@fluixi/auth 1.0.0-alpha.100

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ibrahima Touré
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,72 @@
+# @fluixi/auth
+
+Server-first auth for Fluixi — **native bindings over [Better Auth](https://better-auth.com)**.
+Better Auth owns the security primitives (password hashing, sessions, CSRF, secure cookies,
+OAuth, 2FA/TOTP, organizations, RBAC, DB adapters — audited and maintained). This package
+owns the *Fluixi integration* Better Auth can't provide: request-context server helpers,
+SSR-seeded reactive hooks, middleware wiring, and route protection.
+
+`better-auth` is a **peer dependency** — the bindings consume it structurally, so the app owns the version.
+
+## Server (`@fluixi/auth/server`)
+
+```ts
+// auth.config.ts
+import { betterAuth } from 'better-auth';
+import { defineAuth } from '@fluixi/auth/server';
+export const auth = defineAuth(betterAuth({ /* db, providers, plugins */ }));
+```
+```ts
+// src/middleware.ts — resolve the session once per request → locals.auth
+import { defineMiddleware } from '@fluixi/start';
+import { authMiddleware } from '@fluixi/auth/server';
+export default defineMiddleware([ authMiddleware() ]);
+```
+```ts
+// src/api/auth/[...all].ts — mount Better Auth
+import { mountAuthRoutes } from '@fluixi/auth/server';
+export const ALL = mountAuthRoutes(); // (request) => auth.handler(request)
+```
+```ts
+// loaders / server functions — no token parsing, reads request-scoped locals
+const user  = await requireUser();            // throws AuthError(401, '/login')
+const admin = await requireRole('admin');     // throws AuthError(403)
+await requirePermission(() => can(user, 'edit', post));
+const maybe = await optionalUser();           // U | null
+```
+```ts
+// API route contracts (@fluixi/api) take a guard instead: it runs before the input is read
+// and types `auth` in the handler.
+import { route } from '@fluixi/api';
+import { member, signedIn } from '@fluixi/auth/server';
+
+export const GET = route({ guard: signedIn(), handler: ({ auth }) => auth.user });
+export const DELETE = route({
+  guard: member({ roles: ['owner', 'admin'] }), // 403 no_active_organization, not_a_member, forbidden
+  handler: ({ auth }) => projects.remove(auth.member.organizationId),
+});
+```
+> The app entry must forward the request so middleware locals reach the render:
+> `export const render = (url, request) => renderRequestAsync(App, { url, request })`.
+
+## Client (`@fluixi/auth/client`)
+
+```ts
+import { createAuthClient } from 'better-auth/client';
+import { createAuthHooks } from '@fluixi/auth/client';
+
+const authClient = createAuthClient({ baseURL: '/api/auth' });
+export const { useUser, useSession, useAuth, useSignIn, useSignOut, protectedRoute } =
+  createAuthHooks({ client: authClient });
+```
+```ts
+const user = useUser();                 // reactive accessor, SEEDED from SSR (no flash/refetch)
+const signIn = useSignIn();
+export default protectedRoute(() => <Dashboard/>);          // authed only
+export default protectedRoute(Login, { guestOnly: true });  // redirect authed away
+export default protectedRoute(Admin, { role: 'admin' });    // role-gated
+```
+
+The session is a `createIsomorphicStore` — resolved on the server from `locals.auth`,
+serialized into the page, and seeded synchronously on the client. No auth flash, no
+post-hydration refetch. `@fluixi/auth/client` never imports the server engine or Node.

package/dist/client.cjs

@@ -0,0 +1,219 @@
+/*! @fluixi/auth v1.0.0-alpha.100 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client.ts
+var client_exports = {};
+__export(client_exports, {
+  createAuthHooks: () => createAuthHooks
+});
+module.exports = __toCommonJS(client_exports);
+var import_core = require("@fluixi/core");
+var import_dom = require("@fluixi/dom");
+
+// src/types.ts
+var AUTH_LOCALS_KEY = "auth";
+
+// src/client.ts
+function createAuthHooks(options) {
+  const sess = options.session;
+  const store = (0, import_core.createIsomorphicStore)("auth", {
+    // Server: read what authMiddleware put on locals → serialized for the client to seed.
+    server: () => (0, import_dom.getLocals)()[AUTH_LOCALS_KEY] ?? { user: null, session: null },
+    // SPA cold load: from the provided session, else the Better Auth client.
+    client: async () => sess ? { user: sess.user(), session: null } : normalize(await options.client.getSession()),
+    fallback: { user: null, session: null }
+  });
+  if (sess) {
+    const apply = () => {
+      if (options.ready && !options.ready()) return;
+      store.set({ user: sess.user(), session: null });
+    };
+    apply();
+    (0, import_core.createRoot)(() => (0, import_core.createEffect)(apply, void 0, { name: "auth ← session" }));
+  }
+  const refresh = async () => {
+    store.set(sess ? { user: sess.user(), session: null } : normalize(await options.client.getSession()));
+  };
+  const signIn = sess ? ((...args) => sess.login?.(...args) ?? Promise.resolve()) : async (creds) => {
+    await options.client.signIn.email(creds);
+    await refresh();
+  };
+  const signOut = sess ? () => sess.logout?.() ?? Promise.resolve() : async () => {
+    await options.client.signOut();
+    store.set({ user: null, session: null });
+  };
+  const go = (to, opts) => {
+    const fromRoute = typeof opts?.handler === "function" ? opts.handler() : void 0;
+    const fromHooks = typeof options.navigate === "function" ? options.navigate : typeof options.navigate?.handler === "function" ? (
+      // Called, not passed along. Handing back the factory made `fn(to)` build a
+      // navigate function and return it, so the redirect silently did nothing.
+      options.navigate.handler()
+    ) : void 0;
+    const fn = fromRoute ?? fromHooks;
+    if (fn) {
+      const navigateOptions = opts?.options ?? (typeof options.navigate === "object" ? options.navigate?.options : void 0);
+      if (navigateOptions) fn(to, navigateOptions);
+      else fn(to);
+      return;
+    }
+    import_core.env.window?.location.assign(to);
+  };
+  const permissions = () => sess?.permissions?.();
+  const can = (query) => sess?.can?.(query) ?? false;
+  const roleList = () => {
+    if (sess?.roles) return sess.roles();
+    const r = store.fields.user()?.role;
+    return r ? [r] : [];
+  };
+  const passesRole = (opts) => {
+    if (opts?.role && !roleList().includes(opts.role)) return false;
+    if (opts?.roles && !opts.roles.some((r) => roleList().includes(r))) return false;
+    if (opts?.permission !== void 0 && !can(opts.permission)) return false;
+    return true;
+  };
+  function Can(props) {
+    return () => can(props.perform) ? props.children : props.fallback ?? null;
+  }
+  function Protect(props) {
+    return () => {
+      if (!store.fields.user()) return props.fallback ?? null;
+      return passesRole(props) ? props.children : props.fallback ?? null;
+    };
+  }
+  function protectedRoute(Comp, opts) {
+    return (props) => {
+      const user = store.fields.user();
+      if (opts?.guestOnly) {
+        if (user) return go(options.homePath ?? "/", opts?.navigator), null;
+      } else {
+        if (!user) return go(options.loginPath ?? "/login", opts?.navigator), null;
+        if (!passesRole(opts)) return go(options.forbiddenPath ?? "/403"), null;
+      }
+      return Comp(props);
+    };
+  }
+  return {
+    /**
+     * The signed-in user, or null.
+     *
+     * Returns the accessor rather than the value, so a component reads it where it
+     * renders and re-renders when it changes.
+     *
+     * @example
+     * ```tsx
+     * const user = useUser();
+     * <span>{() => user()?.email ?? 'Signed out'}</span>
+     * ```
+     */
+    useUser: () => store.fields.user,
+    /**
+     * The session record beside the user: when it expires, and whatever else the
+     * backend attached. Null when signed out.
+     */
+    useSession: () => store.fields.session,
+    /**
+     * Everything at once, for a component that needs more than one of them.
+     *
+     * @example
+     * ```tsx
+     * const { user, isAuthenticated, can, signOut } = useAuth();
+     * ```
+     */
+    useAuth: () => ({
+      user: store.fields.user,
+      session: store.fields.session,
+      isAuthenticated: () => store.fields.user() !== null,
+      roles: roleList,
+      can,
+      signIn,
+      signOut
+    }),
+    /**
+     * Start a sign-in.
+     *
+     * What it takes depends on what the hooks were given: credentials for a Better Auth
+     * client, and for a redirect flow whatever that session's `login` expects.
+     *
+     * @example
+     * ```tsx
+     * const signIn = useSignIn();
+     * <button onClick={() => signIn({ email, password })}>Sign in</button>
+     * ```
+     */
+    useSignIn: () => signIn,
+    /**
+     * End the session.
+     *
+     * @example
+     * ```tsx
+     * const signOut = useSignOut();
+     * <button onClick={() => signOut()}>Sign out</button>
+     * ```
+     */
+    useSignOut: () => signOut,
+    /**
+     * The permission set for the current roles, reactively.
+     *
+     * A rendering hint and nothing more: a client can claim any permission, so the
+     * server decides what is allowed on every request.
+     */
+    usePermissions: () => permissions,
+    /**
+     * Ask whether the current user may do something.
+     *
+     * `false` when the session supplies no RBAC, so a missing `access` config hides a
+     * control rather than revealing it.
+     *
+     * @example
+     * ```tsx
+     * const can = useCan();
+     * <button disabled={() => !can((p) => p.users.delete)}>Delete</button>
+     * ```
+     */
+    useCan: () => can,
+    Can,
+    Protect,
+    /**
+     * Re-read the session from the backend.
+     *
+     * For after something changed outside this tab: a role granted elsewhere, or a
+     * return from a flow that altered the account.
+     *
+     * @example
+     * ```ts
+     * await refresh();
+     * ```
+     */
+    refresh,
+    protectedRoute,
+    /**
+     * The underlying isomorphic store.
+     *
+     * Escape hatch. It is here for a test that wants to seed a user, and for the rare
+     * caller that needs to write what the hooks read. Prefer the accessors above:
+     * writing to the store directly puts the interface out of step with the session
+     * that owns it.
+     */
+    store
+  };
+}
+function normalize(r) {
+  return { user: r.data?.user ?? null, session: r.data?.session ?? null };
+}

package/dist/client.d.ts

@@ -0,0 +1,177 @@
+import { type ComponentChild } from '@fluixi/dom';
+import { type AuthUser, type BetterAuthClient, type SessionData } from './types.js';
+export interface ProtectedRouteOptions<Q = (p: any) => boolean> {
+    guestOnly?: boolean;
+    /** Require this exact role. */
+    role?: string;
+    /** Require ANY of these roles. */
+    roles?: string[];
+    /** Require a permission: your access matcher's query (default: a predicate). */
+    permission?: Q;
+    navigator?: Partial<Navigator>;
+}
+/**
+ * Any reactive session with a `user` accessor (e.g. @fluixi/session's createSession).
+ * The RBAC accessors (`roles` / `permissions` / `can`) are optional, provide them (as
+ * createSession's `access` config does) to unlock `<Can>`, `usePermissions`, and
+ * permission-gated routes. They are a UI affordance only; the server enforces authz.
+ */
+export interface SessionLike<U = AuthUser, P = unknown, Q = (p: P) => boolean> {
+    user: () => U | null;
+    login?: (...args: any[]) => Promise<unknown>;
+    logout?: () => Promise<unknown>;
+    roles?: () => string[];
+    permissions?: () => P | undefined;
+    can?: (query: Q) => boolean;
+}
+export interface NavigateOptions {
+    /** Replace the current history entry instead of pushing a new one. */
+    replace?: boolean;
+    /** Opaque history state to attach. */
+    state?: unknown;
+    transition?: unknown;
+}
+export interface Navigator {
+    handler: () => (to: string, opts?: any) => void;
+    options?: NavigateOptions;
+}
+export interface AuthHooksOptions<U = AuthUser, P = unknown, Q = (p: P) => boolean> {
+    /** A Better Auth client (`createAuthClient(...)`). Mutually exclusive with `session`. */
+    client?: BetterAuthClient;
+    /** An existing reactive session: the framework syncs it into the hooks for you. */
+    session?: SessionLike<U, P, Q>;
+    /**
+     * Whether `session` knows yet. Until it does, the hooks keep what they started from: in the
+     * browser, the user the server rendered with. Default: ready from the start.
+     */
+    ready?: () => boolean;
+    /** Navigate for `protectedRoute` redirects (default: `window.location.assign`). */
+    navigate?: ((to: string, opts?: NavigateOptions) => void) | Navigator;
+    loginPath?: string;
+    homePath?: string;
+    forbiddenPath?: string;
+}
+export declare function createAuthHooks<U = AuthUser, P = unknown, Q = (p: P) => boolean>(options: AuthHooksOptions<U, P, Q>): {
+    /**
+     * The signed-in user, or null.
+     *
+     * Returns the accessor rather than the value, so a component reads it where it
+     * renders and re-renders when it changes.
+     *
+     * @example
+     * ```tsx
+     * const user = useUser();
+     * <span>{() => user()?.email ?? 'Signed out'}</span>
+     * ```
+     */
+    useUser: () => import("@fluixi/core").Accessor<U | null>;
+    /**
+     * The session record beside the user: when it expires, and whatever else the
+     * backend attached. Null when signed out.
+     */
+    useSession: () => import("@fluixi/core").Accessor<import("./types.js").AuthSession | null>;
+    /**
+     * Everything at once, for a component that needs more than one of them.
+     *
+     * @example
+     * ```tsx
+     * const { user, isAuthenticated, can, signOut } = useAuth();
+     * ```
+     */
+    useAuth: () => {
+        user: import("@fluixi/core").Accessor<U | null>;
+        session: import("@fluixi/core").Accessor<import("./types.js").AuthSession | null>;
+        isAuthenticated: () => boolean;
+        roles: () => string[];
+        can: (query: Q) => boolean;
+        signIn: ((...args: any[]) => Promise<unknown>) | ((creds: {
+            email: string;
+            password: string;
+            rememberMe?: boolean;
+        }) => Promise<void>);
+        signOut: () => Promise<unknown>;
+    };
+    /**
+     * Start a sign-in.
+     *
+     * What it takes depends on what the hooks were given: credentials for a Better Auth
+     * client, and for a redirect flow whatever that session's `login` expects.
+     *
+     * @example
+     * ```tsx
+     * const signIn = useSignIn();
+     * <button onClick={() => signIn({ email, password })}>Sign in</button>
+     * ```
+     */
+    useSignIn: () => ((...args: any[]) => Promise<unknown>) | ((creds: {
+        email: string;
+        password: string;
+        rememberMe?: boolean;
+    }) => Promise<void>);
+    /**
+     * End the session.
+     *
+     * @example
+     * ```tsx
+     * const signOut = useSignOut();
+     * <button onClick={() => signOut()}>Sign out</button>
+     * ```
+     */
+    useSignOut: () => () => Promise<unknown>;
+    /**
+     * The permission set for the current roles, reactively.
+     *
+     * A rendering hint and nothing more: a client can claim any permission, so the
+     * server decides what is allowed on every request.
+     */
+    usePermissions: () => () => P | undefined;
+    /**
+     * Ask whether the current user may do something.
+     *
+     * `false` when the session supplies no RBAC, so a missing `access` config hides a
+     * control rather than revealing it.
+     *
+     * @example
+     * ```tsx
+     * const can = useCan();
+     * <button disabled={() => !can((p) => p.users.delete)}>Delete</button>
+     * ```
+     */
+    useCan: () => (query: Q) => boolean;
+    Can: (props: {
+        perform: Q;
+        fallback?: ComponentChild;
+        children: ComponentChild;
+    }) => () => ComponentChild;
+    Protect: (props: {
+        role?: string;
+        roles?: string[];
+        permission?: Q;
+        fallback?: ComponentChild;
+        children: ComponentChild;
+    }) => () => ComponentChild;
+    /**
+     * Re-read the session from the backend.
+     *
+     * For after something changed outside this tab: a role granted elsewhere, or a
+     * return from a flow that altered the account.
+     *
+     * @example
+     * ```ts
+     * await refresh();
+     * ```
+     */
+    refresh: () => Promise<void>;
+    protectedRoute: <Props>(Comp: (props: Props) => unknown, opts?: ProtectedRouteOptions<Q>) => (props: Props) => unknown;
+    /**
+     * The underlying isomorphic store.
+     *
+     * Escape hatch. It is here for a test that wants to seed a user, and for the rare
+     * caller that needs to write what the hooks read. Prefer the accessors above:
+     * writing to the store directly puts the interface out of step with the session
+     * that owns it.
+     */
+    store: import("@fluixi/core").IsomorphicStore<SessionData<U>>;
+};
+export type { SessionData, AuthUser, BetterAuthClient } from './types.js';
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAcA,OAAO,EAAa,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAGpB,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,KAAK,OAAO;IAC5D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE,CAAC,CAAC;IAEf,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO;IAC3E,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAClC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sCAAsC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AACD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO;IAChF,yFAAyF;IACzF,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,mFAAmF;IACnF,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC;IACtB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,eAAe,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,eAAe,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO,EAC9E,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAuLhC;;;;;;;;;;;OAWG;;IAGH;;;OAGG;;IAGH;;;;;;;OAOG;;;;;qBA7HgB,MAAM,EAAE;qBADT,CAAC,KAAG,OAAO;2BAtDhB,GAAG,EAAE,kCACF;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE;;;IA8LzE;;;;;;;;;;;OAWG;gCA1MU,GAAG,EAAE,kCACF;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE;IA4MzE;;;;;;;;OAQG;;IAGH;;;;;OAKG;gCAxKmB,CAAC,GAAG,SAAS;IA2KnC;;;;;;;;;;;OAWG;0BArLe,CAAC,KAAG,OAAO;iBA2BX;QAClB,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,CAAC,EAAE,cAAc,CAAC;QAC1B,QAAQ,EAAE,cAAc,CAAC;KAC1B,KAAG,MAAM,cAAc;qBAqBA;QACtB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,CAAC,CAAC;QACf,QAAQ,CAAC,EAAE,cAAc,CAAC;QAC1B,QAAQ,EAAE,cAAc,CAAC;KAC1B,KAAG,MAAM,cAAc;IAiItB;;;;;;;;;;OAUG;mBAhQqB,OAAO,CAAC,IAAI,CAAC;qBAgJf,KAAK,QAAQ,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,SAAS,qBAAqB,CAAC,CAAC,CAAC,MACrF,OAAO,KAAK;IAoHpB;;;;;;;OAOG;;EAGN;AAMD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}