@capxul/sdk 0.2.0-alpha.3 → 0.2.0-alpha.5

package/README.md

@@ -1,270 +1,8 @@
 # @capxul/sdk
 
-Headless TypeScript client for Capxul — issue and accept stablecoin
-payments, manage organization treasuries, and orchestrate on-chain
-flows backed by audited custody contracts.
+Layer 0 SDK package. Stage 1 currently ships the `@capxul/sdk/env` subpath.
 
-> **Alpha — `0.x` is pre-release.** APIs can change between alpha
-> versions. Pin to an exact version (`@capxul/sdk@0.1.0-alpha.0`) and
-> read the changelog before upgrading.
+See `docs/env.md` for the env Module contract.
 
-## Install
-
-```bash
-pnpm add @capxul/sdk @capxul/sdk-react
-# or: npm install @capxul/sdk @capxul/sdk-react
-```
-
-`@capxul/sdk` is the headless contract — flows, types, errors. The
-React-flavored entry point lives in `@capxul/sdk-react`. Pick:
-
-- **Browser apps (recommended).** Install both. Use
-  `<CapxulProvider config={{ mode: "publishable-key", publishableKey }}>`
-  from `@capxul/sdk-react` and the `useMe` / `useCapxulStatus` hooks.
-  See that package's README for the lazy-DX example.
-- **Server / CLI / scripts.** Install only `@capxul/sdk`. Build a
-  `CapxulClient` directly with your own auth and Convex adapters
-  (see "Server-side construction" below).
-
-## Two-layer trust
-
-Capxul splits the platform into two layers with different licenses:
-
-| Layer | What it does | License |
-|---|---|---|
-| Custody (on-chain) | Safe v1.4.1 + ERC-4337 modules — every contract that holds, transfers, or signs over user funds | Open source, audited, in the [Capxul GitHub repo](https://github.com/Xelmar-tech/Capxul/tree/main/packages/contracts) |
-| Orchestration (this package) | Workflow logic, business rules, integration glue, the `/v1/*` HTTP client | Proprietary — see `LICENSE` |
-
-You don't have to take our word for the parts that hold money — those
-contracts are open and auditable. The parts that orchestrate workflows
-on top are our product.
-
-## Quickstart (server / CLI)
-
-```ts
-import { createCapxulClient, createLocalSigner, tryCatch } from "@capxul/sdk";
-
-const signer = createLocalSigner(process.env.CAPXUL_PRIVATE_KEY!);
-const capxul = createCapxulClient({
-  apiKey: process.env.CAPXUL_API_KEY!, // server-to-server partner key
-  signer,
-});
-
-const [err, payment] = await tryCatch(
-  capxul.payments.create({
-    to: { email: "vendor@example.com" },
-    amount: { value: "100", currency: "USD" },
-  }),
-);
-
-if (err) {
-  if (err.code === "INSUFFICIENT_BALANCE") {
-    // narrow `err.code` to route the UI / reply
-  }
-  throw err;
-}
-
-console.log(payment.id);
-```
-
-## Quickstart (browser via React)
-
-See [`@capxul/sdk-react`](https://www.npmjs.com/package/@capxul/sdk-react).
-The browser path uses a publishable key (`cap_pk_…`) and bootstraps
-runtime URLs lazily — no need to ship secrets to the client:
-
-```tsx
-import { CapxulProvider, useMe, useCapxulStatus } from "@capxul/sdk-react";
-
-<CapxulProvider
-  config={{
-    mode: "publishable-key",
-    publishableKey: process.env.NEXT_PUBLIC_CAPXUL_PUBLISHABLE_KEY!,
-  }}
->
-  <App />
-</CapxulProvider>;
-```
-
-## Publishable-key transport
-
-The browser transport accepts a publishable key, then lazily resolves
-runtime URLs by POSTing to `/v1/client/bootstrap` on the first auth or
-`ensureRuntime()` call. The successful backend response is intentionally
-small:
-
-```json
-{ "authBaseUrl": "https://<deployment>.convex.site/api/auth", "convexUrl": "https://<deployment>.convex.cloud" }
-```
-
-The resolved runtime is cached for the lifetime of the transport. Concurrent
-callers share one bootstrap request, successful resolutions are reused, and
-failed bootstrap attempts reset so the next call can retry. Tests and
-non-default deployments can inject both `fetchImpl` and an absolute
-`bootstrapUrl`:
-
-```ts
-import { makeHttpTransport, CapxulError } from "@capxul/sdk";
-
-const transport = makeHttpTransport({
-  mode: "publishable-key",
-  publishableKey: process.env.NEXT_PUBLIC_CAPXUL_PUBLISHABLE_KEY!,
-  bootstrapUrl: "https://api.capxul.com/v1/client/bootstrap",
-  fetchImpl: fetch,
-});
-
-await transport.ensureRuntime();
-```
-
-Local setup errors and backend bootstrap errors both use `CapxulError`, but
-carry different `details.source` values:
-
-```ts
-try {
-  await transport.ensureRuntime();
-} catch (error) {
-  if (error instanceof CapxulError) {
-    if (error.details?.source === "sdk-config") {
-      // Missing or malformed local config, such as publishableKey or bootstrapUrl.
-    }
-    if (error.details?.source === "backend-bootstrap") {
-      // Sanitized backend refusal, such as NOT_AUTHENTICATED or PERMISSION_DENIED.
-    }
-  }
-}
-```
-
-Runtime proof status:
-
-| Surface | Source support | Runtime proof | Status |
-|---|---|---|---|
-| SDK transport | `makeHttpTransport({ mode: "publishable-key", publishableKey })` | `packages/sdk/tests/unit/transport.test.ts` proves config validation, singleflight bootstrap, retry after failure, lifecycle transitions, and sanitized backend errors. | Proven with mocked fetch |
-| React provider | `CapxulProvider config={{ mode: "publishable-key", ... }}` | `packages/sdk-react/ops/proof/react-headless.test.tsx` proves bootstrap before a real `useMe()` read through the provider and lazy Convex data client. | Proven with mocked fetch + headless React |
-| Reference CLI | `bootstrap probe --mock --json` | `apps/reference-cli/scripts/agent-driver.ts` phase 0 and the direct CLI command prove provider/bootstrap/auth ordering and sanitized output. | Proven locally; live endpoint remains manual-key gated |
-
-Copy-paste local replication:
-
-```bash
-corepack pnpm --filter @capxul/sdk check-types
-corepack pnpm --filter @capxul/sdk build
-corepack pnpm --filter @capxul/sdk-react check-types
-corepack pnpm --filter @capxul/sdk-react build
-corepack pnpm --filter @capxul/reference-cli check-types
-corepack pnpm --filter @capxul/reference-cli build
-node apps/reference-cli/dist/cli.js bootstrap probe --mock --json
-```
-
-Run the SDK and React SDK builds before the reference CLI typecheck in a
-fresh checkout; the CLI depends on their generated declaration outputs.
-
-Expected sanitized pass signal:
-
-```json
-{"command":"bootstrap.probe","ok":true,"mode":"publishable-key","status":"ready","bootstrapRequests":1,"authRequests":1,"keyLengthClass":"provided","mocked":true}
-```
-
-## Public surface (alpha)
-
-```ts
-capxul.auth          // sendOtp, verifyOtp, signOut, serviceTokenMint
-capxul.me            // get, update — first-party caller identity
-capxul.accounts      // create, retrieve, list
-capxul.organizations // CRUD + members + payments + treasury
-capxul.payments      // create, retrieve, list
-capxul.invoices      // create, retrieve, list
-capxul.withdrawals   // create, retrieve, list
-capxul.documents     // KYC uploads, invoices, receipts, tax forms
-capxul.flows.{auth, onboarding, provisioning} // XState v5 flows
-```
-
-Helpers:
-
-- `tryCatch(promise)` — error tuple `[error, data]`; routes on
-  `error.code` (typed `CapxulErrorCode` union)
-- `matchError`, `matchStatus`, `matchAction` — exhaustive pattern
-  matchers per CANON.md §4.44
-- Branded type constructors — `toEmail`, `toAccountId`,
-  `toOrganizationId`, … — never cast raw strings
-
-## Organizations
-
-Create an organization, manage its treasury, and invite members with
-role-based access:
-
-```ts
-// Create
-const [err, org] = await capxul.organizations.create({ name: "Acme" });
-
-// Invite a member — returns the raw token once
-const [err, { member, inviteToken }] = await capxul.organizations.members.invite({
-  organizationId: org.id,
-  email: "alice@example.com",
-  role: "finance_manager",
-});
-
-// List members — defaults to active; pass status to filter
-const [err, list] = await capxul.organizations.members.list({
-  organizationId: org.id,
-  status: "pending", // "pending" | "active" | "revoked" | "expired" | "all"
-});
-
-// Accept an invitation (called by the invitee)
-const [err, member] = await capxul.organizations.members.accept({ token: inviteToken });
-
-// Revoke a pending invitation
-const [err] = await capxul.organizations.members.revoke({
-  organizationId: org.id,
-  memberId: member.id,
-});
-
-// Remove an active member
-const [err] = await capxul.organizations.members.remove({
-  organizationId: org.id,
-  memberId: member.id,
-});
-```
-
-Member roles: `owner`, `finance_manager`, `payments_operator`,
-`org_admin`, `viewer`, `accountant`. Only `owner` and `org_admin` can
-invite, revoke, remove, or change roles.
-
-Pending invitations auto-accept on first sign-in when the user's email
-matches. Overdue pending invitations expire via a nightly cron.
-
-## Error model
-
-Every method returns a `CapxulResult<T, Codes>` tuple. Errors are
-instances of `CapxulError` with a typed `code` (narrowed per method).
-
-```ts
-const [err, account] = await tryCatch(capxul.me.get());
-
-if (err) {
-  switch (err.code) {
-    case "PROFILE_NOT_FOUND": return router.push("/onboarding");
-    case "NOT_AUTHENTICATED": return router.push("/login");
-    default: throw err; // unhandled — bubble to the error boundary
-  }
-}
-```
-
-There is no second error type. Backend `CapxulError` → Convex
-serialization → SDK deserialization → frontend `CapxulError` — one
-class, 34 codes, end-to-end.
-
-## Telemetry (opt-out)
-
-The SDK reports operational telemetry (operation IDs, latencies,
-correlation IDs, error codes) to Capxul. **PII is never sent** — events
-are scrubbed at the source. Disable by passing
-`{ telemetry: { enabled: false } }` (coming in `0.2.0`); current alpha
-sends only operational signals which Capxul Terms disclose explicitly.
-
-## License
-
-Proprietary — see [`LICENSE`](./LICENSE). The orchestration code in
-this package is governed by the Capxul Terms of Service. The
-value-bearing custody contracts are open source — see "Two-layer trust"
-above.
-
-Contact: [legal@capxul.com](mailto:legal@capxul.com)
+See `docs/identity-adapters.md` for the Effect-native identity port and adapter
+Layer exports.

package/dist/InMemoryAuthCacheAdapter-BK-B_ERB.mjs

@@ -0,0 +1,113 @@
+import { Context, Data, Effect, Layer } from "effect";
+import { toAuthUserId, toEmail, toEpochMs, toEpochSeconds, toJwtToken, toSessionToken } from "@capxul/types";
+//#region src/ports/auth-cache.ts
+var AuthCacheError = class extends Data.TaggedError("AuthCacheError") {};
+var AuthCachePortTag = class extends Context.Tag("@capxul/sdk/ports/AuthCachePort")() {};
+//#endregion
+//#region src/adapters/auth-cache/serialization.ts
+function parseAuthSession(raw) {
+	if (typeof raw !== "object" || raw === null) return null;
+	const candidate = raw;
+	try {
+		return {
+			authUserId: toAuthUserId(candidate.authUserId),
+			email: toEmail(candidate.email),
+			token: toSessionToken(candidate.token),
+			expiresAt: toEpochMs(candidate.expiresAt)
+		};
+	} catch {
+		return null;
+	}
+}
+function parseCachedJwt(raw) {
+	if (typeof raw !== "object" || raw === null) return null;
+	const candidate = raw;
+	try {
+		return {
+			token: toJwtToken(candidate.token),
+			expEpochSeconds: toEpochSeconds(candidate.expEpochSeconds)
+		};
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/adapters/auth-cache/BrowserAuthCacheAdapter.ts
+const SESSION_KEY = "capxul.session";
+const JWT_KEY = "capxul.jwt";
+var BrowserAuthCacheAdapter = class {
+	storage;
+	constructor(storage) {
+		this.storage = storage;
+	}
+	getSession = authCacheTry("getSession", () => {
+		const raw = this.storage.getItem(SESSION_KEY);
+		if (raw === null) return null;
+		try {
+			return parseAuthSession(JSON.parse(raw));
+		} catch {
+			return null;
+		}
+	});
+	setSession = (session) => authCacheTry("setSession", () => {
+		this.storage.setItem(SESSION_KEY, JSON.stringify(session));
+	});
+	clearSession = authCacheTry("clearSession", () => {
+		this.storage.removeItem(SESSION_KEY);
+	});
+	getJwt = authCacheTry("getJwt", () => {
+		const raw = this.storage.getItem(JWT_KEY);
+		if (raw === null) return null;
+		try {
+			return parseCachedJwt(JSON.parse(raw));
+		} catch {
+			return null;
+		}
+	});
+	setJwt = (jwt) => authCacheTry("setJwt", () => {
+		this.storage.setItem(JWT_KEY, JSON.stringify(jwt));
+	});
+	clearJwt = authCacheTry("clearJwt", () => {
+		this.storage.removeItem(JWT_KEY);
+	});
+};
+function toAuthCacheError(operation, cause) {
+	return new AuthCacheError({
+		operation,
+		cause
+	});
+}
+function authCacheTry(operation, run) {
+	return Effect.try({
+		try: run,
+		catch: (cause) => toAuthCacheError(operation, cause)
+	});
+}
+//#endregion
+//#region src/adapters/auth-cache/InMemoryAuthCacheAdapter.ts
+var InMemoryAuthCacheAdapter = class {
+	session = null;
+	jwt = null;
+	getSession = Effect.sync(() => this.session);
+	setSession = (session) => Effect.sync(() => {
+		this.session = session;
+	});
+	clearSession = Effect.sync(() => {
+		this.session = null;
+	});
+	getJwt = Effect.sync(() => this.jwt);
+	setJwt = (jwt) => Effect.sync(() => {
+		this.jwt = jwt;
+	});
+	clearJwt = Effect.sync(() => {
+		this.jwt = null;
+	});
+};
+Layer.effect(AuthCachePortTag, Effect.sync(() => new InMemoryAuthCacheAdapter()).pipe(Effect.mapError((cause) => new AuthCacheError({
+	operation: "initialize",
+	cause
+}))));
+//#endregion
+export { AuthCacheError as a, parseCachedJwt as i, BrowserAuthCacheAdapter as n, AuthCachePortTag as o, parseAuthSession as r, InMemoryAuthCacheAdapter as t };
+
+//# sourceMappingURL=InMemoryAuthCacheAdapter-BK-B_ERB.mjs.map

package/dist/InMemoryAuthCacheAdapter-BK-B_ERB.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"InMemoryAuthCacheAdapter-BK-B_ERB.mjs","names":[],"sources":["../src/ports/auth-cache.ts","../src/adapters/auth-cache/serialization.ts","../src/adapters/auth-cache/BrowserAuthCacheAdapter.ts","../src/adapters/auth-cache/InMemoryAuthCacheAdapter.ts"],"sourcesContent":["import { Context, Data, Effect } from \"effect\";\nimport type { AuthSession, EpochSeconds, JwtToken } from \"@capxul/types\";\n\n/**\n * AuthCachePort (TA4) — replaces `SessionStoragePort` in the rebuild slice's\n * consumer-facing wiring. Stores the user-snapshot Session AND the cached\n * Convex JWT (W7 bridge endpoint). The two slots are independent so a session\n * refresh doesn't invalidate the JWT and vice versa.\n *\n * Three adapters (TA7):\n *   - `BrowserAuthCacheAdapter`        — backed by `localStorage`\n *   - `FileSystemAuthCacheAdapter`     — mode-0600 JSON file in `~/.config/capxul/`\n *   - `InMemoryAuthCacheAdapter`       — for tests\n *\n * `SessionStoragePort` was retired by the Stage 4 rebuild; session and JWT\n * persistence now share this cache boundary.\n */\nexport interface AuthCachePort {\n  readonly getSession: Effect.Effect<AuthSession | null, AuthCacheError>;\n  readonly setSession: (session: AuthSession) => Effect.Effect<void, AuthCacheError>;\n  readonly clearSession: Effect.Effect<void, AuthCacheError>;\n\n  /**\n   * JWT cache for the `/api/auth/convex/token` bridge endpoint (W7).\n   * Stored separately from the session so a session refresh doesn't\n   * invalidate cached JWT.\n   */\n  readonly getJwt: Effect.Effect<CachedJwt | null, AuthCacheError>;\n  readonly setJwt: (jwt: CachedJwt) => Effect.Effect<void, AuthCacheError>;\n  readonly clearJwt: Effect.Effect<void, AuthCacheError>;\n}\n\n/**\n * Cached Convex JWT shape (TA4). `expEpochSeconds` is decoded from the JWT's\n * `exp` claim at fetch time so the `tokenProvider` cache eviction logic can\n * proactively refresh at `exp - 30s` per TA3.\n */\nexport interface CachedJwt {\n  readonly token: JwtToken;\n  readonly expEpochSeconds: EpochSeconds;\n}\n\nexport class AuthCacheError extends Data.TaggedError(\"AuthCacheError\")<{\n  readonly operation: string;\n  readonly cause: unknown;\n}> {}\n\nexport class AuthCachePortTag extends Context.Tag(\"@capxul/sdk/ports/AuthCachePort\")<\n  AuthCachePortTag,\n  AuthCachePort\n>() {}\n","import {\n  toAuthUserId,\n  toEmail,\n  toEpochMs,\n  toEpochSeconds,\n  toJwtToken,\n  toSessionToken,\n  type AuthSession,\n} from \"@capxul/types\";\n\nimport type { CachedJwt } from \"../../ports/auth-cache\";\n\nexport function parseAuthSession(raw: unknown): AuthSession | null {\n  if (typeof raw !== \"object\" || raw === null) return null;\n  const candidate = raw as {\n    readonly authUserId?: unknown;\n    readonly email?: unknown;\n    readonly token?: unknown;\n    readonly expiresAt?: unknown;\n  };\n\n  try {\n    return {\n      authUserId: toAuthUserId(candidate.authUserId),\n      email: toEmail(candidate.email),\n      token: toSessionToken(candidate.token),\n      expiresAt: toEpochMs(candidate.expiresAt),\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport function parseCachedJwt(raw: unknown): CachedJwt | null {\n  if (typeof raw !== \"object\" || raw === null) return null;\n  const candidate = raw as {\n    readonly token?: unknown;\n    readonly expEpochSeconds?: unknown;\n  };\n\n  try {\n    return {\n      token: toJwtToken(candidate.token),\n      expEpochSeconds: toEpochSeconds(candidate.expEpochSeconds),\n    };\n  } catch {\n    return null;\n  }\n}\n","import { Effect, Layer } from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\nimport { parseAuthSession, parseCachedJwt } from \"./serialization\";\n\nexport interface BrowserStorageShape {\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n  removeItem(key: string): void;\n}\n\nconst SESSION_KEY = \"capxul.session\";\nconst JWT_KEY = \"capxul.jwt\";\n\nexport class BrowserAuthCacheAdapter implements AuthCachePort {\n  private readonly storage: BrowserStorageShape;\n\n  constructor(storage: BrowserStorageShape) {\n    this.storage = storage;\n  }\n\n  readonly getSession = authCacheTry(\"getSession\", () => {\n    const raw = this.storage.getItem(SESSION_KEY);\n    if (raw === null) return null;\n    try {\n      return parseAuthSession(JSON.parse(raw));\n    } catch {\n      return null;\n    }\n  });\n\n  readonly setSession = (session: AuthSession) =>\n    authCacheTry(\"setSession\", () => {\n      this.storage.setItem(SESSION_KEY, JSON.stringify(session));\n    });\n\n  readonly clearSession = authCacheTry(\"clearSession\", () => {\n    this.storage.removeItem(SESSION_KEY);\n  });\n\n  readonly getJwt = authCacheTry(\"getJwt\", () => {\n    const raw = this.storage.getItem(JWT_KEY);\n    if (raw === null) return null;\n    try {\n      return parseCachedJwt(JSON.parse(raw));\n    } catch {\n      return null;\n    }\n  });\n\n  readonly setJwt = (jwt: CachedJwt) =>\n    authCacheTry(\"setJwt\", () => {\n      this.storage.setItem(JWT_KEY, JSON.stringify(jwt));\n    });\n\n  readonly clearJwt = authCacheTry(\"clearJwt\", () => {\n    this.storage.removeItem(JWT_KEY);\n  });\n}\n\nexport function BrowserAuthCacheLayer(input: {\n  readonly storage: BrowserStorageShape;\n}): Layer.Layer<AuthCachePortTag, AuthCacheError> {\n  return Layer.effect(\n    AuthCachePortTag,\n    Effect.sync(() => new BrowserAuthCacheAdapter(input.storage)).pipe(\n      Effect.mapError((cause) => toAuthCacheError(\"initialize\", cause)),\n    ),\n  );\n}\n\nfunction toAuthCacheError(operation: string, cause: unknown): AuthCacheError {\n  return new AuthCacheError({ operation, cause });\n}\n\nfunction authCacheTry<T>(operation: string, run: () => T): Effect.Effect<T, AuthCacheError> {\n  return Effect.try({\n    try: run,\n    catch: (cause) => toAuthCacheError(operation, cause),\n  });\n}\n","import { Effect, Layer } from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\n\nexport class InMemoryAuthCacheAdapter implements AuthCachePort {\n  private session: AuthSession | null = null;\n  private jwt: CachedJwt | null = null;\n\n  readonly getSession = Effect.sync(() => this.session);\n\n  readonly setSession = (session: AuthSession) =>\n    Effect.sync(() => {\n      this.session = session;\n    });\n\n  readonly clearSession = Effect.sync(() => {\n    this.session = null;\n  });\n\n  readonly getJwt = Effect.sync(() => this.jwt);\n\n  readonly setJwt = (jwt: CachedJwt) =>\n    Effect.sync(() => {\n      this.jwt = jwt;\n    });\n\n  readonly clearJwt = Effect.sync(() => {\n    this.jwt = null;\n  });\n}\n\nexport const InMemoryAuthCacheLayer = Layer.effect(\n  AuthCachePortTag,\n  Effect.sync(() => new InMemoryAuthCacheAdapter()).pipe(\n    Effect.mapError((cause) => new AuthCacheError({ operation: \"initialize\", cause })),\n  ),\n);\n"],"mappings":";;;AA0CA,IAAa,iBAAb,cAAoC,KAAK,YAAY,gBAAgB,EAGlE,CAAC;AAEJ,IAAa,mBAAb,cAAsC,QAAQ,IAAI,iCAAiC,EAGjF,EAAE,CAAC;;;ACtCL,SAAgB,iBAAiB,KAAkC;CACjE,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,MAAM,YAAY;CAOlB,IAAI;EACF,OAAO;GACL,YAAY,aAAa,UAAU,UAAU;GAC7C,OAAO,QAAQ,UAAU,KAAK;GAC9B,OAAO,eAAe,UAAU,KAAK;GACrC,WAAW,UAAU,UAAU,SAAS;EAC1C;CACF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAgB,eAAe,KAAgC;CAC7D,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,MAAM,YAAY;CAKlB,IAAI;EACF,OAAO;GACL,OAAO,WAAW,UAAU,KAAK;GACjC,iBAAiB,eAAe,UAAU,eAAe;EAC3D;CACF,QAAQ;EACN,OAAO;CACT;AACF;;;AC/BA,MAAM,cAAc;AACpB,MAAM,UAAU;AAEhB,IAAa,0BAAb,MAA8D;CAC5D;CAEA,YAAY,SAA8B;EACxC,KAAK,UAAU;CACjB;CAEA,aAAsB,aAAa,oBAAoB;EACrD,MAAM,MAAM,KAAK,QAAQ,QAAQ,WAAW;EAC5C,IAAI,QAAQ,MAAM,OAAO;EACzB,IAAI;GACF,OAAO,iBAAiB,KAAK,MAAM,GAAG,CAAC;EACzC,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CAED,cAAuB,YACrB,aAAa,oBAAoB;EAC/B,KAAK,QAAQ,QAAQ,aAAa,KAAK,UAAU,OAAO,CAAC;CAC3D,CAAC;CAEH,eAAwB,aAAa,sBAAsB;EACzD,KAAK,QAAQ,WAAW,WAAW;CACrC,CAAC;CAED,SAAkB,aAAa,gBAAgB;EAC7C,MAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO;EACxC,IAAI,QAAQ,MAAM,OAAO;EACzB,IAAI;GACF,OAAO,eAAe,KAAK,MAAM,GAAG,CAAC;EACvC,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CAED,UAAmB,QACjB,aAAa,gBAAgB;EAC3B,KAAK,QAAQ,QAAQ,SAAS,KAAK,UAAU,GAAG,CAAC;CACnD,CAAC;CAEH,WAAoB,aAAa,kBAAkB;EACjD,KAAK,QAAQ,WAAW,OAAO;CACjC,CAAC;AACH;AAaA,SAAS,iBAAiB,WAAmB,OAAgC;CAC3E,OAAO,IAAI,eAAe;EAAE;EAAW;CAAM,CAAC;AAChD;AAEA,SAAS,aAAgB,WAAmB,KAAgD;CAC1F,OAAO,OAAO,IAAI;EAChB,KAAK;EACL,QAAQ,UAAU,iBAAiB,WAAW,KAAK;CACrD,CAAC;AACH;;;AC5EA,IAAa,2BAAb,MAA+D;CAC7D,UAAsC;CACtC,MAAgC;CAEhC,aAAsB,OAAO,WAAW,KAAK,OAAO;CAEpD,cAAuB,YACrB,OAAO,WAAW;EAChB,KAAK,UAAU;CACjB,CAAC;CAEH,eAAwB,OAAO,WAAW;EACxC,KAAK,UAAU;CACjB,CAAC;CAED,SAAkB,OAAO,WAAW,KAAK,GAAG;CAE5C,UAAmB,QACjB,OAAO,WAAW;EAChB,KAAK,MAAM;CACb,CAAC;CAEH,WAAoB,OAAO,WAAW;EACpC,KAAK,MAAM;CACb,CAAC;AACH;AAEsC,MAAM,OAC1C,kBACA,OAAO,WAAW,IAAI,yBAAyB,CAAC,EAAE,KAChD,OAAO,UAAU,UAAU,IAAI,eAAe;CAAE,WAAW;CAAc;AAAM,CAAC,CAAC,CACnF,CACF"}