@apteva/web-sdk 0.5.4 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.6.0 — 2026-09-07
+
+- Add typed app-owned extensions through `defineAppExtension` and `client.use`.
+- Add project/install-scoped app handles, HTTP/MCP request options, and app SSE subscriptions sharing live client credentials.
+- Add framework-independent component references, manifest metadata types and a local export registry.
+- Expose installed-app discovery and explicit metadata/version compatibility checks.
+- Fix caller cancellation being overridden by request timeouts; retain cancellation and timeouts through response-body reads.
+- Add abortable fetch subscriptions with SSE resume IDs, optional cursor queries, bounded opt-in deduplication, configurable reconnect delay and terminal auth handling.
+- Add coordinated host-owned access-token renewal without automatically replaying HTTP requests.
+- Preserve legacy Channel Chat APIs; app-specific extensions and UI stay in app-owned packages.
+
+## 0.5.5 — 2026-08-15
+
+- Add a generic, opaque `accessToken` credential to `AptevaClient`, including
+  runtime `setAccessToken(...)` and `getAccessToken()` helpers. The SDK is not
+  coupled to Auth or any other token issuer.
+- Give `accessToken` precedence over `apiKey`, send it only in the Bearer
+  header, omit cookies, and force authenticated fetch streaming for SSE.
+- Keep legacy `apiKey: "uk_…"` behavior as a compatibility fallback while
+  removing token-prefix inference from the recommended integration.
+- Deprecate the Channel Chat-specific `client.delegatedUsers.create(...)`
+  flow in favor of server-policy-controlled application-user tokens.
+
 ## 0.5.4 — 2026-08-13
 
 - Add `client.delegatedUsers.create(...)` for trusted-backend minting of

package/README.md

@@ -2,7 +2,7 @@
 
 Browser SDK for calling [apteva-server](https://github.com/apteva/server). Framework-agnostic. ~3 KB minified + gzipped.
 
-- **Auth** — session cookies, `Authorization: Bearer`, `X-API-Key`, `?api_key=` query — pick any, the SDK handles them.
+- **Auth transport** — session cookies, private API keys, and opaque application-user access tokens. The SDK does not depend on a particular token issuer.
 - **App data** — `client.app("crm").get("/contacts")` reverse-proxies through `/api/apps/<name>/*`.
 - **App tools** — `client.app("crm").tool("contacts_search", {…})` posts an MCP `tools/call`, unwraps the JSON-RPC envelope, returns the tool's natural shape.
 - **Static-app mode** — when the UI is hosted by apteva-server itself (`runtime.kind: static`), `pickBaseURL` and `pickKioskKey` read the `<script>window.__APTEVA_APP__</script>` block the server injects.
@@ -22,8 +22,7 @@ import { AptevaClient } from "@apteva/web-sdk";
 
 const apteva = new AptevaClient({
   baseURL: "https://agents.example.com",
-  // Optional. Omit to rely on the session cookie (after auth.login).
-  apiKey: process.env.NEXT_PUBLIC_APTEVA_KEY,
+  // Optional. Omit to rely on an apteva-server session cookie.
 });
 
 // Sign in (sets the session cookie on the apteva-server domain).
@@ -40,22 +39,36 @@ const { leads } = await apteva.app("flexylead").tool<{ leads: Lead[] }>(
 );
 ```
 
-## Auth carriers
+## Authentication carriers
 
-The SDK sends `credentials: "include"` on every request, so a session cookie set by `auth.login` flows automatically — same-origin always, cross-origin when the apteva-server's `CORS_ORIGIN` allowlists your domain (the default `permissive` mode echoes any origin).
+With no bearer credential, the SDK sends `credentials: "include"` so an
+apteva-server session cookie flows automatically. Private platform integrations
+can provide `apiKey`. Browser applications should provide an opaque
+`accessToken` issued by their trusted authentication flow.
 
-You can layer on an API key by setting `apiKey` in the constructor or calling `client.setApiKey(...)` at runtime. Bearer-wins-over-cookie on the wire.
+`accessToken` takes precedence over `apiKey`. It is sent only through the
+`Authorization: Bearer` header, cookie credentials are omitted, and SSE uses
+authenticated `fetch()` streaming. The SDK does not inspect its prefix or know
+whether Auth, another Apteva app, or a customer service issued it.
 
 ```ts
 const apteva = new AptevaClient({
   baseURL: "...",
-  apiKey: "sk-...",     // optional
+  accessToken: loginResult.apteva_access_token, // application user
+  // apiKey: process.env.APTEVA_API_KEY,         // trusted backend only
   projectId: "proj_123", // routes project-scoped app HTTP and MCP calls
   onUnauthorized: () => router.push("/login"),  // fires once per 401
   timeoutMs: 30_000,    // default, 0 disables
 });
+
+// Replace an expired token without rebuilding the client.
+apteva.setAccessToken(refreshed.apteva_access_token);
 ```
 
+The example above deliberately leaves login outside the SDK. Auth can return
+`apteva_access_token`, but the Web SDK remains decoupled and accepts any opaque
+bearer token that apteva-server recognizes.
+
 ## App HTTP routes
 
 `client.app(name)` returns a handle with `get / post / put / patch / del` that route to `/api/apps/<name>/<path>`. Same auth, same proxy, same error model.
@@ -80,6 +93,185 @@ If the MCP call returns a JSON-RPC error, the SDK throws `AptevaError(-1, messag
 
 For lower-level usage, `client.callTool(appName, toolName, args)` and the standalone `unwrapMCP(envelope)` are both exported.
 
+## App-owned extensions and web components
+
+Apps can publish a headless client and frontend components from their own
+versioned package. The core SDK supplies transport, component references, and
+metadata checks; it has no React dependency and does not import executable UI
+from a server. A dashboard wrapper and an external package can share the same
+component source, receiving an app handle instead of implementing authentication
+and requests again.
+
+### Typed extensions
+
+`defineAppExtension` preserves the extension's return type. `client.use` supplies
+an authenticated app handle. Each call creates a new instance: retain it in your
+host (for example with React's `useMemo`), and close subscriptions when unmounting.
+An async `create` is supported; `use` then returns its Promise unchanged.
+
+```ts
+import { AptevaClient, defineAppExtension } from "@apteva/web-sdk";
+
+// Illustrative app-owned API. Replace routes and wire types with your app's contract.
+const itemsExtension = defineAppExtension({
+  app: "example",
+  create: ({ app }) => ({
+    list: (signal?: AbortSignal) =>
+      app.get<Array<{ id: string; title: string }>>("/items", { signal }),
+  }),
+});
+
+const client = new AptevaClient({ baseURL: "https://agents.example.com", accessToken });
+const items = client.use(itemsExtension, { projectId: "p1", installId: 42 });
+const rows = await items.list(); // typed result
+```
+
+Extensions contain the app's own business logic and API contract validation.
+A Conversations extension and its chat, inbox, and approval UI belong in the
+Conversations package. The existing `client.chat` remains a Channel Chat API;
+it is not redirected to Conversations.
+
+### Shared app transport
+
+`client.app(name, { projectId, installId })` scopes HTTP, MCP, and subscriptions
+together. It exposes `name`, `projectId`, and `installId` for host context and
+reads the client's current credentials on each request or reconnection.
+Explicit handle scope overrides routing query parameters. With no explicit
+project scope, the existing client default and query-override behavior remain.
+The platform still validates the selected installation and project.
+
+```ts
+const app = client.app("example", { projectId: "p1", installId: 42 });
+const controller = new AbortController();
+
+await app.post("/items", { title: "Hello" }, { signal: controller.signal });
+await app.tool("items_list", {}, { signal: controller.signal });
+
+const subscription = app.subscribe<{ id: string; title: string }>(
+  "/events",
+  (row, metadata) => console.log(row, metadata.event, metadata.id),
+  { signal: controller.signal, eventTypes: ["item.updated"] },
+);
+subscription.close();
+```
+
+All HTTP helpers accept `RequestInit`; MCP accepts it as the third argument.
+Cancellation works alongside the client timeout, including while reading the
+response body. App paths must start with `/` and remain inside the app route.
+Use the raw client methods for platform endpoints. No HTTP method is retried
+automatically. Pass an app-supported idempotency header or body field explicitly
+when the app contract permits a write to be retried.
+
+### Component exports and manifest metadata
+
+`AppComponentReference` is the existing `{ app, name, props? }` message shape;
+`ChatComponent` remains a compatible name. `AppComponentSpec` mirrors existing
+`provides.ui_components` metadata, including slots, prop schemas and widget
+settings. There is no second server declaration format.
+
+`AppComponentRegistry<T>` maps those app/component names to local frontend
+exports. It accepts framework-specific components or host-owned loaders without
+adding a framework dependency. Registration rejects duplicate names atomically
+and returns an idempotent unregister function; unknown references resolve to
+`undefined` so the host can render a fallback.
+
+```ts
+import { AppComponentRegistry } from "@apteva/web-sdk";
+import { ItemCard } from "./components/ItemCard"; // or an app-owned frontend package
+
+const components = new AppComponentRegistry<typeof ItemCard>();
+const unregister = components.register("example", { "item-card": ItemCard });
+const Component = components.resolve({ app: "example", name: "item-card" });
+// Render Component using your framework and validated, appropriate props.
+unregister();
+```
+
+`AppComponentContext` defines a host-injected `app: AppHandle`. Pass this trusted
+context separately from message data; do not let message props replace it.
+The host handles rendering, slots, schema validation, loading/error boundaries,
+theme and component lifecycle. Registry membership alone does not establish
+installation, compatibility, identity or authorization. Existing dashboard
+module loading remains a host concern; installing this SDK does not port an
+existing component's fetch calls or styling automatically.
+
+### Installed-app discovery and compatibility
+
+`client.apps.list({ projectId? }, requestInit?)` wraps the existing `/api/apps`
+endpoint and defaults to the client's project. This endpoint retains its current
+platform permissions; application-user tokens are not guaranteed access. Hosts
+can instead supply metadata they have already obtained through an authorized
+flow. Extension setup does not automatically perform discovery.
+
+```ts
+import { checkAppCompatibility, assertAppCompatibility } from "@apteva/web-sdk";
+
+const installed = (await client.apps.list()).find(app => app.install_id === 42);
+const requirements = {
+  app: "example",
+  version: { description: "1.x", accepts: (version: string) => version.startsWith("1.") },
+  tools: ["items_list"],
+  components: ["item-card"],
+};
+const result = checkAppCompatibility(installed, requirements); // { compatible, issues }
+assertAppCompatibility(installed, requirements); // AptevaError if incompatible
+```
+
+Version policy belongs to the app package: supply a predicate (including a semver
+library if needed). These checks validate advertised app identity, version,
+tools and components. They do not infer API schema versions, backend health,
+permissions or unadvertised capabilities. App extensions should separately
+validate any app-owned versioned API contract they require.
+
+### Subscription recovery
+
+Generic subscriptions accept `signal`; already-aborted signals open no connection.
+Bearer credentials use authenticated fetch streaming. Cookie clients can opt into
+fetch with `transport: "fetch"`. `lastEventId`, `cursorParam`, `deduplicate`, and
+`reconnectDelayMs` also select fetch streaming, even if an EventSource was supplied.
+
+```ts
+const subscription = app.subscribe("/events", onEvent, {
+  signal: controller.signal,
+  lastEventId: savedEventId,
+  cursorParam: "since_id", // only if this app accepts SSE IDs here
+  deduplicate: true,      // only if the app promises unique IDs per event
+  deduplicationWindow: 1000,
+  reconnectDelayMs: 1000,
+});
+```
+
+Fetch streams preserve SSE IDs across reconnects, send `Last-Event-ID`, and
+optionally send the same ID in the app's cursor query parameter. Deduplication
+is opt-in and bounded to the most recent 1000 delivered IDs by default; ID-less
+updates are always delivered. It does not persist across new subscriptions.
+Message-row IDs and SSE IDs are not interchangeable unless the backend says so.
+Named events still require `eventTypes`. Malformed JSON is skipped; a throwing
+fetch-stream event/open callback is reported and closes the subscription.
+
+Reconnect delay defaults to 1000ms. Closing or aborting cancels the active reader
+and any pending reconnect. Fetch streams stop on 204 or 403, and on 401 unless
+credentials can be renewed once before a successful connection. Other failures
+reconnect. Native EventSource retains the browser's own reconnect behavior.
+The SDK cannot supply replay, a gap-free history/live handoff, or durable delivery
+unless the app backend implements those contracts.
+
+### Host-owned credential renewal
+
+Configure `refreshAccessToken: async () => tokenOrUndefined` on the client to
+reuse your own authentication flow. Concurrent 401s coordinate one in-flight
+refresh. `client.refreshAccessToken()` can also be called proactively; it returns
+whether a new token was applied. A login/logout/token replacement during a
+refresh wins over the late result. An undefined result leaves credentials intact.
+
+A failed HTTP request still throws its original 401 and triggers `onUnauthorized`
+after the renewal attempt; it is never replayed. Subsequent calls use the new
+token. Requests with a caller-supplied Authorization header do not trigger
+renewal. Fetch SSE can reconnect once with renewed credentials; another 401
+before a successful connection terminates the subscription. Automatic renewal
+failure preserves the original 401; direct `refreshAccessToken()` calls expose
+hook errors. The SDK transports opaque credentials and makes no identity or
+permission decisions.
+
 ## Agents
 
 `client.agents` wraps the core `/api/agents/*` routes — the running apteva-core child processes.
@@ -149,7 +341,10 @@ sub.close();
 
 For any other SSE endpoint, `client.subscribe(path, params, onEvent, opts?)` is the generic form `telemetry.stream` is built on.
 
-With an API key, `subscribe`/`stream` use authenticated fetch streaming and send the key in the `Authorization` header. Cookie-authenticated clients use native `EventSource`; in runtimes without it, pass a polyfill via `opts.EventSource`.
+With an API key or access token, `subscribe`/`stream` use authenticated fetch
+streaming and send the credential in the `Authorization` header. Access tokens
+are never placed in query strings. Cookie-authenticated clients use native
+`EventSource`; in runtimes without it, pass a polyfill via `opts.EventSource`.
 
 ## Chat
 
@@ -201,27 +396,20 @@ sub.close();
 
 Always address Channel Chat with `chat.id`. `thread_id` is informational and must not be used for message delivery. `instance_id` is a legacy response alias; new code should use `agent_id`.
 
-For a website user who is not an Apteva account, mint a delegated credential
-from your trusted backend and use that short-lived token in the browser:
+For a logged-in website user who is not an Apteva platform account, initialize
+the SDK with the application-user token returned by the site's authentication
+flow:
 
 ```ts
-// Customer backend only: this client holds the private sk- key.
-const projects = await adminClient.projects.list();
-const project = projects[0]; // or select one by name in your setup UI
-const token = await adminClient.delegatedUsers.create({
-  projectId: project.id,
-  subjectType: "website_user",
-  subjectId: authenticatedSiteUser.id,
-  agentId: 4,
-  allowedOrigins: ["https://customer.example"],
-  conversationDirective: "Help this visitor choose a subscription plan.",
-  expiresIn: 3600,
-});
+// `login` belongs to the website/Auth integration, not @apteva/web-sdk.
+const login = await websiteAuth.login(email, password);
+if (!login.apteva_access_token) {
+  throw new Error("No Apteva access policy is configured for this client");
+}
 
-// Return token.access_token to that authenticated website user. Browser code:
 const browserClient = new AptevaClient({
   baseURL: "https://agents.example.com",
-  apiKey: accessToken, // uk_… — never the private sk- key
+  accessToken: login.apteva_access_token,
 });
 const chat = await browserClient.chat.createOrResume(4, {
   title: "Customer support",
@@ -236,15 +424,16 @@ const lastMessage = history.at(-1);
 if (lastMessage) await browserClient.chat.markSeen(chat.id, lastMessage.id);
 ```
 
-The browser never submits `subject_id`, `project_id`, or a directive when it
-creates the conversation. Those trusted values come from the delegated
-credential. Reusing the same subject, project, agent, and `conversationKey`
-atomically resumes the same conversation. Delegated SSE uses authenticated
-`fetch()` streaming and omits cookie credentials. A resumed conversation keeps
-the directive established when it was first created; delegated browser clients
-cannot change it.
+The browser never submits `subject_id`, `project_id`, scopes, or a directive
+when it creates the conversation. Trusted identity comes from the credential;
+server policy selects permitted apps, actions, and agent IDs; Channel Chat
+enforces its chat-specific resources. Reusing the same subject, project, agent,
+and `conversationKey` atomically resumes the same conversation.
+
+`client.delegatedUsers.create(...)` remains available for older trusted-backend
+integrations, but is deprecated and is no longer the recommended website flow.
 
-**Rendering note:** `ChatMessage.components[]` carries the agent's `respond(components=…)` attachments. The SDK hands you the data, but rendering app-provided UI components needs a dynamic-component loader the SDK doesn't include yet — third-party UIs render text + a placeholder for now.
+**Rendering note:** `ChatMessage.components[]` carries the agent's `respond(components=…)` attachments. Use `AppComponentRegistry` to resolve these references against app-owned frontend exports, then render them in your host framework. The SDK does not dynamically load server-provided UI.
 
 A complete reference chat UI (message list, composer, streaming bubbles, optimistic send) lives in [`examples/dashboard/src/components/ChatCard.tsx`](./examples/dashboard/src/components/ChatCard.tsx).
 
@@ -284,7 +473,9 @@ The same code also works fine when hosted externally (Vercel, etc.) — `pickBas
 
 ## SSE transports
 
-Prefer `client.subscribe()` and the typed stream helpers. They select authenticated fetch streaming for API keys and credentialed native `EventSource` for cookie sessions.
+Prefer `client.subscribe()` and the typed stream helpers. They select
+authenticated fetch streaming for API keys and access tokens, and credentialed
+native `EventSource` for cookie sessions. Access tokens never enter the URL.
 
 `sseURL()` remains available for endpoints that explicitly accept an API key in the query string, or for external clients that must construct their own `EventSource`:
 

package/dist/apps.d.ts

@@ -0,0 +1,34 @@
+import type { AppComponentSpec } from "./components.js";
+/** Relevant fields of the existing platform /api/apps response. */
+export interface InstalledApp {
+    install_id: number;
+    name: string;
+    version: string;
+    project_id: string;
+    status: string;
+    display_name?: string;
+    source?: string;
+    ui_components?: AppComponentSpec[];
+    surfaces?: {
+        mcp_tool_names?: string[];
+        http_routes?: string[];
+    };
+}
+export interface AppRequirements {
+    app: string;
+    /** App packages choose their version policy; no implied wire/API version. */
+    version?: {
+        description: string;
+        accepts(version: string): boolean;
+    };
+    tools?: readonly string[];
+    components?: readonly string[];
+}
+export interface AppCompatibility {
+    compatible: boolean;
+    issues: string[];
+}
+/** Checks advertised metadata only. This never grants access to an app. */
+export declare function checkAppCompatibility(installed: InstalledApp | undefined, requirements: AppRequirements): AppCompatibility;
+export declare function assertAppCompatibility(installed: InstalledApp | undefined, requirements: AppRequirements): void;
+//# sourceMappingURL=apps.d.ts.map

package/dist/apps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../src/apps.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACnC,QAAQ,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,OAAO,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACrE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,YAAY,GAAG,SAAS,EACnC,YAAY,EAAE,eAAe,GAC5B,gBAAgB,CAiBlB;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,YAAY,GAAG,SAAS,EACnC,YAAY,EAAE,eAAe,GAC5B,IAAI,CAGN"}

package/dist/apps.js

@@ -0,0 +1,30 @@
+import { AptevaError } from "./errors.js";
+/** Checks advertised metadata only. This never grants access to an app. */
+export function checkAppCompatibility(installed, requirements) {
+    const issues = [];
+    if (!installed) {
+        issues.push(`app ${requirements.app} is not installed`);
+    }
+    else {
+        if (installed.name !== requirements.app)
+            issues.push(`expected app ${requirements.app}, got ${installed.name}`);
+        if (requirements.version && !requirements.version.accepts(installed.version)) {
+            issues.push(`version ${installed.version} does not satisfy ${requirements.version.description}`);
+        }
+        for (const tool of requirements.tools ?? []) {
+            if (!installed.surfaces?.mcp_tool_names?.includes(tool))
+                issues.push(`missing tool: ${tool}`);
+        }
+        for (const name of requirements.components ?? []) {
+            if (!installed.ui_components?.some((component) => component.name === name))
+                issues.push(`missing component: ${name}`);
+        }
+    }
+    return { compatible: issues.length === 0, issues };
+}
+export function assertAppCompatibility(installed, requirements) {
+    const result = checkAppCompatibility(installed, requirements);
+    if (!result.compatible)
+        throw new AptevaError(0, `incompatible app: ${result.issues.join("; ")}`);
+}
+//# sourceMappingURL=apps.js.map

package/dist/apps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.js","sourceRoot":"","sources":["../src/apps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgC1C,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CACnC,SAAmC,EACnC,YAA6B;IAE7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,OAAO,YAAY,CAAC,GAAG,mBAAmB,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,CAAC,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,YAAY,CAAC,GAAG,SAAS,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAChH,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,OAAO,qBAAqB,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,SAAmC,EACnC,YAA6B;IAE7B,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,EAAE,qBAAqB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpG,CAAC"}

package/dist/client.d.ts

@@ -1,15 +1,26 @@
-import type { Agent, AgentConfig, AgentCoreEvent, AgentCreateInput, AgentCreateResult, AgentDeleteResult, AgentPauseResult, AgentRestartResult, AgentStatus, AgentSystemMCPResult, AgentUpdateInput, AptevaClientOptions, AuthStatus, ChannelInfo, Chat, CreateChatOptions, CreateOrResumeChatOptions, ChatCreateResult, CreateDelegatedUserInput, DelegatedUserToken, ChatHistoryMessage, ChatMessage, ChatMessagesQuery, ChatSendInput, ChatSendOptions, ChatStreamOptions, MCPCallResponse, Project, StreamHandle, SubscribeOptions, TelemetryEvent, TelemetryPeriod, TelemetryQuery, TelemetryStats, Thread, TimelineBucket, UpdateChatOptions, User } from "./types.js";
+import type { AppExtension, AppScope } from "./extensions.js";
+import type { InstalledApp } from "./apps.js";
+import type { Agent, AgentConfig, AgentCoreEvent, AgentCreateInput, AgentCreateResult, AgentDeleteResult, AgentPauseResult, AgentRestartResult, AgentStatus, AgentSystemMCPResult, AgentUpdateInput, AptevaClientOptions, AuthStatus, ChannelInfo, Chat, CreateChatOptions, CreateOrResumeChatOptions, ChatCreateResult, CreateDelegatedUserInput, DelegatedUserToken, ChatHistoryMessage, ChatMessage, ChatMessagesQuery, ChatSendInput, ChatSendOptions, ChatStreamOptions, MCPCallResponse, Project, StreamHandle, SubscribeOptions, SSEEventMetadata, TelemetryEvent, TelemetryPeriod, TelemetryQuery, TelemetryStats, Thread, TimelineBucket, UpdateChatOptions, User } from "./types.js";
 export declare class AptevaClient {
     private readonly baseURL;
     private apiKey?;
+    private accessToken?;
     private readonly projectId?;
     private readonly fetchImpl;
     private readonly onUnauthorized?;
     private readonly timeoutMs;
+    private readonly refreshTokenHook?;
+    private credentialRevision;
+    private pendingTokenRefresh?;
     private readonly pendingChatResolutions;
     constructor(opts: AptevaClientOptions);
     setApiKey(key: string | undefined): void;
     getApiKey(): string | undefined;
+    setAccessToken(token: string | undefined): void;
+    getAccessToken(): string | undefined;
+    /** Refresh once for concurrent callers. Undefined leaves credentials unchanged. */
+    refreshAccessToken(): Promise<boolean>;
+    private renewAfterUnauthorized;
     readonly auth: {
         register: (email: string, password: string, name?: string) => Promise<{
             user: User;
@@ -34,6 +45,7 @@ export declare class AptevaClient {
         list: () => Promise<Project[]>;
         get: (id: string) => Promise<Project>;
     };
+    /** @deprecated Prefer AptevaClient({ accessToken }). */
     readonly delegatedUsers: {
         create: (input: CreateDelegatedUserInput) => Promise<DelegatedUserToken>;
     };
@@ -57,7 +69,7 @@ export declare class AptevaClient {
         togglePause: (id: number) => Promise<AgentPauseResult>;
         event: <R = unknown>(id: number, body: Record<string, unknown>) => Promise<R>;
         control: <R = unknown>(id: number, body: Record<string, unknown>) => Promise<R>;
-        events: <E = AgentCoreEvent>(id: number, onEvent: (event: E) => void, opts?: SubscribeOptions) => StreamHandle;
+        events: <E = AgentCoreEvent>(id: number, onEvent: (event: E, metadata: SSEEventMetadata) => void, opts?: SubscribeOptions) => StreamHandle;
     };
     readonly telemetry: {
         query: (q: TelemetryQuery) => Promise<TelemetryEvent[]>;
@@ -82,29 +94,40 @@ export declare class AptevaClient {
             last_seen_id: number;
         }>;
     };
-    app<T = unknown>(name: string): AppHandle<T>;
-    callTool<R>(appName: string, toolName: string, args: Record<string, unknown>): Promise<R>;
+    app<T = unknown>(name: string, scope?: AppScope): AppHandle<T>;
+    /** Create an extension instance. Retain it in the host; use() does not cache. */
+    use<T>(extension: AppExtension<T>, scope?: AppScope): T;
+    readonly apps: {
+        /** Requires the platform's existing app-list permission. No auth bypass. */
+        list: (scope?: Pick<AppScope, "projectId">, init?: RequestInit) => Promise<InstalledApp[]>;
+    };
+    callTool<R>(appName: string, toolName: string, args: Record<string, unknown>, init?: RequestInit): Promise<R>;
     get<R>(path: string, init?: RequestInit): Promise<R>;
     post<R>(path: string, body?: unknown, init?: RequestInit): Promise<R>;
     put<R>(path: string, body?: unknown, init?: RequestInit): Promise<R>;
     patch<R>(path: string, body?: unknown, init?: RequestInit): Promise<R>;
     del<R>(path: string, init?: RequestInit): Promise<R>;
     sseURL(path: string, params?: Record<string, string | number | undefined>): string;
-    subscribe<E>(path: string, params: Record<string, string | number | undefined> | undefined, onEvent: (event: E) => void, opts?: SubscribeOptions): StreamHandle;
+    subscribe<E>(path: string, params: Record<string, string | number | undefined> | undefined, onEvent: (event: E, metadata: SSEEventMetadata) => void, opts?: SubscribeOptions): StreamHandle;
     private subscribeWithFetch;
     private bindAbortSignal;
     private appPath;
+    private bearerToken;
+    private isAccessTokenCredential;
     private request;
 }
 export declare function unwrapMCP<R>(env: MCPCallResponse<unknown>): R;
 export interface AppHandle<TDefault = unknown> {
     readonly name: string;
-    get<R = TDefault>(path: string): Promise<R>;
-    post<R = TDefault>(path: string, body?: unknown): Promise<R>;
-    put<R = TDefault>(path: string, body?: unknown): Promise<R>;
-    patch<R = TDefault>(path: string, body?: unknown): Promise<R>;
-    del<R = TDefault>(path: string): Promise<R>;
-    tool<R = TDefault>(name: string, args?: Record<string, unknown>): Promise<R>;
+    readonly projectId?: string;
+    readonly installId?: number;
+    get<R = TDefault>(path: string, init?: RequestInit): Promise<R>;
+    post<R = TDefault>(path: string, body?: unknown, init?: RequestInit): Promise<R>;
+    put<R = TDefault>(path: string, body?: unknown, init?: RequestInit): Promise<R>;
+    patch<R = TDefault>(path: string, body?: unknown, init?: RequestInit): Promise<R>;
+    del<R = TDefault>(path: string, init?: RequestInit): Promise<R>;
+    tool<R = TDefault>(name: string, args?: Record<string, unknown>, init?: RequestInit): Promise<R>;
+    subscribe<E>(path: string, onEvent: (event: E, metadata: SSEEventMetadata) => void, opts?: SubscribeOptions): StreamHandle;
     mcpURL(queryParams?: Record<string, string>): string;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,WAAW,EACX,IAAI,EACJ,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,iBAAiB,EAEjB,eAAe,EACf,OAAO,EAEP,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,IAAI,EACL,MAAM,YAAY,CAAC;AAIpB,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAoC;gBAE/D,IAAI,EAAE,mBAAmB;IAWrC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAIxC,SAAS,IAAI,MAAM,GAAG,SAAS;IAO/B,QAAQ,CAAC,IAAI;0BACO,MAAM,YAAY,MAAM,SAAS,MAAM;kBACrC,IAAI;;uBAET,MAAM,YAAY,MAAM;;;;kCASb,MAAM,QAAQ,MAAM;;gBAIvB,MAAM;kBAAQ,MAAM;wBAAc,MAAM;;0BAI7C,MAAM;gBACN,MAAM;iBAAO,MAAM;;wBAErB,MAAM;MACtB;IAEF,QAAQ,CAAC,QAAQ;;kBAEL,MAAM;MAChB;IAKF,QAAQ,CAAC,cAAc;wBACL,wBAAwB;MAYxC;IAKF,QAAQ,CAAC,MAAM;;wBAGG,gBAAgB;kBAGtB,MAAM;qBAEH,MAAM,SAAS,gBAAgB;qBAG/B,MAAM,QAAQ,MAAM;qBAGpB,MAAM;qBAGN,MAAM;sBAEL,MAAM;uBAEL,MAAM;0BAEH,MAAM;iBAKf,CAAC,oBAAoB,MAAM;uBAGrB,CAAC,oBAAoB,MAAM,UAAU,WAAW;wBAG/C,MAAM,QAAQ,UAAU,GAAG,iBAAiB,UAAU,OAAO;oBAUjE,MAAM;mBAGP,MAAM;sBAGH,MAAM;0BAOF,MAAM;gBAKhB,CAAC,gBAAgB,MAAM,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;kBAGpD,CAAC,gBAAgB,MAAM,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;iBAGvD,CAAC,uBACJ,MAAM,WACD,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,SACpB,gBAAgB,KACtB,YAAY;MAEf;IAIF,QAAQ,CAAC,SAAS;mBAEL,cAAc;4BAWL,MAAM,WAAU,eAAe;yBAMlC,MAAM,WAAU,eAAe;0BAUrC,MAAM,WACN,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,SACjC,gBAAgB,KACtB,YAAY;MAgBf;IAMF,QAAQ,CAAC,IAAI;wBAEK,MAAM;sBAKR,MAAM;0BAOF,MAAM,YAAY,MAAM,GAAG,iBAAiB;kCAapC,MAAM,WAAW,yBAAyB;yBASnD,MAAM,WAAW,iBAAiB;+BAa5B,MAAM,YAAY,MAAM,GAAG,iBAAiB;4BAiBlC,MAAM,UAAS,iBAAiB;2BAQhD,MAAM,UAAS,iBAAiB;2BAQhC,MAAM,SAAS,aAAa;;uBAkBnC,MAAM,kBACE,MAAM,GAAG,aAAa,YAC7B,eAAe;yBA2BT,MAAM,QAAQ,iBAAiB,KAAG,YAAY;2BAmB5C,MAAM,aAAa,MAAM;0BAChB,MAAM;;MAIlC;IAOF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IA4BtC,QAAQ,CAAC,CAAC,EACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,CAAC,CAAC;IAeb,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAGpD,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAGrE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAGpE,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAGtE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAQpD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM;IAwBlF,SAAS,CAAC,CAAC,EACT,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,EAC/D,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,EAC3B,IAAI,CAAC,EAAE,gBAAgB,GACtB,YAAY;IAkDf,OAAO,CAAC,kBAAkB;IA4H1B,OAAO,CAAC,eAAe;IAgBvB,OAAO,CAAC,OAAO;YASD,OAAO;CAyDtB;AAgBD,wBAAgB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAgB7D;AAED,MAAM,WAAW,SAAS,CAAC,QAAQ,GAAG,OAAO;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7D,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5D,KAAK,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;CACtD"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,WAAW,EACX,IAAI,EACJ,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,iBAAiB,EAEjB,eAAe,EACf,OAAO,EAEP,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,IAAI,EACL,MAAM,YAAY,CAAC;AAIpB,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAoC;IACtE,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,mBAAmB,CAAC,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAoC;gBAE/D,IAAI,EAAE,mBAAmB;IAarC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAKxC,SAAS,IAAI,MAAM,GAAG,SAAS;IAO/B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK/C,cAAc,IAAI,MAAM,GAAG,SAAS;IAIpC,mFAAmF;IAC7E,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC;YAmB9B,sBAAsB;IAcpC,QAAQ,CAAC,IAAI;0BACO,MAAM,YAAY,MAAM,SAAS,MAAM;kBACrC,IAAI;;uBAET,MAAM,YAAY,MAAM;;;;kCASb,MAAM,QAAQ,MAAM;;gBAIvB,MAAM;kBAAQ,MAAM;wBAAc,MAAM;;0BAI7C,MAAM;gBACN,MAAM;iBAAO,MAAM;;wBAErB,MAAM;MACtB;IAEF,QAAQ,CAAC,QAAQ;;kBAEL,MAAM;MAChB;IAKF,wDAAwD;IACxD,QAAQ,CAAC,cAAc;wBACL,wBAAwB;MAYxC;IAKF,QAAQ,CAAC,MAAM;;wBAGG,gBAAgB;kBAGtB,MAAM;qBAEH,MAAM,SAAS,gBAAgB;qBAG/B,MAAM,QAAQ,MAAM;qBAGpB,MAAM;qBAGN,MAAM;sBAEL,MAAM;uBAEL,MAAM;0BAEH,MAAM;iBAKf,CAAC,oBAAoB,MAAM;uBAGrB,CAAC,oBAAoB,MAAM,UAAU,WAAW;wBAG/C,MAAM,QAAQ,UAAU,GAAG,iBAAiB,UAAU,OAAO;oBAUjE,MAAM;mBAGP,MAAM;sBAGH,MAAM;0BAOF,MAAM;gBAKhB,CAAC,gBAAgB,MAAM,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;kBAGpD,CAAC,gBAAgB,MAAM,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;iBAGvD,CAAC,uBACJ,MAAM,WACD,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,KAAK,IAAI,SAChD,gBAAgB,KACtB,YAAY;MAEf;IAIF,QAAQ,CAAC,SAAS;mBAEL,cAAc;4BAWL,MAAM,WAAU,eAAe;yBAMlC,MAAM,WAAU,eAAe;0BAUrC,MAAM,WACN,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,SACjC,gBAAgB,KACtB,YAAY;MAgBf;IAMF,QAAQ,CAAC,IAAI;wBAEK,MAAM;sBAKR,MAAM;0BAOF,MAAM,YAAY,MAAM,GAAG,iBAAiB;kCAapC,MAAM,WAAW,yBAAyB;yBASnD,MAAM,WAAW,iBAAiB;+BAa5B,MAAM,YAAY,MAAM,GAAG,iBAAiB;4BAiBlC,MAAM,UAAS,iBAAiB;2BAQhD,MAAM,UAAS,iBAAiB;2BAQhC,MAAM,SAAS,aAAa;;uBAkBnC,MAAM,kBACE,MAAM,GAAG,aAAa,YAC7B,eAAe;yBA2BT,MAAM,QAAQ,iBAAiB,KAAG,YAAY;2BAmB5C,MAAM,aAAa,MAAM;0BAChB,MAAM;;MAIlC;IAOF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,QAAa,GAAG,SAAS,CAAC,CAAC,CAAC;IAoDlE,iFAAiF;IACjF,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,CAAC;IAIvD,QAAQ,CAAC,IAAI;QACX,4EAA4E;uBAC9D,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,SAAc,WAAW;MAKlE;IAII,QAAQ,CAAC,CAAC,EACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,CAAC,CAAC;IAeb,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAGpD,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAGrE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAGpE,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAGtE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAQpD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM;IAwBlF,SAAS,CAAC,CAAC,EACT,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,EAC/D,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,KAAK,IAAI,EACvD,IAAI,CAAC,EAAE,gBAAgB,GACtB,YAAY;IA2Ef,OAAO,CAAC,kBAAkB;IAmJ1B,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,uBAAuB;YAIjB,OAAO;CA4DtB;AAgBD,wBAAgB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAgB7D;AAED,MAAM,WAAW,SAAS,CAAC,QAAQ,GAAG,OAAO;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjF,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChF,KAAK,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClF,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjG,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,KAAK,IAAI,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,YAAY,CAAC;IAC3H,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;CACtD"}