@forklaunch/core 2.1.1 → 3.0.1

package/lib/http/instanceGateway.d.ts

@@ -0,0 +1,113 @@
+/**
+ * The instance gateway: how a managed instance reaches platform-held services
+ * (models, payments, email, SMS, WhatsApp, voice) without holding a vendor
+ * credential, and how the platform delivers vendor events back to it.
+ *
+ * Outbound, every request is signed with the instance's own HMAC key
+ * (`INSTANCE_HMAC_KEY`, key id `INSTANCE_ID`) over the router-relative path,
+ * with a timestamp and a single-use nonce; the platform checks the signature,
+ * the product's limits and the instance's own vendor account, then calls the
+ * vendor with credentials that never leave it.
+ *
+ * Inbound, the platform POSTs events (a payment succeeded, an email bounced, a
+ * text arrived) to `/platform-events/<feature>` on the service that declared
+ * the capability, signed with the same instance key under key id `platform`.
+ * `verifyPlatformEvent` checks that signature, the timestamp and the nonce.
+ *
+ * The platform injects `PLATFORM_GATEWAY_URL`, `INSTANCE_ID` and
+ * `INSTANCE_HMAC_KEY` into a hosted instance. Their absence means the service
+ * is not running in managed mode, and a client refuses to be created rather
+ * than failing on its first call.
+ */
+/** Where the gateway router is mounted on the platform service. */
+export declare const INSTANCE_GATEWAY_MOUNT = "/instance-gateway";
+/** The key id the platform signs events with. */
+export declare const PLATFORM_EVENT_KEY_ID = "platform";
+/** Where a service receives platform events, per feature. */
+export declare const PLATFORM_EVENTS_PATH = "/platform-events";
+export interface InstanceGatewayOptions {
+    /** Platform base URL. Default: `PLATFORM_GATEWAY_URL`. */
+    gatewayUrl?: string;
+    /** This instance's id. Default: `INSTANCE_ID`. */
+    instanceId?: string;
+    /** This instance's HMAC key. Default: `INSTANCE_HMAC_KEY`. */
+    hmacKey?: string;
+    fetch?: typeof fetch;
+}
+/** A refusal or failure from the gateway, with the status it answered. */
+export declare class InstanceGatewayRequestError extends Error {
+    readonly status: number;
+    /** Seconds to wait before retrying, on a 429. */
+    readonly retryAfterSeconds?: number | undefined;
+    readonly name: string;
+    constructor(status: number, message: string, 
+    /** Seconds to wait before retrying, on a 429. */
+    retryAfterSeconds?: number | undefined);
+}
+export interface InstanceGatewayTransport {
+    readonly instanceId: string;
+    /** A signed request; throws `InstanceGatewayRequestError` on a non-2xx. */
+    request(method: 'GET' | 'POST' | 'PUT' | 'DELETE', route: string, body?: Record<string, unknown>, options?: {
+        signal?: AbortSignal;
+        headers?: Record<string, string>;
+    }): Promise<Response>;
+    /** `request`, then the JSON body. */
+    json<T>(method: 'GET' | 'POST' | 'PUT' | 'DELETE', route: string, body?: Record<string, unknown>, options?: {
+        signal?: AbortSignal;
+        headers?: Record<string, string>;
+    }): Promise<T>;
+}
+/** Resolve the managed-mode settings, or explain which are missing. */
+export declare function instanceGatewaySettings(options?: InstanceGatewayOptions, feature?: string): {
+    gatewayUrl: string;
+    instanceId: string;
+    hmacKey: string;
+};
+/** Whether this process runs as a managed instance. */
+export declare function isManagedInstance(env?: Record<string, string | undefined>): boolean;
+/** A signed transport to the instance gateway. */
+export declare function createInstanceGatewayTransport(options?: InstanceGatewayOptions, feature?: string): InstanceGatewayTransport;
+/** An event the platform delivered to this instance. */
+export interface PlatformEvent<Data = Record<string, unknown>> {
+    /** Unique per event; deliveries can repeat, so handlers dedupe on it. */
+    id: string;
+    /** The capability it belongs to: payments, email, sms, whatsapp, voice. */
+    feature: string;
+    /** e.g. `checkout.session.completed`, `email.bounced`, `sms.received`. */
+    type: string;
+    occurredAt: string;
+    data: Data;
+}
+export declare class PlatformEventVerificationError extends Error {
+    readonly name = "PlatformEventVerificationError";
+}
+/**
+ * Verify an event the platform delivered and return it.
+ *
+ * `path` is the path the request arrived on (`/platform-events/payments`);
+ * `rawBody` is the exact request body (a string or Buffer) — pass the raw
+ * bytes when the framework captured them, else the parsed body. Throws
+ * `PlatformEventVerificationError` for a missing, stale, forged or replayed
+ * delivery; answer 401 then, and the platform retries.
+ */
+export declare function verifyPlatformEvent<Data = Record<string, unknown>>(request: {
+    method: string;
+    path: string;
+    headers: Record<string, string | string[] | undefined>;
+    body: unknown;
+}, options?: {
+    hmacKey?: string;
+    now?: () => number;
+}): PlatformEvent<Data>;
+/**
+ * Sign an event delivery the way the platform does. For tests and the local
+ * gateway mock; the platform has its own copy.
+ */
+export declare function signPlatformEvent(params: {
+    hmacKey: string;
+    path: string;
+    body: string;
+}): {
+    authorization: string;
+};
+//# sourceMappingURL=instanceGateway.d.ts.map

package/lib/http/instanceGateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instanceGateway.d.ts","sourceRoot":"","sources":["../../src/http/instanceGateway.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D,iDAAiD;AACjD,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAIvD,MAAM,WAAW,sBAAsB;IACrC,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,0EAA0E;AAC1E,qBAAa,2BAA4B,SAAQ,KAAK;IAGlD,QAAQ,CAAC,MAAM,EAAE,MAAM;IAEvB,iDAAiD;IACjD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM;IALrC,SAAkB,IAAI,EAAE,MAAM,CAAiC;IAC/D,YACW,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;IACf,iDAAiD;IACxC,iBAAiB,CAAC,EAAE,MAAM,YAAA,EAGpC;CACF;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,OAAO,CACL,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,EACzC,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GACnE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrB,qCAAqC;IACrC,IAAI,CAAC,CAAC,EACJ,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,EACzC,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GACnE,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED,uEAAuE;AACvE,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,sBAA2B,EACpC,OAAO,SAAyB,GAC/B;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAW7D;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,OAAO,CAIT;AASD,kDAAkD;AAClD,wBAAgB,8BAA8B,CAC5C,OAAO,GAAE,sBAA2B,EACpC,OAAO,CAAC,EAAE,MAAM,GACf,wBAAwB,CA0D1B;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC3D,yEAAyE;IACzE,EAAE,EAAE,MAAM,CAAC;IACX,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,SAAkB,IAAI,oCAAoC;CAC3D;AAID;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChE,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,IAAI,EAAE,OAAO,CAAC;CACf,EACD,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GACrD,aAAa,CAAC,IAAI,CAAC,CAqErB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,GAAG;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAQ5B"}

package/lib/http/modelGatewayClient.d.ts

@@ -0,0 +1,126 @@
+import { InstanceGatewayRequestError } from './instanceGateway';
+/**
+ * Client for the ForkLaunch model gateway, used from inside a managed
+ * instance.
+ *
+ * A managed instance calls platform-hosted AI models (Azure AI Foundry)
+ * without holding a provider key: each request is signed with the
+ * instance's own HMAC key, and the platform enforces the product's model
+ * allowlist, monthly token budget and rate limit. For a HIPAA product the
+ * platform only offers models covered by its BAA.
+ *
+ * The platform injects everything this needs into a hosted instance:
+ * `PLATFORM_GATEWAY_URL` (the platform's public base), `INSTANCE_ID` and
+ * `INSTANCE_HMAC_KEY`. Their absence means the instance is not hosted in
+ * managed mode, and the client refuses to be created rather than failing on
+ * the first call.
+ *
+ * @example
+ * const models = createModelGatewayClient();
+ * const reply = await models.chat.completions.create({
+ *   model: 'terra',
+ *   messages: [{ role: 'user', content: 'Summarize this intake form: …' }]
+ * });
+ * for await (const chunk of models.chat.completions.stream({ model: 'luna', messages })) {
+ *   process.stdout.write(chunk.choices[0]?.delta?.content ?? '');
+ * }
+ */
+export interface ModelGatewayClientOptions {
+    /** Platform base URL. Default: `PLATFORM_GATEWAY_URL`. */
+    gatewayUrl?: string;
+    /** This instance's id. Default: `INSTANCE_ID`. */
+    instanceId?: string;
+    /** This instance's HMAC key. Default: `INSTANCE_HMAC_KEY`. */
+    hmacKey?: string;
+    fetch?: typeof fetch;
+}
+/** An OpenAI-style chat message. */
+export interface GatewayChatMessage {
+    role: 'system' | 'developer' | 'user' | 'assistant' | 'tool';
+    content: unknown;
+    [key: string]: unknown;
+}
+/** An OpenAI-compatible chat completions request; `model` is a catalog alias. */
+export interface GatewayChatRequest {
+    model: string;
+    messages: GatewayChatMessage[];
+    temperature?: number;
+    top_p?: number;
+    max_tokens?: number;
+    max_completion_tokens?: number;
+    response_format?: unknown;
+    tools?: unknown[];
+    tool_choice?: unknown;
+    parallel_tool_calls?: boolean;
+    stop?: unknown;
+    seed?: number;
+    presence_penalty?: number;
+    frequency_penalty?: number;
+    reasoning_effort?: string;
+}
+export interface GatewayChatCompletion {
+    id: string;
+    object: string;
+    created: number;
+    model: string;
+    choices: {
+        index: number;
+        message: {
+            role: string;
+            content: string | null;
+            [key: string]: unknown;
+        };
+        finish_reason: string | null;
+        [key: string]: unknown;
+    }[];
+    usage?: {
+        prompt_tokens: number;
+        completion_tokens: number;
+        total_tokens: number;
+    };
+    [key: string]: unknown;
+}
+export interface GatewayChatChunk {
+    id: string;
+    object: string;
+    model: string;
+    choices: {
+        index: number;
+        delta: {
+            role?: string;
+            content?: string | null;
+            [key: string]: unknown;
+        };
+        finish_reason?: string | null;
+    }[];
+    usage?: GatewayChatCompletion['usage'];
+    [key: string]: unknown;
+}
+export interface GatewayModels {
+    models: {
+        id: string;
+        baa: boolean;
+    }[];
+    monthlyTokenBudget: number;
+    tokensUsedThisMonth: number;
+    requestsPerMinute: number;
+    withheldForHipaa?: string[];
+}
+/** A refusal or failure from the gateway, with the status it answered. */
+export declare class ModelGatewayRequestError extends InstanceGatewayRequestError {
+    readonly name: 'ModelGatewayRequestError';
+}
+export interface ModelGatewayClient {
+    /** The models this instance may call, and where its monthly budget stands. */
+    models(): Promise<GatewayModels>;
+    chat: {
+        completions: {
+            create(request: GatewayChatRequest): Promise<GatewayChatCompletion>;
+            stream(request: GatewayChatRequest, options?: {
+                signal?: AbortSignal;
+            }): AsyncGenerator<GatewayChatChunk>;
+        };
+    };
+}
+export declare function createModelGatewayClient(options?: ModelGatewayClientOptions): ModelGatewayClient;
+//# sourceMappingURL=modelGatewayClient.d.ts.map

package/lib/http/modelGatewayClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelGatewayClient.d.ts","sourceRoot":"","sources":["../../src/http/modelGatewayClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,2BAA2B,EAC5B,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC7D,OAAO,EAAE,OAAO,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAC1E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,EAAE,CAAC;IACJ,KAAK,CAAC,EAAE;QACN,aAAa,EAAE,MAAM,CAAC;QACtB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAC1E,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,EAAE,CAAC;IACJ,KAAK,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,2BAA2B;IACvE,SAAkB,IAAI,EAAG,0BAA0B,CAAU;CAC9D;AAED,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IACjC,IAAI,EAAE;QACJ,WAAW,EAAE;YACX,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;YACpE,MAAM,CACJ,OAAO,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE;gBAAE,MAAM,CAAC,EAAE,WAAW,CAAA;aAAE,GACjC,cAAc,CAAC,gBAAgB,CAAC,CAAC;SACrC,CAAC;KACH,CAAC;CACH;AAED,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,yBAA8B,GACtC,kBAAkB,CAyDpB"}

package/lib/http/paymentsClient.d.ts

@@ -0,0 +1,123 @@
+import type Stripe from 'stripe';
+import { InstanceGatewayRequestError, type InstanceGatewayOptions } from './instanceGateway';
+/**
+ * Payments for a managed instance: Stripe Connect through the platform.
+ *
+ * The product's publisher runs the Stripe Connect platform, linked once to
+ * ForkLaunch. Each managed instance (a clinic, a studio) gets its OWN
+ * connected account and is the merchant of record: charges are direct
+ * charges on that account, and payouts go to the clinic's bank, never through
+ * the app. The app never holds a Stripe key:
+ *
+ *   - `createPaymentsClient()` onboards the instance (a Stripe-hosted Account
+ *     Link) and reports whether it can take payments yet;
+ *   - `createStripeClient()` is the REAL Stripe SDK, pointed at the instance
+ *     gateway. Every request is signed with the instance key, and the platform
+ *     pins `Stripe-Account` to this instance's connected account, forwards
+ *     only an allowlist of calls (customers, products and prices, checkout and
+ *     billing-portal sessions, payment links, subscriptions, payment intents,
+ *     refunds, invoices — never payouts, transfers, external accounts or
+ *     account changes), adds the product's application fee, and refuses
+ *     metadata that looks like protected data;
+ *   - Stripe's events arrive as platform events (`/platform-events/payments`,
+ *     type = the Stripe event type, id = the Stripe event id, data = the
+ *     event's object), verified with `verifyPlatformEvent`.
+ *
+ * Outside managed mode `createStripeClient({ apiKey })` is `new Stripe(apiKey)`,
+ * so the same registration runs against a developer's own test account.
+ *
+ * @example
+ * const payments = createPaymentsClient();
+ * const { url } = await payments.onboardingLink({
+ *   returnUrl: 'https://clinic.example.com/settings/payments?done=1',
+ *   refreshUrl: 'https://clinic.example.com/settings/payments'
+ * });
+ * const stripe = createStripeClient({ Stripe });
+ * const session = await stripe.checkout.sessions.create({ mode: 'payment', … });
+ */
+/** Where the gateway proxies Stripe's API, router-relative. */
+export declare const STRIPE_GATEWAY_ROUTE = "/stripe";
+export interface PaymentsStatus {
+    /** The connected account can take card payments. */
+    chargesEnabled: boolean;
+    /** Stripe can pay out to the clinic's bank account. */
+    payoutsEnabled: boolean;
+    /** What Stripe still needs (`individual.verification.document`, …). */
+    requirementsDue: string[];
+}
+export interface PaymentsClient {
+    /**
+     * A single-use Stripe-hosted onboarding link for this instance's connected
+     * account (created on first use). Send the clinic's owner to `url`; Stripe
+     * returns them to `returnUrl`, or to `refreshUrl` when the link expired.
+     */
+    onboardingLink(params: {
+        returnUrl: string;
+        refreshUrl: string;
+    }): Promise<{
+        url: string;
+    }>;
+    /** Whether the instance can take payments yet. */
+    status(): Promise<PaymentsStatus>;
+}
+/** A refusal or failure from the payments gateway. */
+export declare class PaymentsRequestError extends InstanceGatewayRequestError {
+    readonly name: 'PaymentsRequestError';
+}
+export declare function createPaymentsClient(options?: InstanceGatewayOptions): PaymentsClient;
+type StripeConstructor = typeof Stripe;
+export interface StripeClientOptions extends InstanceGatewayOptions {
+    /**
+     * A Stripe secret key, for a service NOT running in managed mode (local
+     * development against your own test account, a self-hosted deployment).
+     * Ignored in managed mode, where the platform holds the key.
+     */
+    apiKey?: string;
+    /**
+     * The `Stripe` class to construct. Pass your own `import Stripe from
+     * 'stripe'` when the client is registered with `type: Stripe`: an ESM
+     * service and this package could otherwise load different builds of the
+     * SDK, and the registration's `instanceof` check would fail. Default: the
+     * `stripe` package, loaded on first use (it is an optional peer dependency).
+     */
+    Stripe?: StripeConstructor;
+    /** Extra SDK settings (apiVersion, maxNetworkRetries, timeout, appInfo). */
+    config?: Stripe.StripeConfig;
+}
+/**
+ * A fetch that sends Stripe SDK requests to the instance gateway, signed.
+ *
+ * The SDK builds `https://<host>:<port>/v1/...` from the `host`/`port`/
+ * `protocol` settings; this rewrites the path under
+ * `/instance-gateway/stripe` and adds the instance's HMAC `authorization`,
+ * replacing any bearer key. The signature covers the method, the
+ * router-relative path WITH its query string (`/stripe/v1/prices?active=true`,
+ * so a list filter cannot be altered in flight) and the body exactly as sent:
+ * Stripe's bodies are form-encoded, and the raw form string is signed
+ * verbatim (framework `createHmacToken` treats a string body as the wire
+ * bytes). An empty body signs as no body.
+ */
+export declare function stripeGatewayFetch(settings: {
+    gatewayUrl: string;
+    instanceId: string;
+    hmacKey: string;
+}, fetchImpl?: typeof fetch): typeof fetch;
+/**
+ * The Stripe SDK for this service.
+ *
+ * In managed mode (gateway options given, or `PLATFORM_GATEWAY_URL`,
+ * `INSTANCE_ID` and `INSTANCE_HMAC_KEY` set) it is a real `Stripe` whose
+ * requests go to the platform's instance gateway, signed with the instance
+ * key; there is no Stripe key in the app. Otherwise it is `new
+ * Stripe(apiKey)`.
+ *
+ * Mechanism (stripe-node 22): `host`/`port`/`protocol` point the SDK at the
+ * gateway, `httpClient: Stripe.createFetchHttpClient(signedFetch)` rewrites
+ * each request under `/instance-gateway/stripe` and signs it (see
+ * `stripeGatewayFetch`), and a no-op `authenticator` stands in for the API
+ * key so no bearer credential is ever sent. Retries re-enter the fetch, so
+ * each attempt carries a fresh nonce.
+ */
+export declare function createStripeClient(options?: StripeClientOptions): Stripe;
+export {};
+//# sourceMappingURL=paymentsClient.d.ts.map

package/lib/http/paymentsClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paymentsClient.d.ts","sourceRoot":"","sources":["../../src/http/paymentsClient.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAGL,2BAA2B,EAG3B,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,+DAA+D;AAC/D,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,cAAc,EAAE,OAAO,CAAC;IACxB,uDAAuD;IACvD,cAAc,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7B,kDAAkD;IAClD,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;CACnC;AAED,sDAAsD;AACtD,qBAAa,oBAAqB,SAAQ,2BAA2B;IACnE,SAAkB,IAAI,EAAG,sBAAsB,CAAU;CAC1D;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,sBAA2B,GACnC,cAAc,CAuChB;AAED,KAAK,iBAAiB,GAAG,OAAO,MAAM,CAAC;AAEvC,MAAM,WAAW,mBAAoB,SAAQ,sBAAsB;IACjE;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;CAC9B;AAsBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACrE,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,KAAK,CAqDd;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,MAAM,CAoC5E"}

package/lib/http/smsClient.d.ts

@@ -0,0 +1,123 @@
+import { InstanceGatewayRequestError, type InstanceGatewayOptions, type PlatformEvent } from './instanceGateway';
+/**
+ * Client for platform-held SMS (AWS End User Messaging SMS), used from inside
+ * a managed instance.
+ *
+ * The instance never holds an AWS credential or a phone number. It signs each
+ * send with its own HMAC key; the platform checks the instance's monthly
+ * segment cap, its rate limit and its opt-out list, then sends from the
+ * product's origination pool under a configuration set named for the
+ * instance, so delivery receipts come back to this instance and no other.
+ *
+ * Events arrive at `POST /platform-events/sms` (verify them with
+ * `verifyPlatformEvent`): `sms.delivered`, `sms.failed`, `sms.received`
+ * (a reply) and `sms.opted_out` (the person texted STOP; further sends to that
+ * number are refused with 422).
+ *
+ * A text message is not a secure channel: carriers, the handset's lock screen
+ * and anyone holding the phone can read it. Never put protected data (a
+ * `.deanon` value, a diagnosis, a result) in `body`; send a link to sign in
+ * instead. `forklaunch score` flags it (`sms-protected-data`).
+ *
+ * Locally, run the gateway mock (`npx -p @forklaunch/core
+ * forklaunch-gateway-mock`, or the `gateway-mock` compose service that
+ * `forklaunch infra add <service> sms` wires) and point PLATFORM_GATEWAY_URL,
+ * INSTANCE_ID and INSTANCE_HMAC_KEY at it.
+ *
+ * @example
+ * const sms = createSmsClient();
+ * const { messageId, segments } = await sms.send({
+ *   to: '+14155550123',
+ *   body: 'Your appointment is confirmed. Sign in for details: https://…',
+ *   purpose: 'transactional'
+ * });
+ */
+export interface SmsClientOptions extends InstanceGatewayOptions {
+    /**
+     * Refuse on the first `send` rather than at creation when the service is
+     * not a managed instance. For dependency containers that build singletons
+     * at boot, so a local run without the gateway still starts.
+     */
+    deferRefusal?: boolean;
+}
+export type SmsPurpose = 'transactional' | 'promotional';
+export interface SmsSendRequest {
+    /** E.164, e.g. `+14155550123`. */
+    to: string;
+    /** Plain text. At most `SMS_MAX_SEGMENTS` segments. */
+    body: string;
+    /** Default `transactional`. Promotional texts need prior marketing consent. */
+    purpose?: SmsPurpose;
+}
+export interface SmsSendResult {
+    /** The vendor's message id; delivery events carry it. */
+    messageId: string;
+    /** Billed segments (a long or non-GSM message is several). */
+    segments: number;
+}
+export interface SmsDeliveredData {
+    messageId: string;
+    to: string;
+    deliveredAt?: string;
+}
+export interface SmsFailedData {
+    messageId: string;
+    to: string;
+    reason: string;
+}
+export interface SmsReceivedData {
+    from: string;
+    body: string;
+    receivedAt: string;
+    /** The recognized keyword (STOP, HELP, START…), when the text was one. */
+    keyword?: string;
+}
+export interface SmsOptedOutData {
+    phone: string;
+    optedOutAt: string;
+}
+/** The events the platform delivers for SMS. */
+export type SmsEvent = (PlatformEvent<SmsDeliveredData> & {
+    type: 'sms.delivered';
+}) | (PlatformEvent<SmsFailedData> & {
+    type: 'sms.failed';
+}) | (PlatformEvent<SmsReceivedData> & {
+    type: 'sms.received';
+}) | (PlatformEvent<SmsOptedOutData> & {
+    type: 'sms.opted_out';
+});
+/** A refusal or failure from the SMS gateway, with the status it answered. */
+export declare class SmsRequestError extends InstanceGatewayRequestError {
+    readonly name: 'SmsRequestError';
+}
+/** An input the client refuses before any network call. */
+export declare class SmsValidationError extends Error {
+    readonly name: 'SmsValidationError';
+}
+export declare const SMS_MAX_SEGMENTS = 10;
+export declare function isE164(phone: string): boolean;
+/**
+ * How many segments a body is billed as: GSM-7 is 160 septets in one
+ * segment, 153 per segment when split; anything outside GSM-7 is UCS-2, 70
+ * characters in one, 67 per segment (UTF-16 code units).
+ */
+export declare function smsSegments(body: string): {
+    encoding: 'GSM-7' | 'UCS-2';
+    units: number;
+    segments: number;
+};
+/** Check a send before it leaves the process; throws SmsValidationError. */
+export declare function validateSmsSend(request: SmsSendRequest): void;
+/**
+ * Sends texts through the platform. A class so a dependency container can
+ * register it by type (`type: SmsClient`); build it with `createSmsClient`.
+ */
+export declare class SmsClient {
+    private readonly transport?;
+    constructor(options?: SmsClientOptions);
+    /** Whether sends can reach the gateway (false: every send refuses). */
+    get managed(): boolean;
+    send(request: SmsSendRequest): Promise<SmsSendResult>;
+}
+export declare function createSmsClient(options?: SmsClientOptions): SmsClient;
+//# sourceMappingURL=smsClient.d.ts.map

package/lib/http/smsClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smsClient.d.ts","sourceRoot":"","sources":["../../src/http/smsClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,2BAA2B,EAE3B,KAAK,sBAAsB,EAE3B,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,WAAW,gBAAiB,SAAQ,sBAAsB;IAC9D;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,aAAa,CAAC;AAEzD,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AACD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,gDAAgD;AAChD,MAAM,MAAM,QAAQ,GAChB,CAAC,aAAa,CAAC,gBAAgB,CAAC,GAAG;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,GAC7D,CAAC,aAAa,CAAC,aAAa,CAAC,GAAG;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC,GACvD,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,GAC3D,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,CAAC;AAEjE,8EAA8E;AAC9E,qBAAa,eAAgB,SAAQ,2BAA2B;IAC9D,SAAkB,IAAI,EAAG,iBAAiB,CAAU;CACrD;AAED,2DAA2D;AAC3D,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAkB,IAAI,EAAG,oBAAoB,CAAU;CACxD;AAED,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAInC,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7C;AAQD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG;IACzC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,CAwBA;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAwB7D;AAQD;;;GAGG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAA2B;IAEtD,YAAY,OAAO,GAAE,gBAAqB,EAYzC;IAED,uEAAuE;IACvE,IAAI,OAAO,IAAI,OAAO,CAErB;IAEK,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAmB1D;CACF;AAED,wBAAgB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,SAAS,CAEzE"}

package/lib/http/voiceClient.d.ts

@@ -0,0 +1,105 @@
+import { type InstanceGatewayOptions, InstanceGatewayRequestError } from './instanceGateway';
+/**
+ * Client for platform-held voice calls (Amazon Connect), used from inside a
+ * managed instance.
+ *
+ * The instance never holds an AWS credential, a Connect instance id or a
+ * contact-flow ARN. It asks the platform to place a call with a FLOW NAME from
+ * the product's flow catalog (`appointment_reminder`, …); the platform maps it
+ * to the contact flow, dials from the phone number claimed for this instance,
+ * and enforces the instance's concurrent-call and monthly-minute limits.
+ *
+ * Call progress arrives as platform events on `/platform-events/voice`
+ * (`voice.call.started`, `voice.call.ended`, `voice.recording.ready`), signed
+ * with the instance key; `forklaunch infra add <service> voice` writes the
+ * route and a handler stub.
+ *
+ * Attributes are passed to the contact flow and are stored in Connect's
+ * contact records. Put identifiers in them (an appointment id the flow looks
+ * up), never health information: the `voice-protected-data` check flags a
+ * `.deanon` value flowing into them.
+ *
+ * Locally, `infra add` points the service at the gateway mock in
+ * docker-compose (flows from `MOCK_VOICE_FLOWS`, events delivered back to the
+ * service), so the same code runs with no AWS account.
+ *
+ * @example
+ * const voice = createVoiceClient();
+ * const { callId } = await voice.startOutboundCall({
+ *   to: '+15551230000',
+ *   flow: 'appointment_reminder',
+ *   attributes: { appointmentId: appt.id }
+ * });
+ * const { status } = await voice.call(callId);
+ */
+export type VoiceClientOptions = InstanceGatewayOptions;
+/** Limits the gateway enforces on attributes; the client checks them first. */
+export declare const VOICE_ATTRIBUTE_LIMITS: {
+    readonly maxKeys: 20;
+    readonly maxKeyLength: 64;
+    readonly maxValueLength: 256;
+    readonly maxTotalBytes: 4096;
+    /** Keys the platform reserves (it prefixes and adds its own under `fl_`). */
+    readonly reservedPrefix: 'fl_';
+};
+export interface StartOutboundCallRequest {
+    /** The number to call, E.164 (`+15551230000`). */
+    to: string;
+    /** A flow name from the product's catalog, e.g. `appointment_reminder`. */
+    flow: string;
+    /** String values the contact flow can read. No health information. */
+    attributes?: Record<string, string>;
+}
+export interface StartOutboundCallResult {
+    callId: string;
+}
+export type VoiceCallStatus = 'initiated' | 'in_progress' | 'ended';
+export interface VoiceCall {
+    status: VoiceCallStatus;
+    startedAt: string;
+    endedAt?: string;
+    durationSeconds?: number;
+    /** Why it ended: `customer`, `agent`, `api`, `busy`, `no_answer`, … */
+    disconnectReason?: string;
+}
+/** Data of `voice.call.started`. */
+export interface VoiceCallStartedEvent {
+    callId: string;
+    flow?: string;
+}
+/** Data of `voice.call.ended`. */
+export interface VoiceCallEndedEvent {
+    callId: string;
+    durationSeconds: number;
+    disconnectReason: string;
+}
+/** Data of `voice.recording.ready`: the key in the instance's object store. */
+export interface VoiceRecordingReadyEvent {
+    callId: string;
+    recordingKey: string;
+}
+/** A refusal or failure from the voice gateway, with its status. */
+export declare class VoiceRequestError extends InstanceGatewayRequestError {
+    readonly name: 'VoiceRequestError';
+}
+/** Why a request would be refused, or undefined. Shared with the gateway. */
+export declare function voiceRequestProblem(request: StartOutboundCallRequest): string | undefined;
+/**
+ * The voice client. A class so a service's registrations.ts can declare it
+ * (`type: VoiceClient`); construct it with `createVoiceClient()`.
+ */
+export declare class VoiceClient {
+    private readonly transport;
+    /** Throws when the process is not a managed instance (see instanceGatewaySettings). */
+    constructor(options?: VoiceClientOptions);
+    /** Place an outbound call; resolves once the platform accepted it. */
+    startOutboundCall(request: StartOutboundCallRequest): Promise<StartOutboundCallResult>;
+    /** Hang up a call this instance placed. */
+    endCall(callId: string): Promise<void>;
+    /** Where a call this instance placed stands. */
+    call(callId: string): Promise<VoiceCall>;
+    private send;
+}
+/** A voice client for this managed instance (settings from the environment). */
+export declare function createVoiceClient(options?: VoiceClientOptions): VoiceClient;
+//# sourceMappingURL=voiceClient.d.ts.map

package/lib/http/voiceClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"voiceClient.d.ts","sourceRoot":"","sources":["../../src/http/voiceClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,sBAAsB,EAC3B,2BAA2B,EAE5B,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAExD,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB;aACjC,OAAO,EAAE,EAAE;aACX,YAAY,EAAE,EAAE;aAChB,cAAc,EAAE,GAAG;aACnB,aAAa,EAAE,IAAI;IACnB,6EAA6E;aAC7E,cAAc,EAAE,KAAK;CACb,CAAC;AAEX,MAAM,WAAW,wBAAwB;IACvC,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;AAEpE,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,oCAAoC;AACpC,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,+EAA+E;AAC/E,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,oEAAoE;AACpE,qBAAa,iBAAkB,SAAQ,2BAA2B;IAChE,SAAkB,IAAI,EAAG,mBAAmB,CAAU;CACvD;AAMD,6EAA6E;AAC7E,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,wBAAwB,GAChC,MAAM,GAAG,SAAS,CAuCpB;AAED;;;GAGG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;IAErD,uFAAuF;IACvF,YAAY,OAAO,GAAE,kBAAuB,EAK3C;IAED,sEAAsE;IAChE,iBAAiB,CACrB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAQlC;IAED,2CAA2C;IACrC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3C;IAED,gDAAgD;IAC1C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAE7C;YAEa,IAAI;CAoBnB;AASD,gFAAgF;AAChF,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,kBAAuB,GAC/B,WAAW,CAEb"}