@auth-craft/client 0.1.0 → 0.1.1

package/README.md

@@ -6,9 +6,13 @@ Every method is generated from `@auth-craft/api-contract` — the **same** endpo
 declarations the backend routes validate against. So the client's paths, request
 bodies, query params, path params **and response types cannot drift** from the
 server: if a route changes and the contract is updated, your call sites re-type
-at build time. Tokens are isolated in a Web Worker (via `@auth-craft/transport`,
+at build time. Tokens are isolated in a Web Worker (a vendored transport,
 absorbed from FetchGuard), protecting them from XSS.
 
+> **One scope per app?** Import [`@auth-craft/client/core`](#auth-craftclientcore--per-scope-isolation)
+> + only the contract groups you need, so other scopes' code stays out of your
+> bundle. The root export below wires every group.
+
 > Migrating from the old `@auth-craft/frontend-sdk`? Jump to
 > [Migration](#migration-from-auth-craftfrontend-sdk).
 
@@ -22,12 +26,12 @@ npm install @auth-craft/client
 
 ### Bundler note (Vite)
 
-The transport runs a Web Worker. With Vite, exclude it from pre-bundling:
+The client runs a Web Worker. With Vite, exclude it from pre-bundling:
 
 ```ts
 // vite.config.ts
 export default defineConfig({
-  optimizeDeps: { exclude: ['@auth-craft/transport'] }
+  optimizeDeps: { exclude: ['@auth-craft/client'] }
 })
 ```
 
@@ -116,6 +120,12 @@ interface AuthCraftClientConfig {
    * 'system' = admin, 'tenant' = tenant-scoped, omit/'customer' = default.
    */
   context?: 'customer' | 'tenant' | 'system'
+  /**
+   * Subscribe to session state changes (login, logout, refresh, expiry).
+   * Fires after `init()`. Bridge it into app state or trigger auto-logout
+   * on `authenticated: false`.
+   */
+  onAuthStateChanged?: (state: { authenticated: boolean; user?: unknown; expiresAt?: number | null }) => void
 }
 ```
 
@@ -176,6 +186,116 @@ await client.tenant.createInvite({
 
 ---
 
+## `client.api` — authenticated requests to your own APIs
+
+The typed groups above only cover **Auth Craft's** routes. Your app still has its
+own backend (commerce, console, billing, …) that the *same* logged-in user must
+call. `client.api` is that escape hatch: a raw HTTP transport that rides the
+**same Worker-isolated session** — tokens stay out of JS, refresh is shared, and
+you get a deserialized `Result<T>` back.
+
+```ts
+// any URL you build — points at YOUR backend, not the auth server
+const r = await client.api.post<{ items: Product[] }>(
+  'https://api.example.com/core/products',
+  { name: 'Tee', price: 1900 }
+)
+if (r.ok) r.data.items   // typed by the <T> you supply
+
+await client.api.get<Plan>('https://api.example.com/core/plans/current')
+await client.api.delete('https://api.example.com/core/team/members/remove', { userId })
+```
+
+```ts
+interface ApiTransport {
+  get<T = unknown>(url: string, options?): Promise<Result<T>>
+  post<T = unknown>(url: string, body?: unknown, options?): Promise<Result<T>>
+  put<T = unknown>(url: string, body?: unknown, options?): Promise<Result<T>>
+  patch<T = unknown>(url: string, body?: unknown, options?): Promise<Result<T>>
+  delete<T = unknown>(url: string, body?: unknown, options?): Promise<Result<T>>
+}
+```
+
+- **URLs pass through as-is** — build absolute URLs to whichever backend you
+  target. (Unlike the typed groups, `api` does **not** prepend `baseUrl`.)
+- **You supply the type** `<T>` — `api` is unaware of your app's contract. For
+  Auth Craft's own routes, prefer the typed groups, which can't drift.
+- Throws if accessed before `init()`.
+
+> The escape hatch is deliberately *outside* the contract: your app's routes are
+> not Auth Craft's concern, so they don't belong in `@auth-craft/api-contract`.
+> `api` gives you the authenticated session; you own the routes.
+
+---
+
+## `@auth-craft/client/core` — per-scope isolation
+
+The root export (`createAuthCraftClient`) wires **every** group, so it can't be
+tree-shaken per scope. A web app is almost always **one** scope (storefront =
+customer, console = tenant, admin = system). For those, import the scope-agnostic
+core and wire only the groups you need — other scopes' code then stays out of
+your bundle and your dev call surface:
+
+```ts
+import { createClientCore } from '@auth-craft/client/core'
+import { authContract } from '@auth-craft/api-contract/auth'
+
+const core = await createClientCore({
+  baseUrl, strategy: 'cookie-auth', allowedDomains, context: 'customer'
+})
+const auth = core.group(authContract)          // typed, drift-proof
+await core.api.get('https://api.example.com/core/products')  // your own backend
+```
+
+`core.group(contract)` attaches a typed client for one group; `core.api`,
+`onAuthStateChanged`, `context`, `init()`/`destroy()` work exactly as on the full
+client. A `tenant` console just wires more groups (`@auth-craft/api-contract/tenant`).
+
+Verified: a customer app built this way contains **zero** tenant/mfa/oauth route
+code. "Not in the bundle" ≠ "not on disk" — the unused group files still live in
+`node_modules/@auth-craft/api-contract`, just unreferenced. That's isolation at
+the call surface, which is the point.
+
+### Keeping it enforced (two guards)
+
+1. **Library guard (always on):** a test in this package fails if the core
+   (`src/core`) ever imports a contract group or the api-contract root — so the
+   isolation can't silently rot for downstream apps.
+
+2. **App guard (optional, your linter):** stop an app importing a scope it
+   doesn't own.
+
+   **ESLint** — a helper ships here:
+   ```ts
+   // app/eslint.config.mjs
+   import tseslint from 'typescript-eslint'
+   import { authCraftIsolation } from '@auth-craft/client/eslint'
+   export default tseslint.config(
+     authCraftIsolation({ allow: ['auth', 'password', 'verification', 'mfa', 'oauth', 'session', 'users'] })
+   )
+   ```
+   Omit a group (e.g. `tenant`) and importing it — or the all-groups root
+   `@auth-craft/client`, or the api-contract root — becomes an error.
+
+   **Biome** — no shipped preset (Biome config is JSON, not composable), but the
+   same intent is `noRestrictedImports` in `biome.json`:
+   ```jsonc
+   {
+     "linter": { "rules": { "nursery": { "noRestrictedImports": { "level": "error", "options": { "paths": {
+       "@auth-craft/client": "Use @auth-craft/client/core + per-group subpaths; the all-groups root can't be tree-shaken.",
+       "@auth-craft/api-contract": "Import a focused group (e.g. /auth), not the root.",
+       "@auth-craft/api-contract/tenant": "This app's scope does not include 'tenant'."
+     } } } } } }
+   }
+   ```
+   (Rule placement — `nursery` vs stable — follows your Biome version.)
+
+   **Neither linter?** No guard is strictly required: an app that never imports
+   `@auth-craft/api-contract/tenant` simply doesn't have it; the guards only catch
+   *accidental* imports.
+
+---
+
 ## Login: handling challenge & MFA
 
 A login call (`authenticate`, `completeChallenge`, `oauthCallback`) resolves to a
@@ -224,10 +344,15 @@ is the local-dev convention.)
 ## Lifecycle
 
 ```ts
-await client.init()   // boot Worker; idempotent enough to call once at startup
-client.destroy()      // terminate the Worker and clear in-memory state
+await client.init()      // boot Worker; idempotent enough to call once at startup
+client.destroy()         // terminate the Worker and clear in-memory state
+client.getTransport()    // advanced: the raw FetchGuard transport handle
 ```
 
+> `createAuthCraftClient(config)` returns the client **without** initializing —
+> call `await client.init()` yourself. (`createClientCore(config)` from
+> `@auth-craft/client/core` initializes for you and resolves a ready core.)
+
 ---
 
 ## Why it can't drift
@@ -247,8 +372,10 @@ client.destroy()      // terminate the Worker and clear in-memory state
 ## Migration from `@auth-craft/frontend-sdk`
 
 The old `@auth-craft/frontend-sdk` was hand-written (per-method paths/types), which
-let request/response shapes drift from the server. It is **removed**. This client
-replaces it. The package name and factory change, and every call uses the uniform
+let request/response shapes drift from the server. This client supersedes it: the
+auth methods are now generated from the contract (drift-proof), and raw
+authenticated HTTP moves to [`client.api`](#clientapi--authenticated-requests-to-your-own-apis).
+The package name and factory change, and every auth call uses the uniform
 `{ body / params / query }` shape.
 
 ### Setup
@@ -293,7 +420,8 @@ await client.init()
 | `client.tenant.createInvite(req)` | `client.tenant.createInvite({ params: { tenantId }, body })` ⚠️ tenantId in path |
 | `client.tenant.listMembers()` | `client.tenant.listMembers({ params: { tenantId } })` ⚠️ tenantId in path |
 | `client.tenant.getProfile()` | `client.tenant.getTenantProfile({ params: { tenantId } })` |
-| `client.tenant.checkPendingInvites(req)` | **removed** — no public route (internal only) |
+| `client.api.get/post(...)` *(raw)* | `client.api.get/post(...)` — **unchanged surface**, but on `client.api` (the old SDK exposed these on the root client) |
+| `client.tenant.checkPendingInvites(req)` | not on the typed `tenant` group (no public auth-route). If your app exposes it on its **own** API, call it via `client.api.post('<your-url>', req)`. |
 
 ### Behaviour changes you must be aware of
 
@@ -308,6 +436,14 @@ await client.init()
   / `isMfaRequired` (see [above](#login-handling-challenge--mfa)). The old client
   returned ad-hoc shapes per path.
 - **`refresh` is automatic** — remove any manual refresh calls.
+- **Raw authenticated requests moved to `client.api`.** The old SDK exposed
+  `client.get/post/put/patch/delete` (and `getFetchGuard()`) on the root client
+  for hitting your own backend. These now live on [`client.api`](#clientapi--authenticated-requests-to-your-own-apis)
+  with the **same signatures** (`Result<T>` in, `Result<T>` out) — just change
+  `client.post(...)` → `client.api.post(...)`. Auth-route calls should move to
+  the typed groups instead.
+- **`onAuthStateChanged` is unchanged** — still a config callback, same
+  `{ authenticated, user?, expiresAt? }` payload; wire your auto-logout there.
 
 ### Errors
 

package/dist/core/core.d.ts

@@ -0,0 +1,72 @@
+/**
+ * @auth-craft/client/core — scope-agnostic frontend client core.
+ *
+ * Owns the Web-Worker transport (token isolation + auto-refresh), the session
+ * lifecycle, the authenticated raw-HTTP escape hatch (`api`), and a `group()`
+ * factory that attaches a typed contract group.
+ *
+ * It deliberately imports **no** contract group. A per-scope app builds the
+ * client and wires only the groups it needs:
+ *
+ *   import { createClientCore } from '@auth-craft/client/core'
+ *   import { authContract } from '@auth-craft/api-contract/auth'
+ *
+ *   const core = await createClientCore(config)
+ *   const auth = core.group(authContract)   // typed, drift-proof
+ *   core.api.post('https://api.example.com/...', body)   // your own backend
+ *
+ * Because no tenant/system contract is imported, that app's bundle — and its
+ * node_modules call surface — never contains code for other scopes.
+ */
+import type { Endpoint } from '@auth-craft/api-contract/core';
+import type { Result } from 'ts-micro-result';
+import { type FetchGuardClient, type FetchGuardRequestInit, type AuthResult as TransportAuthResult } from '../transport';
+import { type ContractClient } from './proxy';
+/**
+ * Authenticated raw-HTTP escape hatch for the host app's own (non-auth-craft)
+ * APIs. Rides the same Worker session as the typed groups; returns a
+ * deserialized `Result<T>`. URLs pass through as-is.
+ */
+export interface ApiTransport {
+    get<T = unknown>(url: string, options?: FetchGuardRequestInit): Promise<Result<T>>;
+    post<T = unknown>(url: string, body?: unknown, options?: FetchGuardRequestInit): Promise<Result<T>>;
+    put<T = unknown>(url: string, body?: unknown, options?: FetchGuardRequestInit): Promise<Result<T>>;
+    patch<T = unknown>(url: string, body?: unknown, options?: FetchGuardRequestInit): Promise<Result<T>>;
+    delete<T = unknown>(url: string, body?: unknown, options?: FetchGuardRequestInit): Promise<Result<T>>;
+}
+export interface ClientCoreConfig {
+    baseUrl: string;
+    strategy: 'cookie-auth' | 'body-auth';
+    allowedDomains: string[];
+    refreshEarlyMs?: number;
+    defaultHeaders?: Record<string, string>;
+    workerFactory?: () => Worker;
+    /** Auth scope → `X-Auth-Context` header. */
+    context?: 'customer' | 'tenant' | 'system';
+    /** Session state changes (login/logout/refresh/expiry). Fires after init(). */
+    onAuthStateChanged?: (state: TransportAuthResult) => void;
+}
+export declare class ClientCore {
+    private fg;
+    private readonly config;
+    constructor(config: ClientCoreConfig);
+    init(): Promise<void>;
+    /**
+     * Attach a typed client for one contract group. Call once per group the app
+     * uses. The group's URLs are resolved against `baseUrl`.
+     */
+    group<C extends Record<string, Endpoint>>(contract: C): ContractClient<C>;
+    /**
+     * Authenticated raw-HTTP transport for the host app's own APIs. Throws if
+     * accessed before `init()`.
+     */
+    get api(): ApiTransport;
+    buildUrl(path: string): string;
+    /** Raw transport handle — for advanced use (e.g. manual subscriptions). */
+    getTransport(): FetchGuardClient;
+    destroy(): void;
+}
+export declare function createClientCore(config: ClientCoreConfig): Promise<ClientCore>;
+export type { AuthResult, ContractClient, EndpointMethod } from './proxy';
+export { buildClient } from './proxy';
+//# sourceMappingURL=core.d.ts.map

package/dist/core/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/core/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,UAAU,IAAI,mBAAmB,EACvC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;CACvG;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,GAAG,WAAW,CAAC;IACtC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;IAC7B,4CAA4C;IAC5C,OAAO,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC3C,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;CAC3D;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,EAAE,CAAiC;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;gBAE9B,MAAM,EAAE,gBAAgB;IAI9B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B3B;;;OAGG;IACH,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC;IAMzE;;;OAGG;IACH,IAAI,GAAG,IAAI,YAAY,CAqBtB;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAK9B,2EAA2E;IAC3E,YAAY,IAAI,gBAAgB;IAKhC,OAAO,IAAI,IAAI;CAIhB;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAIpF;AAED,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC"}

package/dist/core/core.js

@@ -0,0 +1,105 @@
+/**
+ * @auth-craft/client/core — scope-agnostic frontend client core.
+ *
+ * Owns the Web-Worker transport (token isolation + auto-refresh), the session
+ * lifecycle, the authenticated raw-HTTP escape hatch (`api`), and a `group()`
+ * factory that attaches a typed contract group.
+ *
+ * It deliberately imports **no** contract group. A per-scope app builds the
+ * client and wires only the groups it needs:
+ *
+ *   import { createClientCore } from '@auth-craft/client/core'
+ *   import { authContract } from '@auth-craft/api-contract/auth'
+ *
+ *   const core = await createClientCore(config)
+ *   const auth = core.group(authContract)   // typed, drift-proof
+ *   core.api.post('https://api.example.com/...', body)   // your own backend
+ *
+ * Because no tenant/system contract is imported, that app's bundle — and its
+ * node_modules call surface — never contains code for other scopes.
+ */
+import { createClient, } from '../transport';
+import { buildClient } from './proxy';
+export class ClientCore {
+    fg = null;
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async init() {
+        const headers = this.config.context && this.config.context !== 'customer'
+            ? { ...this.config.defaultHeaders, 'X-Auth-Context': this.config.context }
+            : this.config.defaultHeaders;
+        this.fg = createClient({
+            provider: {
+                type: this.config.strategy,
+                refreshUrl: this.buildUrl('/auth/refresh'),
+                loginUrl: this.buildUrl('/auth/authenticate'),
+                logoutUrl: this.buildUrl('/auth/logout'),
+                ...(headers ? { headers } : {}),
+            },
+            allowedDomains: this.config.allowedDomains,
+            ...(this.config.refreshEarlyMs !== undefined ? { refreshEarlyMs: this.config.refreshEarlyMs } : {}),
+            ...(headers ? { defaultHeaders: headers } : {}),
+            ...(this.config.workerFactory ? { workerFactory: this.config.workerFactory } : {}),
+        });
+        await this.fg.whenReady();
+        if (this.config.onAuthStateChanged) {
+            this.fg.onAuthStateChanged(this.config.onAuthStateChanged);
+        }
+    }
+    /**
+     * Attach a typed client for one contract group. Call once per group the app
+     * uses. The group's URLs are resolved against `baseUrl`.
+     */
+    group(contract) {
+        const fg = this.fg;
+        if (!fg)
+            throw new Error('ClientCore not initialized. Call init() first.');
+        return buildClient(fg, contract, (p) => this.buildUrl(p));
+    }
+    /**
+     * Authenticated raw-HTTP transport for the host app's own APIs. Throws if
+     * accessed before `init()`.
+     */
+    get api() {
+        const fg = this.fg;
+        if (!fg)
+            throw new Error('ClientCore not initialized. Call init() first.');
+        // callJson forbids method/body in options — drop them before forwarding.
+        const opts = (o) => {
+            if (!o)
+                return {};
+            const { method: _m, body: _b, ...rest } = o;
+            return rest;
+        };
+        return {
+            get: (url, options) => fg.callJson('GET', url, undefined, opts(options)),
+            post: (url, body, options) => fg.callJson('POST', url, body, opts(options)),
+            put: (url, body, options) => fg.callJson('PUT', url, body, opts(options)),
+            patch: (url, body, options) => fg.callJson('PATCH', url, body, opts(options)),
+            delete: (url, body, options) => fg.callJson('DELETE', url, body, opts(options)),
+        };
+    }
+    buildUrl(path) {
+        const p = path.startsWith('/') ? path : `/${path}`;
+        return `${this.config.baseUrl}${p}`;
+    }
+    /** Raw transport handle — for advanced use (e.g. manual subscriptions). */
+    getTransport() {
+        if (!this.fg)
+            throw new Error('ClientCore not initialized. Call init() first.');
+        return this.fg;
+    }
+    destroy() {
+        this.fg?.destroy();
+        this.fg = null;
+    }
+}
+export async function createClientCore(config) {
+    const core = new ClientCore(config);
+    await core.init();
+    return core;
+}
+export { buildClient } from './proxy';
+//# sourceMappingURL=core.js.map

package/dist/core/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/core/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EACL,YAAY,GAIb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAuB,MAAM,SAAS,CAAC;AA4B3D,MAAM,OAAO,UAAU;IACb,EAAE,GAA4B,IAAI,CAAC;IAC1B,MAAM,CAAmB;IAE1C,YAAY,MAAwB;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU;YACvD,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;YAC1E,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAEjC,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC;YACrB,QAAQ,EAAE;gBACR,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC1B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;gBAC7C,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACxC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC;YACD,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC1C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAqC,QAAW;QACnD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC3E,OAAO,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACH,IAAI,GAAG;QACL,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC3E,yEAAyE;QACzE,MAAM,IAAI,GAAG,CAAC,CAAyB,EAAkD,EAAE;YACzF,IAAI,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClB,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,OAAO;YACL,GAAG,EAAE,CAAc,GAAW,EAAE,OAA+B,EAAE,EAAE,CACjE,EAAE,CAAC,QAAQ,CAAI,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,EAAE,CAAc,GAAW,EAAE,IAAc,EAAE,OAA+B,EAAE,EAAE,CAClF,EAAE,CAAC,QAAQ,CAAI,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,GAAG,EAAE,CAAc,GAAW,EAAE,IAAc,EAAE,OAA+B,EAAE,EAAE,CACjF,EAAE,CAAC,QAAQ,CAAI,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,KAAK,EAAE,CAAc,GAAW,EAAE,IAAc,EAAE,OAA+B,EAAE,EAAE,CACnF,EAAE,CAAC,QAAQ,CAAI,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,EAAE,CAAc,GAAW,EAAE,IAAc,EAAE,OAA+B,EAAE,EAAE,CACpF,EAAE,CAAC,QAAQ,CAAI,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;SACrD,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QACnD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,2EAA2E;IAC3E,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,OAAO;QACL,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAwB;IAC7D,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC"}

package/dist/core/proxy.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Contract-driven typed proxy.
+ *
+ * Given a transport (the absorbed FetchGuard client) and a map of contract
+ * endpoints, this builds a typed method per endpoint. The `kind` discriminator
+ * decides how each one is dispatched:
+ *
+ *   data   → transport.callJson(method, url, body)   (auto-bound, typed Result<T>)
+ *   login  → transport.login(body, url)              (Worker session bootstrap)
+ *   logout → transport.logout(body)
+ *   exchange → transport.exchangeToken(url, { payload })
+ *
+ * Types flow straight from the contract: the input is inferred from the body
+ * schema, the output from the response schema (or AuthResult for login/logout).
+ * A route change to the contract therefore re-types every call site at build.
+ *
+ * Scope-agnostic: imports only `@auth-craft/api-contract/core` (the endpoint
+ * type + helpers), never a specific group — so a per-scope app that only wires
+ * `auth` never pulls in `tenant`/`system` code through this module.
+ */
+import type { Endpoint, PathParams } from '@auth-craft/api-contract/core';
+import { type Result } from 'ts-micro-result';
+import type { InferInput, InferOutput } from 'valibot';
+import { type FetchGuardClient } from '../transport';
+export interface AuthResult {
+    authenticated: boolean;
+    user?: unknown;
+    expiresAt?: number | null;
+}
+/** Whether an endpoint has any `:param` segments. */
+type HasParams<P extends string> = PathParams<P> extends never ? false : true;
+/** The `params` argument, required only when the path has params. */
+type ParamsArg<P extends string> = HasParams<P> extends true ? {
+    params: Record<PathParams<P>, string | number>;
+} : {
+    params?: undefined;
+};
+/** Body argument, present only when the endpoint declares a body schema. */
+type BodyArg<E> = E extends {
+    body: infer S;
+} ? {
+    body: InferInput<S extends import('valibot').GenericSchema ? S : never>;
+} : {
+    body?: undefined;
+};
+/** Query argument, present only when the endpoint declares a query schema. */
+type QueryArg<E> = E extends {
+    query: infer S;
+} ? {
+    query?: InferInput<S extends import('valibot').GenericSchema ? S : never>;
+} : {
+    query?: undefined;
+};
+/** The single call argument object for a generated method. */
+type CallArg<E extends Endpoint> = ParamsArg<E['path']> & BodyArg<E> & QueryArg<E>;
+/** The resolved return type of a generated method. */
+type CallReturn<E extends Endpoint> = E extends {
+    kind: 'data';
+} ? E extends {
+    response: infer R;
+} ? Result<InferOutput<R extends import('valibot').GenericSchema ? R : never>> : Result<unknown> : E extends {
+    kind: 'login';
+} ? E extends {
+    response: infer R;
+} ? Result<InferOutput<R extends import('valibot').GenericSchema ? R : never>> : Result<AuthResult> : Result<AuthResult>;
+/** Does this arg shape need any argument at all? */
+type NeedsArg<E extends Endpoint> = HasParams<E['path']> extends true ? true : E extends {
+    body: unknown;
+} ? true : false;
+export type EndpointMethod<E extends Endpoint> = NeedsArg<E> extends true ? (arg: CallArg<E>) => Promise<CallReturn<E>> : (arg?: CallArg<E>) => Promise<CallReturn<E>>;
+export type ContractClient<C extends Record<string, Endpoint>> = {
+    [K in keyof C]: EndpointMethod<C[K]>;
+};
+/**
+ * Build a typed client object from a contract group.
+ */
+export declare function buildClient<C extends Record<string, Endpoint>>(transport: FetchGuardClient, contract: C, buildUrl: (path: string) => string): ContractClient<C>;
+export {};
+//# sourceMappingURL=proxy.d.ts.map

package/dist/core/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/core/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGxE,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,qDAAqD;AACrD,KAAK,SAAS,CAAC,CAAC,SAAS,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;AAE9E,qEAAqE;AACrE,KAAK,SAAS,CAAC,CAAC,SAAS,MAAM,IAC7B,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1G,4EAA4E;AAC5E,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,UAAU,CAAC,CAAC,SAAS,OAAO,SAAS,EAAE,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;CAAE,GAC3E;IAAE,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,CAAC;AAEzB,8EAA8E;AAC9E,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC,CAAA;CAAE,GAC3C;IAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,SAAS,OAAO,SAAS,EAAE,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;CAAE,GAC7E;IAAE,KAAK,CAAC,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1B,8DAA8D;AAC9D,KAAK,OAAO,CAAC,CAAC,SAAS,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AAEnF,sDAAsD;AACtD,KAAK,UAAU,CAAC,CAAC,SAAS,QAAQ,IAAI,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5D,CAAC,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;CAAE,GAC7B,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,OAAO,SAAS,EAAE,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAC1E,MAAM,CAAC,OAAO,CAAC,GACjB,CAAC,SAAS;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAEzB,CAAC,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;CAAE,GAC7B,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,OAAO,SAAS,EAAE,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAC1E,MAAM,CAAC,UAAU,CAAC,GACpB,MAAM,CAAC,UAAU,CAAC,CAAC;AAEzB,oDAAoD;AACpD,KAAK,QAAQ,CAAC,CAAC,SAAS,QAAQ,IAC9B,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,KAAK,CAAC;AAExF,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,QAAQ,IAC3C,QAAQ,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAExH,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI;KAC9D,CAAC,IAAI,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACrC,CAAC;AAEF;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC5D,SAAS,EAAE,gBAAgB,EAC3B,QAAQ,EAAE,CAAC,EACX,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GACjC,cAAc,CAAC,CAAC,CAAC,CAoCnB"}

package/dist/core/proxy.js

@@ -0,0 +1,99 @@
+/**
+ * Contract-driven typed proxy.
+ *
+ * Given a transport (the absorbed FetchGuard client) and a map of contract
+ * endpoints, this builds a typed method per endpoint. The `kind` discriminator
+ * decides how each one is dispatched:
+ *
+ *   data   → transport.callJson(method, url, body)   (auto-bound, typed Result<T>)
+ *   login  → transport.login(body, url)              (Worker session bootstrap)
+ *   logout → transport.logout(body)
+ *   exchange → transport.exchangeToken(url, { payload })
+ *
+ * Types flow straight from the contract: the input is inferred from the body
+ * schema, the output from the response schema (or AuthResult for login/logout).
+ * A route change to the contract therefore re-types every call site at build.
+ *
+ * Scope-agnostic: imports only `@auth-craft/api-contract/core` (the endpoint
+ * type + helpers), never a specific group — so a per-scope app that only wires
+ * `auth` never pulls in `tenant`/`system` code through this module.
+ */
+import { fillPath } from '@auth-craft/api-contract/core';
+import { err, ok } from 'ts-micro-result';
+import { deserializeResult } from '../transport';
+/**
+ * Build a typed client object from a contract group.
+ */
+export function buildClient(transport, contract, buildUrl) {
+    const out = {};
+    for (const key of Object.keys(contract)) {
+        const ep = contract[key];
+        out[key] = async (arg) => {
+            const path = fillPath(ep.path, arg?.params);
+            const url = buildUrl(path) + buildQueryString(arg?.query);
+            const body = arg?.body;
+            const requiresAuth = ep.public !== true;
+            switch (ep.kind) {
+                case 'data':
+                    return transport.callJson(ep.method, url, body, { requiresAuth });
+                case 'login':
+                    return dispatchLogin(transport, body, url);
+                case 'logout':
+                    return transport.logout(body);
+                case 'exchange':
+                    return transport.exchangeToken(url, {
+                        ...(body !== undefined ? { payload: body } : {}),
+                    });
+                default:
+                    return err({ code: 'UNKNOWN_KIND', message: `Unknown endpoint kind for '${key}'.` });
+            }
+        };
+    }
+    return out;
+}
+/**
+ * Dispatch a login-kind endpoint and normalize the outcome.
+ *
+ * FetchGuard's login() resolves the AuthResult when a session is established. A
+ * 2-step login (credential challenge / MFA required) comes back as a non-error
+ * HTTP body that FetchGuard surfaces via `meta.params.body`. We deserialize that
+ * envelope so the caller gets the discriminated login result (tokens | challenge
+ * | mfa) instead of an opaque "not authenticated" — matching the old SDK's
+ * behaviour, but in ONE place instead of per method.
+ */
+async function dispatchLogin(transport, body, url) {
+    const result = await transport.login(body, url);
+    // Session established → return the tokens/auth-state shape.
+    if (result.ok && result.data.authenticated) {
+        return ok({
+            accessToken: '',
+            expiresAt: result.data.expiresAt ?? 0,
+        });
+    }
+    // Not authenticated: the backend body may carry a challenge / MFA requirement
+    // (a legitimate 2-step step), or a real error. Deserialize and forward it.
+    if (!result.ok) {
+        const params = result.meta?.params;
+        if (params?.body) {
+            const parsed = deserializeResult(params.body);
+            // Forward whatever the backend said — challenge/mfa (ok) or error (err).
+            return parsed;
+        }
+        return err(result.errors);
+    }
+    // ok but not authenticated and no body to interpret — surface a generic error.
+    return err({ code: 'LOGIN_FAILED', message: 'Authentication did not establish a session' });
+}
+/** Serialize a query object to a `?a=1&b=2` string (skips undefined). */
+function buildQueryString(query) {
+    if (!query)
+        return '';
+    const params = new URLSearchParams();
+    for (const [k, v] of Object.entries(query)) {
+        if (v !== undefined && v !== null)
+            params.set(k, String(v));
+    }
+    const qs = params.toString();
+    return qs ? `?${qs}` : '';
+}
+//# sourceMappingURL=proxy.js.map

package/dist/core/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/core/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAyB,MAAM,cAAc,CAAC;AAoDxE;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,SAA2B,EAC3B,QAAW,EACX,QAAkC;IAElC,MAAM,GAAG,GAAG,EAOX,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAa,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,EAAE;YACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC;YACvB,MAAM,YAAY,GAAG,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC;YAExC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;gBAChB,KAAK,MAAM;oBACT,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBACpE,KAAK,OAAO;oBACV,OAAO,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC7C,KAAK,QAAQ;oBACX,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAA6B,CAAC;gBAC5D,KAAK,UAAU;oBACb,OAAO,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE;wBAClC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAA+B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC5E,CAA6B,CAAC;gBACjC;oBACE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,8BAA8B,GAAG,IAAI,EAAE,CAAC,CAAC;YACzF,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,GAAwB,CAAC;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,aAAa,CAAC,SAA2B,EAAE,IAAa,EAAE,GAAW;IAClF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEhD,4DAA4D;IAC5D,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,OAAO,EAAE,CAAC;YACR,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAuC,CAAC;QACpE,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,iBAAiB,CAAU,MAAM,CAAC,IAAI,CAAC,CAAC;YACvD,yEAAyE;YACzE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,+EAA+E;IAC/E,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,yEAAyE;AACzE,SAAS,gBAAgB,CAAC,KAA+B;IACvD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC"}