@fougere/app 0.2.0-alpha.0

package/dist/rest.js

@@ -0,0 +1,92 @@
+/**
+ * The REST table this app serves, and the rule that matches a request against it.
+ *
+ * Separated from the h3 handler on purpose: this file holds the whole of what the door
+ * DECIDES — which operation a verb and a path name — while `api/crud.ts` only translates
+ * that decision into h3. The rule was previously inline, untested, and had drifted into a
+ * second REST projection that answered differently from `schema-rest` on all three counts
+ * (verb, path, exposure).
+ */
+import { generateRoutes } from '@fougere/schema-rest';
+// Keyed on the app, which `useFougereApp` memoizes — the table derives from the boot, so
+// it changes exactly when the app does.
+const tables = new WeakMap();
+/**
+ * The table, per frond.
+ *
+ * `generateRoutes` prefixes every path the same way, while this door addresses a frond by
+ * name (`/api/{frond}/{plural}`) — so it runs once per frond, each with its own prefix and
+ * a filter naming it. That frond loop is the only thing this file knows that `schema-rest`
+ * does not; the verbs, the paths and the membership rule all come from there.
+ */
+export function tableOf(app) {
+    const cached = tables.get(app);
+    if (cached)
+        return cached;
+    const table = app.fronds.flatMap((frond) => generateRoutes(app, {
+        prefix: `/${frond.name}`,
+        filter: (_entity, frondName) => frondName === frond.name,
+    }).map((route) => ({
+        method: route.method,
+        segments: route.path.split('/').filter(Boolean),
+        path: route.path,
+        entityName: route.entityName,
+        operationName: route.operationName,
+    })));
+    tables.set(app, table);
+    return table;
+}
+/** The captured params if this pattern accepts these segments, else null. */
+function paramsOf(route, segments) {
+    if (route.segments.length !== segments.length)
+        return null;
+    const params = {};
+    for (let i = 0; i < segments.length; i++) {
+        const pattern = route.segments[i];
+        if (pattern.startsWith(':'))
+            params[pattern.slice(1)] = decodeURIComponent(segments[i]);
+        else if (pattern !== segments[i])
+            return null;
+    }
+    return params;
+}
+/** How many segments a pattern leaves open — fewer is more specific. */
+function openness(route) {
+    return route.segments.filter((s) => s.startsWith(':')).length;
+}
+/**
+ * Verbs this door accepts in place of the one the table names.
+ *
+ * `deriveMethod` gives `update` a single verb, PUT, while this door has always served
+ * PATCH on it too — and says so (`docs/infra/surfaces`, "PUT · PATCH"). An alias keeps
+ * that promise without giving the table a second row: both are mutations on a row, so
+ * nothing is widened, and the one thing the table decides — WHICH operation a path names —
+ * is still decided there alone.
+ */
+const ALIASES = { PATCH: 'PUT' };
+/**
+ * Path first, method second — a router's order, and what makes a 405 possible at all.
+ *
+ * The order matters where the two overlap: `/posts/publish` and `/posts/:id` both accept
+ * `GET /posts/publish`. Taking the most specific path first means the answer is "that verb
+ * is refused here", not `findById('publish')` — and never `publish()`, which is what this
+ * door used to do with the caller's session cookie attached.
+ */
+export function matchRoute(table, method, segments) {
+    const matches = table
+        .map((route) => ({ route, params: paramsOf(route, segments) }))
+        .filter((m) => m.params !== null);
+    if (matches.length === 0)
+        return null;
+    const best = Math.min(...matches.map((m) => openness(m.route)));
+    const candidates = matches.filter((m) => openness(m.route) === best);
+    const wanted = ALIASES[method] ?? method;
+    const matched = candidates.find((m) => m.route.method === wanted);
+    if (matched)
+        return { kind: 'match', route: matched.route, params: matched.params };
+    return {
+        kind: 'method-not-allowed',
+        allow: [...new Set(candidates.map((m) => m.route.method))].sort(),
+    };
+}
+//# sourceMappingURL=rest.js.map

package/dist/rest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest.js","sourceRoot":"","sources":["../src/rest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAoBtD,yFAAyF;AACzF,wCAAwC;AACxC,MAAM,MAAM,GAAG,IAAI,OAAO,EAAoB,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAAQ;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,cAAc,CAAC,GAAY,EAAE;QAC3B,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,IAAI;KACzD,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,MAAM,EAAE,KAAK,CAAC,MAAgB;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,KAAgB,EAAE,QAAkB;IACpD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE3D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;QACnC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;aACpF,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wEAAwE;AACxE,SAAS,QAAQ,CAAC,KAAgB;IAChC,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AAChE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,GAA2B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,KAAkB,EAAE,MAAc,EAAE,QAAkB;IAC/E,MAAM,OAAO,GAAG,KAAK;SAClB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;SAC9D,MAAM,CAAC,CAAC,CAAC,EAA6D,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAE/F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IAErE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAClE,IAAI,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAEpF,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;KAClE,CAAC;AACJ,CAAC"}

package/dist/serve.d.ts

@@ -0,0 +1,110 @@
+/**
+ * The three doors, decided — and nothing about how a request arrives.
+ *
+ * A host (Nuxt, Next) owns exactly two translations: read the request into the
+ * plain values below, and write the outcome back out. Everything between — which
+ * operation a verb and a path name, which audience a segment selects, what a
+ * refusal becomes — is decided here, once, for every host.
+ *
+ * The split matters because the alternative was measured in this repo: two copies
+ * of a REST rule drifted until the Nuxt door answered differently from
+ * `schema-rest` on the verb, the path AND the exposure. A second host would have
+ * been a third copy.
+ */
+import { type App, type FrondCall, type InvocationContext } from '@fougere/core';
+/** What a host must read off the request before any decision is possible. */
+export interface DoorRequest {
+    method: string;
+    /** Path with no query string. The REST door strips its own `/api` prefix. */
+    path: string;
+    query: Record<string, string>;
+    body?: unknown;
+    /**
+     * The server-resolved session. Stamped by the host from what IT resolved —
+     * never taken from the wire, which is the whole trust boundary of the browser
+     * door (`transport/http/src/server.ts` carries the same warning for the split).
+     */
+    state: Record<string, unknown>;
+}
+/** What a host must write back. `pass` is the one that keeps a door additive. */
+export type Outcome = 
+/** Not ours — the host's own routes must still reach their handler. */
+{
+    kind: 'pass';
+} | {
+    kind: 'ok';
+    status: number;
+    body: unknown;
+} | {
+    kind: 'error';
+    status: number;
+    body: {
+        message: string;
+    } & Record<string, unknown>;
+    headers?: Record<string, string>;
+};
+/**
+ * The audience this door serves — the path segment after `/_fougere/call`.
+ *
+ * The envelope is a surface like REST and GraphQL, so it selects its audience like
+ * they do; the difference is only that it takes it from the path instead of an
+ * option, because a door is mounted, not called. The same word names the directory
+ * (`handlers/public/`), the config key (`surfaces: { public: [...] }`) and this
+ * segment — derived, never configured.
+ *
+ * No escalation to guard: a named surface serves the entities it names and nothing
+ * else (closed by naming), so every one of them is a subset of what the bare path
+ * already serves.
+ */
+export declare function surfaceOf(path: string): string | undefined;
+/**
+ * Receiving end for the browser — same wire as process-to-process (JSON-RPC),
+ * different trust boundary: the browser sits outside the topology, so `state` is
+ * whatever the host resolved server-side, never what the payload claims.
+ *
+ * The runner follows the app's topology: local façades and remote doublures alike
+ * — the browser never knows where a Frond lives.
+ */
+export declare function serveRpc(app: App, request: Pick<DoorRequest, 'path' | 'body' | 'state'>): Promise<unknown>;
+/** The answer a host returns when it could not even parse the payload. */
+export declare function rpcParseError(): {
+    jsonrpc: '2.0';
+    id: null;
+    error: {
+        code: number;
+        message: string;
+    };
+};
+/**
+ * Match the URL against the canonical table, invoke the call it names, shape the
+ * result for HTTP. The decision lives in `rest.ts`; dispatch belongs to the runner.
+ *
+ * `path` is what follows the REST mount point, so `/api/blog/posts/1` arrives as
+ * `blog/posts/1`. A path this door does not serve returns `pass`, and that is what
+ * lets an app keep its own `/api/*` handlers.
+ */
+export declare function serveRest(app: App, request: DoorRequest): Promise<Outcome>;
+/**
+ * What an operation's return becomes on the wire.
+ *
+ * Separate from `serveRest` because it is a DECISION and dispatch is not: it can be
+ * pinned without a runner, and both hosts get it whether the call ran in memory or
+ * came back over JSON-RPC.
+ */
+export declare function shapeRest(operationName: string, result: unknown): Outcome;
+type EntityClass = {
+    name: string;
+};
+type CallInput = Partial<InvocationContext>;
+/**
+ * Name a call server-side and let the runner place it — local façade → direct
+ * in-memory execution, a frond in `remotes` → JSON-RPC on the wire. The caller
+ * never knows which.
+ *
+ * `state` is explicit here. Each host wraps this with its own way of finding the
+ * current request (Nitro's async context, Next's `headers()` scope), because that
+ * is the one part a host actually owns.
+ */
+export declare function invokeOn<T = unknown>(app: App, target: EntityClass | FrondCall, opOrInput?: string | CallInput, input?: CallInput, state?: Record<string, unknown>): Promise<T>;
+export {};
+//# sourceMappingURL=serve.d.ts.map

package/dist/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAIL,KAAK,GAAG,EACR,KAAK,SAAS,EACd,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAC;AAIvB,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,iFAAiF;AACjF,MAAM,MAAM,OAAO;AACjB,uEAAuE;AACrE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAI7H;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAGhH;AAED,0EAA0E;AAC1E,wBAAgB,aAAa;aACT,KAAK;;;;;;EACxB;AAID;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAyChF;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAkBzE;AAID,KAAK,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AACpC,KAAK,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAE5C;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EACxC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,CAAC,EAAE,SAAS,EACjB,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,OAAO,CAAC,CAAC,CAAC,CAMZ"}

package/dist/serve.js

@@ -0,0 +1,136 @@
+/**
+ * The three doors, decided — and nothing about how a request arrives.
+ *
+ * A host (Nuxt, Next) owns exactly two translations: read the request into the
+ * plain values below, and write the outcome back out. Everything between — which
+ * operation a verb and a path name, which audience a segment selects, what a
+ * refusal becomes — is decided here, once, for every host.
+ *
+ * The split matters because the alternative was measured in this repo: two copies
+ * of a REST rule drifted until the Nuxt door answered differently from
+ * `schema-rest` on the verb, the path AND the exposure. A second host would have
+ * been a third copy.
+ */
+import { createAppRunner, callValueOf, toHttpError, } from '@fougere/core';
+import { handleRpc, PARSE_ERROR } from '@fougere/transport-http';
+import { matchRoute, tableOf } from './rest.js';
+// ── The call envelope ────────────────────────────
+/**
+ * The audience this door serves — the path segment after `/_fougere/call`.
+ *
+ * The envelope is a surface like REST and GraphQL, so it selects its audience like
+ * they do; the difference is only that it takes it from the path instead of an
+ * option, because a door is mounted, not called. The same word names the directory
+ * (`handlers/public/`), the config key (`surfaces: { public: [...] }`) and this
+ * segment — derived, never configured.
+ *
+ * No escalation to guard: a named surface serves the entities it names and nothing
+ * else (closed by naming), so every one of them is a subset of what the bare path
+ * already serves.
+ */
+export function surfaceOf(path) {
+    const named = /^\/_fougere\/call\/([A-Za-z0-9_-]+)/.exec(path.replace(/\?.*$/, ''));
+    return named?.[1];
+}
+/**
+ * Receiving end for the browser — same wire as process-to-process (JSON-RPC),
+ * different trust boundary: the browser sits outside the topology, so `state` is
+ * whatever the host resolved server-side, never what the payload claims.
+ *
+ * The runner follows the app's topology: local façades and remote doublures alike
+ * — the browser never knows where a Frond lives.
+ */
+export async function serveRpc(app, request) {
+    const runner = createAppRunner(app, surfaceOf(request.path));
+    return handleRpc((call, invocation) => runner(call, { ...invocation, state: request.state }), request.body);
+}
+/** The answer a host returns when it could not even parse the payload. */
+export function rpcParseError() {
+    return { jsonrpc: '2.0', id: null, error: { code: PARSE_ERROR, message: 'Parse error' } };
+}
+// ── REST ─────────────────────────────────────────
+/**
+ * Match the URL against the canonical table, invoke the call it names, shape the
+ * result for HTTP. The decision lives in `rest.ts`; dispatch belongs to the runner.
+ *
+ * `path` is what follows the REST mount point, so `/api/blog/posts/1` arrives as
+ * `blog/posts/1`. A path this door does not serve returns `pass`, and that is what
+ * lets an app keep its own `/api/*` handlers.
+ */
+export async function serveRest(app, request) {
+    // The app decides, not the host. A route file may exist and a middleware may be
+    // installed; if `fougere.config.ts` does not declare `adapters: { rest: true }`,
+    // this serves nothing and the request carries on to whatever the app itself routes.
+    if (!app.adapters?.rest)
+        return { kind: 'pass' };
+    const segments = request.path.split('/').filter(Boolean);
+    if (segments.length < 2)
+        return { kind: 'pass' };
+    const method = request.method.toUpperCase();
+    const match = matchRoute(tableOf(app), method, segments);
+    if (!match)
+        return { kind: 'pass' };
+    if (match.kind === 'method-not-allowed') {
+        return {
+            kind: 'error',
+            status: 405,
+            body: {
+                message: `Method ${method} not allowed on /${request.path} — try ${match.allow.join(', ')}`,
+                allow: match.allow,
+            },
+            headers: { allow: match.allow.join(', ') },
+        };
+    }
+    const { route, params } = match;
+    let result;
+    try {
+        result = await invokeOn(app, { entity: route.entityName, op: route.operationName }, { params, query: request.query, body: request.body }, undefined, request.state);
+    }
+    catch (err) {
+        const { status, body } = toHttpError(err);
+        return { kind: 'error', status, body: body };
+    }
+    return shapeRest(route.operationName, result);
+}
+/**
+ * What an operation's return becomes on the wire.
+ *
+ * Separate from `serveRest` because it is a DECISION and dispatch is not: it can be
+ * pinned without a runner, and both hosts get it whether the call ran in memory or
+ * came back over JSON-RPC.
+ */
+export function shapeRest(operationName, result) {
+    if (result === null)
+        return { kind: 'error', status: 404, body: { message: 'Not found' } };
+    // A list reads as { items, total, hasMore, endCursor } on the wire — the page-level
+    // facts ride beside the rows instead of on the array, where JSON drops them.
+    if (operationName === 'list' && Array.isArray(result)) {
+        const page = result;
+        return {
+            kind: 'ok',
+            status: 200,
+            body: { items: [...result], total: page.total, hasMore: page.hasMore, endCursor: page.endCursor },
+        };
+    }
+    // 200 on every verb, including POST — what the Nuxt door has always answered. A 201
+    // would be better REST and is a change of behaviour, so it belongs to `schema-rest`
+    // (which owns what a verb means) and not to a refactor that moved this code.
+    return { kind: 'ok', status: 200, body: result };
+}
+/**
+ * Name a call server-side and let the runner place it — local façade → direct
+ * in-memory execution, a frond in `remotes` → JSON-RPC on the wire. The caller
+ * never knows which.
+ *
+ * `state` is explicit here. Each host wraps this with its own way of finding the
+ * current request (Nitro's async context, Next's `headers()` scope), because that
+ * is the one part a host actually owns.
+ */
+export async function invokeOn(app, target, opOrInput, input, state = {}) {
+    const { call, invocation } = callValueOf(target, opOrInput, input);
+    // An explicit `state` on the input wins over the request's — the caller who spells
+    // it is answering for it, which is what makes a call outside any request possible.
+    const given = typeof opOrInput === 'string' ? input : opOrInput;
+    return (await createAppRunner(app)(call, { ...invocation, state: given?.state ?? state }));
+}
+//# sourceMappingURL=serve.js.map

package/dist/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,eAAe,EACf,WAAW,EACX,WAAW,GAIZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwBhD,oDAAoD;AAEpD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACpF,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAQ,EAAE,OAAqD;IAC5F,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,SAAS,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AAC9G,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,OAAO,EAAE,KAAc,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC;AACrG,CAAC;AAED,oDAAoD;AAEpD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,OAAoB;IAC5D,gFAAgF;IAChF,iFAAiF;IACjF,oFAAoF;IACpF,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEjD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEjD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEpC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACxC,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,OAAO,EAAE,UAAU,MAAM,oBAAoB,OAAO,CAAC,IAAI,UAAU,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC3F,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB;YACD,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAChC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CACrB,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,aAAa,EAAE,EACrD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EACpD,SAAS,EACT,OAAO,CAAC,KAAK,CACd,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAqD,EAAE,CAAC;IAChG,CAAC;IAED,OAAO,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,aAAqB,EAAE,MAAe;IAC9D,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;IAE3F,oFAAoF;IACpF,6EAA6E;IAC7E,IAAI,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAA8E,CAAC;QAC5F,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;SAClG,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,oFAAoF;IACpF,6EAA6E;IAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAQ,EACR,MAA+B,EAC/B,SAA8B,EAC9B,KAAiB,EACjB,KAAK,GAA4B,EAAE;IAEnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACnE,mFAAmF;IACnF,mFAAmF;IACnF,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,OAAO,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,KAAK,EAAE,CAAC,CAAM,CAAC;AAClG,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The session view — the one place that turns the server-resolved
+ * request context (filled by the auth middleware) into what the client
+ * is allowed to see. One resolution, three readers: the page by
+ * hydration, the refresh route over the wire, handlers by invocation.
+ *
+ * The app-declared context (viewer enrichment) will attach here when
+ * a real case lands — this function is the seam.
+ */
+export interface SessionView {
+    user: Record<string, unknown> | null;
+}
+export declare function sessionViewOf(context: Record<string, unknown>): SessionView;
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACtC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAK3E"}

package/dist/session.js

@@ -0,0 +1,17 @@
+/**
+ * The session view — the one place that turns the server-resolved
+ * request context (filled by the auth middleware) into what the client
+ * is allowed to see. One resolution, three readers: the page by
+ * hydration, the refresh route over the wire, handlers by invocation.
+ *
+ * The app-declared context (viewer enrichment) will attach here when
+ * a real case lands — this function is the seam.
+ */
+export function sessionViewOf(context) {
+    const raw = context.user;
+    if (!raw)
+        return { user: null };
+    const { passwordHash: _passwordHash, ...user } = raw;
+    return { user };
+}
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,MAAM,UAAU,aAAa,CAAC,OAAgC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,IAA2C,CAAC;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IACrD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/dist/state.d.ts

@@ -0,0 +1,3 @@
+/** The request state for these headers. Empty when no auth is declared, or nobody is signed in. */
+export declare function stateFor(headers: Headers): Promise<Record<string, unknown>>;
+//# sourceMappingURL=state.d.ts.map

package/dist/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAiBA,mGAAmG;AACnG,wBAAsB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAcjF"}

package/dist/state.js

@@ -0,0 +1,32 @@
+/**
+ * Who the caller is, resolved server-side from the request's own headers.
+ *
+ * Nuxt answers this with a Nitro middleware that stamps `event.context`; a
+ * Web-standard host has no such seam on a route handler, so it resolves here
+ * instead. Same source (the auth runtime mounted on `app.auth`), same result shape
+ * (`{ user, session }`), so `serveRpc` and `serveRest` cannot tell hosts apart.
+ *
+ * What must stay true in both: this is what the SERVER resolved. A browser sits
+ * outside the topology, so nothing here may come from the payload.
+ */
+import { useFougereApp } from './boot.js';
+/** The request state for these headers. Empty when no auth is declared, or nobody is signed in. */
+export async function stateFor(headers) {
+    const app = await useFougereApp();
+    if (!app.auth)
+        return {};
+    // No cookie, no session — asking the provider would be a round-trip for a known answer.
+    if (!headers.get('cookie'))
+        return {};
+    try {
+        const result = await app.auth.api.getSession({ headers });
+        if (result?.session && result?.user)
+            return { user: result.user, session: result.session };
+    }
+    catch {
+        // An unreachable or misconfigured provider leaves the caller anonymous rather
+        // than failing the request — the same choice the Nuxt middleware makes.
+    }
+    return {};
+}
+//# sourceMappingURL=state.js.map

package/dist/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAM1C,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAgB;IAC7C,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACzB,wFAAwF;IACxF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAO,GAAG,CAAC,IAAI,CAAC,GAA6B,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACrF,IAAI,MAAM,EAAE,OAAO,IAAI,MAAM,EAAE,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;QAC9E,wEAAwE;IAC1E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/web.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The call envelope. A named surface is the path segment after the door —
+ * `/_fougere/call/public` serves the `public` audience — and `surfaceOf` reads it,
+ * so a host only has to mount this at a path that keeps the segments.
+ */
+export declare function fougereCall(request: Request): Promise<Response>;
+/**
+ * The REST projection, mounted under `/api`.
+ *
+ * `pass` — a path this app does not serve — becomes a 404 here rather than a
+ * fall-through, because a Web handler has nobody to fall through to. Hosts that
+ * resolve a static route before a catch-all (Next does) still let an app keep its
+ * own `/api/*` handlers: they are reached BEFORE this one, not after.
+ */
+export declare function fougereRest(request: Request): Promise<Response>;
+/** The session view over the wire, for a client refreshing after login or logout. */
+export declare function fougereSession(request: Request): Promise<Response>;
+/**
+ * GraphQL, at whatever path the host mounted it — `/graphql` by convention.
+ *
+ * Answers `404` when the app declares no GraphQL adapter, because unlike REST this
+ * door is mounted at a path of its own: there is no app route underneath it to pass to.
+ */
+export declare function fougereGraphQL(request: Request): Promise<Response>;
+//# sourceMappingURL=web.d.ts.map

package/dist/web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqBrE;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoBrE;AAED,qFAAqF;AACrF,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAExE;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkBxE"}

package/dist/web.js

@@ -0,0 +1,93 @@
+/**
+ * The three doors as Web-standard handlers: `Request` in, `Response` out.
+ *
+ * This is the whole server surface for any host built on fetch semantics — Next
+ * route handlers, TanStack Start server routes, Hono, a bare `Deno.serve`. Such a
+ * host mounts these; it does not translate anything, because there is nothing left
+ * to translate.
+ *
+ * Nuxt is the exception and keeps its own translation, for a reason worth stating:
+ * an h3 event is not a `Request`, and reading its body has to straddle two h3
+ * majors (`server/routes/call.post.ts` carries that hundred lines). That file is
+ * what a NON-Web-standard host costs.
+ */
+import { serveRest, serveRpc, rpcParseError, useFougereApp, serveGraphQL } from './index.js';
+import { sessionViewOf } from './session.js';
+import { stateFor } from './state.js';
+const MAX_BODY_BYTES = 1024 * 1024;
+const WITH_BODY = new Set(['POST', 'PUT', 'PATCH']);
+/**
+ * The call envelope. A named surface is the path segment after the door —
+ * `/_fougere/call/public` serves the `public` audience — and `surfaceOf` reads it,
+ * so a host only has to mount this at a path that keeps the segments.
+ */
+export async function fougereCall(request) {
+    const declared = Number(request.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+        return Response.json({ message: 'Payload too large' }, { status: 413 });
+    }
+    const app = await useFougereApp();
+    let body;
+    try {
+        body = await request.json();
+    }
+    catch {
+        return Response.json(rpcParseError());
+    }
+    return Response.json(await serveRpc(app, {
+        path: new URL(request.url).pathname,
+        body,
+        state: await stateFor(request.headers),
+    }));
+}
+/**
+ * The REST projection, mounted under `/api`.
+ *
+ * `pass` — a path this app does not serve — becomes a 404 here rather than a
+ * fall-through, because a Web handler has nobody to fall through to. Hosts that
+ * resolve a static route before a catch-all (Next does) still let an app keep its
+ * own `/api/*` handlers: they are reached BEFORE this one, not after.
+ */
+export async function fougereRest(request) {
+    const app = await useFougereApp();
+    const url = new URL(request.url);
+    const method = request.method.toUpperCase();
+    const outcome = await serveRest(app, {
+        method,
+        path: url.pathname.replace(/^\/api\//, ''),
+        query: Object.fromEntries(url.searchParams),
+        body: WITH_BODY.has(method) ? await request.json().catch(() => undefined) : undefined,
+        state: await stateFor(request.headers),
+    });
+    if (outcome.kind === 'pass') {
+        return Response.json({ message: `No route for ${method} ${url.pathname}` }, { status: 404 });
+    }
+    if (outcome.kind === 'error') {
+        return Response.json(outcome.body, { status: outcome.status, headers: outcome.headers });
+    }
+    return Response.json(outcome.body, { status: outcome.status });
+}
+/** The session view over the wire, for a client refreshing after login or logout. */
+export async function fougereSession(request) {
+    return Response.json(sessionViewOf(await stateFor(request.headers)));
+}
+/**
+ * GraphQL, at whatever path the host mounted it — `/graphql` by convention.
+ *
+ * Answers `404` when the app declares no GraphQL adapter, because unlike REST this
+ * door is mounted at a path of its own: there is no app route underneath it to pass to.
+ */
+export async function fougereGraphQL(request) {
+    const app = await useFougereApp();
+    const body = (await request.json().catch(() => ({})));
+    const outcome = await serveGraphQL(app, {
+        ...body,
+        surface: new URL(request.url).pathname.split('/').filter(Boolean)[1],
+        state: await stateFor(request.headers),
+    });
+    if (outcome.kind === 'pass') {
+        return Response.json({ message: 'GraphQL is not served by this app' }, { status: 404 });
+    }
+    return Response.json(outcome.body, { status: outcome.status });
+}
+//# sourceMappingURL=web.js.map

package/dist/web.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.js","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,cAAc,EAAE,CAAC;QAC3D,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAClB,MAAM,QAAQ,CAAC,GAAG,EAAE;QAClB,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;QACnC,IAAI;QACJ,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KACvC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB;IAChD,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAE5C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QACnC,MAAM;QACN,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QAC1C,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC;QAC3C,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QACrF,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KACvC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAgB,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAInD,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;QACtC,GAAG,IAAI;QACP,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpE,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KACvC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACjE,CAAC"}