@apteva/web-sdk 0.8.0 → 0.10.0

package/CHANGELOG.md

@@ -1,3 +1,33 @@
+## 0.10.0
+
+- Add generic opt-in managed Auth persistence (`auth.persistence: "local"`),
+  `auth.restore()`, credential-free restoration state, and `auth.dispose()`.
+- Persist only refresh credentials and versioned scope/session metadata. Keep
+  access tokens and authoritative identity/permissions in memory.
+- Coordinate same-origin tabs with Web Locks, notifications and durable refresh
+  markers; reject unsafe reuse after lost responses, crashes or uncertain commits.
+- Preserve memory-only defaults, explicit app credential selection and no write
+  replay. Browsers without Web Locks/storage use memory-only login.
+- No implicit legacy-format import; adoption requires one login.
+- Pair persistence with Auth v0.12.1 for explicit retry-safe refresh errors.
+
+## 0.9.0
+
+- Add `credential: "auth" | "platform"` to app handles, extensions and frontend
+  loaders. HTTP, MCP and SSE use the selected credential within one managed session.
+- Refresh Auth and platform credentials independently with shared renewal across
+  handles. Auth routes remain usable when platform minting is unavailable.
+- Prevent stale mints and old-session 401s from overwriting a newer session.
+  Both stream types reconnect at their credential expiry and close on logout or
+  detected session revocation. No credential fallback or HTTP replay after a 401.
+- Restrict managed forwarding to the configured server, project and scoped app
+  routes; reject escaped paths, URL credentials, header overrides and redirects.
+- Managed `getAccessToken()` now returns `undefined`; use app handles instead.
+  Host-owned opaque-token transport retains its existing behavior.
+- Add mixed-session regression tests and an opt-in integration harness using real
+  Auth, API and Telephony handlers. Platform mint/Conversations gateway are fixtures.
+- Requires Auth v0.12.0 or newer. No additional Auth or server release required.
+
 ## 0.8.0
 
 - Add unified Auth app login/signup, user lookup, session metadata, automatic

package/README.md

@@ -557,7 +557,7 @@ bun run serve
 
 MIT
 
-## One client for Auth app sessions (v0.8.0)
+## One client for Auth app sessions (v0.9.0)
 
 With Auth app v0.12.0 or newer, configure `auth` and use the same client for
 login, app requests, agents and logout:
@@ -576,7 +576,17 @@ const apteva = new AptevaClient({
 });
 
 const user = await apteva.auth.login({ email, password });
-await apteva.app("conversations").get("/chats");
+const crm = apteva.app("api", { credential: "auth" });
+const conversations = apteva.app("conversations", { credential: "platform" });
+await crm.get("/YOUR_CRM_ROUTE");
+await conversations.get("/chats");
+
+const telephony = await apteva.apps.load("telephony", {
+  credential: "auth",
+  installId: YOUR_TELEPHONY_INSTALL_ID,
+  clientOptions: { authProvider: "YOUR_CONFIGURED_PROVIDER" },
+});
+// The loaded client keeps this Auth handle for /user/ calls and subscriptions.
 await apteva.auth.logout();
 ```
 
@@ -588,40 +598,161 @@ metadata without credentials. `auth.status()` reports local session presence.
 `auth.refresh()` explicitly requests a fresh platform credential when needed.
 
 Auth owns identity and authorization. Configure its trusted role bindings and
-matching platform policies with `token_ttl_seconds: 60` before enabling protected
-app access. Login can succeed without app permissions; app calls then fail closed
-until an authorized policy can mint a token. A requested profile never grants a
+matching platform policies with `token_ttl_seconds: 60` before enabling platform
+app access. Login can succeed without platform permissions; platform calls fail
+closed until an authorized policy can mint a token. Auth-credential routes remain
+available according to their own current user permissions. A requested profile never grants a
 role. The SDK does not infer permissions or mint credentials itself.
 
 The SDK privately maintains the normal Auth session plus its short-lived
-platform token. Before an app request it renews a platform token that is within
-ten seconds of expiry. Expired/stale Auth credentials use the normal refresh
-flow. Concurrent operations share renewal and refresh-token rotation; no custom
+platform token. Choose `credential: "auth"` for API Auth-policy routes and
+Telephony `/user/` routes; choose `"platform"` for Conversations. Omitted choices
+default to `"platform"`. The choice applies to every HTTP method, MCP tool and
+subscription on that handle, and to `client.use` and `client.apps.load`. Loaded
+frontend assets and the resulting app client share the selected handle.
+
+Before a request, the SDK renews the selected credential when it is within ten
+seconds of expiry. Auth tokens use the normal Auth refresh flow; platform tokens
+use `/delegated-token`. Auth requests do not require a working mint policy. Concurrent operations share renewal and refresh-token rotation; no custom
 refresh callback or application token endpoint is required. Both the returned
 absolute expiry and remaining lifetime limit credential use. Fetch streams
 reconnect at token expiry and close on local logout. SDK stream reconnection is
 not server-side revocation: already-admitted work or a modified client may outlive
 token expiry unless the receiving app enforces its own lifetime.
 
-Sessions are kept **in memory**, not written to localStorage, sessionStorage or
-cookies. Reuse one client per application session. Reloads/new tabs require
-login and do not implicitly share a rotating refresh credential. Do not copy
-refresh tokens between clients/tabs. This release deliberately does not provide
-persistent/shared browser sessions.
+Sessions default to **memory-only**. Reuse one client per application session.
+Reloads/new tabs require login unless the host explicitly enables persistent
+sessions as described below. Do not manage or copy refresh credentials yourself.
 
 `auth` mode cannot be combined with `apiKey`, `accessToken` or
 `refreshAccessToken`; `setApiKey` and `setAccessToken` are unavailable in this
-mode. User requests omit cookies and never fall back to a kiosk or administrator
+mode. `getAccessToken()` now returns `undefined` in managed mode: use scoped
+handles instead of extracting either credential. Host-owned opaque tokens retain
+the existing getter behavior. Auth handles cannot change the configured project
+or escape their app routes; credentials are never forwarded through redirects
+or accepted from URL parameters or header overrides.
+
+User requests omit cookies and never fall back to a kiosk or administrator
 credential. Platform administrator operations such as `auth.listKeys()` are
 rejected in app Auth mode. Without `auth` configuration, existing platform
 login and opaque-token APIs retain their original behavior.
 
-A temporary mint failure preserves the normal Auth session and blocks protected
-app requests. A rejected Auth refresh clears the session. Local logout clears
+A temporary mint failure preserves the normal Auth session and blocks only
+platform-credential requests. Credential types never switch after an error. A rejected Auth refresh clears the session. Local logout clears
 credentials and streams immediately; a failed network logout still throws so the
 host can report that server-side revocation could not be confirmed. A late
 renewal cannot restore a logged-out session. HTTP writes are never automatically
 replayed after a 401; successful renewal prepares subsequent calls. Unlike legacy
-transport mode, a successfully recovered platform 401 does not trigger the
+transport mode, a successfully recovered 401 does not trigger the
 `onUnauthorized` callback in managed Auth mode, although the original call still
 rejects. Reconcile a write's outcome before retrying it.
+
+
+### Mixed-app integration check
+
+Run `APTEVA_APPS_DIR=/path/to/apps bun run test:mixed-apps` with a compatible Go
+compiler (`GO_BINARY` can select it). This uses real Auth handlers, API's
+`auth_jwt` validator and Telephony's `/user/` handler, temporary databases and
+local fixture servers. The platform mint API and protected Conversations gateway
+are simulated. It verifies routing, role downgrade, and server-side session
+revocation without accessing live accounts or carriers. Set `SDK_TEST_MODULE` to
+an unpacked package's `dist/index.js` to check the release artifact.
+
+
+## Optional persistent Auth sessions
+
+Persistence is application-independent and opt-in. It uses the same managed Auth
+session as HTTP, MCP, frontend loaders and streams; app credential selection does
+not change. No customer-specific storage key, legacy session format or routing is
+built into the SDK.
+
+```ts
+const client = new AptevaClient({
+  baseURL,
+  projectId,
+  auth: {
+    clientId,
+    persistence: "local", // default: "memory"
+    onStateChange: state => renderSessionState(state),
+    onSessionChange: session => renderUser(session?.user),
+  },
+});
+
+try {
+  await client.auth.restore();
+} catch {
+  // Show a retry action or login, according to client.auth.getState().
+}
+
+const crm = client.app("api", { credential: "auth" });
+const conversations = client.app("conversations", { credential: "platform" });
+```
+
+`auth.getState()` reports `status` (`idle`, `restoring`, `authenticated`,
+`unauthenticated`, or `error`), effective `persistence` (`memory`, `local`, or
+`unavailable`) and optional credential-free error metadata. Render loading for
+`idle`/`restoring`, rather than briefly displaying the login screen. Concurrent
+`restore()` calls share one promise. Protected requests await pending restoration
+and can start initial restoration themselves. After a restoration error, retry
+explicitly with `restore()` or log in; requests do not repeatedly retry it.
+
+Only the refresh credential, format version, configuration scope and locally
+generated session/revision identifiers are persisted in localStorage. Normal Auth
+and platform access tokens, user details and permissions stay in memory. The
+`/refresh` response supplies the authoritative user and authorization context.
+`getSession()`, `getState()`, callbacks and cross-tab notifications expose no
+credentials. Browser storage is JavaScript-readable: enabling it deliberately
+accepts the same-origin script/XSS exposure of a persisted refresh credential.
+
+Storage and lock namespaces include the canonical server URL, project, Auth
+installation (or automatic routing), organization, public client and profile.
+Use consistent configuration across tabs that should share a session. Cross-tab
+sharing is limited to the same browser origin and storage partition. Different
+scopes do not import each other's credentials or identities.
+
+Native Web Locks serialize login, restore, refresh and logout. Each refresh reads
+the latest saved credential under the lock, writes an in-progress marker before
+sending it, then saves the replacement before releasing the lock. Other tabs are
+notified without broadcasting credentials. Switching accounts invalidates the
+previous local session and closes its streams. Disposed clients release browser
+listeners and local streams through `client.auth.dispose()` without revoking or
+deleting the saved session.
+
+If localStorage or Web Locks are unavailable, `persistence` reports `unavailable`
+and a fresh login works in memory-only mode. There is no localStorage-based lock
+fallback. If saving a rotated credential fails, the replacement remains in memory
+and the durable in-progress marker prevents other tabs from reusing the old one.
+A failure reading previously shared credentials requires a new login; the SDK
+cannot safely promote a potentially stale in-memory refresh to an independent
+session.
+
+Logout clears local credentials and streams immediately. It then clears the
+saved refresh credential under the shared lock, notifies other tabs, and asks
+Auth to revoke the session. A failed network logout still rejects: local logout
+does not guarantee server-side revocation while offline. Late refresh results
+cannot replace a newer login or resurrect a completed logout.
+
+Restoration failure handling:
+
+| Result | SDK behavior |
+| --- | --- |
+| Auth rejects an invalid/revoked refresh with 401 | Clear the saved and local session; login is required. |
+| Browser is already offline before sending | Preserve the saved credential; retry restoration when connected. |
+| Auth returns `refresh_unavailable` with 503 | Auth confirms rotation did not commit; preserve the credential for explicit retry. |
+| Network failure, generic proxy 5xx, malformed response, or `refresh_uncertain` | Preserve an uncertain marker; do not reuse the old credential. If no replacement was saved, require login. |
+| Platform mint denied | Restore the Auth session; platform-protected access remains blocked. |
+| Unsupported or malformed storage format | Fail closed; login or logout replaces the record. |
+
+The explicit retry-safe and uncertain response codes require Auth v0.12.1
+or newer. With older Auth versions, generic errors
+are handled conservatively. A tab crash after server rotation but before saving
+the response cannot be recovered transparently with single-use refresh tokens.
+
+There is no automatic legacy-session migration. Existing customer storage is not
+read or deleted; hosts should remove their old refresh loops and require one
+login when adopting persistence. Any future import must be a separate explicit,
+tested SDK API. HTTP writes are never replayed automatically after a 401.
+
+Validate native browser behavior with `bunx playwright install chromium` followed
+by `bun run test:persistence:browser`. These checks use isolated local fixtures,
+real tabs, Web Locks and localStorage; they do not contact customer accounts.

package/dist/auth-session.d.ts

@@ -1,3 +1,5 @@
+import { type PersistenceEnvironment } from "./session-persistence.js";
+import type { AppCredential } from "./extensions.js";
 import type { User } from "./types.js";
 export interface AuthLoginInput {
     email: string;
@@ -24,6 +26,14 @@ export interface AuthSessionInfo {
     expiresAt: string;
     platformExpiresAt?: string;
 }
+export interface AuthState {
+    status: "idle" | "restoring" | "authenticated" | "unauthenticated" | "error";
+    persistence: "memory" | "local" | "unavailable";
+    error?: {
+        code: string;
+        message: string;
+    };
+}
 export interface AppAuthOptions {
     /** Public Auth app OAuth client identifier; never a private client secret. */
     clientId: string;
@@ -31,9 +41,19 @@ export interface AppAuthOptions {
     organizationSlug?: string;
     /** Requested Auth policy profile. Auth independently checks current roles. */
     profile?: string;
-    /** Receives user/session metadata, never credentials. Sessions are memory-only. */
+    /** Explicit opt-in. Local persistence requires browser storage and Web Locks. */
+    persistence?: "memory" | "local";
+    /** Restoration and persistence availability, without credentials. */
+    onStateChange?: (state: AuthState) => void;
+    /** Receives user/session metadata, never credentials. */
     onSessionChange?: (session: AuthSessionInfo | undefined) => void;
 }
+export interface SessionCredential {
+    token: string;
+    epoch: number;
+    revision: number;
+    deadline: number;
+}
 /** Internal issuer-specific session lifecycle. AptevaClient is the public API. */
 export declare class AuthSession {
     private readonly baseURL;
@@ -42,12 +62,27 @@ export declare class AuthSession {
     private readonly fetchImpl;
     private readonly changed;
     private state?;
+    private persistence?;
+    private stored?;
+    private restoration?;
+    private lifecycle;
+    private disposed;
     private epoch;
+    private authRevision;
+    private platformRevision;
     private pending?;
     private pendingAuth?;
     private controllers;
     private listeners;
-    constructor(baseURL: string, projectId: string, options: AppAuthOptions, fetchImpl: typeof fetch, changed: (token: string | undefined) => void);
+    constructor(baseURL: string, projectId: string, options: AppAuthOptions, fetchImpl: typeof fetch, changed: (token: string | undefined) => void, environment?: PersistenceEnvironment);
+    getState(): AuthState;
+    private emitState;
+    private status;
+    private synchronize;
+    private ready;
+    restore(): Promise<AuthSessionInfo | undefined>;
+    private restoreSaved;
+    dispose(): void;
     info(): AuthSessionInfo | undefined;
     onClear(listener: () => void): () => void;
     private notify;
@@ -56,18 +91,22 @@ export declare class AuthSession {
     private call;
     private input;
     private platform;
+    private validateResponse;
     private accept;
+    private establish;
     login(input: AuthLoginInput): Promise<AuthUser>;
     register(input: AuthSignupInput): Promise<{
         user: AuthUser;
         verification_required?: boolean;
     }>;
     logout(): Promise<void>;
+    private refreshSaved;
     private refreshAuth;
     private performAuthRefresh;
     private renew;
     token(force?: boolean): Promise<string>;
     me(): Promise<AuthUser>;
-    platformDeadline(): number;
+    credential(kind: AppCredential): Promise<SessionCredential>;
+    recover(kind: AppCredential, used: SessionCredential): Promise<boolean>;
 }
 //# sourceMappingURL=auth-session.d.ts.map

package/dist/auth-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-session.d.ts","sourceRoot":"","sources":["../src/auth-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,cAAc;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AACnE,MAAM,WAAW,eAAgB,SAAQ,cAAc;IAAG,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE;AAChF,MAAM,WAAW,QAAS,SAAQ,IAAI;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,KAAK,IAAI,CAAC;CAClE;AAeD,kFAAkF;AAClF,qBAAa,WAAW;IAQpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAX1B,OAAO,CAAC,KAAK,CAAC,CAAQ;IACtB,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,OAAO,CAAC,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAC,CAAgB;IACpC,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,SAAS,CAAyB;gBAEvB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,OAAO,KAAK,EACvB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI;IAK/D,IAAI,IAAI,eAAe,GAAG,SAAS;IAMnC,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IACzC,OAAO,CAAC,MAAM;IAGd,KAAK,IAAI,IAAI;IAWb,OAAO,CAAC,WAAW;YAGL,IAAI;IAelB,OAAO,CAAC,KAAK;IAGb,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,MAAM;IAcR,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;IAK/C,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAO9F,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YAKf,WAAW;YAMX,kBAAkB;YAWlB,KAAK;IAyBb,KAAK,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAcrC,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC;IAmB7B,gBAAgB,IAAI,MAAM;CAC3B"}
+{"version":3,"file":"auth-session.d.ts","sourceRoot":"","sources":["../src/auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4D,KAAK,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACjI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,cAAc;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AACnE,MAAM,WAAW,eAAgB,SAAQ,cAAc;IAAG,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE;AAChF,MAAM,WAAW,QAAS,SAAQ,IAAI;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,eAAe,GAAG,iBAAiB,GAAG,OAAO,CAAC;IAC7E,WAAW,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IAChD,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AACD,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACjC,qEAAqE;IACrE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC3C,yDAAyD;IACzD,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,KAAK,IAAI,CAAC;CAClE;AAYD,MAAM,WAAW,iBAAiB;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAIvG,kFAAkF;AAClF,qBAAa,WAAW;IAepB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAlB1B,OAAO,CAAC,KAAK,CAAC,CAAQ;IACtB,OAAO,CAAC,WAAW,CAAC,CAAqB;IACzC,OAAO,CAAC,MAAM,CAAC,CAAgB;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAuC;IAC3D,OAAO,CAAC,SAAS,CAAmE;IACpF,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,OAAO,CAAC,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAC,CAAgB;IACpC,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,SAAS,CAAyB;gBAEvB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,OAAO,KAAK,EACvB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,EAC7D,WAAW,CAAC,EAAE,sBAAsB;IAatC,QAAQ,IAAI,SAAS;IACrB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,WAAW;YAgBL,KAAK;IAOnB,OAAO,IAAI,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;YAajC,YAAY;IAc1B,OAAO,IAAI,IAAI;IACf,IAAI,IAAI,eAAe,GAAG,SAAS;IAMnC,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IACzC,OAAO,CAAC,MAAM;IAGd,KAAK,IAAI,IAAI;IAab,OAAO,CAAC,WAAW;YAGL,IAAI;IAwBlB,OAAO,CAAC,KAAK;IAGb,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,gBAAgB;IAGxB,OAAO,CAAC,MAAM;YAeA,SAAS;IA8BjB,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAI9F,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YA0Bf,YAAY;YA+BZ,WAAW;YAMX,kBAAkB;YAyBlB,KAAK;IA+Bb,KAAK,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBrC,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC;IAoBvB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmB3D,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;CAS9E"}