@keboola/api-client 27.0.0 → 31.0.0

package/dist/sdk/configurations/index.js

@@ -1,7 +1,2 @@
-export { createConfigurationSdk } from '../../chunk-DVV35AIS.js';
-import '../../chunk-PSR3N4NC.js';
-import '../../chunk-NHYL5QPM.js';
-import '../../chunk-552FC4ZV.js';
-import '../../chunk-MSI6FVGG.js';
-//# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map
+import { t as createConfigurationSdk } from "../../configurations-Byt59bIa.js";
+export { createConfigurationSdk };

package/dist/sdk/developerPortal/index.cjs

@@ -0,0 +1,203 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_dedupe = require("../../dedupe-CiskLkGR.cjs");
+const require_createStore = require("../../createStore-MQbboXcB.cjs");
+const require_createFetchClient = require("../../createFetchClient-B9Cv0W9f.cjs");
+const require_credential = require("../../credential-D-tX9gP4.cjs");
+const require_developerPortalClient = require("../../developerPortalClient-B7lNR5q0.cjs");
+//#region src/sdks/developerPortal/tokenExpiry.ts
+/**
+* Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable ("expiry unknown", which the
+* caller leaves to the 401 path). A read, not a verification.
+*
+* Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a
+* proactive-refresh clock honest past the first rotation. The token always carries its own expiry.
+*/
+const readTokenExpiry = (token) => {
+	const segments = token.split(".");
+	if (segments.length !== 3) return null;
+	const payload = segments[1];
+	if (payload === void 0 || payload === "") return null;
+	try {
+		const base64 = payload.replaceAll("-", "+").replaceAll("_", "/");
+		const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
+		const claims = JSON.parse(atob(padded));
+		if (typeof claims !== "object" || claims === null || !("exp" in claims)) return null;
+		const { exp } = claims;
+		if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+		return exp * 1e3;
+	} catch {
+		return null;
+	}
+};
+//#endregion
+//#region src/sdks/developerPortal/credential.ts
+const DEFAULT_REFRESH_LEAD_TIME_MS = 3e5;
+/** Mirrors `createBearerCredential`, over the id token of the trio. */
+const createDeveloperPortalCredential = ({ refresh, getTokens, onSessionExpired, refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS }) => {
+	const doRefresh = async () => {
+		try {
+			return await refresh();
+		} catch (error) {
+			if (require_credential.isUnauthorized(error)) onSessionExpired?.();
+			throw error;
+		}
+	};
+	const refreshShared = require_dedupe.dedupe(doRefresh);
+	const getIdToken = async ({ forceRefresh = false } = {}) => {
+		const tokens = getTokens();
+		if (tokens === null) return null;
+		if (forceRefresh) return (await refreshShared()).token;
+		const expiresAt = readTokenExpiry(tokens.token);
+		if (expiresAt === null) return tokens.token;
+		if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;
+		return refreshShared().then((fresh) => fresh.token).catch(() => tokens.token);
+	};
+	return {
+		getIdToken,
+		getTokens,
+		notifyExpired: () => onSessionExpired?.()
+	};
+};
+//#endregion
+//#region src/sdks/developerPortal/middleware.ts
+/**
+* Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors
+* `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.
+*
+* An anonymous session passes through unstamped, so a failed login is never read as session expiry.
+*/
+const createDeveloperPortalAuthMiddleware = (credential) => {
+	return (next) => async (request) => {
+		const token = await credential.getIdToken();
+		if (token === null) return next(request);
+		const retryRequest = request.request.clone();
+		request.request.headers.set(require_createFetchClient.HttpHeader.AUTHORIZATION, token);
+		try {
+			return await next(request);
+		} catch (error) {
+			if (!require_credential.isUnauthorized(error)) throw error;
+			const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);
+			if (refreshed === null) throw error;
+			retryRequest.headers.set(require_createFetchClient.HttpHeader.AUTHORIZATION, refreshed);
+			try {
+				return await next({
+					...request,
+					request: retryRequest
+				});
+			} catch (retryError) {
+				if (require_credential.isUnauthorized(retryError)) credential.notifyExpired();
+				throw retryError;
+			}
+		}
+	};
+};
+//#endregion
+//#region src/sdks/developerPortal/developerPortalSdk.ts
+/**
+* `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the
+* credential, the auth middleware, and the tokens the four self-authenticating endpoints need.
+*
+* It constructs its client rather than receiving one like `createTagSdk` does, because the middleware
+* needs the credential, the credential needs the session, and the session needs a client to rotate
+* with. `createKeboola` closes the same cycle the same way, and stays separate from this one because
+* apps-api is its own identity domain.
+*/
+const createDeveloperPortalSdk = ({ baseUrl, tokens: initialTokens = null, onTokensChange, onSessionExpired, refreshLeadTimeMs, middlewares = [] }) => {
+	const store = require_createStore.createStore(initialTokens);
+	store.subscribe((value) => onTokensChange?.(value));
+	const getTokens = () => store.get();
+	const requireTokens = (action) => {
+		const tokens = store.get();
+		if (tokens === null) throw new Error(`Developer Portal: ${action} requires a signed-in session.`);
+		return tokens;
+	};
+	const refreshClient = require_developerPortalClient.createDeveloperPortalClient({
+		baseUrl,
+		middlewares
+	});
+	const refresh = async () => {
+		const before = store.get();
+		if (before === null) throw new Error("Cannot refresh the Developer Portal session: signed out.");
+		const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);
+		const next = {
+			token,
+			accessToken,
+			refreshToken: before.refreshToken
+		};
+		const after = store.get();
+		if (after === null || after.refreshToken !== before.refreshToken) throw new Error("Developer Portal session changed while refreshing; discarding the result.");
+		store.set(next);
+		return next;
+	};
+	const clear = () => store.set(null);
+	const credential = createDeveloperPortalCredential({
+		refresh,
+		getTokens,
+		refreshLeadTimeMs,
+		onSessionExpired: () => {
+			clear();
+			onSessionExpired?.();
+		}
+	});
+	const client = require_developerPortalClient.createDeveloperPortalClient({
+		baseUrl,
+		middlewares,
+		authMiddleware: createDeveloperPortalAuthMiddleware(credential)
+	});
+	const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;
+	return {
+		api: {
+			...client,
+			auth: {
+				...auth,
+				logout: async (signal) => client.auth.logout(requireTokens("sign-out").accessToken, signal),
+				setupMfa: async (signal) => {
+					await credential.getIdToken();
+					const { token, accessToken } = requireTokens("MFA enrolment");
+					return client.auth.setupMfa({
+						idToken: token,
+						accessToken
+					}, signal);
+				},
+				confirmMfa: async (code, signal) => {
+					await credential.getIdToken();
+					const { token, accessToken } = requireTokens("MFA confirmation");
+					return client.auth.confirmMfa({
+						idToken: token,
+						accessToken,
+						code
+					}, signal);
+				}
+			}
+		},
+		session: {
+			set: (result) => {
+				store.set({
+					token: result.token,
+					accessToken: result.accessToken,
+					refreshToken: result.refreshToken
+				});
+			},
+			get: getTokens,
+			subscribe: store.subscribe,
+			clear,
+			/** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */
+			ensureFresh: async () => {
+				await credential.getIdToken();
+			},
+			/**
+			* Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that
+			* matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.
+			* Propagates failure: a caller forcing this needs to know whether the claims actually changed.
+			*/
+			refresh: async () => {
+				await credential.getIdToken({ forceRefresh: true });
+			},
+			isAuthenticated: () => store.get() !== null
+		}
+	};
+};
+//#endregion
+exports.createDeveloperPortalSdk = createDeveloperPortalSdk;
+
+//# sourceMappingURL=index.cjs.map

package/dist/sdk/developerPortal/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["isUnauthorized","dedupe","HttpHeader","isUnauthorized","createStore","createDeveloperPortalClient"],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credential';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credential';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction — e.g. a trio read back out of `localStorage`. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the\n * credential, the auth middleware, and the tokens the four self-authenticating endpoints need.\n *\n * It constructs its client rather than receiving one like `createTagSdk` does, because the middleware\n * needs the credential, the credential needs the session, and the session needs a client to rotate\n * with. `createKeboola` closes the same cycle the same way, and stays separate from this one because\n * apps-api is its own identity domain.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware: `refreshTokens` sets its own header, so a rotation cannot recurse into the\n  // middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation: without this, a `clear()` that lands while the request\n    // is on the wire is undone by the response, silently signing the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store would leave the session holding\n  // tokens the server has moved past. `session.refresh()` is the supported way.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /**\n     * Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that\n     * matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.\n     * Propagates failure: a caller forcing this needs to know whether the claims actually changed.\n     */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAIA,mBAAAA,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgBC,eAAAA,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAACC,mBAAAA,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAID,0BAAAA,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAIC,mBAAAA,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;;;;;;ACZA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQC,oBAAAA,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAIA,MAAM,gBAAgBC,8BAAAA,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAI5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAASA,8BAAAA,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAID,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CAgDnE,OAAO;EAAE,KAAA;GA7CP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EA6BS;EAAG,SAAA;GAzBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;;;;;GAMA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}