mint a
+     *  new release id and reshuffle `isInStagedRollout`'s per-install
+     *  bucketing — see `updateOtaReleaseRolloutSchema`'s own docblock in
+     *  `packages/core/src/schemas.ts`. */
+    updateOtaReleaseRollout(appId: string, releaseId: string, rollout: number): Promise<{
+        release: OtaRelease;
+    }>;
+    setActiveOtaRelease(appId: string, channel: string, releaseId: string | null): Promise<{
+        ok: true;
+    }>;
+    rollbackOtaChannel(appId: string, channel: string): Promise<{
+        release: OtaRelease | null;
+    }>;
+}
+//# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,GAAG,EACH,WAAW,EACX,YAAY,EACZ,KAAK,EACL,uBAAuB,EACvB,WAAW,EACX,cAAc,EACd,GAAG,EACH,UAAU,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,SAAS,EACT,IAAI,EACJ,UAAU,EACX,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;+BAI2B;IAC3B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;0EACsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;iDAeiD;AACjD,eAAO,MAAM,0BAA0B,QAAS,CAAC;AAEjD,qBAAa,QAAS,SAAQ,KAAK;IAExB,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,OAAO;gBADb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO;CAIvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMtE;AAED;;;GAGG;AACH,qBAAa,SAAS;IACR,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,gBAAgB;YAE5B,OAAO;IA6DrB,OAAO,CAAC,YAAY;IAIpB;;;;;OAKG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE;eAChE,MAAM;cAAQ,IAAI;;IAQjD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM;eAClD,MAAM;cAAQ,IAAI;aAAO,GAAG;;IAQ3D,EAAE;cAC4B,IAAI;cAAQ,GAAG,EAAE;;IAG/C;;;;;;;OAOG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM;YACG,IAAI;;IAGhC;;0DAEsD;IACtD,kBAAkB;YACU,IAAI;;IAGhC;;;;;;;;kCAQ8B;IAC9B,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;YAC/B,IAAI;eAAS,MAAM;;IAG/C;;;;+CAI2C;IAC3C,cAAc,CAAC,KAAK,EAAE,MAAM;YACA,IAAI;;IAGhC;;;;;yEAKqE;IACrE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;YACpB,IAAI;eAAS,MAAM;;IAK/C;2EACuE;IACvE,eAAe;gBACiB,MAAM;oBAAc,MAAM;;IAG1D;;;;;;;;8EAQ0E;IAC1E,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;YACnB,IAAI;uBAAiB,MAAM,EAAE;;IAGzD;;;;;4CAKwC;IACxC,gBAAgB,CAAC,QAAQ,EAAE,MAAM;YACL,IAAI;eAAS,MAAM;;IAG/C;;;;;;;gDAO4C;IAC5C,uBAAuB,CAAC,QAAQ,EAAE,MAAM;YACZ,IAAI;uBAAiB,MAAM,EAAE;;IAGzD,wHAAwH;IACxH,eAAe;oBACqB,MAAM;kBAAY,MAAM;yBAAmB,MAAM;0BAAoB,MAAM;yBAAmB,MAAM;;IAMxI,qHAAqH;IACrH,cAAc,CAAC,UAAU,EAAE,MAAM;gBAEnB,SAAS,GAAG,QAAQ,GAAG,SAAS;;gBAAe,UAAU;eAAS,MAAM;eAAS,MAAM;iBAAW,MAAM;;IAItH,mGAAmG;IACnG,iBAAiB,CAAC,QAAQ,EAAE,MAAM;YACN,IAAI;iBAAW,MAAM;;IAGjD,cAAc,CAAC,QAAQ,EAAE,MAAM;YACH,IAAI;;IAGhC,wIAAwI;IACxI,sBAAsB,CAAC,KAAK,EAAE;QAAE,gBAAgB,EAAE,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;cAC1G,MAAM;;IAGpC,8IAA8I;IAC9I,WAAW,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE;gBACtC,MAAM;;IAGtC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;eACZ,MAAM;;IAGrC;yCACqC;IACrC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;gBAK7C,YAAY,EAAE;;IAG9C;2EACuE;IACvE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;iBACZ,IAAI;iBAAW,MAAM;;IAGtD;;;;;sDAKkD;IAClD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;aACrD,GAAG;;IAGhC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;cAK1C,GAAG,EAAE;;IAGnC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE;aAC7E,GAAG;;IAGhC;;;qDAGiD;IACjD,MAAM,CAAC,KAAK,EAAE,MAAM;aACS,GAAG;;IAGhC;;;;;0BAKsB;IACtB,mBAAmB,CAAC,KAAK,EAAE,MAAM;uBACM,MAAM;;IAG7C;6CACyC;IACzC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE;aAC9D,GAAG;;IAGhC;;;yBAGqB;IACrB,SAAS,CAAC,KAAK,EAAE,MAAM;iBACU,IAAI;eAAS,MAAM;;IAGpD;;;2CAGuC;IACvC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;cACpC,MAAM;;IAGpC;;iEAE6D;IAC7D,iBAAiB,CAAC,KAAK,EAAE,MAAM;eACA,MAAM,EAAE;;IAGvC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;iBACV,IAAI;cAAQ,MAAM;;IAGnD;;;;;;sEAMkE;IAClE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;cACtC,MAAM;;IAGpC;;;6EAGyE;IACzE,mBAAmB,CAAC,KAAK,EAAE,MAAM;eACF,MAAM,EAAE;;IAGvC,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;iBACZ,IAAI;cAAQ,MAAM;;IAMnD,UAAU,CAAC,KAAK,EAAE,MAAM;gBACQ,KAAK,EAAE;;IAGvC;;;wEAGoE;IACpE,gBAAgB,CAAC,KAAK,EAAE,MAAM;mBACK,MAAM,EAAE;;IAG3C,QAAQ,CAAC,OAAO,EAAE,MAAM;eACO,KAAK;;IAGpC,YAAY,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;eACzC,KAAK;;IAGpC,WAAW,CAAC,OAAO,EAAE,MAAM;eACI,KAAK;;IAOpC,UAAU,CAAC,KAAK,EAAE,MAAM;gBACa,SAAS,EAAE;;IAGhD,qBAAqB,CAAC,KAAK,EAAE,MAAM;yBACW,MAAM;mBAAa,MAAM;;IAMvE;;mEAE+D;IAC/D,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;iBACJ,IAAI;iBAAW,MAAM;;IAM3D;;;;;;;sEAOkE;IAClE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;iBACvE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE;;IAQpD;;;+CAG2C;IAC3C,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM;kBAEV,YAAY,EAAE;;IAGrD;;;;;;;;;;;;;;iEAc6D;IAC7D,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE;iBAChD,MAAM;eAAS,MAAM;mBAAa,MAAM;eAAS,MAAM;cAAQ,MAAM,GAAG,SAAS;;IAOvH;;;;;;;iCAO6B;IAC7B,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;iBAChC,MAAM;8BAAwB,MAAM;;IAO1E;;;oEAGgE;IAChE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;kBACP,UAAU,EAAE;;IAMnD,UAAU,CAAC,KAAK,EAAE,MAAM;sBACc,MAAM;yBAAmB,MAAM;;IAMrE,cAAc;eACiB,SAAS,EAAE;;IAG1C,+HAA+H;IAC/H,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;aACzB,MAAM;;IAGnC,eAAe;oBACqB,OAAO;;IAG3C,UAAU,CAAC,KAAK,EAAE,MAAM;iBACS,WAAW,EAAE;;IAG9C,eAAe,CAAC,KAAK,EAAE,MAAM;IAI7B,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW;aAClB,GAAG;;IAGhC,mBAAmB,CAAC,KAAK,EAAE,MAAM;kBACC,cAAc,EAAE;;IAGlD;;;8BAG0B;IAC1B,mBAAmB,CAAC,OAAO,EAAE,MAAM;qBACE,uBAAuB;;IAM5D;;qEAEiE;IACjE,gBAAgB,CAAC,OAAO,EAAE,MAAM;kBACE,gBAAgB,EAAE;;IAGpD,sBAAsB,CAAC,OAAO,EAAE,MAAM;mBACH,MAAM;eAAS,MAAM;eAAS,MAAM;;IAQvE;;;;;;wCAMoC;IACpC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM;IAc5G;2EACuE;IACvE,iBAAiB,CAAC,KAAK,EAAE,MAAM;gBACC,MAAM;;IAGtC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;kBAM/D,UAAU,EAAE;;IAG9C,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;kBAK7C,UAAU,EAAE;;IAG9C,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;iBACnF,UAAU;;IAG3C;;;;0CAIsC;IACtC,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;iBACxC,UAAU;;IAG3C,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;YAChD,IAAI;;IAGhC,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;iBAChB,UAAU,GAAG,IAAI;;CAEnD"}