@flarelink/client 0.2.0

package/dist/index.js

@@ -0,0 +1,501 @@
+// src/errors.ts
+var FlarelinkError = class extends Error {
+  status;
+  code;
+  constructor(message, status, code) {
+    super(message);
+    this.name = "FlarelinkError";
+    this.status = status;
+    this.code = code;
+  }
+};
+var AuthError = class extends FlarelinkError {
+  constructor(message, status, code) {
+    super(message, status, code);
+    this.name = "AuthError";
+  }
+};
+var StorageError = class extends FlarelinkError {
+  constructor(message, status, code) {
+    super(message, status, code);
+    this.name = "StorageError";
+  }
+};
+var DatabaseError = class extends FlarelinkError {
+  constructor(message, status, code) {
+    super(message, status, code);
+    this.name = "DatabaseError";
+  }
+};
+var MissingServiceKeyError = class extends FlarelinkError {
+  constructor(api) {
+    super(
+      `flarelink.${api} requires a service key. Pass it to createFlarelink({ serviceKey }) \u2014 only do this on the server (never in the browser). Mint a key from your project's dashboard.`,
+      400,
+      "MISSING_SERVICE_KEY"
+    );
+    this.name = "MissingServiceKeyError";
+  }
+};
+
+// src/auth.ts
+function createAuth(base, f) {
+  async function call(path, init = {}) {
+    const method = (init.method ?? "GET").toUpperCase();
+    const bodyBearing = method !== "GET" && method !== "HEAD" && method !== "OPTIONS";
+    const headers = {
+      ...init.headers ?? {}
+    };
+    let body = init.body;
+    if (bodyBearing) {
+      if (body === void 0 || body === null) body = "{}";
+      if (headers["Content-Type"] === void 0) headers["Content-Type"] = "application/json";
+    }
+    const res = await f(`${base}${path}`, {
+      ...init,
+      credentials: "include",
+      headers,
+      body
+    });
+    if (!res.ok) {
+      const data = await res.json().catch(() => ({}));
+      throw new AuthError(
+        data.message ?? data.error ?? res.statusText,
+        res.status,
+        data.code
+      );
+    }
+    return await res.json();
+  }
+  const fetchMe = async () => {
+    try {
+      return await call("/api/me");
+    } catch (err) {
+      if (err instanceof AuthError && err.status === 401) return null;
+      throw err;
+    }
+  };
+  const browserDefault = () => typeof location !== "undefined" ? location.href : void 0;
+  return {
+    signUp: (input) => call("/api/auth/sign-up/email", {
+      method: "POST",
+      body: JSON.stringify({
+        ...input,
+        callbackURL: input.callbackURL ?? browserDefault()
+      })
+    }),
+    signIn: (input) => call("/api/auth/sign-in/email", {
+      method: "POST",
+      body: JSON.stringify(input)
+    }),
+    signInWithSocial: async (provider, opts = {}) => {
+      const callbackURL = opts.callbackURL ?? browserDefault();
+      const r = await call("/api/auth/sign-in/social", {
+        method: "POST",
+        body: JSON.stringify({ provider, callbackURL })
+      });
+      if (!opts.noRedirect && typeof location !== "undefined") {
+        location.href = r.url;
+      }
+      return r;
+    },
+    signInWithMagicLink: (email, opts = {}) => {
+      const callbackURL = opts.callbackURL ?? browserDefault();
+      return call("/api/auth/sign-in/magic-link", {
+        method: "POST",
+        body: JSON.stringify({ email, callbackURL })
+      });
+    },
+    signOut: async () => {
+      await call("/api/auth/sign-out", { method: "POST" });
+    },
+    requestPasswordReset: (input) => call("/api/auth/request-password-reset", {
+      method: "POST",
+      body: JSON.stringify(input)
+    }),
+    resetPassword: (input) => call("/api/auth/reset-password", {
+      method: "POST",
+      body: JSON.stringify(input)
+    }),
+    sendVerificationEmail: (input) => call("/api/auth/send-verification-email", {
+      method: "POST",
+      body: JSON.stringify({
+        ...input,
+        callbackURL: input.callbackURL ?? browserDefault()
+      })
+    }),
+    getMe: async () => (await fetchMe())?.user ?? null,
+    getSession: async () => (await fetchMe())?.session ?? null
+  };
+}
+
+// src/sql-builder.ts
+var IDENT_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function assertIdent(name, role) {
+  if (typeof name !== "string" || !IDENT_RE.test(name)) {
+    throw new DatabaseError(
+      `Invalid ${role} name: ${JSON.stringify(
+        name
+      )}. Must match /^[A-Za-z_][A-Za-z0-9_]*$/ \u2014 use flarelink.sql\`...\` for anything more dynamic.`,
+      400,
+      "INVALID_IDENTIFIER"
+    );
+  }
+}
+function composeWhere(filter, paramOffset = 0) {
+  const parts = [];
+  const params = [];
+  for (const [col, value] of Object.entries(filter)) {
+    assertIdent(col, "column");
+    if (value === null) {
+      parts.push(`"${col}" IS NULL`);
+      continue;
+    }
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      params.push(value);
+      parts.push(`"${col}" = ?${paramOffset + params.length}`);
+      continue;
+    }
+    throw new DatabaseError(
+      `Unsupported filter value for column ${JSON.stringify(col)} (${typeof value}). where() takes equality on primitives or NULL \u2014 use flarelink.sql\`...\` for IN / ranges / OR / etc.`,
+      400,
+      "UNSUPPORTED_FILTER"
+    );
+  }
+  return { sql: parts.length > 0 ? parts.join(" AND ") : "1=1", params };
+}
+function composeSelect(opts) {
+  assertIdent(opts.table, "table");
+  const cols = opts.columns === "*" ? "*" : opts.columns.map((c) => {
+    assertIdent(c, "column");
+    return `"${c}"`;
+  }).join(", ");
+  let sql = `SELECT ${cols} FROM "${opts.table}"`;
+  let params = [];
+  if (opts.where) {
+    const w = composeWhere(opts.where);
+    sql += ` WHERE ${w.sql}`;
+    params = params.concat(w.params);
+  }
+  if (opts.orderBy) {
+    assertIdent(opts.orderBy.column, "column");
+    const dir = opts.orderBy.direction === "desc" ? "DESC" : "ASC";
+    sql += ` ORDER BY "${opts.orderBy.column}" ${dir}`;
+  }
+  if (typeof opts.limit === "number") {
+    if (!Number.isInteger(opts.limit) || opts.limit < 0) {
+      throw new DatabaseError("limit must be a non-negative integer", 400, "INVALID_LIMIT");
+    }
+    sql += ` LIMIT ${opts.limit}`;
+  }
+  if (typeof opts.offset === "number") {
+    if (!Number.isInteger(opts.offset) || opts.offset < 0) {
+      throw new DatabaseError("offset must be a non-negative integer", 400, "INVALID_OFFSET");
+    }
+    sql += ` OFFSET ${opts.offset}`;
+  }
+  return { sql, params };
+}
+function composeInsert(opts) {
+  assertIdent(opts.table, "table");
+  if (opts.rows.length === 0) {
+    throw new DatabaseError("insert(): no rows provided", 400, "EMPTY_INSERT");
+  }
+  const cols = Object.keys(opts.rows[0]);
+  if (cols.length === 0) {
+    throw new DatabaseError(
+      "insert(): row has no columns. Pass at least one column to insert a row.",
+      400,
+      "EMPTY_ROW"
+    );
+  }
+  for (const c of cols) assertIdent(c, "column");
+  const colList = cols.map((c) => `"${c}"`).join(", ");
+  const params = [];
+  const valueGroups = [];
+  for (const row of opts.rows) {
+    const placeholders = [];
+    for (const c of cols) {
+      const v = row[c];
+      params.push(v === void 0 ? null : v);
+      placeholders.push(`?${params.length}`);
+    }
+    valueGroups.push(`(${placeholders.join(", ")})`);
+  }
+  let sql = `INSERT INTO "${opts.table}" (${colList}) VALUES ${valueGroups.join(", ")}`;
+  if (opts.returning) {
+    sql += ` RETURNING ${composeReturning(opts.returning)}`;
+  }
+  return { sql, params };
+}
+function composeUpdate(opts) {
+  assertIdent(opts.table, "table");
+  const cols = Object.keys(opts.patch);
+  if (cols.length === 0) {
+    throw new DatabaseError(
+      "update(): patch is empty. Pass at least one column to update.",
+      400,
+      "EMPTY_PATCH"
+    );
+  }
+  const params = [];
+  const setParts = [];
+  for (const c of cols) {
+    assertIdent(c, "column");
+    const v = opts.patch[c];
+    params.push(v);
+    setParts.push(`"${c}" = ?${params.length}`);
+  }
+  let sql = `UPDATE "${opts.table}" SET ${setParts.join(", ")}`;
+  if (opts.where) {
+    const w = composeWhere(opts.where, params.length);
+    sql += ` WHERE ${w.sql}`;
+    params.push(...w.params);
+  }
+  if (opts.returning) {
+    sql += ` RETURNING ${composeReturning(opts.returning)}`;
+  }
+  return { sql, params };
+}
+function composeDelete(opts) {
+  assertIdent(opts.table, "table");
+  let sql = `DELETE FROM "${opts.table}"`;
+  const params = [];
+  if (opts.where) {
+    const w = composeWhere(opts.where);
+    sql += ` WHERE ${w.sql}`;
+    params.push(...w.params);
+  }
+  return { sql, params };
+}
+function composeReturning(returning) {
+  if (returning === "*") return "*";
+  return returning.map((c) => {
+    assertIdent(c, "column");
+    return `"${c}"`;
+  }).join(", ");
+}
+function composeTaggedSql(strings, values) {
+  let sql = "";
+  const params = [];
+  for (let i = 0; i < strings.length; i++) {
+    sql += strings[i] ?? "";
+    if (i < values.length) {
+      params.push(values[i]);
+      sql += `?${params.length}`;
+    }
+  }
+  return { sql, params };
+}
+
+// src/db.ts
+async function postQuery(base, serviceKey, f, sql, params) {
+  const res = await f(`${base}/api/db/query`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${serviceKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({ sql, params })
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({}));
+    throw new DatabaseError(body.error ?? res.statusText, res.status, body.code);
+  }
+  const data = await res.json();
+  return { rows: data.results, meta: data.meta };
+}
+function createDatabase(base, serviceKey, f) {
+  const requireKey = () => {
+    if (!serviceKey) throw new MissingServiceKeyError("database");
+    return serviceKey;
+  };
+  function makeSelect(state) {
+    const exec = async () => {
+      const key = requireKey();
+      const { sql, params } = composeSelect(state);
+      return await postQuery(base, key, f, sql, params);
+    };
+    return {
+      select: (columns) => makeSelect({ ...state, columns: normalizeCols(columns) }),
+      where: (filter) => makeSelect({ ...state, where: filter }),
+      orderBy: (column, direction = "asc") => makeSelect({
+        ...state,
+        orderBy: { column, direction }
+      }),
+      limit: (n) => makeSelect({ ...state, limit: n }),
+      offset: (n) => makeSelect({ ...state, offset: n }),
+      then: (onfulfilled, onrejected) => exec().then(onfulfilled, onrejected)
+    };
+  }
+  function makeInsert(table, rows, returning) {
+    const exec = async () => {
+      const key = requireKey();
+      const { sql, params } = composeInsert({ table, rows, returning });
+      return await postQuery(base, key, f, sql, params);
+    };
+    return {
+      returning: (cols) => makeInsert(table, rows, normalizeCols(cols ?? "*")),
+      then: (onfulfilled, onrejected) => exec().then(onfulfilled, onrejected)
+    };
+  }
+  function makeUpdate(table, patch, where, returning) {
+    const exec = async () => {
+      const key = requireKey();
+      const { sql, params } = composeUpdate({ table, patch, where, returning });
+      return await postQuery(base, key, f, sql, params);
+    };
+    return {
+      where: (filter) => makeUpdate(table, patch, filter, returning),
+      returning: (cols) => makeUpdate(table, patch, where, normalizeCols(cols ?? "*")),
+      then: (onfulfilled, onrejected) => exec().then(onfulfilled, onrejected)
+    };
+  }
+  function makeDelete(table, where) {
+    const exec = async () => {
+      const key = requireKey();
+      const { sql, params } = composeDelete({ table, where });
+      return await postQuery(base, key, f, sql, params);
+    };
+    return {
+      where: (filter) => makeDelete(table, filter),
+      then: (onfulfilled, onrejected) => exec().then(onfulfilled, onrejected)
+    };
+  }
+  return {
+    from: (table) => {
+      assertIdent(table, "table");
+      const select = makeSelect({ table, columns: "*" });
+      const tableQuery = select;
+      tableQuery.insert = (row) => {
+        const rows = Array.isArray(row) ? row : [row];
+        return makeInsert(table, rows);
+      };
+      tableQuery.update = (patch) => makeUpdate(table, patch);
+      tableQuery.delete = () => makeDelete(table);
+      return tableQuery;
+    },
+    sql: async (strings, ...values) => {
+      const key = requireKey();
+      const { sql, params } = composeTaggedSql(strings, values);
+      return await postQuery(base, key, f, sql, params);
+    }
+  };
+}
+function normalizeCols(cols) {
+  if (cols === "*") return "*";
+  return [...cols];
+}
+
+// src/storage.ts
+function createStorage(base, serviceKey, f) {
+  const requireKey = () => {
+    if (!serviceKey) throw new MissingServiceKeyError("storage");
+    return serviceKey;
+  };
+  async function call(path, init = {}) {
+    const key = requireKey();
+    const headers = {
+      Authorization: `Bearer ${key}`,
+      ...init.headers ?? {}
+    };
+    const method = (init.method ?? "GET").toUpperCase();
+    if (method !== "GET" && method !== "HEAD" && headers["Content-Type"] === void 0) {
+      headers["Content-Type"] = "application/json";
+    }
+    const url = new URL(`${base}${path}`);
+    if (init.query) {
+      for (const [k, v] of Object.entries(init.query)) {
+        if (v !== void 0 && v !== "") url.searchParams.set(k, v);
+      }
+    }
+    const res = await f(url.toString(), { ...init, headers });
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({}));
+      throw new StorageError(
+        body.error ?? res.statusText,
+        res.status,
+        body.code
+      );
+    }
+    return await res.json();
+  }
+  return {
+    listBuckets: async () => {
+      const r = await call("/api/storage/buckets");
+      return r.buckets;
+    },
+    from: (bucket) => ({
+      createSignedUploadUrl: async (key, opts = {}) => {
+        const r = await call(
+          "/api/storage/presign",
+          {
+            method: "POST",
+            body: JSON.stringify({
+              bucket,
+              key,
+              op: "put",
+              contentType: opts.contentType,
+              expiresIn: opts.expiresIn
+            })
+          }
+        );
+        return { url: r.url, signedHeaders: r.signedHeaders };
+      },
+      createSignedDownloadUrl: async (key, opts = {}) => {
+        const r = await call("/api/storage/presign", {
+          method: "POST",
+          body: JSON.stringify({
+            bucket,
+            key,
+            op: "get",
+            expiresIn: opts.expiresIn
+          })
+        });
+        return { url: r.url };
+      },
+      remove: async (keys) => {
+        for (const k of keys) {
+          await call("/api/storage/object", {
+            method: "DELETE",
+            body: JSON.stringify({ bucket, key: k })
+          });
+        }
+      },
+      list: async (opts = {}) => {
+        return call("/api/storage/list", {
+          method: "GET",
+          query: {
+            bucket,
+            ...opts.prefix !== void 0 && { prefix: opts.prefix },
+            ...opts.cursor !== void 0 && { cursor: opts.cursor }
+          }
+        });
+      }
+    })
+  };
+}
+
+// src/index.ts
+function createFlarelink(config) {
+  if (!config?.url) {
+    throw new Error(
+      `createFlarelink({ url }) is required. The URL is your project's auth Worker, e.g. "https://myapp-auth.your-subdomain.workers.dev" \u2014 find it in the Flarelink dashboard.`
+    );
+  }
+  const base = config.url.replace(/\/$/, "");
+  const f = config.fetch ?? fetch;
+  const auth = createAuth(base, f);
+  const storage = createStorage(base, config.serviceKey, f);
+  const db = createDatabase(base, config.serviceKey, f);
+  return {
+    auth,
+    storage,
+    from: (table) => db.from(table),
+    sql: (strings, ...values) => db.sql(strings, ...values)
+  };
+}
+
+export { AuthError, DatabaseError, FlarelinkError, MissingServiceKeyError, StorageError, createFlarelink };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/auth.ts","../src/sql-builder.ts","../src/db.ts","../src/storage.ts","../src/index.ts"],"names":[],"mappings":";AAIO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,IAAA;AAAA,EAET,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,IAAA,EAAe;AAC1D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,IAAM,SAAA,GAAN,cAAwB,cAAA,CAAe;AAAA,EAC5C,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,IAAA,EAAe;AAC1D,IAAA,KAAA,CAAM,OAAA,EAAS,QAAQ,IAAI,CAAA;AAC3B,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AAAA,EACd;AACF;AAEO,IAAM,YAAA,GAAN,cAA2B,cAAA,CAAe;AAAA,EAC/C,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,IAAA,EAAe;AAC1D,IAAA,KAAA,CAAM,OAAA,EAAS,QAAQ,IAAI,CAAA;AAC3B,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AAAA,EACd;AACF;AAEO,IAAM,aAAA,GAAN,cAA4B,cAAA,CAAe;AAAA,EAChD,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,IAAA,EAAe;AAC1D,IAAA,KAAA,CAAM,OAAA,EAAS,QAAQ,IAAI,CAAA;AAC3B,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACd;AACF;AAGO,IAAM,sBAAA,GAAN,cAAqC,cAAA,CAAe;AAAA,EACzD,YAAY,GAAA,EAA6B;AACvC,IAAA,KAAA;AAAA,MACE,aAAa,GAAG,CAAA,uKAAA,CAAA;AAAA,MAChB,GAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AAAA,EACd;AACF;;;ACQO,SAAS,UAAA,CAAW,MAAc,CAAA,EAAuB;AAC9D,EAAA,eAAe,IAAA,CAAQ,IAAA,EAAc,IAAA,GAAoB,EAAC,EAAe;AAMvE,IAAA,MAAM,MAAA,GAAA,CAAU,IAAA,CAAK,MAAA,IAAU,KAAA,EAAO,WAAA,EAAY;AAClD,IAAA,MAAM,WAAA,GAAc,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,UAAU,MAAA,KAAW,SAAA;AACxE,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,GAAK,IAAA,CAAK,OAAA,IAAkD;AAAC,KAC/D;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,IAAA;AAChB,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,IAAI,IAAA,KAAS,MAAA,IAAa,IAAA,KAAS,IAAA,EAAM,IAAA,GAAO,IAAA;AAChD,MAAA,IAAI,QAAQ,cAAc,CAAA,KAAM,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAAA,IACvE;AACA,IAAA,MAAM,MAAM,MAAM,CAAA,CAAE,GAAG,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MACpC,GAAG,IAAA;AAAA,MACH,WAAA,EAAa,SAAA;AAAA,MACb,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAK/C,MAAA,MAAM,IAAI,SAAA;AAAA,QACR,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,KAAA,IAAS,GAAA,CAAI,UAAA;AAAA,QAClC,GAAA,CAAI,MAAA;AAAA,QACJ,IAAA,CAAK;AAAA,OACP;AAAA,IACF;AACA,IAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,EACzB;AAEA,EAAA,MAAM,UAAU,YAA8D;AAC5E,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,KAAuC,SAAS,CAAA;AAAA,IAC/D,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,SAAA,IAAa,GAAA,CAAI,MAAA,KAAW,KAAK,OAAO,IAAA;AAC3D,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAA;AAOA,EAAA,MAAM,iBAAiB,MACrB,OAAO,QAAA,KAAa,WAAA,GAAc,SAAS,IAAA,GAAO,MAAA;AAEpD,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,CAAC,KAAA,KACP,IAAA,CAAqB,yBAAA,EAA2B;AAAA,MAC9C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,GAAG,KAAA;AAAA,QACH,WAAA,EAAa,KAAA,CAAM,WAAA,IAAe,cAAA;AAAe,OAClD;AAAA,KACF,CAAA;AAAA,IACH,MAAA,EAAQ,CAAC,KAAA,KACP,IAAA,CAAqB,yBAAA,EAA2B;AAAA,MAC9C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA,KAC3B,CAAA;AAAA,IACH,gBAAA,EAAkB,OAAO,QAAA,EAAU,IAAA,GAAO,EAAC,KAAM;AAC/C,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,IAAe,cAAA,EAAe;AACvD,MAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAsB,0BAAA,EAA4B;AAAA,QAChE,MAAA,EAAQ,MAAA;AAAA,QACR,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,aAAa;AAAA,OAC/C,CAAA;AACD,MAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,OAAO,aAAa,WAAA,EAAa;AACvD,QAAA,QAAA,CAAS,OAAO,CAAA,CAAE,GAAA;AAAA,MACpB;AACA,MAAA,OAAO,CAAA;AAAA,IACT,CAAA;AAAA,IACA,mBAAA,EAAqB,CAAC,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACzC,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,WAAA,IAAe,cAAA,EAAe;AACvD,MAAA,OAAO,KAA0B,8BAAA,EAAgC;AAAA,QAC/D,MAAA,EAAQ,MAAA;AAAA,QACR,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,aAAa;AAAA,OAC5C,CAAA;AAAA,IACH,CAAA;AAAA,IACA,SAAS,YAAY;AACnB,MAAA,MAAM,IAAA,CAAwB,oBAAA,EAAsB,EAAE,MAAA,EAAQ,QAAQ,CAAA;AAAA,IACxE,CAAA;AAAA,IACA,oBAAA,EAAsB,CAAC,KAAA,KACrB,IAAA,CAA0B,kCAAA,EAAoC;AAAA,MAC5D,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA,KAC3B,CAAA;AAAA,IACH,aAAA,EAAe,CAAC,KAAA,KACd,IAAA,CAA0B,0BAAA,EAA4B;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA,KAC3B,CAAA;AAAA,IACH,qBAAA,EAAuB,CAAC,KAAA,KACtB,IAAA,CAA0B,mCAAA,EAAqC;AAAA,MAC7D,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,GAAG,KAAA;AAAA,QACH,WAAA,EAAa,KAAA,CAAM,WAAA,IAAe,cAAA;AAAe,OAClD;AAAA,KACF,CAAA;AAAA,IACH,KAAA,EAAO,YAAA,CAAa,MAAM,OAAA,KAAY,IAAA,IAAQ,IAAA;AAAA,IAC9C,UAAA,EAAY,YAAA,CAAa,MAAM,OAAA,KAAY,OAAA,IAAW;AAAA,GACxD;AACF;;;AC3JA,IAAM,QAAA,GAAW,0BAAA;AAIV,SAAS,WAAA,CAAY,MAAc,IAAA,EAAgC;AACxE,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,CAAC,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,EAAG;AACpD,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,CAAA,QAAA,EAAW,IAAI,CAAA,OAAA,EAAU,IAAA,CAAK,SAAA;AAAA,QAC5B;AAAA,OACD,CAAA,kGAAA,CAAA;AAAA,MACD,GAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACF;AAQO,SAAS,YAAA,CACd,MAAA,EACA,WAAA,GAAc,CAAA,EACuB;AACrC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACjD,IAAA,WAAA,CAAY,KAAK,QAAQ,CAAA;AACzB,IAAA,IAAI,UAAU,IAAA,EAAM;AAClB,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,CAAA,EAAI,GAAG,CAAA,SAAA,CAAW,CAAA;AAC7B,MAAA;AAAA,IACF;AACA,IAAA,IACE,OAAO,UAAU,QAAA,IACjB,OAAO,UAAU,QAAA,IACjB,OAAO,UAAU,SAAA,EACjB;AACA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,MAAA,KAAA,CAAM,KAAK,CAAA,CAAA,EAAI,GAAG,QAAQ,WAAA,GAAc,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AACvD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,uCAAuC,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,EAAA,EAAK,OAAO,KAAK,CAAA,2GAAA,CAAA;AAAA,MAE3E,GAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,GAAA,EAAK,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,MAAM,IAAA,CAAK,OAAO,CAAA,GAAI,KAAA,EAAO,MAAA,EAAO;AACvE;AAGO,SAAS,cAAc,IAAA,EAOU;AACtC,EAAA,WAAA,CAAY,IAAA,CAAK,OAAO,OAAO,CAAA;AAC/B,EAAA,MAAM,IAAA,GACJ,KAAK,OAAA,KAAY,GAAA,GACb,MACA,IAAA,CAAK,OAAA,CACF,GAAA,CAAI,CAAC,CAAA,KAAM;AACV,IAAA,WAAA,CAAY,GAAG,QAAQ,CAAA;AACvB,IAAA,OAAO,IAAI,CAAC,CAAA,CAAA,CAAA;AAAA,EACd,CAAC,CAAA,CACA,IAAA,CAAK,IAAI,CAAA;AAClB,EAAA,IAAI,GAAA,GAAM,CAAA,OAAA,EAAU,IAAI,CAAA,OAAA,EAAU,KAAK,KAAK,CAAA,CAAA,CAAA;AAC5C,EAAA,IAAI,SAAqB,EAAC;AAC1B,EAAA,IAAI,KAAK,KAAA,EAAO;AACd,IAAA,MAAM,CAAA,GAAI,YAAA,CAAa,IAAA,CAAK,KAAK,CAAA;AACjC,IAAA,GAAA,IAAO,CAAA,OAAA,EAAU,EAAE,GAAG,CAAA,CAAA;AACtB,IAAA,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,CAAA,CAAE,MAAM,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,KAAK,OAAA,EAAS;AAChB,IAAA,WAAA,CAAY,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,QAAQ,CAAA;AACzC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,SAAA,KAAc,SAAS,MAAA,GAAS,KAAA;AACzD,IAAA,GAAA,IAAO,CAAA,WAAA,EAAc,IAAA,CAAK,OAAA,CAAQ,MAAM,KAAK,GAAG,CAAA,CAAA;AAAA,EAClD;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,IAAA,IAAI,CAAC,OAAO,SAAA,CAAU,IAAA,CAAK,KAAK,CAAA,IAAK,IAAA,CAAK,QAAQ,CAAA,EAAG;AACnD,MAAA,MAAM,IAAI,aAAA,CAAc,sCAAA,EAAwC,GAAA,EAAK,eAAe,CAAA;AAAA,IACtF;AACA,IAAA,GAAA,IAAO,CAAA,OAAA,EAAU,KAAK,KAAK,CAAA,CAAA;AAAA,EAC7B;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,MAAA,KAAW,QAAA,EAAU;AACnC,IAAA,IAAI,CAAC,OAAO,SAAA,CAAU,IAAA,CAAK,MAAM,CAAA,IAAK,IAAA,CAAK,SAAS,CAAA,EAAG;AACrD,MAAA,MAAM,IAAI,aAAA,CAAc,uCAAA,EAAyC,GAAA,EAAK,gBAAgB,CAAA;AAAA,IACxF;AACA,IAAA,GAAA,IAAO,CAAA,QAAA,EAAW,KAAK,MAAM,CAAA,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,EAAE,KAAK,MAAA,EAAO;AACvB;AAIO,SAAS,cAAc,IAAA,EAIU;AACtC,EAAA,WAAA,CAAY,IAAA,CAAK,OAAO,OAAO,CAAA;AAC/B,EAAA,IAAI,IAAA,CAAK,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,aAAA,CAAc,4BAAA,EAA8B,GAAA,EAAK,cAAc,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,CAAC,CAAE,CAAA;AACtC,EAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,yEAAA;AAAA,MACA,GAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,KAAA,MAAW,CAAA,IAAK,IAAA,EAAM,WAAA,CAAY,CAAA,EAAG,QAAQ,CAAA;AAC7C,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AACnD,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,MAAM,cAAwB,EAAC;AAC/B,EAAA,KAAA,MAAW,GAAA,IAAO,KAAK,IAAA,EAAM;AAC3B,IAAA,MAAM,eAAyB,EAAC;AAChC,IAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,MAAA,MAAM,CAAA,GAAI,IAAI,CAAC,CAAA;AAGf,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,KAAM,MAAA,GAAY,IAAA,GAAQ,CAAc,CAAA;AACpD,MAAA,YAAA,CAAa,IAAA,CAAK,CAAA,CAAA,EAAI,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAAA,IACvC;AACA,IAAA,WAAA,CAAY,KAAK,CAAA,CAAA,EAAI,YAAA,CAAa,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EACjD;AACA,EAAA,IAAI,GAAA,GAAM,CAAA,aAAA,EAAgB,IAAA,CAAK,KAAK,CAAA,GAAA,EAAM,OAAO,CAAA,SAAA,EAAY,WAAA,CAAY,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AACnF,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,GAAA,IAAO,CAAA,WAAA,EAAc,gBAAA,CAAiB,IAAA,CAAK,SAAS,CAAC,CAAA,CAAA;AAAA,EACvD;AACA,EAAA,OAAO,EAAE,KAAK,MAAA,EAAO;AACvB;AAEO,SAAS,cAAc,IAAA,EAKU;AACtC,EAAA,WAAA,CAAY,IAAA,CAAK,OAAO,OAAO,CAAA;AAC/B,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,KAAK,CAAA;AACnC,EAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,aAAA;AAAA,MACR,+DAAA;AAAA,MACA,GAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,IAAA,WAAA,CAAY,GAAG,QAAQ,CAAA;AACvB,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AACtB,IAAA,MAAA,CAAO,KAAK,CAAC,CAAA;AACb,IAAA,QAAA,CAAS,KAAK,CAAA,CAAA,EAAI,CAAC,CAAA,KAAA,EAAQ,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAAA,EAC5C;AACA,EAAA,IAAI,GAAA,GAAM,WAAW,IAAA,CAAK,KAAK,SAAS,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAC3D,EAAA,IAAI,KAAK,KAAA,EAAO;AACd,IAAA,MAAM,CAAA,GAAI,YAAA,CAAa,IAAA,CAAK,KAAA,EAAO,OAAO,MAAM,CAAA;AAChD,IAAA,GAAA,IAAO,CAAA,OAAA,EAAU,EAAE,GAAG,CAAA,CAAA;AACtB,IAAA,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAM,CAAA;AAAA,EACzB;AACA,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,GAAA,IAAO,CAAA,WAAA,EAAc,gBAAA,CAAiB,IAAA,CAAK,SAAS,CAAC,CAAA,CAAA;AAAA,EACvD;AACA,EAAA,OAAO,EAAE,KAAK,MAAA,EAAO;AACvB;AAEO,SAAS,cAAc,IAAA,EAGU;AACtC,EAAA,WAAA,CAAY,IAAA,CAAK,OAAO,OAAO,CAAA;AAC/B,EAAA,IAAI,GAAA,GAAM,CAAA,aAAA,EAAgB,IAAA,CAAK,KAAK,CAAA,CAAA,CAAA;AACpC,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,IAAI,KAAK,KAAA,EAAO;AACd,IAAA,MAAM,CAAA,GAAI,YAAA,CAAa,IAAA,CAAK,KAAK,CAAA;AACjC,IAAA,GAAA,IAAO,CAAA,OAAA,EAAU,EAAE,GAAG,CAAA,CAAA;AACtB,IAAA,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAM,CAAA;AAAA,EACzB;AACA,EAAA,OAAO,EAAE,KAAK,MAAA,EAAO;AACvB;AAEA,SAAS,iBAAiB,SAAA,EAAmC;AAC3D,EAAA,IAAI,SAAA,KAAc,KAAK,OAAO,GAAA;AAC9B,EAAA,OAAO,SAAA,CACJ,GAAA,CAAI,CAAC,CAAA,KAAM;AACV,IAAA,WAAA,CAAY,GAAG,QAAQ,CAAA;AACvB,IAAA,OAAO,IAAI,CAAC,CAAA,CAAA,CAAA;AAAA,EACd,CAAC,CAAA,CACA,IAAA,CAAK,IAAI,CAAA;AACd;AASO,SAAS,gBAAA,CACd,SACA,MAAA,EACoC;AACpC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,MAAM,SAAoB,EAAC;AAC3B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,QAAQ,CAAA,EAAA,EAAK;AACvC,IAAA,GAAA,IAAO,OAAA,CAAQ,CAAC,CAAA,IAAK,EAAA;AACrB,IAAA,IAAI,CAAA,GAAI,OAAO,MAAA,EAAQ;AACrB,MAAA,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,CAAC,CAAC,CAAA;AACrB,MAAA,GAAA,IAAO,CAAA,CAAA,EAAI,OAAO,MAAM,CAAA,CAAA;AAAA,IAC1B;AAAA,EACF;AACA,EAAA,OAAO,EAAE,KAAK,MAAA,EAAO;AACvB;;;ACjJA,eAAe,SAAA,CACb,IAAA,EACA,UAAA,EACA,CAAA,EACA,KACA,MAAA,EACsB;AACtB,EAAA,MAAM,GAAA,GAAM,MAAM,CAAA,CAAE,CAAA,EAAG,IAAI,CAAA,aAAA,CAAA,EAAiB;AAAA,IAC1C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,UAAU,UAAU,CAAA,CAAA;AAAA,MACnC,cAAA,EAAgB;AAAA,KAClB;AAAA,IACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,GAAA,EAAK,QAAQ;AAAA,GACrC,CAAA;AACD,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAC/C,IAAA,MAAM,IAAI,cAAc,IAAA,CAAK,KAAA,IAAS,IAAI,UAAA,EAAY,GAAA,CAAI,MAAA,EAAQ,IAAA,CAAK,IAAI,CAAA;AAAA,EAC7E;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAI7B,EAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,OAAA,EAAS,IAAA,EAAM,KAAK,IAAA,EAAK;AAC/C;AAEO,SAAS,cAAA,CACd,IAAA,EACA,UAAA,EACA,CAAA,EACU;AACV,EAAA,MAAM,aAAa,MAAc;AAC/B,IAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,uBAAuB,UAAU,CAAA;AAC5D,IAAA,OAAO,UAAA;AAAA,EACT,CAAA;AAaA,EAAA,SAAS,WACP,KAAA,EACiB;AACjB,IAAA,MAAM,OAAO,YAAqC;AAChD,MAAA,MAAM,MAAM,UAAA,EAAW;AACvB,MAAA,MAAM,EAAE,GAAA,EAAK,MAAA,EAAO,GAAI,cAAc,KAAK,CAAA;AAC3C,MAAA,OAAQ,MAAM,SAAA,CAAU,IAAA,EAAM,GAAA,EAAK,CAAA,EAAG,KAAK,MAAM,CAAA;AAAA,IACnD,CAAA;AACA,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,CAAC,OAAA,KAAY,UAAA,CAAc,EAAE,GAAG,KAAA,EAAO,OAAA,EAAS,aAAA,CAAc,OAAO,CAAA,EAAG,CAAA;AAAA,MAChF,KAAA,EAAO,CAAC,MAAA,KACN,UAAA,CAAc,EAAE,GAAG,KAAA,EAAO,KAAA,EAAO,MAAA,EAAoC,CAAA;AAAA,MACvE,OAAA,EAAS,CAAC,MAAA,EAAQ,SAAA,GAAY,UAC5B,UAAA,CAAc;AAAA,QACZ,GAAG,KAAA;AAAA,QACH,OAAA,EAAS,EAAE,MAAA,EAA0B,SAAA;AAAU,OAChD,CAAA;AAAA,MACH,KAAA,EAAO,CAAC,CAAA,KAAM,UAAA,CAAc,EAAE,GAAG,KAAA,EAAO,KAAA,EAAO,CAAA,EAAG,CAAA;AAAA,MAClD,MAAA,EAAQ,CAAC,CAAA,KAAM,UAAA,CAAc,EAAE,GAAG,KAAA,EAAO,MAAA,EAAQ,CAAA,EAAG,CAAA;AAAA,MACpD,IAAA,EAAM,CAAC,WAAA,EAAa,UAAA,KAAe,MAAK,CAAE,IAAA,CAAK,aAAa,UAAU;AAAA,KACxE;AAAA,EACF;AAEA,EAAA,SAAS,UAAA,CACP,KAAA,EACA,IAAA,EACA,SAAA,EACkB;AAClB,IAAA,MAAM,OAAO,YAAqC;AAChD,MAAA,MAAM,MAAM,UAAA,EAAW;AACvB,MAAA,MAAM,EAAE,KAAK,MAAA,EAAO,GAAI,cAAc,EAAE,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,CAAA;AAChE,MAAA,OAAQ,MAAM,SAAA,CAAU,IAAA,EAAM,GAAA,EAAK,CAAA,EAAG,KAAK,MAAM,CAAA;AAAA,IACnD,CAAA;AACA,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,CAAC,IAAA,KAAS,UAAA,CAAc,OAAO,IAAA,EAAM,aAAA,CAAc,IAAA,IAAQ,GAAG,CAAC,CAAA;AAAA,MAC1E,IAAA,EAAM,CAAC,WAAA,EAAa,UAAA,KAAe,MAAK,CAAE,IAAA,CAAK,aAAa,UAAU;AAAA,KACxE;AAAA,EACF;AAEA,EAAA,SAAS,UAAA,CACP,KAAA,EACA,KAAA,EACA,KAAA,EACA,SAAA,EACkB;AAClB,IAAA,MAAM,OAAO,YAAqC;AAChD,MAAA,MAAM,MAAM,UAAA,EAAW;AACvB,MAAA,MAAM,EAAE,GAAA,EAAK,MAAA,EAAO,GAAI,aAAA,CAAc,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,SAAA,EAAW,CAAA;AACxE,MAAA,OAAQ,MAAM,SAAA,CAAU,IAAA,EAAM,GAAA,EAAK,CAAA,EAAG,KAAK,MAAM,CAAA;AAAA,IACnD,CAAA;AACA,IAAA,OAAO;AAAA,MACL,OAAO,CAAC,MAAA,KACN,WAAc,KAAA,EAAO,KAAA,EAAO,QAAoC,SAAS,CAAA;AAAA,MAC3E,SAAA,EAAW,CAAC,IAAA,KAAS,UAAA,CAAc,KAAA,EAAO,OAAO,KAAA,EAAO,aAAA,CAAc,IAAA,IAAQ,GAAG,CAAC,CAAA;AAAA,MAClF,IAAA,EAAM,CAAC,WAAA,EAAa,UAAA,KAAe,MAAK,CAAE,IAAA,CAAK,aAAa,UAAU;AAAA,KACxE;AAAA,EACF;AAEA,EAAA,SAAS,UAAA,CACP,OACA,KAAA,EACkB;AAClB,IAAA,MAAM,OAAO,YAAqC;AAChD,MAAA,MAAM,MAAM,UAAA,EAAW;AACvB,MAAA,MAAM,EAAE,KAAK,MAAA,EAAO,GAAI,cAAc,EAAE,KAAA,EAAO,OAAO,CAAA;AACtD,MAAA,OAAQ,MAAM,SAAA,CAAU,IAAA,EAAM,GAAA,EAAK,CAAA,EAAG,KAAK,MAAM,CAAA;AAAA,IACnD,CAAA;AACA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,CAAC,MAAA,KAAW,UAAA,CAAc,OAAO,MAAkC,CAAA;AAAA,MAC1E,IAAA,EAAM,CAAC,WAAA,EAAa,UAAA,KAAe,MAAK,CAAE,IAAA,CAAK,aAAa,UAAU;AAAA,KACxE;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,CAAoC,KAAA,KAAkB;AAK1D,MAAA,WAAA,CAAY,OAAO,OAAO,CAAA;AAC1B,MAAA,MAAM,SAAS,UAAA,CAAc,EAAE,KAAA,EAAO,OAAA,EAAS,KAAK,CAAA;AACpD,MAAA,MAAM,UAAA,GAAa,MAAA;AAGnB,MAAC,UAAA,CAA6B,MAAA,GAAS,CAAC,GAAA,KAAQ;AAG9C,QAAA,MAAM,OAAQ,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,GAAI,GAAA,GAAM,CAAC,GAAG,CAAA;AAC7C,QAAA,OAAO,UAAA,CAAc,OAAO,IAAI,CAAA;AAAA,MAClC,CAAA;AACA,MAAC,WAA6B,MAAA,GAAS,CAAC,KAAA,KACtC,UAAA,CAAc,OAAO,KAAiC,CAAA;AACxD,MAAC,UAAA,CAA6B,MAAA,GAAS,MAAM,UAAA,CAAc,KAAK,CAAA;AAChE,MAAA,OAAO,UAAA;AAAA,IACT,CAAA;AAAA,IACA,GAAA,EAAK,OACH,OAAA,EAAA,GACG,MAAA,KACA;AACH,MAAA,MAAM,MAAM,UAAA,EAAW;AACvB,MAAA,MAAM,EAAE,GAAA,EAAK,MAAA,EAAO,GAAI,gBAAA,CAAiB,SAAS,MAAM,CAAA;AACxD,MAAA,OAAQ,MAAM,SAAA,CAAU,IAAA,EAAM,GAAA,EAAK,CAAA,EAAG,KAAK,MAAM,CAAA;AAAA,IACnD;AAAA,GACF;AACF;AAEA,SAAS,cAAc,IAAA,EAA0D;AAC/E,EAAA,IAAI,IAAA,KAAS,KAAK,OAAO,GAAA;AACzB,EAAA,OAAO,CAAC,GAAG,IAAI,CAAA;AACjB;;;ACjKO,SAAS,aAAA,CACd,IAAA,EACA,UAAA,EACA,CAAA,EACS;AACT,EAAA,MAAM,aAAa,MAAc;AAC/B,IAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,uBAAuB,SAAS,CAAA;AAC3D,IAAA,OAAO,UAAA;AAAA,EACT,CAAA;AAEA,EAAA,eAAe,IAAA,CACb,IAAA,EACA,IAAA,GAAyD,EAAC,EAC9C;AACZ,IAAA,MAAM,MAAM,UAAA,EAAW;AACvB,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,aAAA,EAAe,UAAU,GAAG,CAAA,CAAA;AAAA,MAC5B,GAAK,IAAA,CAAK,OAAA,IAAkD;AAAC,KAC/D;AACA,IAAA,MAAM,MAAA,GAAA,CAAU,IAAA,CAAK,MAAA,IAAU,KAAA,EAAO,WAAA,EAAY;AAClD,IAAA,IAAI,WAAW,KAAA,IAAS,MAAA,KAAW,UAAU,OAAA,CAAQ,cAAc,MAAM,MAAA,EAAW;AAClF,MAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAAA,IAC5B;AACA,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,GAAG,IAAI,CAAA,EAAG,IAAI,CAAA,CAAE,CAAA;AACpC,IAAA,IAAI,KAAK,KAAA,EAAO;AACd,MAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/C,QAAA,IAAI,CAAA,KAAM,UAAa,CAAA,KAAM,EAAA,MAAQ,YAAA,CAAa,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,MAC5D;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,CAAA,CAAE,GAAA,CAAI,QAAA,IAAY,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,CAAA;AACxD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAC/C,MAAA,MAAM,IAAI,YAAA;AAAA,QACR,IAAA,CAAK,SAAS,GAAA,CAAI,UAAA;AAAA,QAClB,GAAA,CAAI,MAAA;AAAA,QACJ,IAAA,CAAK;AAAA,OACP;AAAA,IACF;AACA,IAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,EACzB;AAEA,EAAA,OAAO;AAAA,IACL,aAAa,YAAY;AACvB,MAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAmC,sBAAsB,CAAA;AACzE,MAAA,OAAO,CAAA,CAAE,OAAA;AAAA,IACX,CAAA;AAAA,IACA,IAAA,EAAM,CAAC,MAAA,MAAY;AAAA,MACjB,qBAAA,EAAuB,OAAO,GAAA,EAAK,IAAA,GAAO,EAAC,KAAM;AAC/C,QAAA,MAAM,IAAI,MAAM,IAAA;AAAA,UACd,sBAAA;AAAA,UACA;AAAA,YACE,MAAA,EAAQ,MAAA;AAAA,YACR,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,cACnB,MAAA;AAAA,cACA,GAAA;AAAA,cACA,EAAA,EAAI,KAAA;AAAA,cACJ,aAAa,IAAA,CAAK,WAAA;AAAA,cAClB,WAAW,IAAA,CAAK;AAAA,aACjB;AAAA;AACH,SACF;AACA,QAAA,OAAO,EAAE,GAAA,EAAK,CAAA,CAAE,GAAA,EAAK,aAAA,EAAe,EAAE,aAAA,EAAc;AAAA,MACtD,CAAA;AAAA,MACA,uBAAA,EAAyB,OAAO,GAAA,EAAK,IAAA,GAAO,EAAC,KAAM;AACjD,QAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAsB,sBAAA,EAAwB;AAAA,UAC5D,MAAA,EAAQ,MAAA;AAAA,UACR,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,YACnB,MAAA;AAAA,YACA,GAAA;AAAA,YACA,EAAA,EAAI,KAAA;AAAA,YACJ,WAAW,IAAA,CAAK;AAAA,WACjB;AAAA,SACF,CAAA;AACD,QAAA,OAAO,EAAE,GAAA,EAAK,CAAA,CAAE,GAAA,EAAI;AAAA,MACtB,CAAA;AAAA,MACA,MAAA,EAAQ,OAAO,IAAA,KAAS;AAKtB,QAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,UAAA,MAAM,KAAmB,qBAAA,EAAuB;AAAA,YAC9C,MAAA,EAAQ,QAAA;AAAA,YACR,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,MAAA,EAAQ,GAAA,EAAK,GAAG;AAAA,WACxC,CAAA;AAAA,QACH;AAAA,MACF,CAAA;AAAA,MACA,IAAA,EAAM,OAAO,IAAA,GAAO,EAAC,KAAM;AACzB,QAAA,OAAO,KAA0B,mBAAA,EAAqB;AAAA,UACpD,MAAA,EAAQ,KAAA;AAAA,UACR,KAAA,EAAO;AAAA,YACL,MAAA;AAAA,YACA,GAAI,IAAA,CAAK,MAAA,KAAW,UAAa,EAAE,MAAA,EAAQ,KAAK,MAAA,EAAO;AAAA,YACvD,GAAI,IAAA,CAAK,MAAA,KAAW,UAAa,EAAE,MAAA,EAAQ,KAAK,MAAA;AAAO;AACzD,SACD,CAAA;AAAA,MACH;AAAA,KACF;AAAA,GACF;AACF;;;AC3IO,SAAS,gBAAgB,MAAA,EAAoC;AAClE,EAAA,IAAI,CAAC,QAAQ,GAAA,EAAK;AAChB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,4KAAA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,OAAA,CAAQ,OAAO,EAAE,CAAA;AACzC,EAAA,MAAM,CAAA,GAAI,OAAO,KAAA,IAAS,KAAA;AAE1B,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,IAAA,EAAM,CAAC,CAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,IAAA,EAAM,MAAA,CAAO,YAAY,CAAC,CAAA;AACxD,EAAA,MAAM,EAAA,GAAK,cAAA,CAAe,IAAA,EAAM,MAAA,CAAO,YAAY,CAAC,CAAA;AAEpD,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA,EAAM,CAAC,KAAA,KAAU,EAAA,CAAG,KAAK,KAAK,CAAA;AAAA,IAC9B,GAAA,EAAK,CAAC,OAAA,EAAA,GAAY,MAAA,KAAW,GAAG,GAAA,CAAI,OAAA,EAAS,GAAG,MAAM;AAAA,GACxD;AACF","file":"index.js","sourcesContent":["// Shared error types. Callers get a concrete class to instanceof against,\n// plus the BetterAuth machine-readable `code` so they can branch on\n// \"INVALID_PASSWORD\" / \"TOO_MANY_REQUESTS\" / etc. without string-matching.\n\nexport class FlarelinkError extends Error {\n  readonly status: number;\n  readonly code: string | undefined;\n\n  constructor(message: string, status: number, code?: string) {\n    super(message);\n    this.name = 'FlarelinkError';\n    this.status = status;\n    this.code = code;\n  }\n}\n\nexport class AuthError extends FlarelinkError {\n  constructor(message: string, status: number, code?: string) {\n    super(message, status, code);\n    this.name = 'AuthError';\n  }\n}\n\nexport class StorageError extends FlarelinkError {\n  constructor(message: string, status: number, code?: string) {\n    super(message, status, code);\n    this.name = 'StorageError';\n  }\n}\n\nexport class DatabaseError extends FlarelinkError {\n  constructor(message: string, status: number, code?: string) {\n    super(message, status, code);\n    this.name = 'DatabaseError';\n  }\n}\n\n/** Thrown when a server-only API is called without a service key. */\nexport class MissingServiceKeyError extends FlarelinkError {\n  constructor(api: 'storage' | 'database') {\n    super(\n      `flarelink.${api} requires a service key. Pass it to createFlarelink({ serviceKey }) — only do this on the server (never in the browser). Mint a key from your project's dashboard.`,\n      400,\n      'MISSING_SERVICE_KEY',\n    );\n    this.name = 'MissingServiceKeyError';\n  }\n}\n","// Auth surface. Ported verbatim from auth-module/client/flarelinkAuth.ts —\n// every method sends `credentials: 'include'` so the browser carries the\n// session cookie automatically. Caller's app origin must be in the\n// deployment's trustedOrigins list (Authentication page in the dashboard),\n// otherwise the Worker rejects with 403.\n\nimport { AuthError } from './errors.js';\nimport type {\n  RequestPasswordResetInput,\n  ResetPasswordInput,\n  SendVerificationEmailInput,\n  Session,\n  SignInInput,\n  SignInWithMagicLinkOptions,\n  SignInWithSocialOptions,\n  SignUpInput,\n  SocialProvider,\n  User,\n} from './types.js';\n\nexport type Auth = {\n  signUp(input: SignUpInput): Promise<{ user: User }>;\n  signIn(input: SignInInput): Promise<{ user: User }>;\n  signInWithSocial(\n    provider: SocialProvider,\n    opts?: SignInWithSocialOptions,\n  ): Promise<{ url: string }>;\n  signInWithMagicLink(\n    email: string,\n    opts?: SignInWithMagicLinkOptions,\n  ): Promise<{ status: boolean }>;\n  signOut(): Promise<void>;\n  /**\n   * Triggers a password-reset email. Always resolves with `{ status: true }`\n   * even when the email is unknown — that's deliberate, BetterAuth doesn't\n   * leak account existence on this endpoint.\n   */\n  requestPasswordReset(input: RequestPasswordResetInput): Promise<{ status: boolean }>;\n  /**\n   * Completes the reset using the token from the email link. Your reset\n   * page reads `?token=` from the URL and passes it here alongside the\n   * new password.\n   */\n  resetPassword(input: ResetPasswordInput): Promise<{ status: boolean }>;\n  /**\n   * Sends a verification email to the address. The link in the email lands\n   * the user on `callbackURL` after the email is marked verified.\n   */\n  sendVerificationEmail(input: SendVerificationEmailInput): Promise<{ status: boolean }>;\n  /** Current user, or null when not signed in. */\n  getMe(): Promise<User | null>;\n  /** Active session, or null when not signed in. */\n  getSession(): Promise<Session | null>;\n};\n\nexport function createAuth(base: string, f: typeof fetch): Auth {\n  async function call<T>(path: string, init: RequestInit = {}): Promise<T> {\n    // BetterAuth is strict on two fronts: state-changing requests must declare\n    // Content-Type: application/json (else 415), AND if Content-Type is JSON\n    // the body has to actually parse as JSON (empty body throws). For POSTs\n    // like sign-out that semantically have nothing to send, we default the\n    // body to \"{}\" so both checks pass.\n    const method = (init.method ?? 'GET').toUpperCase();\n    const bodyBearing = method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS';\n    const headers: Record<string, string> = {\n      ...((init.headers as Record<string, string> | undefined) ?? {}),\n    };\n    let body = init.body;\n    if (bodyBearing) {\n      if (body === undefined || body === null) body = '{}';\n      if (headers['Content-Type'] === undefined) headers['Content-Type'] = 'application/json';\n    }\n    const res = await f(`${base}${path}`, {\n      ...init,\n      credentials: 'include',\n      headers,\n      body,\n    });\n    if (!res.ok) {\n      const data = (await res.json().catch(() => ({}))) as {\n        message?: string;\n        error?: string;\n        code?: string;\n      };\n      throw new AuthError(\n        data.message ?? data.error ?? res.statusText,\n        res.status,\n        data.code,\n      );\n    }\n    return (await res.json()) as T;\n  }\n\n  const fetchMe = async (): Promise<{ user: User; session: Session } | null> => {\n    try {\n      return await call<{ user: User; session: Session }>('/api/me');\n    } catch (err) {\n      if (err instanceof AuthError && err.status === 401) return null;\n      throw err;\n    }\n  };\n\n  // Default a missing browser-side callbackURL to the current page so the\n  // auto-send-on-signup verification email lands the user back where they\n  // started. Without this, BetterAuth defaults to `/` which resolves against\n  // the auth Worker's hostname → 404. Non-browser callers (SSR, tests) pass\n  // explicit values or accept the Worker's first-trusted-origin fallback.\n  const browserDefault = (): string | undefined =>\n    typeof location !== 'undefined' ? location.href : undefined;\n\n  return {\n    signUp: (input) =>\n      call<{ user: User }>('/api/auth/sign-up/email', {\n        method: 'POST',\n        body: JSON.stringify({\n          ...input,\n          callbackURL: input.callbackURL ?? browserDefault(),\n        }),\n      }),\n    signIn: (input) =>\n      call<{ user: User }>('/api/auth/sign-in/email', {\n        method: 'POST',\n        body: JSON.stringify(input),\n      }),\n    signInWithSocial: async (provider, opts = {}) => {\n      const callbackURL = opts.callbackURL ?? browserDefault();\n      const r = await call<{ url: string }>('/api/auth/sign-in/social', {\n        method: 'POST',\n        body: JSON.stringify({ provider, callbackURL }),\n      });\n      if (!opts.noRedirect && typeof location !== 'undefined') {\n        location.href = r.url;\n      }\n      return r;\n    },\n    signInWithMagicLink: (email, opts = {}) => {\n      const callbackURL = opts.callbackURL ?? browserDefault();\n      return call<{ status: boolean }>('/api/auth/sign-in/magic-link', {\n        method: 'POST',\n        body: JSON.stringify({ email, callbackURL }),\n      });\n    },\n    signOut: async () => {\n      await call<{ success: true }>('/api/auth/sign-out', { method: 'POST' });\n    },\n    requestPasswordReset: (input) =>\n      call<{ status: boolean }>('/api/auth/request-password-reset', {\n        method: 'POST',\n        body: JSON.stringify(input),\n      }),\n    resetPassword: (input) =>\n      call<{ status: boolean }>('/api/auth/reset-password', {\n        method: 'POST',\n        body: JSON.stringify(input),\n      }),\n    sendVerificationEmail: (input) =>\n      call<{ status: boolean }>('/api/auth/send-verification-email', {\n        method: 'POST',\n        body: JSON.stringify({\n          ...input,\n          callbackURL: input.callbackURL ?? browserDefault(),\n        }),\n      }),\n    getMe: async () => (await fetchMe())?.user ?? null,\n    getSession: async () => (await fetchMe())?.session ?? null,\n  };\n}\n","// Internal SQL composer. Customer-facing API is in db.ts; this module is\n// the engine. Every identifier (table + column names) is validated against\n// IDENT_RE before composition — if a string doesn't match, we throw rather\n// than letting it reach the SQL.\n//\n// Values always go through bind parameters. There is no path from a\n// customer-supplied value into a SQL string. Try to find one in code review\n// before adding any.\n\nimport { DatabaseError } from './errors.js';\n\nconst IDENT_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\nexport type Equality = string | number | boolean | null;\n\nexport function assertIdent(name: string, role: 'table' | 'column'): void {\n  if (typeof name !== 'string' || !IDENT_RE.test(name)) {\n    throw new DatabaseError(\n      `Invalid ${role} name: ${JSON.stringify(\n        name,\n      )}. Must match /^[A-Za-z_][A-Za-z0-9_]*$/ — use flarelink.sql\\`...\\` for anything more dynamic.`,\n      400,\n      'INVALID_IDENTIFIER',\n    );\n  }\n}\n\n// Build a WHERE clause from a filter object. Equality only, AND-chained.\n// NULL becomes `IS NULL` (not `= NULL`, which is always false in SQL).\n// Arrays + objects in the filter throw with a message pointing at\n// flarelink.sql — keeps the builder surface honestly minimal.\nexport type WhereFilter = Record<string, Equality>;\n\nexport function composeWhere(\n  filter: WhereFilter,\n  paramOffset = 0,\n): { sql: string; params: Equality[] } {\n  const parts: string[] = [];\n  const params: Equality[] = [];\n  for (const [col, value] of Object.entries(filter)) {\n    assertIdent(col, 'column');\n    if (value === null) {\n      parts.push(`\"${col}\" IS NULL`);\n      continue;\n    }\n    if (\n      typeof value === 'string' ||\n      typeof value === 'number' ||\n      typeof value === 'boolean'\n    ) {\n      params.push(value);\n      parts.push(`\"${col}\" = ?${paramOffset + params.length}`);\n      continue;\n    }\n    throw new DatabaseError(\n      `Unsupported filter value for column ${JSON.stringify(col)} (${typeof value}). ` +\n        `where() takes equality on primitives or NULL — use flarelink.sql\\`...\\` for IN / ranges / OR / etc.`,\n      400,\n      'UNSUPPORTED_FILTER',\n    );\n  }\n  return { sql: parts.length > 0 ? parts.join(' AND ') : '1=1', params };\n}\n\n// Build a SELECT query.\nexport function composeSelect(opts: {\n  table: string;\n  columns: '*' | string[];\n  where?: WhereFilter;\n  orderBy?: { column: string; direction: 'asc' | 'desc' };\n  limit?: number;\n  offset?: number;\n}): { sql: string; params: Equality[] } {\n  assertIdent(opts.table, 'table');\n  const cols =\n    opts.columns === '*'\n      ? '*'\n      : opts.columns\n          .map((c) => {\n            assertIdent(c, 'column');\n            return `\"${c}\"`;\n          })\n          .join(', ');\n  let sql = `SELECT ${cols} FROM \"${opts.table}\"`;\n  let params: Equality[] = [];\n  if (opts.where) {\n    const w = composeWhere(opts.where);\n    sql += ` WHERE ${w.sql}`;\n    params = params.concat(w.params);\n  }\n  if (opts.orderBy) {\n    assertIdent(opts.orderBy.column, 'column');\n    const dir = opts.orderBy.direction === 'desc' ? 'DESC' : 'ASC';\n    sql += ` ORDER BY \"${opts.orderBy.column}\" ${dir}`;\n  }\n  if (typeof opts.limit === 'number') {\n    if (!Number.isInteger(opts.limit) || opts.limit < 0) {\n      throw new DatabaseError('limit must be a non-negative integer', 400, 'INVALID_LIMIT');\n    }\n    sql += ` LIMIT ${opts.limit}`;\n  }\n  if (typeof opts.offset === 'number') {\n    if (!Number.isInteger(opts.offset) || opts.offset < 0) {\n      throw new DatabaseError('offset must be a non-negative integer', 400, 'INVALID_OFFSET');\n    }\n    sql += ` OFFSET ${opts.offset}`;\n  }\n  return { sql, params };\n}\n\n// Build INSERT — accepts a single row or an array of rows. All rows must\n// have the same column shape; we use the first row's keys as the schema.\nexport function composeInsert(opts: {\n  table: string;\n  rows: Record<string, Equality>[];\n  returning?: '*' | string[];\n}): { sql: string; params: Equality[] } {\n  assertIdent(opts.table, 'table');\n  if (opts.rows.length === 0) {\n    throw new DatabaseError('insert(): no rows provided', 400, 'EMPTY_INSERT');\n  }\n  const cols = Object.keys(opts.rows[0]!);\n  if (cols.length === 0) {\n    throw new DatabaseError(\n      'insert(): row has no columns. Pass at least one column to insert a row.',\n      400,\n      'EMPTY_ROW',\n    );\n  }\n  for (const c of cols) assertIdent(c, 'column');\n  const colList = cols.map((c) => `\"${c}\"`).join(', ');\n  const params: Equality[] = [];\n  const valueGroups: string[] = [];\n  for (const row of opts.rows) {\n    const placeholders: string[] = [];\n    for (const c of cols) {\n      const v = row[c];\n      // Allow undefined as null on insert — most ORMs default missing\n      // columns to NULL; matches user expectation.\n      params.push(v === undefined ? null : (v as Equality));\n      placeholders.push(`?${params.length}`);\n    }\n    valueGroups.push(`(${placeholders.join(', ')})`);\n  }\n  let sql = `INSERT INTO \"${opts.table}\" (${colList}) VALUES ${valueGroups.join(', ')}`;\n  if (opts.returning) {\n    sql += ` RETURNING ${composeReturning(opts.returning)}`;\n  }\n  return { sql, params };\n}\n\nexport function composeUpdate(opts: {\n  table: string;\n  patch: Record<string, Equality>;\n  where?: WhereFilter;\n  returning?: '*' | string[];\n}): { sql: string; params: Equality[] } {\n  assertIdent(opts.table, 'table');\n  const cols = Object.keys(opts.patch);\n  if (cols.length === 0) {\n    throw new DatabaseError(\n      'update(): patch is empty. Pass at least one column to update.',\n      400,\n      'EMPTY_PATCH',\n    );\n  }\n  const params: Equality[] = [];\n  const setParts: string[] = [];\n  for (const c of cols) {\n    assertIdent(c, 'column');\n    const v = opts.patch[c]!;\n    params.push(v);\n    setParts.push(`\"${c}\" = ?${params.length}`);\n  }\n  let sql = `UPDATE \"${opts.table}\" SET ${setParts.join(', ')}`;\n  if (opts.where) {\n    const w = composeWhere(opts.where, params.length);\n    sql += ` WHERE ${w.sql}`;\n    params.push(...w.params);\n  }\n  if (opts.returning) {\n    sql += ` RETURNING ${composeReturning(opts.returning)}`;\n  }\n  return { sql, params };\n}\n\nexport function composeDelete(opts: {\n  table: string;\n  where?: WhereFilter;\n}): { sql: string; params: Equality[] } {\n  assertIdent(opts.table, 'table');\n  let sql = `DELETE FROM \"${opts.table}\"`;\n  const params: Equality[] = [];\n  if (opts.where) {\n    const w = composeWhere(opts.where);\n    sql += ` WHERE ${w.sql}`;\n    params.push(...w.params);\n  }\n  return { sql, params };\n}\n\nfunction composeReturning(returning: '*' | string[]): string {\n  if (returning === '*') return '*';\n  return returning\n    .map((c) => {\n      assertIdent(c, 'column');\n      return `\"${c}\"`;\n    })\n    .join(', ');\n}\n\n// Tagged-template SQL: turn `SELECT * WHERE id = ${userId}` into\n//   sql: \"SELECT * WHERE id = ?1\"\n//   params: [userId]\n// Every interpolated value becomes a bind param. There is no path to inject\n// raw SQL via this entry point — interpolation is the only way values get\n// in, and the result strings are concatenations of the developer-owned\n// template parts.\nexport function composeTaggedSql(\n  strings: TemplateStringsArray,\n  values: unknown[],\n): { sql: string; params: unknown[] } {\n  let sql = '';\n  const params: unknown[] = [];\n  for (let i = 0; i < strings.length; i++) {\n    sql += strings[i] ?? '';\n    if (i < values.length) {\n      params.push(values[i]);\n      sql += `?${params.length}`;\n    }\n  }\n  return { sql, params };\n}\n","// Database surface — server-only query builder over the project's D1.\n//\n// Wire shape:\n//   POST {url}/api/db/query  { sql, params? } → { results, meta }\n//   POST {url}/api/db/batch  { statements }   → { responses: [{ results, meta }] }\n//\n// Server-only because the service key is the only auth: anyone with the\n// key has full DB access. Use server env (process.env, CF env binding,\n// SvelteKit `$env/static/private`, etc.). Never bundle the service key\n// into client-side code.\n//\n// The chainable builder is a thin facade over composeSelect/Insert/Update/\n// Delete in sql-builder.ts. Every method returns the same chainable object\n// so calls compose into one terminal request. Awaiting (via the .then on\n// the chainable) sends the HTTP request.\n\nimport { DatabaseError, MissingServiceKeyError } from './errors.js';\nimport {\n  assertIdent,\n  composeDelete,\n  composeInsert,\n  composeSelect,\n  composeTaggedSql,\n  composeUpdate,\n  type Equality,\n} from './sql-builder.js';\n\nexport type QueryResult<T = Record<string, unknown>> = {\n  rows: T[];\n  meta: {\n    duration: number;\n    rows_read?: number;\n    rows_written?: number;\n    last_row_id?: number;\n    changes?: number;\n  };\n};\n\nexport type { Equality };\n\nexport type QueryBuilder<T = Record<string, unknown>> = PromiseLike<QueryResult<T>> & {\n  /** `*` is the default — call this only when you want to narrow. */\n  select(columns: '*' | (keyof T & string)[] | string[]): QueryBuilder<T>;\n  /** Equality filter, AND-chained. NULL becomes `IS NULL`. */\n  where(filter: Partial<Record<keyof T & string, Equality>>): QueryBuilder<T>;\n  orderBy(column: keyof T & string, direction?: 'asc' | 'desc'): QueryBuilder<T>;\n  limit(n: number): QueryBuilder<T>;\n  offset(n: number): QueryBuilder<T>;\n};\n\nexport type InsertBuilder<T = Record<string, unknown>> = PromiseLike<QueryResult<T>> & {\n  /** Return the inserted row(s). Without this, the promise resolves with `rows: []`. */\n  returning(columns?: '*' | (keyof T & string)[] | string[]): InsertBuilder<T>;\n};\n\nexport type UpdateBuilder<T = Record<string, unknown>> = PromiseLike<QueryResult<T>> & {\n  where(filter: Partial<Record<keyof T & string, Equality>>): UpdateBuilder<T>;\n  returning(columns?: '*' | (keyof T & string)[] | string[]): UpdateBuilder<T>;\n};\n\nexport type DeleteBuilder<T = Record<string, unknown>> = PromiseLike<QueryResult<T>> & {\n  where(filter: Partial<Record<keyof T & string, Equality>>): DeleteBuilder<T>;\n};\n\nexport type TableQuery<T = Record<string, unknown>> = QueryBuilder<T> & {\n  insert(row: Partial<T> | Partial<T>[]): InsertBuilder<T>;\n  update(patch: Partial<T>): UpdateBuilder<T>;\n  delete(): DeleteBuilder<T>;\n};\n\nexport type Database = {\n  from<T extends Record<string, unknown> = Record<string, unknown>>(\n    table: string,\n  ): TableQuery<T>;\n\n  /**\n   * Raw SQL escape hatch. Tagged-template syntax interpolates values as\n   * bind params — there's no way for an interpolated value to inject SQL:\n   *   await flarelink.sql`SELECT * FROM users WHERE id = ${userId}`\n   */\n  sql<T extends Record<string, unknown> = Record<string, unknown>>(\n    strings: TemplateStringsArray,\n    ...values: unknown[]\n  ): Promise<QueryResult<T>>;\n};\n\n// Internal HTTP transport for a single query.\nasync function postQuery(\n  base: string,\n  serviceKey: string,\n  f: typeof fetch,\n  sql: string,\n  params: unknown[],\n): Promise<QueryResult> {\n  const res = await f(`${base}/api/db/query`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${serviceKey}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify({ sql, params }),\n  });\n  if (!res.ok) {\n    const body = (await res.json().catch(() => ({}))) as { error?: string; code?: string };\n    throw new DatabaseError(body.error ?? res.statusText, res.status, body.code);\n  }\n  const data = (await res.json()) as {\n    results: Record<string, unknown>[];\n    meta: QueryResult['meta'];\n  };\n  return { rows: data.results, meta: data.meta };\n}\n\nexport function createDatabase(\n  base: string,\n  serviceKey: string | undefined,\n  f: typeof fetch,\n): Database {\n  const requireKey = (): string => {\n    if (!serviceKey) throw new MissingServiceKeyError('database');\n    return serviceKey;\n  };\n\n  // SELECT builder. State accumulates via clone-and-return so a builder\n  // can't be mutated mid-chain (each call returns a fresh object that\n  // shares immutable state).\n  type SelectState = {\n    table: string;\n    columns: '*' | string[];\n    where?: Record<string, Equality>;\n    orderBy?: { column: string; direction: 'asc' | 'desc' };\n    limit?: number;\n    offset?: number;\n  };\n  function makeSelect<T extends Record<string, unknown>>(\n    state: SelectState,\n  ): QueryBuilder<T> {\n    const exec = async (): Promise<QueryResult<T>> => {\n      const key = requireKey();\n      const { sql, params } = composeSelect(state);\n      return (await postQuery(base, key, f, sql, params)) as QueryResult<T>;\n    };\n    return {\n      select: (columns) => makeSelect<T>({ ...state, columns: normalizeCols(columns) }),\n      where: (filter) =>\n        makeSelect<T>({ ...state, where: filter as Record<string, Equality> }),\n      orderBy: (column, direction = 'asc') =>\n        makeSelect<T>({\n          ...state,\n          orderBy: { column: column as string, direction },\n        }),\n      limit: (n) => makeSelect<T>({ ...state, limit: n }),\n      offset: (n) => makeSelect<T>({ ...state, offset: n }),\n      then: (onfulfilled, onrejected) => exec().then(onfulfilled, onrejected),\n    };\n  }\n\n  function makeInsert<T extends Record<string, unknown>>(\n    table: string,\n    rows: Record<string, Equality>[],\n    returning?: '*' | string[],\n  ): InsertBuilder<T> {\n    const exec = async (): Promise<QueryResult<T>> => {\n      const key = requireKey();\n      const { sql, params } = composeInsert({ table, rows, returning });\n      return (await postQuery(base, key, f, sql, params)) as QueryResult<T>;\n    };\n    return {\n      returning: (cols) => makeInsert<T>(table, rows, normalizeCols(cols ?? '*')),\n      then: (onfulfilled, onrejected) => exec().then(onfulfilled, onrejected),\n    };\n  }\n\n  function makeUpdate<T extends Record<string, unknown>>(\n    table: string,\n    patch: Record<string, Equality>,\n    where?: Record<string, Equality>,\n    returning?: '*' | string[],\n  ): UpdateBuilder<T> {\n    const exec = async (): Promise<QueryResult<T>> => {\n      const key = requireKey();\n      const { sql, params } = composeUpdate({ table, patch, where, returning });\n      return (await postQuery(base, key, f, sql, params)) as QueryResult<T>;\n    };\n    return {\n      where: (filter) =>\n        makeUpdate<T>(table, patch, filter as Record<string, Equality>, returning),\n      returning: (cols) => makeUpdate<T>(table, patch, where, normalizeCols(cols ?? '*')),\n      then: (onfulfilled, onrejected) => exec().then(onfulfilled, onrejected),\n    };\n  }\n\n  function makeDelete<T extends Record<string, unknown>>(\n    table: string,\n    where?: Record<string, Equality>,\n  ): DeleteBuilder<T> {\n    const exec = async (): Promise<QueryResult<T>> => {\n      const key = requireKey();\n      const { sql, params } = composeDelete({ table, where });\n      return (await postQuery(base, key, f, sql, params)) as QueryResult<T>;\n    };\n    return {\n      where: (filter) => makeDelete<T>(table, filter as Record<string, Equality>),\n      then: (onfulfilled, onrejected) => exec().then(onfulfilled, onrejected),\n    };\n  }\n\n  return {\n    from: <T extends Record<string, unknown>>(table: string) => {\n      // Defer key check until execution — instantiating a builder without a\n      // key shouldn't throw (lets callers compose builders for codegen,\n      // tests, etc.). Identifier validation IS eager because that's a\n      // programmer error caught early.\n      assertIdent(table, 'table');\n      const select = makeSelect<T>({ table, columns: '*' });\n      const tableQuery = select as TableQuery<T>;\n      // Augment with the write methods. TS already knows the shape via the\n      // intersection — these casts are just glue.\n      (tableQuery as TableQuery<T>).insert = (row) => {\n        // Partial<T> permits undefined per-field; the composer turns those\n        // into NULL on insert. Cast at the boundary — runtime handles it.\n        const rows = (Array.isArray(row) ? row : [row]) as Record<string, Equality>[];\n        return makeInsert<T>(table, rows) as InsertBuilder<T>;\n      };\n      (tableQuery as TableQuery<T>).update = (patch) =>\n        makeUpdate<T>(table, patch as Record<string, Equality>);\n      (tableQuery as TableQuery<T>).delete = () => makeDelete<T>(table);\n      return tableQuery;\n    },\n    sql: async <T extends Record<string, unknown>>(\n      strings: TemplateStringsArray,\n      ...values: unknown[]\n    ) => {\n      const key = requireKey();\n      const { sql, params } = composeTaggedSql(strings, values);\n      return (await postQuery(base, key, f, sql, params)) as QueryResult<T>;\n    },\n  };\n}\n\nfunction normalizeCols(cols: '*' | string[] | readonly string[]): '*' | string[] {\n  if (cols === '*') return '*';\n  return [...cols];\n}\n","// Storage surface — Supabase-shaped facade over the project's R2 buckets.\n//\n// Wire shape:\n//   POST   {url}/api/storage/presign  { bucket, key, op, contentType?, expiresIn? }\n//   DELETE {url}/api/storage/object   { bucket, key }\n//   GET    {url}/api/storage/list?bucket&prefix&cursor\n//   GET    {url}/api/storage/buckets\n//\n// All gated by `Authorization: Bearer <serviceKey>`. Browser PUT/GET hits R2\n// directly via presigned URL — the Worker is only in the control plane.\n//\n// Service key is required for every call. Without it (or if it's invalid),\n// the Worker returns 401 / 412 and we surface a clear error rather than a\n// raw fetch failure.\n\nimport { MissingServiceKeyError, StorageError } from './errors.js';\n\nexport type StorageBucket = {\n  name: string;\n  createdAt: string;\n};\n\nexport type StorageObject = {\n  key: string;\n  size: number;\n  lastModified: string;\n  etag: string;\n};\n\nexport type StorageListResponse = {\n  objects: StorageObject[];\n  prefixes: string[];\n  nextCursor?: string;\n};\n\nexport type PresignOptions = {\n  /** Default 300s (5 min). Server clamps to [60s, 3600s]. */\n  expiresIn?: number;\n  contentType?: string;\n};\n\nexport type StorageBucketAPI = {\n  /**\n   * Mint a presigned PUT URL. Use it with a plain `fetch` (or XHR for\n   * progress) — bytes go direct to R2, the Worker never sees them.\n   *\n   * @returns `url` to PUT to, and `signedHeaders` you must send on the PUT\n   *   request (currently `content-type` when supplied). Don't add extra\n   *   headers — they'll break the signature.\n   */\n  createSignedUploadUrl(\n    key: string,\n    opts?: PresignOptions,\n  ): Promise<{ url: string; signedHeaders: Record<string, string> }>;\n\n  /**\n   * Mint a presigned GET URL. Open it in the browser, embed it as an\n   * `<img src>`, or fetch it server-side — same URL works anywhere until\n   * it expires.\n   */\n  createSignedDownloadUrl(\n    key: string,\n    opts?: PresignOptions,\n  ): Promise<{ url: string }>;\n\n  /** Delete an object. */\n  remove(keys: string[]): Promise<void>;\n\n  /**\n   * List objects under an optional prefix. Returns up to 1000 per call;\n   * pass `cursor` from the previous response to page further.\n   */\n  list(opts?: { prefix?: string; cursor?: string }): Promise<StorageListResponse>;\n};\n\nexport type Storage = {\n  /** List buckets attached to the project's R2 account. */\n  listBuckets(): Promise<StorageBucket[]>;\n  /** Scope all operations to a single bucket. */\n  from(bucket: string): StorageBucketAPI;\n};\n\nexport function createStorage(\n  base: string,\n  serviceKey: string | undefined,\n  f: typeof fetch,\n): Storage {\n  const requireKey = (): string => {\n    if (!serviceKey) throw new MissingServiceKeyError('storage');\n    return serviceKey;\n  };\n\n  async function call<T>(\n    path: string,\n    init: RequestInit & { query?: Record<string, string> } = {},\n  ): Promise<T> {\n    const key = requireKey();\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${key}`,\n      ...((init.headers as Record<string, string> | undefined) ?? {}),\n    };\n    const method = (init.method ?? 'GET').toUpperCase();\n    if (method !== 'GET' && method !== 'HEAD' && headers['Content-Type'] === undefined) {\n      headers['Content-Type'] = 'application/json';\n    }\n    const url = new URL(`${base}${path}`);\n    if (init.query) {\n      for (const [k, v] of Object.entries(init.query)) {\n        if (v !== undefined && v !== '') url.searchParams.set(k, v);\n      }\n    }\n    const res = await f(url.toString(), { ...init, headers });\n    if (!res.ok) {\n      const body = (await res.json().catch(() => ({}))) as { error?: string; code?: string };\n      throw new StorageError(\n        body.error ?? res.statusText,\n        res.status,\n        body.code,\n      );\n    }\n    return (await res.json()) as T;\n  }\n\n  return {\n    listBuckets: async () => {\n      const r = await call<{ buckets: StorageBucket[] }>('/api/storage/buckets');\n      return r.buckets;\n    },\n    from: (bucket) => ({\n      createSignedUploadUrl: async (key, opts = {}) => {\n        const r = await call<{ url: string; signedHeaders: Record<string, string> }>(\n          '/api/storage/presign',\n          {\n            method: 'POST',\n            body: JSON.stringify({\n              bucket,\n              key,\n              op: 'put',\n              contentType: opts.contentType,\n              expiresIn: opts.expiresIn,\n            }),\n          },\n        );\n        return { url: r.url, signedHeaders: r.signedHeaders };\n      },\n      createSignedDownloadUrl: async (key, opts = {}) => {\n        const r = await call<{ url: string }>('/api/storage/presign', {\n          method: 'POST',\n          body: JSON.stringify({\n            bucket,\n            key,\n            op: 'get',\n            expiresIn: opts.expiresIn,\n          }),\n        });\n        return { url: r.url };\n      },\n      remove: async (keys) => {\n        // Each delete is its own request — R2's S3-compatible API supports\n        // batch delete but the wire format (signed XML body) is materially\n        // more code on the Worker. Sequential deletes are fine for typical\n        // app use; revisit if customer needs bulk delete UX.\n        for (const k of keys) {\n          await call<{ ok: true }>('/api/storage/object', {\n            method: 'DELETE',\n            body: JSON.stringify({ bucket, key: k }),\n          });\n        }\n      },\n      list: async (opts = {}) => {\n        return call<StorageListResponse>('/api/storage/list', {\n          method: 'GET',\n          query: {\n            bucket,\n            ...(opts.prefix !== undefined && { prefix: opts.prefix }),\n            ...(opts.cursor !== undefined && { cursor: opts.cursor }),\n          },\n        });\n      },\n    }),\n  };\n}\n","// @flarelink/client — typed client SDK for a Flarelink-provisioned project.\n//\n//   import { createFlarelink } from '@flarelink/client';\n//   const flarelink = createFlarelink({ url: 'https://myapp-auth.workers.dev' });\n//\n// Auth works everywhere (browser + server). Storage + database require a\n// per-project service key passed via `createFlarelink({ serviceKey })` and only\n// work on the server — never include the service key in client bundles.\n\nimport { createAuth, type Auth } from './auth.js';\nimport { createDatabase, type Database, type QueryResult, type TableQuery } from './db.js';\nimport { createStorage, type Storage } from './storage.js';\nimport type { FlarelinkConfig } from './types.js';\n\nexport type Flarelink = {\n  /** Auth surface — browser + server safe. */\n  readonly auth: Auth;\n\n  /** File storage (R2). Server-only — requires `serviceKey`. */\n  readonly storage: Storage;\n\n  /**\n   * Build a query against a D1 table.\n   * Server-only — requires `serviceKey`.\n   */\n  from<T extends Record<string, unknown> = Record<string, unknown>>(\n    table: string,\n  ): TableQuery<T>;\n\n  /**\n   * Raw SQL escape hatch. Tagged-template syntax interpolates values as\n   * bind params:\n   *   await flarelink.sql`SELECT * FROM users WHERE id = ${userId}`\n   *\n   * Server-only — requires `serviceKey`.\n   */\n  sql<T extends Record<string, unknown> = Record<string, unknown>>(\n    strings: TemplateStringsArray,\n    ...values: unknown[]\n  ): Promise<QueryResult<T>>;\n};\n\nexport function createFlarelink(config: FlarelinkConfig): Flarelink {\n  if (!config?.url) {\n    throw new Error(\n      'createFlarelink({ url }) is required. The URL is your project\\'s auth Worker, e.g. \"https://myapp-auth.your-subdomain.workers.dev\" — find it in the Flarelink dashboard.',\n    );\n  }\n  const base = config.url.replace(/\\/$/, '');\n  const f = config.fetch ?? fetch;\n\n  const auth = createAuth(base, f);\n  const storage = createStorage(base, config.serviceKey, f);\n  const db = createDatabase(base, config.serviceKey, f);\n\n  return {\n    auth,\n    storage,\n    from: (table) => db.from(table),\n    sql: (strings, ...values) => db.sql(strings, ...values),\n  };\n}\n\n// Re-export everything callers might want to instanceof / annotate / catch.\nexport {\n  AuthError,\n  FlarelinkError,\n  DatabaseError,\n  MissingServiceKeyError,\n  StorageError,\n} from './errors.js';\n\nexport type { Auth } from './auth.js';\nexport type {\n  Database,\n  DeleteBuilder,\n  Equality,\n  InsertBuilder,\n  QueryBuilder,\n  QueryResult,\n  TableQuery,\n  UpdateBuilder,\n} from './db.js';\nexport type {\n  PresignOptions,\n  Storage,\n  StorageBucket,\n  StorageBucketAPI,\n  StorageListResponse,\n  StorageObject,\n} from './storage.js';\nexport type {\n  FlarelinkConfig,\n  RequestPasswordResetInput,\n  ResetPasswordInput,\n  SendVerificationEmailInput,\n  Session,\n  SignInInput,\n  SignInWithMagicLinkOptions,\n  SignInWithSocialOptions,\n  SignUpInput,\n  SocialProvider,\n  User,\n} from './types.js';\n"]}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@flarelink/client",
+  "version": "0.2.0",
+  "description": "Client SDK for Flarelink — auth + storage + database for the Cloudflare developer stack.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "flarelink",
+    "cloudflare",
+    "auth",
+    "d1",
+    "r2",
+    "workers"
+  ],
+  "devDependencies": {
+    "tsup": "^8.3.0",
+    "typescript": "^5.6.0"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "sideEffects": false
+}