@apteva/web-sdk 0.9.0 → 0.10.1

package/CHANGELOG.md

@@ -1,3 +1,26 @@
+## 0.10.1
+
+- Keep an active managed Auth session after Auth explicitly reports a retryable
+  pre-commit refresh failure. Continue to reject the failed request and retry
+  refresh on a later request.
+- Treat only `401 invalid_grant` as definitive refresh rejection. Retain an
+  uncertain marker for generic 401, timeout and proxy errors so a single-use
+  credential cannot be replayed.
+- Add credential-free `onDiagnostic` refresh outcomes and session-clear reasons.
+
+## 0.10.0
+
+- Add generic opt-in managed Auth persistence (`auth.persistence: "local"`),
+  `auth.restore()`, credential-free restoration state, and `auth.dispose()`.
+- Persist only refresh credentials and versioned scope/session metadata. Keep
+  access tokens and authoritative identity/permissions in memory.
+- Coordinate same-origin tabs with Web Locks, notifications and durable refresh
+  markers; reject unsafe reuse after lost responses, crashes or uncertain commits.
+- Preserve memory-only defaults, explicit app credential selection and no write
+  replay. Browsers without Web Locks/storage use memory-only login.
+- No implicit legacy-format import; adoption requires one login.
+- Pair persistence with Auth v0.12.1 for explicit retry-safe refresh errors.
+
 ## 0.9.0
 
 - Add `credential: "auth" | "platform"` to app handles, extensions and frontend

package/README.md

@@ -620,11 +620,9 @@ reconnect at token expiry and close on local logout. SDK stream reconnection is
 not server-side revocation: already-admitted work or a modified client may outlive
 token expiry unless the receiving app enforces its own lifetime.
 
-Sessions are kept **in memory**, not written to localStorage, sessionStorage or
-cookies. Reuse one client per application session. Reloads/new tabs require
-login and do not implicitly share a rotating refresh credential. Do not copy
-refresh tokens between clients/tabs. This release deliberately does not provide
-persistent/shared browser sessions.
+Sessions default to **memory-only**. Reuse one client per application session.
+Reloads/new tabs require login unless the host explicitly enables persistent
+sessions as described below. Do not manage or copy refresh credentials yourself.
 
 `auth` mode cannot be combined with `apiKey`, `accessToken` or
 `refreshAccessToken`; `setApiKey` and `setAccessToken` are unavailable in this
@@ -640,7 +638,10 @@ rejected in app Auth mode. Without `auth` configuration, existing platform
 login and opaque-token APIs retain their original behavior.
 
 A temporary mint failure preserves the normal Auth session and blocks only
-platform-credential requests. Credential types never switch after an error. A rejected Auth refresh clears the session. Local logout clears
+platform-credential requests. Credential types never switch after an error. An
+explicit `refresh_unavailable` response keeps an active session and permits a
+later refresh attempt; an `invalid_grant` response clears it. An uncertain
+refresh outcome cannot safely reuse a single-use credential. Local logout clears
 credentials and streams immediately; a failed network logout still throws so the
 host can report that server-side revocation could not be confirmed. A late
 renewal cannot restore a logged-out session. HTTP writes are never automatically
@@ -659,3 +660,107 @@ local fixture servers. The platform mint API and protected Conversations gateway
 are simulated. It verifies routing, role downgrade, and server-side session
 revocation without accessing live accounts or carriers. Set `SDK_TEST_MODULE` to
 an unpacked package's `dist/index.js` to check the release artifact.
+
+
+## Optional persistent Auth sessions
+
+Persistence is application-independent and opt-in. It uses the same managed Auth
+session as HTTP, MCP, frontend loaders and streams; app credential selection does
+not change. No customer-specific storage key, legacy session format or routing is
+built into the SDK.
+
+```ts
+const client = new AptevaClient({
+  baseURL,
+  projectId,
+  auth: {
+    clientId,
+    persistence: "local", // default: "memory"
+    onStateChange: state => renderSessionState(state),
+    onSessionChange: session => renderUser(session?.user),
+  },
+});
+
+try {
+  await client.auth.restore();
+} catch {
+  // Show a retry action or login, according to client.auth.getState().
+}
+
+const crm = client.app("api", { credential: "auth" });
+const conversations = client.app("conversations", { credential: "platform" });
+```
+
+`auth.getState()` reports `status` (`idle`, `restoring`, `authenticated`,
+`unauthenticated`, or `error`), effective `persistence` (`memory`, `local`, or
+`unavailable`) and optional credential-free error metadata. Render loading for
+`idle`/`restoring`, rather than briefly displaying the login screen. Concurrent
+`restore()` calls share one promise. Protected requests await pending restoration
+and can start initial restoration themselves. After a restoration error, retry
+explicitly with `restore()` or log in; requests do not repeatedly retry it.
+`onDiagnostic` receives credential-free refresh outcomes (`succeeded`,
+`retryable`, `uncertain`, `invalid`) and session-clear reason codes. It never
+receives tokens, server response text or user details. An already authenticated
+tab stays authenticated after Auth explicitly returns `refresh_unavailable`;
+the failed request rejects, and the next request can try refresh again.
+
+Only the refresh credential, format version, configuration scope and locally
+generated session/revision identifiers are persisted in localStorage. Normal Auth
+and platform access tokens, user details and permissions stay in memory. The
+`/refresh` response supplies the authoritative user and authorization context.
+`getSession()`, `getState()`, callbacks and cross-tab notifications expose no
+credentials. Browser storage is JavaScript-readable: enabling it deliberately
+accepts the same-origin script/XSS exposure of a persisted refresh credential.
+
+Storage and lock namespaces include the canonical server URL, project, Auth
+installation (or automatic routing), organization, public client and profile.
+Use consistent configuration across tabs that should share a session. Cross-tab
+sharing is limited to the same browser origin and storage partition. Different
+scopes do not import each other's credentials or identities.
+
+Native Web Locks serialize login, restore, refresh and logout. Each refresh reads
+the latest saved credential under the lock, writes an in-progress marker before
+sending it, then saves the replacement before releasing the lock. Other tabs are
+notified without broadcasting credentials. Switching accounts invalidates the
+previous local session and closes its streams. Disposed clients release browser
+listeners and local streams through `client.auth.dispose()` without revoking or
+deleting the saved session.
+
+If localStorage or Web Locks are unavailable, `persistence` reports `unavailable`
+and a fresh login works in memory-only mode. There is no localStorage-based lock
+fallback. If saving a rotated credential fails, the replacement remains in memory
+and the durable in-progress marker prevents other tabs from reusing the old one.
+A failure reading previously shared credentials requires a new login; the SDK
+cannot safely promote a potentially stale in-memory refresh to an independent
+session.
+
+Logout clears local credentials and streams immediately. It then clears the
+saved refresh credential under the shared lock, notifies other tabs, and asks
+Auth to revoke the session. A failed network logout still rejects: local logout
+does not guarantee server-side revocation while offline. Late refresh results
+cannot replace a newer login or resurrect a completed logout.
+
+Restoration failure handling:
+
+| Result | SDK behavior |
+| --- | --- |
+| Auth rejects an invalid/revoked refresh with `401 invalid_grant` | Clear the saved and local session; login is required. |
+| Browser is already offline before sending | Preserve the saved credential; retry restoration when connected. |
+| Auth returns `refresh_unavailable` with 503 | Auth confirms rotation did not commit; preserve an active session and its credential for retry. |
+| Network failure, generic proxy 5xx/401, malformed response, or `refresh_uncertain` | Preserve an uncertain marker; do not reuse the old credential. If no replacement was saved, require login. |
+| Platform mint denied | Restore the Auth session; platform-protected access remains blocked. |
+| Unsupported or malformed storage format | Fail closed; login or logout replaces the record. |
+
+The explicit retry-safe and uncertain response codes require Auth v0.12.1
+or newer. With older Auth versions, generic errors
+are handled conservatively. A tab crash after server rotation but before saving
+the response cannot be recovered transparently with single-use refresh tokens.
+
+There is no automatic legacy-session migration. Existing customer storage is not
+read or deleted; hosts should remove their old refresh loops and require one
+login when adopting persistence. Any future import must be a separate explicit,
+tested SDK API. HTTP writes are never replayed automatically after a 401.
+
+Validate native browser behavior with `bunx playwright install chromium` followed
+by `bun run test:persistence:browser`. These checks use isolated local fixtures,
+real tabs, Web Locks and localStorage; they do not contact customer accounts.

package/dist/auth-session.d.ts

@@ -1,3 +1,4 @@
+import { type PersistenceEnvironment } from "./session-persistence.js";
 import type { AppCredential } from "./extensions.js";
 import type { User } from "./types.js";
 export interface AuthLoginInput {
@@ -25,6 +26,22 @@ export interface AuthSessionInfo {
     expiresAt: string;
     platformExpiresAt?: string;
 }
+export interface AuthState {
+    status: "idle" | "restoring" | "authenticated" | "unauthenticated" | "error";
+    persistence: "memory" | "local" | "unavailable";
+    error?: {
+        code: string;
+        message: string;
+    };
+}
+/** Credential-free lifecycle events suitable for client telemetry. */
+export type AuthDiagnostic = {
+    type: "refresh";
+    outcome: "succeeded" | "retryable" | "uncertain" | "invalid";
+} | {
+    type: "session_clear";
+    reason: "login" | "logout" | "dispose" | "shared_change" | "invalid_refresh" | "refresh_uncertain" | "storage_error";
+};
 export interface AppAuthOptions {
     /** Public Auth app OAuth client identifier; never a private client secret. */
     clientId: string;
@@ -32,8 +49,14 @@ export interface AppAuthOptions {
     organizationSlug?: string;
     /** Requested Auth policy profile. Auth independently checks current roles. */
     profile?: string;
-    /** Receives user/session metadata, never credentials. Sessions are memory-only. */
+    /** Explicit opt-in. Local persistence requires browser storage and Web Locks. */
+    persistence?: "memory" | "local";
+    /** Restoration and persistence availability, without credentials. */
+    onStateChange?: (state: AuthState) => void;
+    /** Receives user/session metadata, never credentials. */
     onSessionChange?: (session: AuthSessionInfo | undefined) => void;
+    /** Receives fixed outcome and reason codes, never credentials or server text. */
+    onDiagnostic?: (event: AuthDiagnostic) => void;
 }
 export interface SessionCredential {
     token: string;
@@ -49,6 +72,11 @@ export declare class AuthSession {
     private readonly fetchImpl;
     private readonly changed;
     private state?;
+    private persistence?;
+    private stored?;
+    private restoration?;
+    private lifecycle;
+    private disposed;
     private epoch;
     private authRevision;
     private platformRevision;
@@ -56,22 +84,36 @@ export declare class AuthSession {
     private pendingAuth?;
     private controllers;
     private listeners;
-    constructor(baseURL: string, projectId: string, options: AppAuthOptions, fetchImpl: typeof fetch, changed: (token: string | undefined) => void);
+    constructor(baseURL: string, projectId: string, options: AppAuthOptions, fetchImpl: typeof fetch, changed: (token: string | undefined) => void, environment?: PersistenceEnvironment);
+    getState(): AuthState;
+    private diagnostic;
+    private emitState;
+    private status;
+    private synchronize;
+    private ready;
+    restore(): Promise<AuthSessionInfo | undefined>;
+    private restoreSaved;
+    dispose(): void;
     info(): AuthSessionInfo | undefined;
     onClear(listener: () => void): () => void;
     private notify;
-    clear(): void;
+    clear(reason?: Extract<AuthDiagnostic, {
+        type: "session_clear";
+    }>["reason"]): void;
     private assertEpoch;
     private call;
     private input;
     private platform;
+    private validateResponse;
     private accept;
+    private establish;
     login(input: AuthLoginInput): Promise<AuthUser>;
     register(input: AuthSignupInput): Promise<{
         user: AuthUser;
         verification_required?: boolean;
     }>;
     logout(): Promise<void>;
+    private refreshSaved;
     private refreshAuth;
     private performAuthRefresh;
     private renew;

package/dist/auth-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-session.d.ts","sourceRoot":"","sources":["../src/auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,cAAc;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AACnE,MAAM,WAAW,eAAgB,SAAQ,cAAc;IAAG,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE;AAChF,MAAM,WAAW,QAAS,SAAQ,IAAI;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,KAAK,IAAI,CAAC;CAClE;AAYD,MAAM,WAAW,iBAAiB;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAIvG,kFAAkF;AAClF,qBAAa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAb1B,OAAO,CAAC,KAAK,CAAC,CAAQ;IACtB,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,OAAO,CAAC,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAC,CAAgB;IACpC,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,SAAS,CAAyB;gBAEvB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,OAAO,KAAK,EACvB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI;IAK/D,IAAI,IAAI,eAAe,GAAG,SAAS;IAMnC,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IACzC,OAAO,CAAC,MAAM;IAGd,KAAK,IAAI,IAAI;IAWb,OAAO,CAAC,WAAW;YAGL,IAAI;IAelB,OAAO,CAAC,KAAK;IAGb,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,MAAM;IAeR,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;IAK/C,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAO9F,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YAKf,WAAW;YAMX,kBAAkB;YAWlB,KAAK;IA+Bb,KAAK,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBrC,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC;IAmBvB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAkB3D,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;CAS9E"}
+{"version":3,"file":"auth-session.d.ts","sourceRoot":"","sources":["../src/auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4D,KAAK,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACjI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,cAAc;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AACnE,MAAM,WAAW,eAAgB,SAAQ,cAAc;IAAG,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE;AAChF,MAAM,WAAW,QAAS,SAAQ,IAAI;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,eAAe,GAAG,iBAAiB,GAAG,OAAO,CAAC;IAC7E,WAAW,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IAChD,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AACD,sEAAsE;AACtE,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,SAAS,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,eAAe,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,eAAe,CAAA;CAAE,CAAC;AACpJ,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACjC,qEAAqE;IACrE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC3C,yDAAyD;IACzD,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,KAAK,IAAI,CAAC;IACjE,iFAAiF;IACjF,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CAChD;AAYD,MAAM,WAAW,iBAAiB;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AASvG,kFAAkF;AAClF,qBAAa,WAAW;IAepB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAlB1B,OAAO,CAAC,KAAK,CAAC,CAAQ;IACtB,OAAO,CAAC,WAAW,CAAC,CAAqB;IACzC,OAAO,CAAC,MAAM,CAAC,CAAgB;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAuC;IAC3D,OAAO,CAAC,SAAS,CAAmE;IACpF,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,OAAO,CAAC,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAC,CAAgB;IACpC,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,SAAS,CAAyB;gBAEvB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,OAAO,KAAK,EACvB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,EAC7D,WAAW,CAAC,EAAE,sBAAsB;IAatC,QAAQ,IAAI,SAAS;IACrB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,WAAW;YAgBL,KAAK;IAOnB,OAAO,IAAI,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;YAajC,YAAY;IAc1B,OAAO,IAAI,IAAI;IACf,IAAI,IAAI,eAAe,GAAG,SAAS;IAMnC,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IACzC,OAAO,CAAC,MAAM;IAGd,KAAK,CAAC,MAAM,GAAE,OAAO,CAAC,cAAc,EAAE;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC,QAAQ,CAAmB,GAAG,IAAI;IAenG,OAAO,CAAC,WAAW;YAGL,IAAI;IAyBlB,OAAO,CAAC,KAAK;IAGb,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,gBAAgB;IAGxB,OAAO,CAAC,MAAM;YAeA,SAAS;IA8BjB,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAI9F,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YA0Bf,YAAY;YAoCZ,WAAW;YAMX,kBAAkB;YAsClB,KAAK;IA+Bb,KAAK,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBrC,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC;IAoBvB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmB3D,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;CAS9E"}