@keboola/api-client 32.0.0 → 34.0.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["assert","createConfig","createProjectClients","z","createConfig","createProjectClients"],"sources":["../src/utils/assert.ts","../src/utils/async/coalesce.ts","../src/utils/async/poll/registry.ts","../src/utils/deepMerge.ts","../src/utils/persistor/adapters.ts","../src/utils/persistor/persistor.ts","../src/keboola/createLiveProject.ts","../src/keboola/errors.ts","../src/middlewares/loggingMiddleware.ts","../src/middlewares/retryMiddleware.ts","../src/serviceClientRegistry/utils.ts","../src/serviceClientRegistry/createServiceClientRegistry.ts","../src/keboola/createApi.ts","../src/keboola/createMiddlewareFor.ts","../src/keboola/bearer/createConfig.ts","../src/domain/defaultBranch.ts","../src/domain/stack.ts","../src/sdks/variables/variablesSdk.ts","../src/keboola/createServiceClients.ts","../src/keboola/bearer/createProjectClients.ts","../src/keboola/bearer/middleware.ts","../src/keboola/bearer/persistor.ts","../src/keboola/bearer/keboola.ts","../src/keboola/legacy/createConfig.ts","../src/keboola/legacy/createProjectClients.ts","../src/keboola/legacy/keboola.ts"],"sourcesContent":["export function assert<T>(value: T | undefined | null, message: string): asserts value is T {\n  if (value == null) {\n    throw new Error(message);\n  }\n}\n","import type { TaskFn } from './types';\n\n/**\n * Coalesces concurrent triggers onto a single, never-parallel run of `task`.\n * Triggers fired while a run is busy collapse into one trailing run, and each\n * resolves with the first run that started after it — so it never sees stale state.\n *\n * Example — A triggers, then B and C trigger while A's run is still going:\n *   1. trigger A      → run #1 starts\n *   2. trigger B, C   → run #1 busy, so they wait\n *   3. run #1 done    → A resolves\n *   4. run #2 starts  → covers B and C together (one trailing run, not two)\n *   5. run #2 done    → B and C resolve\n *\n * @returns a trigger; each call returns a promise of the task result.\n * @throws The returned promise rejects with whatever `task` throws or rejects\n * with — the caller handles it (try/catch, or `.catch` on `void trigger()`).\n */\nexport const coalesce = <T>(task: TaskFn<T>): (() => Promise<Awaited<T>>) => {\n  let running = false;\n  const waiters: PromiseWithResolvers<Awaited<T>>[] = [];\n\n  const drain = async () => {\n    running = true;\n    const batch = waiters.splice(0);\n\n    try {\n      const result = await task();\n      batch.forEach((waiter) => waiter.resolve(result));\n    } catch (error) {\n      batch.forEach((waiter) => waiter.reject(error));\n    }\n    // Drain any triggers that arrived during the task; tail position, so no stack growth.\n    if (waiters.length > 0) return drain();\n    running = false;\n  };\n\n  return () => {\n    const waiter = Promise.withResolvers<Awaited<T>>();\n    waiters.push(waiter);\n    if (!running) void drain();\n    return waiter.promise;\n  };\n};\n","import { createStore } from '../../createStore';\n\nimport {\n  emitter,\n  type ObservedPoller,\n  type PollerStartFn,\n  type PollerStopFn,\n  type PollSnapshot,\n} from './poll';\nimport { clamp, finiteOr } from './utils';\n\nconst DEFAULT_LIMIT = 50;\n\nexport type PollEntry = {\n  /** Monotonic, so a list has a key that outlives a re-render. */\n  key: number;\n  startedAt: number;\n  snapshot: PollSnapshot;\n  stop: PollerStopFn;\n  start: PollerStartFn<unknown>;\n};\n\nexport type PollRegistry = {\n  list: () => PollEntry[];\n  subscribe: (listener: () => void) => () => void;\n  clear: () => void;\n  stopAll: (reason?: string) => void;\n  collect: () => void;\n};\n\nconst isFinished = ({ snapshot }: PollEntry) =>\n  snapshot.state !== 'idle' && snapshot.state !== 'polling';\n\nexport const createPollRegistry = ({ limit = DEFAULT_LIMIT } = {}): PollRegistry => {\n  const entries = createStore<PollEntry[]>([]);\n  const unsubscribes = new Map<number, () => void>();\n\n  const maxEntries = clamp(finiteOr(limit, DEFAULT_LIMIT), 1);\n  let nextKey = 1;\n\n  const forget = (key: number) => {\n    unsubscribes.get(key)?.();\n    unsubscribes.delete(key);\n  };\n\n  const trim = (list: PollEntry[]) => {\n    let kept = list;\n\n    while (kept.length > maxEntries) {\n      const dropped = kept.findLast(isFinished) ?? kept.at(-1);\n\n      if (!dropped) break;\n\n      forget(dropped.key);\n      kept = kept.filter((entry) => entry !== dropped);\n    }\n\n    return kept;\n  };\n\n  const replace = (key: number, snapshot: PollSnapshot) =>\n    entries.set(entries.get().map((entry) => (entry.key === key ? { ...entry, snapshot } : entry)));\n\n  const register = (poller: ObservedPoller) => {\n    const key = nextKey++;\n    const entry: PollEntry = {\n      key,\n      startedAt: Date.now(),\n      snapshot: poller.debug(),\n      stop: poller.stop,\n      start: poller.start,\n    };\n\n    unsubscribes.set(\n      key,\n      poller.subscribe((snapshot) => replace(key, snapshot)),\n    );\n    entries.set(trim([entry, ...entries.get()]));\n  };\n\n  const collect = () => {\n    emitter.subscribe(register);\n  };\n\n  return {\n    list: entries.get,\n    collect,\n    subscribe: (listener) => entries.subscribe(() => listener()),\n    clear: () => {\n      entries.get().forEach(({ key }) => forget(key));\n      entries.set([]);\n    },\n    stopAll: (reason) => entries.get().forEach((entry) => entry.stop(reason)),\n  };\n};\n","import { isPlainObject } from './isPlainObject';\n\n/**\n * Recursively merge `patch` into `base`. Plain-object values are merged key-by-key; every\n * other value (primitives, arrays, or a type mismatch between the two sides) replaces the\n * base value. `undefined` patch values are skipped, so a partial patch leaves untouched\n * fields alone. Pure — neither argument is mutated; the result preserves `base`'s type.\n */\nexport const deepMerge = <T extends Record<string, unknown>>(\n  base: T,\n  patch: Record<string, unknown>,\n): T => {\n  const out: Record<string, unknown> = { ...base };\n\n  for (const [key, value] of Object.entries(patch)) {\n    if (value === undefined) continue;\n    const current = out[key];\n    out[key] = isPlainObject(current) && isPlainObject(value) ? deepMerge(current, value) : value;\n  }\n\n  return out as T;\n};\n","// Minimal, synchronous key/value contract — the Web Storage shape (`localStorage`/`sessionStorage`)\n// narrowed to what a persistor needs. Framework- and environment-agnostic.\nexport type StorageAdapter = {\n  getItem: (key: string) => string | null;\n  setItem: (key: string, value: string) => void;\n  removeItem: (key: string) => void;\n};\n\n// Persist nowhere: reads always miss, writes are dropped. The default when no storage is configured,\n// so a persistor is always constructable and simply becomes a no-op.\nexport const createNullStorage = (): StorageAdapter => ({\n  getItem: () => null,\n  setItem: () => {},\n  removeItem: () => {},\n});\n\n// In-process Map, living for the lifetime of the process. The Node default and the fallback the\n// Web Storage adapters degrade to when `localStorage`/`sessionStorage` is unavailable (SSR).\nexport const createMemoryStorage = (): StorageAdapter => {\n  const store = new Map<string, string>();\n  return {\n    getItem: (key) => store.get(key) ?? null,\n    setItem: (key, value) => {\n      store.set(key, value);\n    },\n    removeItem: (key) => {\n      store.delete(key);\n    },\n  };\n};\n\n// Wrap a Web Storage instance, degrading to memory when it is absent OR unusable. Merely accessing\n// the global (sandboxed iframe) or calling its methods (privacy mode, disabled/blocked storage) can\n// throw, so a canary write probes real usability at construction; any failure falls back to an\n// in-memory store so persistence never crashes the caller. Resolution happens when the factory is\n// called (not at import), so importing this module never touches browser globals.\nconst createWebStorage = (pick: () => Storage | null): StorageAdapter => {\n  let web: Storage | null = null;\n  try {\n    web = pick();\n    if (web) {\n      const probe = '__keboola_storage_probe__';\n      web.setItem(probe, probe);\n      web.removeItem(probe);\n    }\n  } catch (err) {\n    console.warn('createWebStorage: web storage unavailable, falling back to memory', err);\n    web = null;\n  }\n  if (!web) return createMemoryStorage();\n\n  const storage = web;\n  return {\n    getItem: (key) => storage.getItem(key),\n    setItem: (key, value) => {\n      storage.setItem(key, value);\n    },\n    removeItem: (key) => {\n      storage.removeItem(key);\n    },\n  };\n};\n\nexport const createLocalStorage = (): StorageAdapter =>\n  createWebStorage(() => ('localStorage' in globalThis ? globalThis.localStorage : null));\n\nexport const createSessionStorage = (): StorageAdapter =>\n  createWebStorage(() => ('sessionStorage' in globalThis ? globalThis.sessionStorage : null));\n","import { createNullStorage, type StorageAdapter } from './adapters';\n\n// A zod-compatible, structurally-typed validator. Kept structural so this package needs no zod\n// dependency — any schema exposing `safeParse` (e.g. a zod schema) satisfies it.\ntype Schema<T> = {\n  safeParse: (value: unknown) => { success: true; data: T } | { success: false };\n};\n\nexport type Persistor<T> = {\n  /** Read + validate the stored value; returns `defaultValue` when empty or corrupt. */\n  hydrate: () => T;\n  /** Serialize + write the value. */\n  persist: (value: T) => void;\n  /** Remove the stored value. */\n  clear: () => void;\n  /** Whether a value is currently persisted under the key. */\n  hasPersistedValue: () => boolean;\n};\n\ntype PersistorOptions<T> = {\n  storage?: StorageAdapter;\n  key: string;\n  schema: Schema<T>;\n  defaultValue: T;\n  encode?: (value: T) => string;\n  decode?: (raw: string) => unknown;\n};\n\n// A durable cell over a `StorageAdapter`: one key, encoded on write and validated on read. `hydrate`\n// is total — it never returns null and never throws: empty, unreadable, corrupt, or schema-invalid\n// storage all yield the caller-supplied `defaultValue`, so callers need no null-checks. `persist` and\n// `clear` are best-effort — a failing `encode()` (e.g. circular JSON) or a throwing adapter (quota,\n// blocked/privacy-mode storage) is logged and swallowed rather than crashing the caller. The schema\n// validates stored data only; give fields `.default(...)` to patch partial blobs instead of discarding.\nexport const createPersistor = <T>({\n  storage = createNullStorage(),\n  key,\n  schema,\n  defaultValue,\n  encode = JSON.stringify,\n  decode = JSON.parse,\n}: PersistorOptions<T>): Persistor<T> => {\n  // Best-effort key removal — adapters can throw (blocked storage), and dropping a corrupt entry must\n  // never take down `hydrate`.\n  const clear = (): void => {\n    try {\n      storage.removeItem(key);\n    } catch (err) {\n      console.warn(`createPersistor: failed to clear \"${key}\"`, err);\n    }\n  };\n\n  // Callers use this to decide synchronously (during render) whether a restore is worth waiting for,\n  // so a throwing adapter must read as \"nothing stored\" rather than propagate.\n  const hasPersistedValue = (): boolean => {\n    try {\n      return !!storage.getItem(key);\n    } catch (err) {\n      console.warn(`createPersistor: failed to read \"${key}\", assuming empty`, err);\n      return false;\n    }\n  };\n\n  const hydrate = (): T => {\n    let raw: string | null;\n    try {\n      raw = storage.getItem(key);\n    } catch (err) {\n      console.warn(`createPersistor: failed to read \"${key}\", using default`, err);\n      return defaultValue;\n    }\n    if (raw === null) return defaultValue;\n\n    let decoded: unknown;\n    try {\n      decoded = decode(raw);\n    } catch (err) {\n      console.warn(`createPersistor: failed to decode \"${key}\", resetting`, err);\n      clear();\n      return defaultValue;\n    }\n\n    const parsed = schema.safeParse(decoded);\n    if (parsed.success) return parsed.data;\n    clear();\n    return defaultValue;\n  };\n\n  const persist = (value: T): void => {\n    let raw: string;\n    try {\n      raw = encode(value);\n    } catch (err) {\n      console.warn(`createPersistor: failed to encode \"${key}\", not persisting`, err);\n      return;\n    }\n    try {\n      storage.setItem(key, raw);\n    } catch (err) {\n      console.warn(`createPersistor: failed to write \"${key}\"`, err);\n    }\n  };\n\n  return { hydrate, persist, clear, hasPersistedValue };\n};\n","import type { StorageToken } from '../clients/storage/types';\nimport type { createDefaultBranch } from '../domain/defaultBranch';\nimport { createProject, type Project } from '../domain/project';\nimport type { createStack } from '../domain/stack';\nimport type { createStorageTable } from '../domain/storageTable';\nimport type { MiddlewareFn } from '../fetchClient';\nimport { coalesce, createStore } from '../utils';\n\n// Storage API endpoints that mutate fields carried by the verified token, so the\n// live project must re-verify after them. Each pattern is matched against the URL pathname.\nconst STORAGE_TOKEN_MUTATING_PATTERNS = [\n  // Bucket lifecycle (create / delete / register) — changes token.bucketPermissions.\n  // At most one trailing segment, so sub-resources (tables, listing, metadata, refresh)\n  // under /buckets/{id}/... don't trigger a re-verify.\n  /\\/buckets(\\/[^/]+)?$/,\n  // Project feature toggles — changes token.owner.features. Anchored to\n  // /projects/{id}/features so /manage/features and /users/{id}/features don't match.\n  /\\/projects\\/[^/]+\\/features(\\/[^/]+)?$/,\n];\n\nexport const isStorageTokenMutatingRequest = (request: Request): boolean => {\n  if (request.method === 'GET') return false;\n  const { pathname } = new URL(request.url);\n  return STORAGE_TOKEN_MUTATING_PATTERNS.some((pattern) => pattern.test(pathname));\n};\n\nconst createProjectRefreshMiddleware =\n  (\n    shouldRefresh: (request: Request) => boolean,\n    requestRefresh: () => Promise<void>,\n  ): MiddlewareFn =>\n  (next) =>\n  async (request) => {\n    const response = await next(request);\n    // Await the re-verify before resolving the mutating request, so a caller that\n    // reads `api.context.project` right after it can never observe pre-mutation state.\n    if (shouldRefresh(request.request)) await requestRefresh();\n    return response;\n  };\n\n/**\n * The live project store: seeded from the verified token, re-verified (coalesced) after a\n * token-mutating request or an explicit re-scope. Its `middleware` drives the auto re-verify.\n */\nexport const createLiveProject = ({\n  initialToken,\n  verify,\n}: {\n  initialToken: StorageToken;\n  verify: () => Promise<StorageToken>;\n}) => {\n  const store = createStore(createProject({ sapiToken: initialToken }));\n  const refresh = coalesce(async () => store.set(createProject({ sapiToken: await verify() })));\n  const middleware = createProjectRefreshMiddleware(isStorageTokenMutatingRequest, refresh);\n  return { store, getProject: () => store.get(), subscribe: store.subscribe, middleware, refresh };\n};\n\nexport type ClientContext = {\n  /**\n   * The stack this client is configured against, canonical form (absolute, no trailing slash) — the\n   * `baseUrl` every request is built on. Distinct from `stack.host`, which is the index response's\n   * own `host` field: the API pod that served the request (`connection-api-756b66f7c8-ql5sr`), not a\n   * stack hostname. It varies between two calls to the same stack and is never used to route a\n   * request. For the stack's hostname, look the stack id up in `STACKS` (`@keboola/api-client/constants`).\n   */\n  baseUrl: string;\n  stack: ReturnType<typeof createStack>;\n  defaultBranch: ReturnType<typeof createDefaultBranch>;\n  readonly project: Project;\n  readonly st: ReturnType<typeof createStorageTable>;\n};\n","/**\n * The single error the keboola client / session throws. It carries a stable `type` (the switchable\n * contract) and a human-readable message derived from that type — no per-call message strings.\n */\nexport const KeboolaErrorType = {\n  Unconfigured: 'unconfigured',\n  NotAuthenticated: 'not-authenticated',\n  AlreadyAuthenticated: 'already-authenticated',\n  NoStorageToken: 'no-storage-token',\n  NoManagementToken: 'no-management-token',\n  MissingProject: 'missing-project',\n  NotBearer: 'not-bearer',\n  NotReady: 'not-ready',\n  InvalidBuildTransition: 'invalid-build-transition',\n} as const;\n\nexport type KeboolaErrorType = (typeof KeboolaErrorType)[keyof typeof KeboolaErrorType];\n\nconst MESSAGES: Record<KeboolaErrorType, string> = {\n  [KeboolaErrorType.Unconfigured]: 'The session is not configured — set a baseUrl first.',\n  [KeboolaErrorType.NotAuthenticated]: 'The session is not authenticated — sign in first.',\n  [KeboolaErrorType.AlreadyAuthenticated]:\n    'The session is already authenticated — reset before authenticating again.',\n  [KeboolaErrorType.NoStorageToken]: 'No storage token — authenticate the storage realm first.',\n  [KeboolaErrorType.NoManagementToken]:\n    'No management token — authenticate the management realm first.',\n  [KeboolaErrorType.MissingProject]:\n    'A bearer storage session requires a project — call setProject(projectId) first.',\n  [KeboolaErrorType.NotBearer]: 'This operation requires a bearer (OAuth) session.',\n  [KeboolaErrorType.NotReady]: 'The client is not ready — authenticate the storage realm first.',\n  [KeboolaErrorType.InvalidBuildTransition]:\n    'Invalid storage build transition — the build goes idle → initializing → ready | failed.',\n};\n\nexport class KeboolaError extends Error {\n  readonly type: KeboolaErrorType;\n\n  constructor(type: KeboolaErrorType) {\n    super(MESSAGES[type]);\n    this.type = type;\n    this.name = 'KeboolaError';\n    Object.setPrototypeOf(this, KeboolaError.prototype);\n  }\n}\n\nexport const isKeboolaError = (error: unknown): error is KeboolaError =>\n  error instanceof KeboolaError;\n\n/** Throw a {@link KeboolaError} of `type` when `value` is null/undefined; otherwise narrow it. */\nexport function assert<T>(value: T | null | undefined, type: KeboolaErrorType): asserts value is T {\n  if (value == null) throw new KeboolaError(type);\n}\n","import { ApiError } from '../errors';\nimport { type HttpMethod, isApiError, type MiddlewareFn } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\nimport { generateUUID } from '../utils';\n\nconst CORRELATION_ID_HEADER = 'X-Correlation-ID';\n\nconst ALWAYS_REDACTED_HEADERS = [\n  KeboolaHttpHeader.MANAGEMENT_API_TOKEN,\n  KeboolaHttpHeader.STORAGE_API_TOKEN,\n  'authorization',\n  'cookie',\n  'set-cookie',\n];\n\nconst ALWAYS_REDACTED_QUERY_PARAMS = new Set([\n  'token',\n  'apikey',\n  'api_key',\n  'access_token',\n  'refresh_token',\n  'code',\n  'state',\n  'signature',\n  'sig',\n  'x-amz-signature',\n  'x-amz-credential',\n  'x-amz-security-token',\n  'password',\n  'secret',\n]);\n\nconst REDACTED = '[REDACTED]';\n\nconst getRedactedUrl = (rawUrl: string): string => {\n  const url = new URL(rawUrl);\n  if (url.username) url.username = REDACTED;\n  if (url.password) url.password = REDACTED;\n\n  url.searchParams.forEach((_value, key) => {\n    if (ALWAYS_REDACTED_QUERY_PARAMS.has(key.toLowerCase())) {\n      url.searchParams.set(key, REDACTED);\n    }\n  });\n  return url.toString();\n};\n\n// Returns the request's correlation ID, generating and attaching one if missing.\n//\n// Forwarded via the X-Correlation-ID header so downstream services log the same ID,\n// letting all log lines for a single user action be stitched together across service\n// boundaries. Reuse when the caller already set one (preserves the chain inside a\n// larger trace); otherwise mint a fresh UUID to start a new trace.\nconst ensureCorrelationId = (request: Request): string => {\n  const correlationId = request.headers.get(CORRELATION_ID_HEADER) ?? generateUUID();\n  request.headers.set(CORRELATION_ID_HEADER, correlationId);\n  return correlationId;\n};\n\nconst getRedactedHeaders = (headers: Headers, redacted: string[]): Record<string, string> => {\n  const redactedSet = new Set(\n    [...ALWAYS_REDACTED_HEADERS, ...redacted].map((h) => h.toLowerCase()),\n  );\n\n  const result: Record<string, string> = {};\n  headers.forEach((value, name) => {\n    result[name] = redactedSet.has(name.toLowerCase()) ? REDACTED : value;\n  });\n  return result;\n};\n\nexport type RequestLog = {\n  url: string;\n  headers: Record<string, string>;\n};\n\nexport type ResponseLog = {\n  status: number;\n  statusText: string;\n  headers: Record<string, string>;\n};\n\ntype BaseLog = {\n  correlationId: string;\n  method: HttpMethod;\n  durationMs: number;\n  request: RequestLog;\n};\n\ntype SuccessLog = BaseLog & {\n  response: ResponseLog;\n};\n\ntype ErrorLog = BaseLog & {\n  error: Error;\n};\n\nexport type Log = SuccessLog | ErrorLog;\n\nexport type Logger = {\n  info?: (log: SuccessLog) => void;\n  error?: (log: ErrorLog) => void;\n};\n\nexport type LogLevel = 'error-only' | 'all';\n\nexport type LoggingOptions = {\n  logger?: Logger;\n  level?: LogLevel;\n  redactHeaders?: string[];\n};\n\nconst getRequestLog = (request: Request, redactedHeaders: string[]): RequestLog => ({\n  url: getRedactedUrl(request.url),\n  headers: getRedactedHeaders(request.headers, redactedHeaders),\n});\n\nconst getResponseLog = (response: Response, redactedHeaders: string[]): ResponseLog => ({\n  status: response.status,\n  statusText: response.statusText,\n  headers: getRedactedHeaders(response.headers, redactedHeaders),\n});\n\n// On failure the logger receives the thrown error itself, but an ApiError carries the raw\n// fetch Request/Response whose headers were never redacted (only the middleware's own log\n// payload is). Hand the logger a copy with the same redaction applied to its headers and URL;\n// the original error is still thrown untouched so error handlers keep full fidelity.\nconst redactApiError = (error: ApiError, redactedHeaders: string[]): ApiError =>\n  new ApiError({\n    request: new Request(getRedactedUrl(error.request.url), {\n      method: error.request.method,\n      headers: getRedactedHeaders(error.request.headers, redactedHeaders),\n    }),\n    response: new Response(null, {\n      status: error.response.status,\n      statusText: error.response.statusText,\n      headers: getRedactedHeaders(error.response.headers, redactedHeaders),\n    }),\n    data: error.data,\n  });\n\nconst formatLog = (level: 'info' | 'error', log: Log): string => {\n  const parts = [`[${level.toUpperCase()}]`, `${Math.round(log.durationMs)}ms`, log.method];\n  parts.push(log.request.url);\n  if ('response' in log) parts.push(String(log.response.status));\n  return parts.join(' ');\n};\n\nconst createSafeLogger = (logger?: Logger, level: LogLevel = 'error-only'): Required<Logger> => {\n  return {\n    info: (log) => {\n      if (level !== 'all') return;\n      try {\n        if (logger?.info) {\n          logger.info(log);\n          return;\n        }\n\n        console.info(formatLog('info', log));\n      } catch {\n        /* never let logging break the request */\n      }\n    },\n    error: (log) => {\n      try {\n        if (logger?.error) {\n          logger.error(log);\n          return;\n        }\n\n        console.error(formatLog('error', log));\n      } catch {\n        /* never let logging break the request */\n      }\n    },\n  };\n};\n\nexport const createLoggingMiddleware = (options: LoggingOptions = {}): MiddlewareFn => {\n  const safeLogger = createSafeLogger(options.logger, options.level);\n  const redactHeaders = options.redactHeaders ?? [];\n\n  return (next) => async (fetchRequest) => {\n    const correlationId = ensureCorrelationId(fetchRequest.request);\n    const start = performance.now();\n    const method = fetchRequest.request.method.toLowerCase() as HttpMethod;\n    const requestLog = getRequestLog(fetchRequest.request, redactHeaders);\n\n    try {\n      const result = await next(fetchRequest);\n      safeLogger.info({\n        correlationId,\n        method,\n        durationMs: performance.now() - start,\n        request: requestLog,\n        response: getResponseLog(result.response, redactHeaders),\n      });\n      return result;\n    } catch (error) {\n      if (error instanceof Error)\n        safeLogger.error({\n          correlationId,\n          method,\n          durationMs: performance.now() - start,\n          request: requestLog,\n          error: isApiError(error) ? redactApiError(error, redactHeaders) : error,\n        });\n\n      throw error;\n    }\n  };\n};\n","import { ApiError } from '../errors';\nimport type { MiddlewareFn } from '../fetchClient';\nimport { HttpStatus } from '../internal';\nimport { delay } from '../utils';\n\nconst DEFAULT_MAX_RETRIES = 5;\nconst DEFAULT_RETRYABLE_STATUSES: number[] = [\n  HttpStatus.INTERNAL_SERVER_ERROR,\n  HttpStatus.BAD_GATEWAY,\n  HttpStatus.SERVICE_UNAVAILABLE,\n  HttpStatus.GATEWAY_TIMEOUT,\n];\nconst DEFAULT_BACKOFF_FACTOR = 0.3;\n\nexport type RetryOptions = {\n  maxRetries?: number;\n  backoffFactor?: number;\n  shouldRetry?: (error: unknown, attempt: number) => boolean;\n};\n\nconst defaultShouldRetry = (error: unknown): boolean =>\n  error instanceof ApiError && DEFAULT_RETRYABLE_STATUSES.includes(error.response.status);\n\nexport const createRetryMiddleware = (options?: RetryOptions): MiddlewareFn => {\n  const {\n    maxRetries = DEFAULT_MAX_RETRIES,\n    backoffFactor = DEFAULT_BACKOFF_FACTOR,\n    shouldRetry = defaultShouldRetry,\n  } = options ?? {};\n\n  if (!Number.isInteger(maxRetries) || maxRetries < 0) {\n    throw new RangeError('maxRetries must be a non-negative integer');\n  }\n  if (!Number.isFinite(backoffFactor) || backoffFactor < 0) {\n    throw new RangeError('backoffFactor must be a finite non-negative number');\n  }\n\n  return (next) => async (request) => {\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      try {\n        return await next({ ...request, request: request.request.clone() });\n      } catch (error) {\n        if (attempt === maxRetries || !shouldRetry(error, attempt)) {\n          throw error;\n        }\n\n        const delayMs = backoffFactor * 1000 * Math.pow(2, attempt);\n        await delay(delayMs, request.request.signal ?? undefined);\n      }\n    }\n\n    throw new Error('unreachable');\n  };\n};\n","export const isBuiltInProperty = (property: string | symbol) =>\n  typeof property === 'symbol' ||\n  property === 'then' ||\n  property === 'constructor' ||\n  property === 'toString' ||\n  property === 'valueOf';\n\n/**\n * Creates a dummy client that intercepts method calls and invokes the provided onCall callback.\n */\nexport const createDummyClient = <T extends Record<string, unknown>>({\n  onCall,\n}: {\n  onCall: (path: string[], args: unknown[]) => void;\n}): T => {\n  const createProxy = (path: string[] = []) =>\n    new Proxy(() => {}, {\n      // Create a new proxy for nested property access\n      get: (_target, prop) => {\n        // Don't intercept Symbol properties or special methods\n        if (isBuiltInProperty(prop)) return undefined;\n        return createProxy([...path, prop]);\n      },\n      // When called as a function, invoke the interceptor\n      apply: (_target, _thisArgs, args) => onCall(path, args),\n    });\n\n  return createProxy() as unknown as T;\n};\n","import { createDummyClient } from './utils';\n\ntype OnUnavailableFn = (info: {\n  serviceId: string;\n  path: string[];\n  args: unknown[];\n  clientName: string;\n}) => void;\n\ntype ClientConfig<ServiceId extends string, ClientName extends string> = {\n  serviceId: ServiceId;\n  clientName: ClientName;\n  clientFn: (serviceUrl: string) => unknown;\n};\n\ntype ClientMeta<ServiceId extends string> = {\n  clientName: string;\n  serviceId: ServiceId;\n  isAvailable: boolean;\n};\n\ntype Options<ServiceId extends string> = {\n  getServiceBaseUrl: (serviceId: ServiceId) => string | null;\n  onUnavailable?: OnUnavailableFn;\n};\n\ntype BuildResult<\n  ServiceId extends string,\n  ClientName extends string,\n  Configs extends ClientConfig<ServiceId, ClientName>[],\n> = {\n  client: {\n    [Config in Configs[number] as Config['clientName']]: ReturnType<Config['clientFn']>;\n  };\n  meta: ClientMeta<ServiceId>[];\n};\n\ntype Registry<\n  ServiceId extends string,\n  ClientName extends string,\n  Configs extends ClientConfig<ServiceId, ClientName>[],\n> = {\n  add: <const Config extends ClientConfig<ServiceId, ClientName>>(\n    config: Config,\n  ) => Registry<ServiceId, ClientName, [...Configs, Config]>;\n  build: () => BuildResult<ServiceId, ClientName, Configs>;\n};\n\nexport const createServiceClientRegistry =\n  <ServiceId extends string, ClientName extends string = string>() =>\n  ({\n    getServiceBaseUrl,\n    onUnavailable,\n  }: Options<ServiceId>): Registry<ServiceId, ClientName, []> => {\n    const dummy = (serviceId: string, clientName: string) =>\n      createDummyClient({\n        onCall: (path, args) => {\n          onUnavailable?.({\n            serviceId,\n            path,\n            args,\n            clientName,\n          });\n        },\n      });\n\n    const configs: ClientConfig<ServiceId, ClientName>[] = [];\n\n    const resolveClient = ({\n      serviceId,\n      clientFn,\n      clientName,\n    }: ClientConfig<ServiceId, ClientName>) => {\n      const serviceBaseUrl = getServiceBaseUrl(serviceId);\n      return serviceBaseUrl ? clientFn(serviceBaseUrl) : dummy(serviceId, clientName);\n    };\n\n    type AnyConfig = ClientConfig<ServiceId, ClientName>;\n    const registry: Registry<ServiceId, ClientName, AnyConfig[]> = {\n      add: (config) => {\n        configs.push(config);\n        return registry;\n      },\n      build: () => {\n        const clientMap: Record<string, unknown> = {};\n        const clientMeta: ClientMeta<ServiceId>[] = [];\n\n        configs.forEach((config) => {\n          clientMap[config.clientName] = resolveClient(config);\n          clientMeta.push({\n            clientName: config.clientName,\n            serviceId: config.serviceId,\n            isAvailable: !!getServiceBaseUrl(config.serviceId),\n          });\n        });\n\n        // The dynamically-built map can't be statically proven against the\n        // per-config mapped type; the public key safety comes from the fluent\n        // `add` chain asserted at the bottom of this factory.\n        return {\n          client: clientMap,\n          meta: clientMeta,\n        } as BuildResult<ServiceId, ClientName, AnyConfig[]>;\n      },\n    };\n\n    return registry as Registry<ServiceId, ClientName, []>;\n  };\n","import type { createAuthClient } from '../clients/auth/authClient';\nimport type { createManagementClient } from '../clients/management';\nimport { isBuiltInProperty } from '../serviceClientRegistry';\n\nimport type { createProjectClients } from './bearer/createProjectClients';\nimport { assert, KeboolaErrorType } from './errors';\n\ntype AuthClient = ReturnType<typeof createAuthClient>;\ntype ManagementClient = ReturnType<typeof createManagementClient>;\ntype ProjectClients = Awaited<ReturnType<typeof createProjectClients>>;\n\nexport type KeboolaApi = ProjectClients & {\n  auth: ReturnType<typeof createAuthClient>;\n  management: ReturnType<typeof createManagementClient>;\n};\n\ntype ApiState = {\n  getAuthClient: () => AuthClient | null;\n  getManagementClient: () => ManagementClient | null;\n  getProjectClients: () => ProjectClients | null;\n};\n\nexport const createApi = (state: ApiState) =>\n  new Proxy({} as KeboolaApi, {\n    get(_target, property) {\n      if (isBuiltInProperty(property)) return undefined;\n\n      if (property === 'auth') {\n        const authClient = state.getAuthClient();\n        assert(authClient, KeboolaErrorType.Unconfigured);\n        return authClient;\n      }\n\n      if (property === 'management') {\n        const management = state.getManagementClient();\n        assert(management, KeboolaErrorType.NoManagementToken);\n        return management;\n      }\n\n      const clients = state.getProjectClients();\n      assert(clients, KeboolaErrorType.NotReady);\n\n      return clients[property as keyof ProjectClients];\n    },\n  });\n","import type { MiddlewareFn } from '../fetchClient';\n\n/**\n * Service clients reached through the registry — the key is the `clientName`\n * the user accesses them by (e.g. `api.dataScience`), not the `serviceId`.\n */\nexport type ServiceClientName =\n  | 'vault'\n  | 'dataScience'\n  | 'apps'\n  | 'encryption'\n  | 'editor'\n  | 'syncActions'\n  | 'telemetry'\n  | 'queryService'\n  | 'queue'\n  | 'chat'\n  | 'ai'\n  | 'import'\n  | 'kaiAgent'\n  | 'oauth'\n  | 'omnisearch'\n  | 'stream'\n  | 'notifications'\n  | 'scheduler'\n  | 'metastore';\n\n/** Clients instantiated directly (not stack-discovered), keyed by their property name. */\ntype NonServiceClientName = 'storage' | 'management' | 'auth';\n\nexport type MiddlewareTarget = ServiceClientName | NonServiceClientName;\n\nexport type Middlewares =\n  | MiddlewareFn[]\n  | ({ all?: MiddlewareFn[] } & Partial<Record<MiddlewareTarget, MiddlewareFn[]>>);\n\nexport const createMiddlewareFor = (middlewares: Middlewares | undefined) => {\n  return (target: MiddlewareTarget, baseline: MiddlewareFn[] = []): MiddlewareFn[] => {\n    if (Array.isArray(middlewares)) return [...baseline, ...middlewares];\n\n    const all = middlewares?.all ?? [];\n    const targeted = middlewares?.[target] ?? [];\n    return [...baseline, ...all, ...targeted];\n  };\n};\n\nexport type MiddlewareFor = ReturnType<typeof createMiddlewareFor>;\n","import { createStore, type ReadableStore } from '../../utils';\nimport { KeboolaError, KeboolaErrorType } from '../errors';\n\n// Config owns its credential model — the subset of a login/refresh response it actually needs, so it\n// doesn't couple to the auth schema.\nexport type TokenSet = {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number; // seconds\n};\n// The active tokens plus when this access token was issued/refreshed (ms epoch). `issuedAt` +\n// `expiresIn` is the single source of truth for expiry: the refresh policy derives its\n// proactive-refresh time from it, and the dev tools count down against it.\nexport type Credential = TokenSet & { issuedAt: number };\n\n// Session phases, each a superset of the previous: anonymous ⊂ authenticated ⊂ scoped.\n// \"Has a credential\" is `status !== 'anonymous'` (authenticated and scoped both); \"has a project\" is\n// `status === 'scoped'`. Prefer the accessors below (`requireCredential`, `getBaseUrl`) over raw\n// status checks so that grouping lives in one place.\nexport type State =\n  | { status: 'anonymous'; baseUrl: string | null }\n  | { status: 'authenticated'; baseUrl: string; credential: Credential }\n  | { status: 'scoped'; baseUrl: string; credential: Credential; projectId: number };\n\nconst INITIAL: State = { status: 'anonymous', baseUrl: null };\n\nconst stamp = (tokens: TokenSet): Credential => ({ ...tokens, issuedAt: Date.now() });\n\nexport const createConfig = (initial: State = INITIAL) => {\n  const store = createStore<State>(initial);\n  let expiredNotified = false;\n\n  const setBaseUrl = (baseUrl: string) => {\n    // baseUrl is fixed once authenticated — a credential is bound to the stack that issued it.\n    if (store.get().status !== 'anonymous')\n      throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);\n    store.set({ status: 'anonymous', baseUrl });\n  };\n\n  const authenticate = (tokens: TokenSet) => {\n    const state = store.get();\n    if (state.status !== 'anonymous') throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);\n    // A credential is only meaningful against a stack: enforce baseUrl so we never hold a session we\n    // couldn't refresh (no auth client without it).\n    if (!state.baseUrl) throw new KeboolaError(KeboolaErrorType.Unconfigured);\n    expiredNotified = false; // re-arm the expiry latch for the new session\n    store.set({ status: 'authenticated', baseUrl: state.baseUrl, credential: stamp(tokens) });\n  };\n\n  const setProjectId = (projectId: number) => {\n    const state = store.get();\n    if (state.status === 'anonymous') throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n    store.set({\n      status: 'scoped',\n      baseUrl: state.baseUrl,\n      credential: state.credential,\n      projectId,\n    });\n  };\n\n  /**\n   * Drop the project scope, keeping the credential — the inverse of `setProjectId`, for leaving a\n   * project without signing out. The project clients are keyed on the scope, so they tear down and\n   * the storage build returns to `idle`; the session stays usable for `auth` and `management`.\n   * No-op unless currently scoped.\n   */\n  const clearProjectId = () => {\n    const state = store.get();\n    if (state.status !== 'scoped') return;\n    store.set({ status: 'authenticated', baseUrl: state.baseUrl, credential: state.credential });\n  };\n\n  /** Drop the credential (sign out); keeps the configured baseUrl. */\n  const reset = () => {\n    store.set({ status: 'anonymous', baseUrl: store.get().baseUrl });\n  };\n\n  /** Apply a token refresh: replace the credential (fresh tokens, new issue time); no-op before auth. */\n  const applyRefresh = (tokens: TokenSet) => {\n    const state = store.get();\n    if (state.status === 'anonymous') return;\n    store.set({ ...state, credential: stamp(tokens) });\n  };\n\n  /**\n   * Dev/test lever: backdate the current token's issue time by a full lifetime so it reads as\n   * expired, making the refresh policy rotate it on the next request. No-op before auth.\n   */\n  const forceExpire = () => {\n    const state = store.get();\n    if (state.status === 'anonymous') return;\n    const issuedAt = Date.now() - state.credential.expiresIn * 1000;\n    store.set({ ...state, credential: { ...state.credential, issuedAt } });\n  };\n\n  /**\n   * The current credential, asserting the session is authenticated (or scoped). Single point for that\n   * check so callers (token attach, refresh) don't each re-narrow the state.\n   */\n  const requireCredential = (): Credential => {\n    const state = store.get();\n    if (state.status === 'anonymous') throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n    return state.credential;\n  };\n\n  const getBaseUrl = (): string | null => store.get().baseUrl;\n\n  /**\n   * Session-expiry latch (fire-once):\n   * - why: concurrent 401s all report expiry, but the app must sign out once; and the credential /\n   *   auth middleware are long-lived singletons, so the latch can't live in them — it must reset\n   *   per session.\n   * - how: returns `true` only for the first call since the last `authenticate` (which re-arms it),\n   *   so the caller runs its sign-out exactly once per session death.\n   */\n  const notifyExpired = (): boolean => {\n    if (expiredNotified) return false;\n    expiredNotified = true;\n    return true;\n  };\n\n  const debug = (): State => store.get();\n\n  // Read-only view: every write goes through the methods above so the state-machine invariants hold.\n  const readable: ReadableStore<State> = {\n    get: store.get,\n    subscribe: store.subscribe,\n    dispose: store.dispose,\n  };\n\n  return {\n    store: readable,\n    setBaseUrl,\n    authenticate,\n    setProjectId,\n    clearProjectId,\n    reset,\n    applyRefresh,\n    forceExpire,\n    requireCredential,\n    getBaseUrl,\n    notifyExpired,\n    debug,\n  };\n};\n","import type { DevBranch } from '../clients/storage/branches/types';\nimport { assert } from '../utils';\n\ntype BranchType = 'default' | 'dev';\n\ntype Options = {\n  devBranches: DevBranch[];\n};\n\nexport const createDefaultBranch = ({ devBranches }: Options) => {\n  const defaultBranch = devBranches.find((branch) => branch.isDefault);\n  assert(defaultBranch, 'No default branch found for the project.');\n\n  const getType = (branchId?: string | number): BranchType => {\n    if (branchId == null || branchId === 'default') return 'default';\n    return Number(branchId) === defaultBranch.id ? 'default' : 'dev';\n  };\n\n  return {\n    id: defaultBranch.id,\n    name: defaultBranch.name,\n    getType,\n    isDev: (branchId?: string | number) => getType(branchId) === 'dev',\n    isDefault: (branchId?: string | number) => getType(branchId) === 'default',\n  };\n};\n","import type { ServiceId, StackInfo } from '../clients/storage/types';\n\nexport type ServiceUrls = Partial<Record<ServiceId, (url: string) => string | undefined | null>>;\n\nconst SERVICE_URL_OVERRIDES: ServiceUrls = {\n  // The service URL for the Kai Assistant is incomplete; we need to add the `/api` suffix to get the full URL for the API.\n  // I assume the service is versioned.\n  'kai-assistant': (url) => `${url}/api`,\n};\n\ntype Options = {\n  stackInfo: StackInfo;\n  clientServiceUrls?: ServiceUrls;\n};\n\nexport const createStack = ({ stackInfo, clientServiceUrls }: Options) => {\n  const { services, components, features, ...infoRest } = stackInfo;\n\n  const serviceMap = new Map(\n    services.map((service) => {\n      const devOverride = clientServiceUrls?.[service.id]?.(service.url);\n      const prodOverride = SERVICE_URL_OVERRIDES[service.id]?.(service.url);\n      const url = devOverride ?? prodOverride ?? service.url;\n      return [service.id, url];\n    }),\n  );\n\n  const componentMap = new Map(components.map((component) => [component.id, component]));\n  const featureSet = new Set(features);\n\n  const hasFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => featureSet.has(x));\n  };\n\n  const hasComponent = (...componentId: string[]) => {\n    if (componentId.length === 0) return false;\n    return componentId.every((x) => componentMap.has(x));\n  };\n\n  const getComponent = (componentId: string) => componentMap.get(componentId) ?? null;\n\n  const hasService = (serviceId: ServiceId) => serviceMap.has(serviceId);\n\n  const getServiceUrl = (serviceId: ServiceId) => serviceMap.get(serviceId) ?? null;\n\n  return {\n    ...infoRest,\n    services,\n    features,\n    components,\n    hasFeature,\n    getServiceUrl,\n    hasService,\n    getComponent,\n    hasComponent,\n  };\n};\n","import type * as storage from '../../clients/storage';\n\nconst VARIABLES_COMPONENT_ID = 'keboola.variables';\n\n// The storage client takes the branch as the string the spec declares.\ntype BranchId = string;\n\ntype VariableDefinition = { name: string; type?: string };\ntype VariableValue = { name: string; value?: unknown };\n\n/** Reference to a `keboola.variables` config + the values row a config points at. */\ntype VariablesRef = { variablesId: string; variablesValuesId: string };\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n};\n\n/** Union the definitions by name; on a name conflict the target's definition is kept. */\nexport const mergeVariableDefinitions = (\n  target: VariableDefinition[],\n  source: VariableDefinition[],\n): VariableDefinition[] => {\n  const targetNames = new Set(target.map((definition) => definition.name));\n\n  return [...target, ...source.filter((definition) => !targetNames.has(definition.name))];\n};\n\n/** Add values missing in the target; on a name conflict the value is updated to the source's. */\nexport const mergeVariableValues = (\n  target: VariableValue[],\n  source: VariableValue[],\n): VariableValue[] => {\n  const sourceByName = new Map(source.map((value) => [value.name, value.value]));\n  const targetNames = new Set(target.map((value) => value.name));\n\n  return [\n    ...target.map((value) =>\n      sourceByName.has(value.name) ? { ...value, value: sourceByName.get(value.name) } : value,\n    ),\n    ...source.filter((value) => !targetNames.has(value.name)),\n  ];\n};\n\n/**\n * Orchestration for `keboola.variables` configs: copy a config, or merge two configs into a fresh\n * one (union definitions, upsert values — source wins on a name conflict). Each result is a brand\n * new config + values row, so the caller can reference it without sharing lineage with the source.\n */\nexport const createVariablesSdk = ({ storageClient }: Options) => {\n  const configs = storageClient.configurations;\n  const rows = storageClient.configurationRows;\n\n  const readVariables = async (\n    configId: string,\n    valuesRowId: string | undefined,\n    branchId: BranchId,\n  ) => {\n    const config = await configs.getConfiguration({\n      componentId: VARIABLES_COMPONENT_ID,\n      configId,\n      branchId,\n    });\n    // variables configs carry a single values row — read the referenced one, or the only one\n    const row = config.rows.find((candidate) => candidate.id === valuesRowId) ?? config.rows[0];\n\n    const rawDefinitions = config.configuration?.variables;\n    const rawValues = row?.configuration?.values;\n\n    // guard the array shape — a non-array from Storage would throw in the merge helpers' .map()\n    return {\n      definitions: (Array.isArray(rawDefinitions) ? rawDefinitions : []) as VariableDefinition[],\n      values: (Array.isArray(rawValues) ? rawValues : []) as VariableValue[],\n    };\n  };\n\n  const createVariables = async (\n    definitions: VariableDefinition[],\n    values: VariableValue[],\n    branchId: BranchId,\n  ): Promise<VariablesRef> => {\n    const config = await configs.createConfiguration({\n      branchId,\n      componentId: VARIABLES_COMPONENT_ID,\n      name: 'Variables definition',\n      configuration: { variables: definitions },\n    });\n\n    try {\n      const row = await rows.createConfigurationRow({\n        branchId: String(branchId),\n        componentId: VARIABLES_COMPONENT_ID,\n        configurationId: config.id,\n        name: 'Default values',\n        configuration: { values },\n      });\n\n      return { variablesId: config.id, variablesValuesId: row.id };\n    } catch (error) {\n      // the values row failed — best-effort drop the orphaned config, but always surface the original error\n      await configs\n        .deleteConfiguration({\n          branchId,\n          componentId: VARIABLES_COMPONENT_ID,\n          configId: config.id,\n        })\n        .catch((cleanupError: unknown) => {\n          // keep the cleanup failure on the original error rather than letting it mask the real cause\n          if (error instanceof Error && error.cause === undefined) {\n            error.cause = cleanupError;\n          }\n        });\n      throw error;\n    }\n  };\n\n  return {\n    /** Copy a variables config into a fresh, independent config + values row. */\n    copy: async ({\n      variablesId,\n      variablesValuesId,\n      branchId = 'default',\n    }: {\n      variablesId: string;\n      variablesValuesId?: string;\n      branchId?: BranchId;\n    }): Promise<VariablesRef> => {\n      const { definitions, values } = await readVariables(variablesId, variablesValuesId, branchId);\n\n      return createVariables(definitions, values, branchId);\n    },\n\n    /** Merge the source's variables into the target's and create a fresh merged config + values row. */\n    merge: async ({\n      targetVariablesId,\n      targetValuesId,\n      sourceVariablesId,\n      sourceValuesId,\n      branchId = 'default',\n    }: {\n      targetVariablesId: string;\n      targetValuesId?: string;\n      sourceVariablesId: string;\n      sourceValuesId?: string;\n      branchId?: BranchId;\n    }): Promise<VariablesRef> => {\n      const [target, source] = await Promise.all([\n        readVariables(targetVariablesId, targetValuesId, branchId),\n        readVariables(sourceVariablesId, sourceValuesId, branchId),\n      ]);\n\n      return createVariables(\n        mergeVariableDefinitions(target.definitions, source.definitions),\n        mergeVariableValues(target.values, source.values),\n        branchId,\n      );\n    },\n  };\n};\n","import { createAiClient } from '../clients/ai';\nimport { createAppsClient } from '../clients/apps';\nimport type { AuthStrategy } from '../clients/auth';\nimport { createChatClient } from '../clients/chat';\nimport { createDataScienceClient } from '../clients/dataScience';\nimport { createEditorClient } from '../clients/editor';\nimport { createEncryptionClient } from '../clients/encryption';\nimport { createImportClient } from '../clients/import';\nimport { createKaiAgentClient } from '../clients/kaiAgent';\nimport { createMetastoreClient } from '../clients/metastore';\nimport { createNotificationsClient } from '../clients/notifications';\nimport { createOauthClient } from '../clients/oauth';\nimport { createOmnisearchClient } from '../clients/omnisearch';\nimport { createQueryServiceClient } from '../clients/queryService';\nimport { createQueueClient } from '../clients/queue';\nimport { createSchedulerClient } from '../clients/scheduler';\nimport type { ServiceId } from '../clients/storage/types';\nimport { createStreamClient } from '../clients/stream';\nimport { createSyncActionsClient } from '../clients/syncActions';\nimport { createTelemetryClient } from '../clients/telemetry';\nimport { createVaultClient } from '../clients/vault';\nimport { ServiceUnavailableError } from '../errors';\nimport type { MiddlewareFn } from '../fetchClient';\nimport { createServiceClientRegistry } from '../serviceClientRegistry';\n\nimport { type MiddlewareFor, type ServiceClientName } from './createMiddlewareFor';\n\ntype Options = {\n  baseUrl: string;\n  auth: AuthStrategy;\n  getServiceBaseUrl: (serviceId: ServiceId) => string | null;\n  middlewareFor: MiddlewareFor;\n  attachTokenMiddleware: MiddlewareFn;\n};\n\nexport const createServiceClients = ({\n  baseUrl,\n  auth,\n  getServiceBaseUrl,\n  middlewareFor,\n  attachTokenMiddleware,\n}: Options) =>\n  createServiceClientRegistry<ServiceId, ServiceClientName>()({\n    getServiceBaseUrl,\n    onUnavailable: ({ serviceId, path, clientName }) => {\n      throw new ServiceUnavailableError(serviceId, path, clientName);\n    },\n  })\n    .add({\n      serviceId: 'vault',\n      clientName: 'vault',\n      clientFn: (serviceBaseUrl) =>\n        createVaultClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('vault', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'data-science',\n      clientName: 'dataScience',\n      clientFn: (serviceBaseUrl) =>\n        createDataScienceClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('dataScience', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      // Deliberately the `data-science` service: the `/v2` App Deployments surface is the same\n      // sandboxes-service deployment one path prefix over, so it resolves off that URL with `/v2`\n      // appended. The `apps.<stack>` vanity host serves the same routes at its root but is absent\n      // from the stack's service index, so it cannot be resolved.\n      // Second client composing a prefix onto a service URL after `omnisearch` below; at a third,\n      // give `.add()` a `pathPrefix` the registry joins so the join can't be got wrong per call site.\n      serviceId: 'data-science',\n      clientName: 'apps',\n      clientFn: (serviceBaseUrl) =>\n        createAppsClient({\n          baseUrl: `${serviceBaseUrl}/v2`,\n          middlewares: middlewareFor('apps', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'encryption',\n      clientName: 'encryption',\n      clientFn: (serviceBaseUrl) =>\n        createEncryptionClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('encryption'),\n        }),\n    })\n    .add({\n      serviceId: 'editor',\n      clientName: 'editor',\n      clientFn: (serviceBaseUrl) =>\n        createEditorClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('editor', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'sync-actions',\n      clientName: 'syncActions',\n      clientFn: (serviceBaseUrl) =>\n        createSyncActionsClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('syncActions', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'telemetry',\n      clientName: 'telemetry',\n      clientFn: (serviceBaseUrl) =>\n        createTelemetryClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('telemetry', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'query',\n      clientName: 'queryService',\n      clientFn: (serviceBaseUrl) =>\n        createQueryServiceClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('queryService', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'queue',\n      clientName: 'queue',\n      clientFn: (serviceBaseUrl) =>\n        createQueueClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('queue', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'kai-assistant',\n      clientName: 'chat',\n      clientFn: (serviceBaseUrl) =>\n        createChatClient({\n          storageApiUrl: baseUrl,\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('chat', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'ai',\n      clientName: 'ai',\n      clientFn: (serviceBaseUrl) =>\n        createAiClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('ai', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      // Deliberately the `ai` service: omnisearch is a separate deployment that the ai-service\n      // ingress exposes under `/omnisearch`, so it resolves off that URL with the prefix appended —\n      // the same shape as the `kai-assistant` `/api` override in `domain/stack.ts`.\n      serviceId: 'ai',\n      clientName: 'omnisearch',\n      clientFn: (serviceBaseUrl) =>\n        createOmnisearchClient({\n          baseUrl: `${serviceBaseUrl}/omnisearch`,\n          middlewares: middlewareFor('omnisearch', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'import',\n      clientName: 'import',\n      clientFn: (serviceBaseUrl) =>\n        createImportClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('import', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'kai-agent',\n      clientName: 'kaiAgent',\n      clientFn: (serviceBaseUrl) =>\n        createKaiAgentClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('kaiAgent', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'oauth',\n      clientName: 'oauth',\n      clientFn: (serviceBaseUrl) =>\n        createOauthClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('oauth', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'scheduler',\n      clientName: 'scheduler',\n      clientFn: (serviceBaseUrl) =>\n        createSchedulerClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('scheduler', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'stream',\n      clientName: 'stream',\n      clientFn: (serviceBaseUrl) =>\n        createStreamClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('stream', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'notification',\n      clientName: 'notifications',\n      clientFn: (serviceBaseUrl) =>\n        createNotificationsClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('notifications', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'metastore',\n      clientName: 'metastore',\n      clientFn: (serviceBaseUrl) =>\n        createMetastoreClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('metastore', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .build();\n","import type { AuthStrategy } from '../../clients/auth';\nimport { createStorageClient } from '../../clients/storage';\nimport { ProjectFeature } from '../../constants/projectFeatures';\nimport { createDefaultBranch } from '../../domain/defaultBranch';\nimport { createStack, type ServiceUrls } from '../../domain/stack';\nimport { createStorageTable } from '../../domain/storageTable';\nimport { type MiddlewareFn, normalizeBaseUrl } from '../../fetchClient';\nimport { KeboolaHttpHeader } from '../../internal';\nimport { createConfigurationSdk } from '../../sdks/configurations';\nimport { createSemanticLayerSdk } from '../../sdks/semanticLayer';\nimport { createStorageSdk } from '../../sdks/storage';\nimport { createTagSdk } from '../../sdks/tag';\nimport { createVariablesSdk } from '../../sdks/variables';\nimport { createVaultSdk } from '../../sdks/vault';\nimport { createDerivedStore } from '../../utils';\nimport { type ClientContext, createLiveProject } from '../createLiveProject';\nimport { type MiddlewareFor } from '../createMiddlewareFor';\nimport { createServiceClients } from '../createServiceClients';\n\n/**\n * Bearer (OAuth) project surface. Same handshake + assembly as the legacy build. The\n * `Authorization: Bearer` header + transparent refresh come from the engine-shared `authMiddleware`\n * (one instance for management + every project client). This build only adds the project-scoped\n * `X-KBC-ProjectId` header, composed *outside* the auth middleware so the header is present\n * before it clones the request for the 401 replay. Bearer has no static token header, so this\n * combined `attach` rides on every client — including the operational storage and the bootstrap reader.\n */\nexport const createProjectClients = async ({\n  baseUrl,\n  projectId,\n  authMiddleware,\n  middlewareFor,\n  clientServiceUrls,\n}: {\n  baseUrl: string;\n  authMiddleware: MiddlewareFn;\n  projectId: number;\n  middlewareFor: MiddlewareFor;\n  clientServiceUrls?: ServiceUrls;\n}) => {\n  // Bearer contributes no static auth header — the auth middleware stamps the live token on every\n  // request. `token: ''` only satisfies the strategy type; it never reaches the wire here.\n  const auth: AuthStrategy = { type: 'bearer', token: '', projectId };\n\n  const projectIdMiddleware: MiddlewareFn = (next) => (request) => {\n    request.request.headers.set(KeboolaHttpHeader.PROJECT_ID, String(projectId));\n    return next(request);\n  };\n  // projectId outer so its header is set before the auth middleware clones for the 401 replay.\n  const attach: MiddlewareFn = (next) => projectIdMiddleware(authMiddleware(next));\n\n  const reader = createStorageClient({ baseUrl, auth, middlewares: [attach] });\n  const [stackInfo, sapiToken, devBranches] = await Promise.all([\n    reader.getStackInfo({ exclude: 'componentDetails' }),\n    reader.tokens.verify(),\n    reader.branches.getDevBranches(),\n  ]);\n\n  const stack = createStack({ stackInfo, clientServiceUrls });\n  const defaultBranch = createDefaultBranch({ devBranches });\n  const liveProject = createLiveProject({\n    initialToken: sapiToken,\n    verify: () => reader.tokens.verify(),\n  });\n  const storageTableStore = createDerivedStore({\n    source: liveProject.store,\n    build: createStorageTable,\n    dependsOn: (project) => ({\n      useLegacyBucketPrefix: !project.hasFeature(ProjectFeature.DisableLegacyBucketPrefix),\n      hasProtectedDefaultBranch: project.hasFeature(ProjectFeature.SoxProtectedDefaultBranch),\n      hasStorageBranches: project.hasFeature(ProjectFeature.StorageBranches),\n    }),\n  });\n\n  const context: ClientContext = {\n    baseUrl: normalizeBaseUrl(baseUrl),\n    stack,\n    defaultBranch,\n    get project() {\n      return liveProject.getProject();\n    },\n    get st() {\n      return storageTableStore.get();\n    },\n  };\n\n  // Bearer has no static auth header, so the operational storage client carries `attach` too.\n  const storage = createStorageClient({\n    baseUrl,\n    auth,\n    middlewares: middlewareFor('storage', [attach, liveProject.middleware]),\n  });\n\n  const { client: services, meta: serviceMeta } = createServiceClients({\n    baseUrl,\n    auth,\n    getServiceBaseUrl: context.stack.getServiceUrl,\n    middlewareFor,\n    attachTokenMiddleware: attach,\n  });\n\n  const sdk = {\n    configuration: createConfigurationSdk({\n      storageClient: storage,\n      encryptionClient: services.encryption,\n      context,\n    }),\n    tag: createTagSdk({ metastoreClient: services.metastore }),\n    semanticLayer: createSemanticLayerSdk({ metastoreClient: services.metastore }),\n    storage: createStorageSdk({ storageClient: storage }),\n    vault: createVaultSdk({ vaultClient: services.vault, encryptionClient: services.encryption }),\n    variables: createVariablesSdk({ storageClient: storage }),\n  };\n\n  return { context, serviceMeta, storage, ...services, sdk };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\n\nimport { type BearerCredential, isUnauthorized } from './credential';\n\n/**\n * Bearer auth for every outgoing request:\n * - Stamps the current access token (from the credential) as the `Authorization` header.\n * - On a 401, force-refreshes the token and replays the request once.\n * - If the replay still 401s, the fresh token is rejected → marks the session expired.\n *\n * When the session is anonymous (`getAccessToken` → `null`) the request is passed through untouched\n * with no 401 dance — so pre-auth calls on the auth client (`login`, `refresh`) work and a failed\n * login is never mistaken for session expiry.\n *\n * Holds no token and never touches config — all token and refresh state lives in the credential.\n */\nexport const createBearerAuthMiddleware = (credential: BearerCredential): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getAccessToken({ forceRefresh: false });\n    // Anonymous request (e.g. login / refresh) — nothing to authenticate; pass through untouched.\n    if (token === null) return next(request);\n\n    // Cloned up front for the 401 replay: the body stream may be consumed by the first attempt.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${token}`);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getAccessToken({ forceRefresh: true });\n      // Went anonymous mid-flight (concurrent sign-out) — don't replay, surface the original 401.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${refreshed}`);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        // Refreshed and replayed, still 401 — the fresh token is rejected, so the session is dead.\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import * as z from 'zod';\n\nimport { createPersistor } from '../../utils/persistor';\nimport type { StorageAdapter } from '../types';\n\nconst SESSION_KEY = 'keboola:bearer-session';\n\nconst persistedSessionSchema = z.object({\n  baseUrl: z.string().nullable(),\n  projectId: z.number().nullable(),\n  refreshToken: z.string().nullable(),\n});\n\nexport type PersistedSession = z.infer<typeof persistedSessionSchema>;\n\nconst EMPTY_PERSISTED_SESSION: PersistedSession = {\n  baseUrl: null,\n  projectId: null,\n  refreshToken: null,\n};\n\nexport const createSessionPersistor = (storage?: StorageAdapter) =>\n  createPersistor<PersistedSession>({\n    storage,\n    key: SESSION_KEY,\n    schema: persistedSessionSchema,\n    defaultValue: EMPTY_PERSISTED_SESSION,\n  });\n","import { createAuthClient } from '../../clients/auth/authClient';\nimport { createManagementClient } from '../../clients/management';\nimport { ApiError } from '../../errors';\nimport { HttpHeader } from '../../fetchClient';\nimport { HttpStatus, KeboolaHttpHeader } from '../../internal';\nimport { createRetryMiddleware } from '../../middlewares';\nimport { createDerivedAsyncStore, createDerivedStore } from '../../utils';\nimport { createApi } from '../createApi';\nimport { createMiddlewareFor } from '../createMiddlewareFor';\nimport { assert, KeboolaError, KeboolaErrorType } from '../errors';\nimport type { KeboolaOptions } from '../types';\n\nimport { createConfig, type TokenSet } from './createConfig';\nimport { createProjectClients } from './createProjectClients';\nimport { createBearerCredential, isUnauthorized } from './credential';\nimport { createBearerAuthMiddleware } from './middleware';\nimport { createSessionPersistor } from './persistor';\nimport type { RestoreResult, SessionSnapshot } from './types';\n\nexport const createKeboola = (options: KeboolaOptions = {}) => {\n  const persistor = createSessionPersistor(options.storage);\n  const config = createConfig();\n  const middlewareFor = createMiddlewareFor(options.middlewares);\n\n  // Retry a 503 (refresh contention) on any auth call — outermost, so it wraps the whole chain. This\n  // covers both the credential's `refresh` closure below and `restore()`, which share this client.\n  const retryContention = createRetryMiddleware({\n    shouldRetry: (error) =>\n      error instanceof ApiError && error.response.status === HttpStatus.SERVICE_UNAVAILABLE,\n  });\n\n  // Bare auth client — retry only, NO auth middleware. This is the transport for `refresh()` and\n  // `restore()`: routing a token refresh through the auth middleware would re-enter the (deduped)\n  // refresh via its 401/near-expiry path and deadlock, so those calls must bypass it.\n  const authClientBare = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => state.baseUrl,\n    build: (baseUrl) =>\n      baseUrl\n        ? createAuthClient({ baseUrl, middlewares: middlewareFor('auth', [retryContention]) })\n        : null,\n  });\n\n  const refresh = async () => {\n    const client = authClientBare.get();\n    assert(client, KeboolaErrorType.NotReady);\n    const refreshed = await client.token.refresh(config.requireCredential().refreshToken);\n    config.applyRefresh(refreshed);\n    return refreshed.accessToken;\n  };\n\n  // `null` while anonymous, so the auth middleware passes pre-auth requests (login) through unstamped.\n  const getToken = () => {\n    const state = config.store.get();\n    if (state.status === 'anonymous') return null;\n    const { accessToken, issuedAt, expiresIn } = state.credential;\n    return { accessToken, timing: { issuedAt, expiresIn } };\n  };\n\n  const signOut = () => {\n    config.reset();\n    persistor.clear();\n  };\n\n  // Sign out once per session death: `config.notifyExpired` latches (re-armed on `authenticate`), so\n  // concurrent 401s from any realm collapse to a single sign-out.\n  const onSessionExpired = () => {\n    if (config.notifyExpired()) signOut();\n  };\n\n  const credential = createBearerCredential({ refresh, getToken, onSessionExpired });\n  const authMiddleware = createBearerAuthMiddleware(credential);\n\n  // Exposed auth client (`api.auth`) — carries the auth middleware so authenticated auth-service\n  // endpoints (`token.introspect`, `getProjects`) are authorized. `login` stays anonymous: the\n  // middleware no-ops when `getToken()` is `null`. Refreshes still go through `authClientBare`.\n  const authClient = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => state.baseUrl,\n    build: (baseUrl) =>\n      baseUrl\n        ? createAuthClient({\n            baseUrl,\n            middlewares: middlewareFor('auth', [retryContention, authMiddleware]),\n          })\n        : null,\n  });\n\n  // Keyed on baseUrl-when-authenticated (a primitive): rebuilds on login/logout and stack change, but\n  // NOT on a token rotation — the credential isn't in the key, and the middleware reads it live. Bearer\n  // carries no static header (the middleware stamps it), so `token: ''` never reaches the wire.\n  const management = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => (state.status === 'anonymous' ? null : state.baseUrl),\n    build: (baseUrl) =>\n      baseUrl\n        ? createManagementClient({\n            baseUrl,\n            auth: { type: 'bearer', token: '' },\n            middlewares: middlewareFor('management', [authMiddleware]),\n          })\n        : null,\n  });\n\n  const projectClientsAsync = createDerivedAsyncStore({\n    source: config.store,\n    // Keyed on baseUrl + projectId only — a rotation (new credential, same project) must not rebuild.\n    dependsOn: (state) =>\n      state.status === 'scoped' ? { baseUrl: state.baseUrl, projectId: state.projectId } : null,\n    build: ({ baseUrl, projectId }) => {\n      return createProjectClients({\n        baseUrl,\n        authMiddleware,\n        projectId,\n        middlewareFor,\n        clientServiceUrls: options.clientServiceUrls,\n      });\n    },\n  });\n\n  if (options.baseUrl) config.setBaseUrl(options.baseUrl);\n\n  // Mirror the live session into storage: persist the durable subset (projected inline here, so it is\n  // clear exactly what we store) whenever a credential is present — login, project switch, token\n  // rotation. Skip when there is no credential so a bare `setBaseUrl` never overwrites a stored session\n  // before `restore()` reads it; `signOut` is what clears storage.\n  config.store.subscribe((state) => {\n    if (state.status === 'anonymous') return;\n\n    persistor.persist({\n      baseUrl: state.baseUrl,\n      projectId: state.status === 'scoped' ? state.projectId : null,\n      refreshToken: state.credential.refreshToken,\n    });\n  });\n\n  const debug = (): SessionSnapshot => ({\n    type: 'Bearer',\n    config: config.debug(),\n    authReady: authClient.get() !== null,\n    managementReady: management.get() !== null,\n    storage: projectClientsAsync.store.get().state,\n  });\n\n  const session = {\n    hasPersistedValue: persistor.hasPersistedValue,\n    setBaseUrl: config.setBaseUrl,\n    isStorageReady: () => projectClientsAsync.store.get().state === 'ready',\n    authenticate: (tokens: TokenSet) => config.authenticate(tokens),\n    setProject: config.setProjectId,\n    setProjectAsync: async (projectId: number) => {\n      config.setProjectId(projectId);\n      await projectClientsAsync.settled();\n    },\n    /**\n     * Leave the current project but stay signed in — the storage build returns to `idle`, so a\n     * consumer gating on it falls back to its project picker. The persisted session is rewritten with\n     * `projectId: null` by the subscription above, so a reload lands on the picker rather than\n     * re-entering the project. Use `reset` to sign out instead.\n     */\n    clearProject: config.clearProjectId,\n    reset: signOut,\n    /**\n     * Dev/test only: mark the current access token as expired so the bearer credential rotates it on\n     * the next request. Pair with any authenticated call (e.g. `api.storage.tokens.verify()`) to force\n     * the rotation immediately and observe the new credential.\n     */\n    debugForceRefresh: config.forceExpire,\n    /**\n     * The headers that authorize one off-client request, resolved fresh each call.\n     *\n     * - For a transport this package does not own — the chat SSE stream, whose `fetch` the AI SDK\n     *   holds. Anything with a service client on `api` should use that instead.\n     * - Returns the assembled bag, never the bare token: no caller handles the credential as a\n     *   string, and `X-KBC-ProjectId` is composed here rather than in every consuming app.\n     * - Resolved per call, through the credential — so a near-expiry token rotates and a revoked\n     *   one is never re-sent. A snapshot held by the caller would do neither.\n     * - Throws rather than emitting a half-formed `Bearer null`: an unauthenticated or unscoped\n     *   session has nothing to authorize with.\n     */\n    getAuthHeaders: async (): Promise<Record<string, string>> => {\n      const state = config.store.get();\n      if (state.status === 'anonymous') throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n      // A credential alone does not authorize a project request — kai-agent reads the project from\n      // the header, not the token, and cannot attribute a call that omits it.\n      if (state.status !== 'scoped') throw new KeboolaError(KeboolaErrorType.NotReady);\n\n      const accessToken = await credential.getAccessToken();\n      // `null` means anonymous, which the guard above already rejected — reachable only if a\n      // sign-out lands while the rotation is in flight.\n      assert(accessToken, KeboolaErrorType.NotAuthenticated);\n\n      return {\n        [HttpHeader.AUTHORIZATION]: `Bearer ${accessToken}`,\n        [KeboolaHttpHeader.PROJECT_ID]: String(state.projectId),\n      };\n    },\n\n    restore: async (): Promise<RestoreResult> => {\n      const persisted = persistor.hydrate();\n      // Need both the refresh token and the stack it belongs to — a blob missing either is unusable.\n      if (!persisted.refreshToken || !persisted.baseUrl) return { status: 'empty' };\n\n      // The configured stack is authoritative. If the caller targets a different stack than the stored\n      // session, that session isn't ours — discard it (the refresh token only validates against its own\n      // stack, so we never send it elsewhere). With no stack configured, adopt the stored one.\n      const configured = config.getBaseUrl();\n      if (configured && configured !== persisted.baseUrl) {\n        persistor.clear();\n        return { status: 'empty' };\n      }\n      if (!configured) config.setBaseUrl(persisted.baseUrl);\n\n      // Bare client: the refresh transport, bypassing the auth middleware (see `authClientBare`).\n      const client = authClientBare.get();\n      assert(client, KeboolaErrorType.NotReady);\n      try {\n        const refreshed = await client.token.refresh(persisted.refreshToken);\n        config.authenticate(refreshed);\n        if (persisted.projectId !== null) {\n          config.setProjectId(persisted.projectId);\n          await projectClientsAsync.settled();\n        }\n        return { status: 'restored' };\n      } catch (err) {\n        if (isUnauthorized(err)) {\n          persistor.clear();\n          return { status: 'expired' };\n        }\n        throw err;\n      }\n    },\n    subscribe: (listener: (snapshot: SessionSnapshot) => void) => {\n      // Fire on both config mutations and storage-build transitions, so `ready` is observable.\n      const unsubscribeConfig = config.store.subscribe(() => listener(debug()));\n      const unsubscribeBuild = projectClientsAsync.store.subscribe(() => listener(debug()));\n      return () => {\n        unsubscribeConfig();\n        unsubscribeBuild();\n      };\n    },\n    debug,\n  };\n\n  const api = createApi({\n    getAuthClient: () => authClient.get(),\n    getManagementClient: () => management.get(),\n    getProjectClients: () => {\n      const state = projectClientsAsync.store.get();\n      return state.state === 'ready' ? state.value : null;\n    },\n  });\n\n  return { api, session };\n};\n","import { createStore } from '../../utils';\n\nexport type State = {\n  baseUrl: string | null;\n  sapiToken: string | null;\n  managementToken: string | null;\n};\n\n// The legacy config is a plain observable state store: the host injects the baseUrl and tokens, and\n// consumers derive their clients from `store` (see `keboola.ts`). No lifecycle events — the derived\n// stores react to state changes directly.\nexport const createConfig = () => {\n  const store = createStore<State>({ baseUrl: null, sapiToken: null, managementToken: null });\n\n  const setBaseUrl = (baseUrl: string) => {\n    store.set({ ...store.get(), baseUrl });\n  };\n\n  const authenticate = (tokens: { sapiToken?: string; managementToken?: string }) => {\n    const current = store.get();\n    store.set({\n      ...current,\n      sapiToken: tokens.sapiToken ?? current.sapiToken,\n      managementToken: tokens.managementToken ?? current.managementToken,\n    });\n  };\n\n  // SAPI token accessors over the config store — the single source of truth. The storage build reads\n  // `getStorageToken` on every request; in-band rotations write back via `setStorageToken`, which\n  // surfaces to observers as an ordinary store change.\n  const getStorageToken = () => store.get().sapiToken ?? '';\n  const setStorageToken = (sapiToken: string) => store.set({ ...store.get(), sapiToken });\n\n  /** Current state, for diagnostics. */\n  const debug = (): State => store.get();\n\n  return { store, setBaseUrl, authenticate, getStorageToken, setStorageToken, debug };\n};\n","import type { AuthStrategy } from '../../clients/auth';\nimport { createStorageClient } from '../../clients/storage';\nimport { ProjectFeature } from '../../constants/projectFeatures';\nimport { createDefaultBranch } from '../../domain/defaultBranch';\nimport { createStack, type ServiceUrls } from '../../domain/stack';\nimport { createStorageTable } from '../../domain/storageTable';\nimport { type MiddlewareFn, normalizeBaseUrl } from '../../fetchClient';\nimport { KeboolaHttpHeader } from '../../internal';\nimport { createConfigurationSdk } from '../../sdks/configurations';\nimport { createSemanticLayerSdk } from '../../sdks/semanticLayer';\nimport { createStorageSdk } from '../../sdks/storage';\nimport { createTagSdk } from '../../sdks/tag';\nimport { createVariablesSdk } from '../../sdks/variables';\nimport { createVaultSdk } from '../../sdks/vault';\nimport { createDerivedStore } from '../../utils';\nimport { type ClientContext, createLiveProject } from '../createLiveProject';\nimport { type MiddlewareFor } from '../createMiddlewareFor';\nimport { createServiceClients } from '../createServiceClients';\n\nconst createAttachStorageToken =\n  (getToken: () => string): MiddlewareFn =>\n  (next) =>\n  (request) => {\n    request.request.headers.set(KeboolaHttpHeader.STORAGE_API_TOKEN, getToken());\n    return next(request);\n  };\n\ntype Options = {\n  baseUrl: string;\n  getStorageToken: () => string;\n  onStorageTokenRefreshed: (token: string) => void;\n  middlewareFor: MiddlewareFor;\n  clientServiceUrls?: ServiceUrls;\n};\n\nexport const createProjectClients = async ({\n  baseUrl,\n  getStorageToken,\n  onStorageTokenRefreshed,\n  middlewareFor,\n  clientServiceUrls,\n}: Options) => {\n  const auth: AuthStrategy = { type: 'sapi-token', token: getStorageToken() };\n\n  const attach = createAttachStorageToken(getStorageToken);\n  const _storage = createStorageClient({ baseUrl, auth, middlewares: [attach] });\n  const [stackInfo, sapiToken, devBranches] = await Promise.all([\n    _storage.getStackInfo({ exclude: 'componentDetails' }),\n    _storage.tokens.verify(),\n    _storage.branches.getDevBranches(),\n  ]);\n\n  const stack = createStack({ stackInfo, clientServiceUrls });\n  const defaultBranch = createDefaultBranch({ devBranches });\n  const liveProject = createLiveProject({\n    initialToken: sapiToken,\n    verify: () => _storage.tokens.verify(),\n  });\n  const storageTableStore = createDerivedStore({\n    source: liveProject.store,\n    build: createStorageTable,\n    dependsOn: (project) => ({\n      useLegacyBucketPrefix: !project.hasFeature(ProjectFeature.DisableLegacyBucketPrefix),\n      hasProtectedDefaultBranch: project.hasFeature(ProjectFeature.SoxProtectedDefaultBranch),\n      hasStorageBranches: project.hasFeature(ProjectFeature.StorageBranches),\n    }),\n  });\n  const context: ClientContext = {\n    baseUrl: normalizeBaseUrl(baseUrl),\n    stack,\n    defaultBranch,\n    get project() {\n      return liveProject.getProject();\n    },\n    get st() {\n      return storageTableStore.get();\n    },\n  };\n\n  // Static storage-token header + in-band refresh (onRefreshToken rotates the shared liveToken store).\n  const storage = createStorageClient({\n    baseUrl,\n    auth,\n    middlewares: middlewareFor('storage', [liveProject.middleware]),\n    onRefreshToken: onStorageTokenRefreshed,\n  });\n\n  const { client: services, meta: serviceMeta } = createServiceClients({\n    baseUrl,\n    auth,\n    getServiceBaseUrl: context.stack.getServiceUrl,\n    middlewareFor,\n    attachTokenMiddleware: attach,\n  });\n\n  const sdk = {\n    configuration: createConfigurationSdk({\n      storageClient: storage,\n      encryptionClient: services.encryption,\n      context,\n    }),\n    tag: createTagSdk({ metastoreClient: services.metastore }),\n    semanticLayer: createSemanticLayerSdk({ metastoreClient: services.metastore }),\n    storage: createStorageSdk({ storageClient: storage }),\n    vault: createVaultSdk({ vaultClient: services.vault, encryptionClient: services.encryption }),\n    variables: createVariablesSdk({ storageClient: storage }),\n  };\n\n  return { context, serviceMeta, storage, ...services, sdk };\n};\n","import { createAuthClient } from '../../clients/auth/authClient';\nimport { createManagementClient } from '../../clients/management';\nimport { createDerivedAsyncStore, createDerivedStore } from '../../utils';\nimport { createApi } from '../createApi';\nimport { createMiddlewareFor } from '../createMiddlewareFor';\nimport type { KeboolaOptions } from '../types';\n\nimport { createConfig, type State } from './createConfig';\nimport { createProjectClients } from './createProjectClients';\nimport type { SessionSnapshot } from './types';\n\ntype ProjectClients = Awaited<ReturnType<typeof createProjectClients>>;\n\nexport const createLegacyKeboola = (options: KeboolaOptions = {}) => {\n  const config = createConfig();\n  const middlewareFor = createMiddlewareFor(options.middlewares);\n\n  // The clients are derived from config state: each rebuilds only when the slice it depends on\n  // changes. auth needs a baseUrl; management builds token-less up front and upgrades once a manage\n  // token lands; storage builds once the SAPI token arrives (a later in-band rotation keeps the same\n  // baseUrl key, so it does not rebuild).\n  const authClient = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => state.baseUrl,\n    build: (baseUrl) =>\n      baseUrl ? createAuthClient({ baseUrl, middlewares: middlewareFor('auth', []) }) : null,\n  });\n\n  const management = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => ({ baseUrl: state.baseUrl, token: state.managementToken }),\n    build: ({ baseUrl, token }) =>\n      baseUrl\n        ? createManagementClient({\n            baseUrl,\n            auth: token ? { type: 'management-token', token } : { type: 'management-token' },\n            middlewares: middlewareFor('management', []),\n          })\n        : null,\n  });\n\n  const build = createDerivedAsyncStore<State, string, ProjectClients>({\n    source: config.store,\n    dependsOn: (state) => (state.sapiToken && state.baseUrl ? state.baseUrl : null),\n    build: (baseUrl) =>\n      createProjectClients({\n        baseUrl,\n        getStorageToken: config.getStorageToken,\n        onStorageTokenRefreshed: config.setStorageToken,\n        middlewareFor,\n        clientServiceUrls: options.clientServiceUrls,\n      }),\n  });\n\n  if (options.baseUrl) config.setBaseUrl(options.baseUrl);\n\n  const debug = (): SessionSnapshot => {\n    const info = config.debug();\n    return {\n      type: 'Sapi',\n      config: info,\n      authReady: authClient.get() !== null,\n      managementReady: !!info.managementToken,\n      storage: build.store.get().state,\n    };\n  };\n\n  const session = {\n    setBaseUrl: config.setBaseUrl,\n    isStorageReady: () => build.store.get().state === 'ready',\n    authenticateStorage: (sapiToken: string) => config.authenticate({ sapiToken }),\n    authenticateStorageAsync: async (sapiToken: string) => {\n      config.authenticate({ sapiToken });\n      // `authenticate` mutates synchronously, so the build is already pending; `settled` awaits it.\n      await build.settled();\n    },\n    authenticateManagement: (managementToken: string) => config.authenticate({ managementToken }),\n    subscribe: (listener: (snapshot: SessionSnapshot) => void) => {\n      // Fire on both config mutations and storage-build transitions, so `ready` is observable.\n      const unsubscribeConfig = config.store.subscribe(() => listener(debug()));\n      const unsubscribeBuild = build.store.subscribe(() => listener(debug()));\n      return () => {\n        unsubscribeConfig();\n        unsubscribeBuild();\n      };\n    },\n    debug,\n  };\n\n  const api = createApi({\n    getAuthClient: () => authClient.get(),\n    getManagementClient: () => management.get(),\n    getProjectClients: () => {\n      const state = build.store.get();\n      return state.state === 'ready' ? state.value : null;\n    },\n  });\n\n  return { api, session };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAgB,OAAU,OAA6B,SAAqC;CAC1F,IAAI,SAAS,MACX,MAAM,IAAI,MAAM,OAAO;AAE3B;;;;;;;;;;;;;;;;;;;ACcA,MAAa,YAAe,SAAiD;CAC3E,IAAI,UAAU;CACd,MAAM,UAA8C,CAAC;CAErD,MAAM,QAAQ,YAAY;EACxB,UAAU;EACV,MAAM,QAAQ,QAAQ,OAAO,CAAC;EAE9B,IAAI;GACF,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,SAAS,WAAW,OAAO,QAAQ,MAAM,CAAC;EAClD,SAAS,OAAO;GACd,MAAM,SAAS,WAAW,OAAO,OAAO,KAAK,CAAC;EAChD;EAEA,IAAI,QAAQ,SAAS,GAAG,OAAO,MAAM;EACrC,UAAU;CACZ;CAEA,aAAa;EACX,MAAM,SAAS,QAAQ,cAA0B;EACjD,QAAQ,KAAK,MAAM;EACnB,IAAI,CAAC,SAAS,MAAW;EACzB,OAAO,OAAO;CAChB;AACF;;;AChCA,MAAM,gBAAgB;AAmBtB,MAAM,cAAc,EAAE,eACpB,SAAS,UAAU,UAAU,SAAS,UAAU;AAElD,MAAa,sBAAsB,EAAE,QAAQ,kBAAkB,CAAC,MAAoB;CAClF,MAAM,UAAU,YAAyB,CAAC,CAAC;CAC3C,MAAM,+BAAe,IAAI,IAAwB;CAEjD,MAAM,aAAa,MAAM,SAAS,OAAO,aAAa,GAAG,CAAC;CAC1D,IAAI,UAAU;CAEd,MAAM,UAAU,QAAgB;EAC9B,aAAa,IAAI,GAAG,CAAC,GAAG;EACxB,aAAa,OAAO,GAAG;CACzB;CAEA,MAAM,QAAQ,SAAsB;EAClC,IAAI,OAAO;EAEX,OAAO,KAAK,SAAS,YAAY;GAC/B,MAAM,UAAU,KAAK,SAAS,UAAU,KAAK,KAAK,GAAG,EAAE;GAEvD,IAAI,CAAC,SAAS;GAEd,OAAO,QAAQ,GAAG;GAClB,OAAO,KAAK,QAAQ,UAAU,UAAU,OAAO;EACjD;EAEA,OAAO;CACT;CAEA,MAAM,WAAW,KAAa,aAC5B,QAAQ,IAAI,QAAQ,IAAI,CAAC,CAAC,KAAK,UAAW,MAAM,QAAQ,MAAM;EAAE,GAAG;EAAO;CAAS,IAAI,KAAM,CAAC;CAEhG,MAAM,YAAY,WAA2B;EAC3C,MAAM,MAAM;EACZ,MAAM,QAAmB;GACvB;GACA,WAAW,KAAK,IAAI;GACpB,UAAU,OAAO,MAAM;GACvB,MAAM,OAAO;GACb,OAAO,OAAO;EAChB;EAEA,aAAa,IACX,KACA,OAAO,WAAW,aAAa,QAAQ,KAAK,QAAQ,CAAC,CACvD;EACA,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC;CAC7C;CAEA,MAAM,gBAAgB;EACpB,QAAQ,UAAU,QAAQ;CAC5B;CAEA,OAAO;EACL,MAAM,QAAQ;EACd;EACA,YAAY,aAAa,QAAQ,gBAAgB,SAAS,CAAC;EAC3D,aAAa;GACX,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,OAAO,GAAG,CAAC;GAC9C,QAAQ,IAAI,CAAC,CAAC;EAChB;EACA,UAAU,WAAW,QAAQ,IAAI,CAAC,CAAC,SAAS,UAAU,MAAM,KAAK,MAAM,CAAC;CAC1E;AACF;;;;;;;;;ACtFA,MAAa,aACX,MACA,UACM;CACN,MAAM,MAA+B,EAAE,GAAG,KAAK;CAE/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,UAAU,IAAI;EACpB,IAAI,OAAO,cAAc,OAAO,KAAK,cAAc,KAAK,IAAI,UAAU,SAAS,KAAK,IAAI;CAC1F;CAEA,OAAO;AACT;;;ACXA,MAAa,2BAA2C;CACtD,eAAe;CACf,eAAe,CAAC;CAChB,kBAAkB,CAAC;AACrB;AAIA,MAAa,4BAA4C;CACvD,MAAM,wBAAQ,IAAI,IAAoB;CACtC,OAAO;EACL,UAAU,QAAQ,MAAM,IAAI,GAAG,KAAK;EACpC,UAAU,KAAK,UAAU;GACvB,MAAM,IAAI,KAAK,KAAK;EACtB;EACA,aAAa,QAAQ;GACnB,MAAM,OAAO,GAAG;EAClB;CACF;AACF;AAOA,MAAM,oBAAoB,SAA+C;CACvE,IAAI,MAAsB;CAC1B,IAAI;EACF,MAAM,KAAK;EACX,IAAI,KAAK;GACP,MAAM,QAAQ;GACd,IAAI,QAAQ,OAAO,KAAK;GACxB,IAAI,WAAW,KAAK;EACtB;CACF,SAAS,KAAK;EACZ,QAAQ,KAAK,qEAAqE,GAAG;EACrF,MAAM;CACR;CACA,IAAI,CAAC,KAAK,OAAO,oBAAoB;CAErC,MAAM,UAAU;CAChB,OAAO;EACL,UAAU,QAAQ,QAAQ,QAAQ,GAAG;EACrC,UAAU,KAAK,UAAU;GACvB,QAAQ,QAAQ,KAAK,KAAK;EAC5B;EACA,aAAa,QAAQ;GACnB,QAAQ,WAAW,GAAG;EACxB;CACF;AACF;AAEA,MAAa,2BACX,uBAAwB,kBAAkB,aAAa,WAAW,eAAe,IAAK;AAExF,MAAa,6BACX,uBAAwB,oBAAoB,aAAa,WAAW,iBAAiB,IAAK;;;ACjC5F,MAAa,mBAAsB,EACjC,UAAU,kBAAkB,GAC5B,KACA,QACA,cACA,SAAS,KAAK,WACd,SAAS,KAAK,YACyB;CAGvC,MAAM,cAAoB;EACxB,IAAI;GACF,QAAQ,WAAW,GAAG;EACxB,SAAS,KAAK;GACZ,QAAQ,KAAK,qCAAqC,IAAI,IAAI,GAAG;EAC/D;CACF;CAIA,MAAM,0BAAmC;EACvC,IAAI;GACF,OAAO,CAAC,CAAC,QAAQ,QAAQ,GAAG;EAC9B,SAAS,KAAK;GACZ,QAAQ,KAAK,oCAAoC,IAAI,oBAAoB,GAAG;GAC5E,OAAO;EACT;CACF;CAEA,MAAM,gBAAmB;EACvB,IAAI;EACJ,IAAI;GACF,MAAM,QAAQ,QAAQ,GAAG;EAC3B,SAAS,KAAK;GACZ,QAAQ,KAAK,oCAAoC,IAAI,mBAAmB,GAAG;GAC3E,OAAO;EACT;EACA,IAAI,QAAQ,MAAM,OAAO;EAEzB,IAAI;EACJ,IAAI;GACF,UAAU,OAAO,GAAG;EACtB,SAAS,KAAK;GACZ,QAAQ,KAAK,sCAAsC,IAAI,eAAe,GAAG;GACzE,MAAM;GACN,OAAO;EACT;EAEA,MAAM,SAAS,OAAO,UAAU,OAAO;EACvC,IAAI,OAAO,SAAS,OAAO,OAAO;EAClC,MAAM;EACN,OAAO;CACT;CAEA,MAAM,WAAW,UAAmB;EAClC,IAAI;EACJ,IAAI;GACF,MAAM,OAAO,KAAK;EACpB,SAAS,KAAK;GACZ,QAAQ,KAAK,sCAAsC,IAAI,oBAAoB,GAAG;GAC9E;EACF;EACA,IAAI;GACF,QAAQ,QAAQ,KAAK,GAAG;EAC1B,SAAS,KAAK;GACZ,QAAQ,KAAK,qCAAqC,IAAI,IAAI,GAAG;EAC/D;CACF;CAEA,OAAO;EAAE;EAAS;EAAS;EAAO;CAAkB;AACtD;;;AC9FA,MAAM,kCAAkC,CAItC,wBAGA,wCACF;AAEA,MAAa,iCAAiC,YAA8B;CAC1E,IAAI,QAAQ,WAAW,OAAO,OAAO;CACrC,MAAM,EAAE,aAAa,IAAI,IAAI,QAAQ,GAAG;CACxC,OAAO,gCAAgC,MAAM,YAAY,QAAQ,KAAK,QAAQ,CAAC;AACjF;AAEA,MAAM,kCAEF,eACA,oBAED,SACD,OAAO,YAAY;CACjB,MAAM,WAAW,MAAM,KAAK,OAAO;CAGnC,IAAI,cAAc,QAAQ,OAAO,GAAG,MAAM,eAAe;CACzD,OAAO;AACT;;;;;AAMF,MAAa,qBAAqB,EAChC,cACA,aAII;CACJ,MAAM,QAAQ,YAAY,cAAc,EAAE,WAAW,aAAa,CAAC,CAAC;CACpE,MAAM,UAAU,SAAS,YAAY,MAAM,IAAI,cAAc,EAAE,WAAW,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC;CAC5F,MAAM,aAAa,+BAA+B,+BAA+B,OAAO;CACxF,OAAO;EAAE;EAAO,kBAAkB,MAAM,IAAI;EAAG,WAAW,MAAM;EAAW;EAAY;CAAQ;AACjG;;;;;;;ACnDA,MAAa,mBAAmB;CAC9B,cAAc;CACd,kBAAkB;CAClB,sBAAsB;CACtB,gBAAgB;CAChB,mBAAmB;CACnB,gBAAgB;CAChB,WAAW;CACX,UAAU;CACV,wBAAwB;AAC1B;AAIA,MAAM,WAA6C;EAChD,iBAAiB,eAAe;EAChC,iBAAiB,mBAAmB;EACpC,iBAAiB,uBAChB;EACD,iBAAiB,iBAAiB;EAClC,iBAAiB,oBAChB;EACD,iBAAiB,iBAChB;EACD,iBAAiB,YAAY;EAC7B,iBAAiB,WAAW;EAC5B,iBAAiB,yBAChB;AACJ;AAEA,IAAa,eAAb,MAAa,qBAAqB,MAAM;CACtC;CAEA,YAAY,MAAwB;EAClC,MAAM,SAAS,KAAK;EACpB,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,OAAO,eAAe,MAAM,aAAa,SAAS;CACpD;AACF;AAEA,MAAa,kBAAkB,UAC7B,iBAAiB;;AAGnB,SAAgBA,SAAU,OAA6B,MAA4C;CACjG,IAAI,SAAS,MAAM,MAAM,IAAI,aAAa,IAAI;AAChD;;;AC9CA,MAAM,wBAAwB;AAE9B,MAAM,0BAA0B;CAC9B,kBAAkB;CAClB,kBAAkB;CAClB;CACA;CACA;AACF;AAEA,MAAM,+CAA+B,IAAI,IAAI;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,WAAW;AAEjB,MAAM,kBAAkB,WAA2B;CACjD,MAAM,MAAM,IAAI,IAAI,MAAM;CAC1B,IAAI,IAAI,UAAU,IAAI,WAAW;CACjC,IAAI,IAAI,UAAU,IAAI,WAAW;CAEjC,IAAI,aAAa,SAAS,QAAQ,QAAQ;EACxC,IAAI,6BAA6B,IAAI,IAAI,YAAY,CAAC,GACpD,IAAI,aAAa,IAAI,KAAK,QAAQ;CAEtC,CAAC;CACD,OAAO,IAAI,SAAS;AACtB;AAQA,MAAM,uBAAuB,YAA6B;CACxD,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,qBAAqB,KAAK,aAAa;CACjF,QAAQ,QAAQ,IAAI,uBAAuB,aAAa;CACxD,OAAO;AACT;AAEA,MAAM,sBAAsB,SAAkB,aAA+C;CAC3F,MAAM,cAAc,IAAI,IACtB,CAAC,GAAG,yBAAyB,GAAG,QAAQ,CAAC,CAAC,KAAK,MAAM,EAAE,YAAY,CAAC,CACtE;CAEA,MAAM,SAAiC,CAAC;CACxC,QAAQ,SAAS,OAAO,SAAS;EAC/B,OAAO,QAAQ,YAAY,IAAI,KAAK,YAAY,CAAC,IAAI,WAAW;CAClE,CAAC;CACD,OAAO;AACT;AA2CA,MAAM,iBAAiB,SAAkB,qBAA2C;CAClF,KAAK,eAAe,QAAQ,GAAG;CAC/B,SAAS,mBAAmB,QAAQ,SAAS,eAAe;AAC9D;AAEA,MAAM,kBAAkB,UAAoB,qBAA4C;CACtF,QAAQ,SAAS;CACjB,YAAY,SAAS;CACrB,SAAS,mBAAmB,SAAS,SAAS,eAAe;AAC/D;AAMA,MAAM,kBAAkB,OAAiB,oBACvC,IAAI,SAAS;CACX,SAAS,IAAI,QAAQ,eAAe,MAAM,QAAQ,GAAG,GAAG;EACtD,QAAQ,MAAM,QAAQ;EACtB,SAAS,mBAAmB,MAAM,QAAQ,SAAS,eAAe;CACpE,CAAC;CACD,UAAU,IAAI,SAAS,MAAM;EAC3B,QAAQ,MAAM,SAAS;EACvB,YAAY,MAAM,SAAS;EAC3B,SAAS,mBAAmB,MAAM,SAAS,SAAS,eAAe;CACrE,CAAC;CACD,MAAM,MAAM;AACd,CAAC;AAEH,MAAM,aAAa,OAAyB,QAAqB;CAC/D,MAAM,QAAQ;EAAC,IAAI,MAAM,YAAY,EAAE;EAAI,GAAG,KAAK,MAAM,IAAI,UAAU,EAAE;EAAK,IAAI;CAAM;CACxF,MAAM,KAAK,IAAI,QAAQ,GAAG;CAC1B,IAAI,cAAc,KAAK,MAAM,KAAK,OAAO,IAAI,SAAS,MAAM,CAAC;CAC7D,OAAO,MAAM,KAAK,GAAG;AACvB;AAEA,MAAM,oBAAoB,QAAiB,QAAkB,iBAAmC;CAC9F,OAAO;EACL,OAAO,QAAQ;GACb,IAAI,UAAU,OAAO;GACrB,IAAI;IACF,IAAI,QAAQ,MAAM;KAChB,OAAO,KAAK,GAAG;KACf;IACF;IAEA,QAAQ,KAAK,UAAU,QAAQ,GAAG,CAAC;GACrC,QAAQ,CAER;EACF;EACA,QAAQ,QAAQ;GACd,IAAI;IACF,IAAI,QAAQ,OAAO;KACjB,OAAO,MAAM,GAAG;KAChB;IACF;IAEA,QAAQ,MAAM,UAAU,SAAS,GAAG,CAAC;GACvC,QAAQ,CAER;EACF;CACF;AACF;AAEA,MAAa,2BAA2B,UAA0B,CAAC,MAAoB;CACrF,MAAM,aAAa,iBAAiB,QAAQ,QAAQ,QAAQ,KAAK;CACjE,MAAM,gBAAgB,QAAQ,iBAAiB,CAAC;CAEhD,QAAQ,SAAS,OAAO,iBAAiB;EACvC,MAAM,gBAAgB,oBAAoB,aAAa,OAAO;EAC9D,MAAM,QAAQ,YAAY,IAAI;EAC9B,MAAM,SAAS,aAAa,QAAQ,OAAO,YAAY;EACvD,MAAM,aAAa,cAAc,aAAa,SAAS,aAAa;EAEpE,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,YAAY;GACtC,WAAW,KAAK;IACd;IACA;IACA,YAAY,YAAY,IAAI,IAAI;IAChC,SAAS;IACT,UAAU,eAAe,OAAO,UAAU,aAAa;GACzD,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,IAAI,iBAAiB,OACnB,WAAW,MAAM;IACf;IACA;IACA,YAAY,YAAY,IAAI,IAAI;IAChC,SAAS;IACT,OAAO,WAAW,KAAK,IAAI,eAAe,OAAO,aAAa,IAAI;GACpE,CAAC;GAEH,MAAM;EACR;CACF;AACF;;;AC9MA,MAAM,sBAAsB;AAC5B,MAAM,6BAAuC;CAC3C,WAAW;CACX,WAAW;CACX,WAAW;CACX,WAAW;AACb;AACA,MAAM,yBAAyB;AAQ/B,MAAM,sBAAsB,UAC1B,iBAAiB,YAAY,2BAA2B,SAAS,MAAM,SAAS,MAAM;AAExF,MAAa,yBAAyB,YAAyC;CAC7E,MAAM,EACJ,aAAa,qBACb,gBAAgB,wBAChB,cAAc,uBACZ,WAAW,CAAC;CAEhB,IAAI,CAAC,OAAO,UAAU,UAAU,KAAK,aAAa,GAChD,MAAM,IAAI,WAAW,2CAA2C;CAElE,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,gBAAgB,GACrD,MAAM,IAAI,WAAW,oDAAoD;CAG3E,QAAQ,SAAS,OAAO,YAAY;EAClC,KAAK,IAAI,UAAU,GAAG,WAAW,YAAY,WAC3C,IAAI;GACF,OAAO,MAAM,KAAK;IAAE,GAAG;IAAS,SAAS,QAAQ,QAAQ,MAAM;GAAE,CAAC;EACpE,SAAS,OAAO;GACd,IAAI,YAAY,cAAc,CAAC,YAAY,OAAO,OAAO,GACvD,MAAM;GAGR,MAAM,UAAU,gBAAgB,MAAO,KAAK,IAAI,GAAG,OAAO;GAC1D,MAAM,MAAM,SAAS,QAAQ,QAAQ,UAAU,KAAA,CAAS;EAC1D;EAGF,MAAM,IAAI,MAAM,aAAa;CAC/B;AACF;;;ACrDA,MAAa,qBAAqB,aAChC,OAAO,aAAa,YACpB,aAAa,UACb,aAAa,iBACb,aAAa,cACb,aAAa;;;;AAKf,MAAa,qBAAwD,EACnE,aAGO;CACP,MAAM,eAAe,OAAiB,CAAC,MACrC,IAAI,YAAY,CAAC,GAAG;EAElB,MAAM,SAAS,SAAS;GAEtB,IAAI,kBAAkB,IAAI,GAAG,OAAO,KAAA;GACpC,OAAO,YAAY,CAAC,GAAG,MAAM,IAAI,CAAC;EACpC;EAEA,QAAQ,SAAS,WAAW,SAAS,OAAO,MAAM,IAAI;CACxD,CAAC;CAEH,OAAO,YAAY;AACrB;;;ACoBA,MAAa,qCAEV,EACC,mBACA,oBAC6D;CAC7D,MAAM,SAAS,WAAmB,eAChC,kBAAkB,EAChB,SAAS,MAAM,SAAS;EACtB,gBAAgB;GACd;GACA;GACA;GACA;EACF,CAAC;CACH,EACF,CAAC;CAEH,MAAM,UAAiD,CAAC;CAExD,MAAM,iBAAiB,EACrB,WACA,UACA,iBACyC;EACzC,MAAM,iBAAiB,kBAAkB,SAAS;EAClD,OAAO,iBAAiB,SAAS,cAAc,IAAI,MAAM,WAAW,UAAU;CAChF;CAGA,MAAM,WAAyD;EAC7D,MAAM,WAAW;GACf,QAAQ,KAAK,MAAM;GACnB,OAAO;EACT;EACA,aAAa;GACX,MAAM,YAAqC,CAAC;GAC5C,MAAM,aAAsC,CAAC;GAE7C,QAAQ,SAAS,WAAW;IAC1B,UAAU,OAAO,cAAc,cAAc,MAAM;IACnD,WAAW,KAAK;KACd,YAAY,OAAO;KACnB,WAAW,OAAO;KAClB,aAAa,CAAC,CAAC,kBAAkB,OAAO,SAAS;IACnD,CAAC;GACH,CAAC;GAKD,OAAO;IACL,QAAQ;IACR,MAAM;GACR;EACF;CACF;CAEA,OAAO;AACT;;;ACrFF,MAAa,aAAa,UACxB,IAAI,MAAM,CAAC,GAAiB,EAC1B,IAAI,SAAS,UAAU;CACrB,IAAI,kBAAkB,QAAQ,GAAG,OAAO,KAAA;CAExC,IAAI,aAAa,QAAQ;EACvB,MAAM,aAAa,MAAM,cAAc;EACvC,SAAO,YAAY,iBAAiB,YAAY;EAChD,OAAO;CACT;CAEA,IAAI,aAAa,cAAc;EAC7B,MAAM,aAAa,MAAM,oBAAoB;EAC7C,SAAO,YAAY,iBAAiB,iBAAiB;EACrD,OAAO;CACT;CAEA,MAAM,UAAU,MAAM,kBAAkB;CACxC,SAAO,SAAS,iBAAiB,QAAQ;CAEzC,OAAO,QAAQ;AACjB,EACF,CAAC;;;ACRH,MAAa,uBAAuB,gBAAyC;CAC3E,QAAQ,QAA0B,WAA2B,CAAC,MAAsB;EAClF,IAAI,MAAM,QAAQ,WAAW,GAAG,OAAO,CAAC,GAAG,UAAU,GAAG,WAAW;EAEnE,MAAM,MAAM,aAAa,OAAO,CAAC;EACjC,MAAM,WAAW,cAAc,WAAW,CAAC;EAC3C,OAAO;GAAC,GAAG;GAAU,GAAG;GAAK,GAAG;EAAQ;CAC1C;AACF;;;ACpBA,MAAM,UAAiB;CAAE,QAAQ;CAAa,SAAS;AAAK;AAE5D,MAAM,SAAS,YAAkC;CAAE,GAAG;CAAQ,UAAU,KAAK,IAAI;AAAE;AAEnF,MAAaC,kBAAgB,UAAiB,YAAY;CACxD,MAAM,QAAQ,YAAmB,OAAO;CACxC,IAAI,kBAAkB;CAEtB,MAAM,cAAc,YAAoB;EAEtC,IAAI,MAAM,IAAI,CAAC,CAAC,WAAW,aACzB,MAAM,IAAI,aAAa,iBAAiB,oBAAoB;EAC9D,MAAM,IAAI;GAAE,QAAQ;GAAa;EAAQ,CAAC;CAC5C;CAEA,MAAM,gBAAgB,WAAqB;EACzC,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa,MAAM,IAAI,aAAa,iBAAiB,oBAAoB;EAG9F,IAAI,CAAC,MAAM,SAAS,MAAM,IAAI,aAAa,iBAAiB,YAAY;EACxE,kBAAkB;EAClB,MAAM,IAAI;GAAE,QAAQ;GAAiB,SAAS,MAAM;GAAS,YAAY,MAAM,MAAM;EAAE,CAAC;CAC1F;CAEA,MAAM,gBAAgB,cAAsB;EAC1C,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;EAC1F,MAAM,IAAI;GACR,QAAQ;GACR,SAAS,MAAM;GACf,YAAY,MAAM;GAClB;EACF,CAAC;CACH;;;;;;;CAQA,MAAM,uBAAuB;EAC3B,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,UAAU;EAC/B,MAAM,IAAI;GAAE,QAAQ;GAAiB,SAAS,MAAM;GAAS,YAAY,MAAM;EAAW,CAAC;CAC7F;;CAGA,MAAM,cAAc;EAClB,MAAM,IAAI;GAAE,QAAQ;GAAa,SAAS,MAAM,IAAI,CAAC,CAAC;EAAQ,CAAC;CACjE;;CAGA,MAAM,gBAAgB,WAAqB;EACzC,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa;EAClC,MAAM,IAAI;GAAE,GAAG;GAAO,YAAY,MAAM,MAAM;EAAE,CAAC;CACnD;;;;;CAMA,MAAM,oBAAoB;EACxB,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa;EAClC,MAAM,WAAW,KAAK,IAAI,IAAI,MAAM,WAAW,YAAY;EAC3D,MAAM,IAAI;GAAE,GAAG;GAAO,YAAY;IAAE,GAAG,MAAM;IAAY;GAAS;EAAE,CAAC;CACvE;;;;;CAMA,MAAM,0BAAsC;EAC1C,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;EAC1F,OAAO,MAAM;CACf;CAEA,MAAM,mBAAkC,MAAM,IAAI,CAAC,CAAC;;;;;;;;;CAUpD,MAAM,sBAA+B;EACnC,IAAI,iBAAiB,OAAO;EAC5B,kBAAkB;EAClB,OAAO;CACT;CAEA,MAAM,cAAqB,MAAM,IAAI;CASrC,OAAO;EACL,OAAO;GANP,KAAK,MAAM;GACX,WAAW,MAAM;GACjB,SAAS,MAAM;EAID;EACd;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACvIA,MAAa,uBAAuB,EAAE,kBAA2B;CAC/D,MAAM,gBAAgB,YAAY,MAAM,WAAW,OAAO,SAAS;CACnE,OAAO,eAAe,0CAA0C;CAEhE,MAAM,WAAW,aAA2C;EAC1D,IAAI,YAAY,QAAQ,aAAa,WAAW,OAAO;EACvD,OAAO,OAAO,QAAQ,MAAM,cAAc,KAAK,YAAY;CAC7D;CAEA,OAAO;EACL,IAAI,cAAc;EAClB,MAAM,cAAc;EACpB;EACA,QAAQ,aAA+B,QAAQ,QAAQ,MAAM;EAC7D,YAAY,aAA+B,QAAQ,QAAQ,MAAM;CACnE;AACF;;;ACrBA,MAAM,wBAAqC,EAGzC,kBAAkB,QAAQ,GAAG,IAAI,MACnC;AAOA,MAAa,eAAe,EAAE,WAAW,wBAAiC;CACxE,MAAM,EAAE,UAAU,YAAY,UAAU,GAAG,aAAa;CAExD,MAAM,aAAa,IAAI,IACrB,SAAS,KAAK,YAAY;EACxB,MAAM,cAAc,oBAAoB,QAAQ,GAAG,GAAG,QAAQ,GAAG;EACjE,MAAM,eAAe,sBAAsB,QAAQ,GAAG,GAAG,QAAQ,GAAG;EACpE,MAAM,MAAM,eAAe,gBAAgB,QAAQ;EACnD,OAAO,CAAC,QAAQ,IAAI,GAAG;CACzB,CAAC,CACH;CAEA,MAAM,eAAe,IAAI,IAAI,WAAW,KAAK,cAAc,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC;CACrF,MAAM,aAAa,IAAI,IAAI,QAAQ;CAEnC,MAAM,cAAc,GAAG,YAAsB;EAC3C,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,WAAW,IAAI,CAAC,CAAC;CAC/C;CAEA,MAAM,gBAAgB,GAAG,gBAA0B;EACjD,IAAI,YAAY,WAAW,GAAG,OAAO;EACrC,OAAO,YAAY,OAAO,MAAM,aAAa,IAAI,CAAC,CAAC;CACrD;CAEA,MAAM,gBAAgB,gBAAwB,aAAa,IAAI,WAAW,KAAK;CAE/E,MAAM,cAAc,cAAyB,WAAW,IAAI,SAAS;CAErE,MAAM,iBAAiB,cAAyB,WAAW,IAAI,SAAS,KAAK;CAE7E,OAAO;EACL,GAAG;EACH;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACvDA,MAAM,yBAAyB;;AAgB/B,MAAa,4BACX,QACA,WACyB;CACzB,MAAM,cAAc,IAAI,IAAI,OAAO,KAAK,eAAe,WAAW,IAAI,CAAC;CAEvE,OAAO,CAAC,GAAG,QAAQ,GAAG,OAAO,QAAQ,eAAe,CAAC,YAAY,IAAI,WAAW,IAAI,CAAC,CAAC;AACxF;;AAGA,MAAa,uBACX,QACA,WACoB;CACpB,MAAM,eAAe,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,MAAM,MAAM,MAAM,KAAK,CAAC,CAAC;CAC7E,MAAM,cAAc,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC;CAE7D,OAAO,CACL,GAAG,OAAO,KAAK,UACb,aAAa,IAAI,MAAM,IAAI,IAAI;EAAE,GAAG;EAAO,OAAO,aAAa,IAAI,MAAM,IAAI;CAAE,IAAI,KACrF,GACA,GAAG,OAAO,QAAQ,UAAU,CAAC,YAAY,IAAI,MAAM,IAAI,CAAC,CAC1D;AACF;;;;;;AAOA,MAAa,sBAAsB,EAAE,oBAA6B;CAChE,MAAM,UAAU,cAAc;CAC9B,MAAM,OAAO,cAAc;CAE3B,MAAM,gBAAgB,OACpB,UACA,aACA,aACG;EACH,MAAM,SAAS,MAAM,QAAQ,iBAAiB;GAC5C,aAAa;GACb;GACA;EACF,CAAC;EAED,MAAM,MAAM,OAAO,KAAK,MAAM,cAAc,UAAU,OAAO,WAAW,KAAK,OAAO,KAAK;EAEzF,MAAM,iBAAiB,OAAO,eAAe;EAC7C,MAAM,YAAY,KAAK,eAAe;EAGtC,OAAO;GACL,aAAc,MAAM,QAAQ,cAAc,IAAI,iBAAiB,CAAC;GAChE,QAAS,MAAM,QAAQ,SAAS,IAAI,YAAY,CAAC;EACnD;CACF;CAEA,MAAM,kBAAkB,OACtB,aACA,QACA,aAC0B;EAC1B,MAAM,SAAS,MAAM,QAAQ,oBAAoB;GAC/C;GACA,aAAa;GACb,MAAM;GACN,eAAe,EAAE,WAAW,YAAY;EAC1C,CAAC;EAED,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,uBAAuB;IAC5C,UAAU,OAAO,QAAQ;IACzB,aAAa;IACb,iBAAiB,OAAO;IACxB,MAAM;IACN,eAAe,EAAE,OAAO;GAC1B,CAAC;GAED,OAAO;IAAE,aAAa,OAAO;IAAI,mBAAmB,IAAI;GAAG;EAC7D,SAAS,OAAO;GAEd,MAAM,QACH,oBAAoB;IACnB;IACA,aAAa;IACb,UAAU,OAAO;GACnB,CAAC,CAAC,CACD,OAAO,iBAA0B;IAEhC,IAAI,iBAAiB,SAAS,MAAM,UAAU,KAAA,GAC5C,MAAM,QAAQ;GAElB,CAAC;GACH,MAAM;EACR;CACF;CAEA,OAAO;;EAEL,MAAM,OAAO,EACX,aACA,mBACA,WAAW,gBAKgB;GAC3B,MAAM,EAAE,aAAa,WAAW,MAAM,cAAc,aAAa,mBAAmB,QAAQ;GAE5F,OAAO,gBAAgB,aAAa,QAAQ,QAAQ;EACtD;;EAGA,OAAO,OAAO,EACZ,mBACA,gBACA,mBACA,gBACA,WAAW,gBAOgB;GAC3B,MAAM,CAAC,QAAQ,UAAU,MAAM,QAAQ,IAAI,CACzC,cAAc,mBAAmB,gBAAgB,QAAQ,GACzD,cAAc,mBAAmB,gBAAgB,QAAQ,CAC3D,CAAC;GAED,OAAO,gBACL,yBAAyB,OAAO,aAAa,OAAO,WAAW,GAC/D,oBAAoB,OAAO,QAAQ,OAAO,MAAM,GAChD,QACF;EACF;CACF;AACF;;;AC1HA,MAAa,wBAAwB,EACnC,SACA,MACA,mBACA,eACA,4BAEA,4BAA0D,CAAC,CAAC;CAC1D;CACA,gBAAgB,EAAE,WAAW,MAAM,iBAAiB;EAClD,MAAM,IAAI,wBAAwB,WAAW,MAAM,UAAU;CAC/D;AACF,CAAC,CAAC,CACC,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,kBAAkB;EAChB,SAAS;EACT,aAAa,cAAc,SAAS,CAAC,qBAAqB,CAAC;EAC3D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,wBAAwB;EACtB,SAAS;EACT,aAAa,cAAc,eAAe,CAAC,qBAAqB,CAAC;EACjE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CAOH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,iBAAiB;EACf,SAAS,GAAG,eAAe;EAC3B,aAAa,cAAc,QAAQ,CAAC,qBAAqB,CAAC;EAC1D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,uBAAuB;EACrB,SAAS;EACT,aAAa,cAAc,YAAY;CACzC,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,mBAAmB;EACjB,SAAS;EACT,aAAa,cAAc,UAAU,CAAC,qBAAqB,CAAC;EAC5D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,wBAAwB;EACtB,SAAS;EACT,aAAa,cAAc,eAAe,CAAC,qBAAqB,CAAC;EACjE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,sBAAsB;EACpB,SAAS;EACT,aAAa,cAAc,aAAa,CAAC,qBAAqB,CAAC;EAC/D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,yBAAyB;EACvB,SAAS;EACT,aAAa,cAAc,gBAAgB,CAAC,qBAAqB,CAAC;EAClE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,kBAAkB;EAChB,SAAS;EACT,aAAa,cAAc,SAAS,CAAC,qBAAqB,CAAC;EAC3D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,iBAAiB;EACf,eAAe;EACf,SAAS;EACT,aAAa,cAAc,QAAQ,CAAC,qBAAqB,CAAC;EAC1D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,eAAe;EACb,SAAS;EACT,aAAa,cAAc,MAAM,CAAC,qBAAqB,CAAC;EACxD;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CAIH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,uBAAuB;EACrB,SAAS,GAAG,eAAe;EAC3B,aAAa,cAAc,cAAc,CAAC,qBAAqB,CAAC;EAChE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,mBAAmB;EACjB,SAAS;EACT,aAAa,cAAc,UAAU,CAAC,qBAAqB,CAAC;EAC5D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,qBAAqB;EACnB,SAAS;EACT,aAAa,cAAc,YAAY,CAAC,qBAAqB,CAAC;EAC9D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,kBAAkB;EAChB,SAAS;EACT,aAAa,cAAc,SAAS,CAAC,qBAAqB,CAAC;EAC3D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,sBAAsB;EACpB,SAAS;EACT,aAAa,cAAc,aAAa,CAAC,qBAAqB,CAAC;EAC/D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,mBAAmB;EACjB,SAAS;EACT,aAAa,cAAc,UAAU,CAAC,qBAAqB,CAAC;EAC5D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,0BAA0B;EACxB,SAAS;EACT,aAAa,cAAc,iBAAiB,CAAC,qBAAqB,CAAC;EACnE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,sBAAsB;EACpB,SAAS;EACT,aAAa,cAAc,aAAa,CAAC,qBAAqB,CAAC;EAC/D;CACF,CAAC;AACL,CAAC,CAAC,CACD,MAAM;;;;;;;;;;;AC5NX,MAAaC,yBAAuB,OAAO,EACzC,SACA,WACA,gBACA,eACA,wBAOI;CAGJ,MAAM,OAAqB;EAAE,MAAM;EAAU,OAAO;EAAI;CAAU;CAElE,MAAM,uBAAqC,UAAU,YAAY;EAC/D,QAAQ,QAAQ,QAAQ,IAAI,kBAAkB,YAAY,OAAO,SAAS,CAAC;EAC3E,OAAO,KAAK,OAAO;CACrB;CAEA,MAAM,UAAwB,SAAS,oBAAoB,eAAe,IAAI,CAAC;CAE/E,MAAM,SAAS,oBAAoB;EAAE;EAAS;EAAM,aAAa,CAAC,MAAM;CAAE,CAAC;CAC3E,MAAM,CAAC,WAAW,WAAW,eAAe,MAAM,QAAQ,IAAI;EAC5D,OAAO,aAAa,EAAE,SAAS,mBAAmB,CAAC;EACnD,OAAO,OAAO,OAAO;EACrB,OAAO,SAAS,eAAe;CACjC,CAAC;CAED,MAAM,QAAQ,YAAY;EAAE;EAAW;CAAkB,CAAC;CAC1D,MAAM,gBAAgB,oBAAoB,EAAE,YAAY,CAAC;CACzD,MAAM,cAAc,kBAAkB;EACpC,cAAc;EACd,cAAc,OAAO,OAAO,OAAO;CACrC,CAAC;CACD,MAAM,oBAAoB,mBAAmB;EAC3C,QAAQ,YAAY;EACpB,OAAO;EACP,YAAY,aAAa;GACvB,uBAAuB,CAAC,QAAQ,WAAW,eAAe,yBAAyB;GACnF,2BAA2B,QAAQ,WAAW,eAAe,yBAAyB;GACtF,oBAAoB,QAAQ,WAAW,eAAe,eAAe;EACvE;CACF,CAAC;CAED,MAAM,UAAyB;EAC7B,SAAS,iBAAiB,OAAO;EACjC;EACA;EACA,IAAI,UAAU;GACZ,OAAO,YAAY,WAAW;EAChC;EACA,IAAI,KAAK;GACP,OAAO,kBAAkB,IAAI;EAC/B;CACF;CAGA,MAAM,UAAU,oBAAoB;EAClC;EACA;EACA,aAAa,cAAc,WAAW,CAAC,QAAQ,YAAY,UAAU,CAAC;CACxE,CAAC;CAED,MAAM,EAAE,QAAQ,UAAU,MAAM,gBAAgB,qBAAqB;EACnE;EACA;EACA,mBAAmB,QAAQ,MAAM;EACjC;EACA,uBAAuB;CACzB,CAAC;CAED,MAAM,MAAM;EACV,eAAe,uBAAuB;GACpC,eAAe;GACf,kBAAkB,SAAS;GAC3B;EACF,CAAC;EACD,KAAK,aAAa,EAAE,iBAAiB,SAAS,UAAU,CAAC;EACzD,eAAe,uBAAuB,EAAE,iBAAiB,SAAS,UAAU,CAAC;EAC7E,SAAS,iBAAiB,EAAE,eAAe,QAAQ,CAAC;EACpD,OAAO,eAAe;GAAE,aAAa,SAAS;GAAO,kBAAkB,SAAS;EAAW,CAAC;EAC5F,WAAW,mBAAmB,EAAE,eAAe,QAAQ,CAAC;CAC1D;CAEA,OAAO;EAAE;EAAS;EAAa;EAAS,GAAG;EAAU;CAAI;AAC3D;;;;;;;;;;;;;;;ACnGA,MAAa,8BAA8B,eAA+C;CACxF,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,eAAe,EAAE,cAAc,MAAM,CAAC;EAErE,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAGvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAI,WAAW,eAAe,UAAU,OAAO;EAEvE,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,eAAe,EAAE,cAAc,KAAK,CAAC;GAExE,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAI,WAAW,eAAe,UAAU,WAAW;GAExE,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IAEnB,IAAI,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;ACxCA,MAAM,cAAc;AAEpB,MAAM,yBAAyBC,IAAE,OAAO;CACtC,SAASA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAWA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,cAAcA,IAAE,OAAO,CAAC,CAAC,SAAS;AACpC,CAAC;AAID,MAAM,0BAA4C;CAChD,SAAS;CACT,WAAW;CACX,cAAc;AAChB;AAEA,MAAa,0BAA0B,YACrC,gBAAkC;CAChC;CACA,KAAK;CACL,QAAQ;CACR,cAAc;AAChB,CAAC;;;ACRH,MAAa,iBAAiB,UAA0B,CAAC,MAAM;CAC7D,MAAM,YAAY,uBAAuB,QAAQ,OAAO;CACxD,MAAM,SAASC,eAAa;CAC5B,MAAM,gBAAgB,oBAAoB,QAAQ,WAAW;CAI7D,MAAM,kBAAkB,sBAAsB,EAC5C,cAAc,UACZ,iBAAiB,YAAY,MAAM,SAAS,WAAW,WAAW,oBACtE,CAAC;CAKD,MAAM,iBAAiB,mBAAmB;EACxC,QAAQ,OAAO;EACf,YAAY,UAAU,MAAM;EAC5B,QAAQ,YACN,UACI,iBAAiB;GAAE;GAAS,aAAa,cAAc,QAAQ,CAAC,eAAe,CAAC;EAAE,CAAC,IACnF;CACR,CAAC;CAED,MAAM,UAAU,YAAY;EAC1B,MAAM,SAAS,eAAe,IAAI;EAClC,SAAO,QAAQ,iBAAiB,QAAQ;EACxC,MAAM,YAAY,MAAM,OAAO,MAAM,QAAQ,OAAO,kBAAkB,CAAC,CAAC,YAAY;EACpF,OAAO,aAAa,SAAS;EAC7B,OAAO,UAAU;CACnB;CAGA,MAAM,iBAAiB;EACrB,MAAM,QAAQ,OAAO,MAAM,IAAI;EAC/B,IAAI,MAAM,WAAW,aAAa,OAAO;EACzC,MAAM,EAAE,aAAa,UAAU,cAAc,MAAM;EACnD,OAAO;GAAE;GAAa,QAAQ;IAAE;IAAU;GAAU;EAAE;CACxD;CAEA,MAAM,gBAAgB;EACpB,OAAO,MAAM;EACb,UAAU,MAAM;CAClB;CAIA,MAAM,yBAAyB;EAC7B,IAAI,OAAO,cAAc,GAAG,QAAQ;CACtC;CAEA,MAAM,aAAa,uBAAuB;EAAE;EAAS;EAAU;CAAiB,CAAC;CACjF,MAAM,iBAAiB,2BAA2B,UAAU;CAK5D,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,UAAU,MAAM;EAC5B,QAAQ,YACN,UACI,iBAAiB;GACf;GACA,aAAa,cAAc,QAAQ,CAAC,iBAAiB,cAAc,CAAC;EACtE,CAAC,IACD;CACR,CAAC;CAKD,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,UAAW,MAAM,WAAW,cAAc,OAAO,MAAM;EACnE,QAAQ,YACN,UACI,uBAAuB;GACrB;GACA,MAAM;IAAE,MAAM;IAAU,OAAO;GAAG;GAClC,aAAa,cAAc,cAAc,CAAC,cAAc,CAAC;EAC3D,CAAC,IACD;CACR,CAAC;CAED,MAAM,sBAAsB,wBAAwB;EAClD,QAAQ,OAAO;EAEf,YAAY,UACV,MAAM,WAAW,WAAW;GAAE,SAAS,MAAM;GAAS,WAAW,MAAM;EAAU,IAAI;EACvF,QAAQ,EAAE,SAAS,gBAAgB;GACjC,OAAOC,uBAAqB;IAC1B;IACA;IACA;IACA;IACA,mBAAmB,QAAQ;GAC7B,CAAC;EACH;CACF,CAAC;CAED,IAAI,QAAQ,SAAS,OAAO,WAAW,QAAQ,OAAO;CAMtD,OAAO,MAAM,WAAW,UAAU;EAChC,IAAI,MAAM,WAAW,aAAa;EAElC,UAAU,QAAQ;GAChB,SAAS,MAAM;GACf,WAAW,MAAM,WAAW,WAAW,MAAM,YAAY;GACzD,cAAc,MAAM,WAAW;EACjC,CAAC;CACH,CAAC;CAED,MAAM,eAAgC;EACpC,MAAM;EACN,QAAQ,OAAO,MAAM;EACrB,WAAW,WAAW,IAAI,MAAM;EAChC,iBAAiB,WAAW,IAAI,MAAM;EACtC,SAAS,oBAAoB,MAAM,IAAI,CAAC,CAAC;CAC3C;CAEA,MAAM,UAAU;EACd,mBAAmB,UAAU;EAC7B,YAAY,OAAO;EACnB,sBAAsB,oBAAoB,MAAM,IAAI,CAAC,CAAC,UAAU;EAChE,eAAe,WAAqB,OAAO,aAAa,MAAM;EAC9D,YAAY,OAAO;EACnB,iBAAiB,OAAO,cAAsB;GAC5C,OAAO,aAAa,SAAS;GAC7B,MAAM,oBAAoB,QAAQ;EACpC;;;;;;;EAOA,cAAc,OAAO;EACrB,OAAO;;;;;;EAMP,mBAAmB,OAAO;;;;;;;;;;;;;EAa1B,gBAAgB,YAA6C;GAC3D,MAAM,QAAQ,OAAO,MAAM,IAAI;GAC/B,IAAI,MAAM,WAAW,aAAa,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;GAG1F,IAAI,MAAM,WAAW,UAAU,MAAM,IAAI,aAAa,iBAAiB,QAAQ;GAE/E,MAAM,cAAc,MAAM,WAAW,eAAe;GAGpD,SAAO,aAAa,iBAAiB,gBAAgB;GAErD,OAAO;KACJ,WAAW,gBAAgB,UAAU;KACrC,kBAAkB,aAAa,OAAO,MAAM,SAAS;GACxD;EACF;EAEA,SAAS,YAAoC;GAC3C,MAAM,YAAY,UAAU,QAAQ;GAEpC,IAAI,CAAC,UAAU,gBAAgB,CAAC,UAAU,SAAS,OAAO,EAAE,QAAQ,QAAQ;GAK5E,MAAM,aAAa,OAAO,WAAW;GACrC,IAAI,cAAc,eAAe,UAAU,SAAS;IAClD,UAAU,MAAM;IAChB,OAAO,EAAE,QAAQ,QAAQ;GAC3B;GACA,IAAI,CAAC,YAAY,OAAO,WAAW,UAAU,OAAO;GAGpD,MAAM,SAAS,eAAe,IAAI;GAClC,SAAO,QAAQ,iBAAiB,QAAQ;GACxC,IAAI;IACF,MAAM,YAAY,MAAM,OAAO,MAAM,QAAQ,UAAU,YAAY;IACnE,OAAO,aAAa,SAAS;IAC7B,IAAI,UAAU,cAAc,MAAM;KAChC,OAAO,aAAa,UAAU,SAAS;KACvC,MAAM,oBAAoB,QAAQ;IACpC;IACA,OAAO,EAAE,QAAQ,WAAW;GAC9B,SAAS,KAAK;IACZ,IAAI,eAAe,GAAG,GAAG;KACvB,UAAU,MAAM;KAChB,OAAO,EAAE,QAAQ,UAAU;IAC7B;IACA,MAAM;GACR;EACF;EACA,YAAY,aAAkD;GAE5D,MAAM,oBAAoB,OAAO,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACxE,MAAM,mBAAmB,oBAAoB,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACpF,aAAa;IACX,kBAAkB;IAClB,iBAAiB;GACnB;EACF;EACA;CACF;CAWA,OAAO;EAAE,KATG,UAAU;GACpB,qBAAqB,WAAW,IAAI;GACpC,2BAA2B,WAAW,IAAI;GAC1C,yBAAyB;IACvB,MAAM,QAAQ,oBAAoB,MAAM,IAAI;IAC5C,OAAO,MAAM,UAAU,UAAU,MAAM,QAAQ;GACjD;EACF,CAEW;EAAG;CAAQ;AACxB;;;ACnPA,MAAa,qBAAqB;CAChC,MAAM,QAAQ,YAAmB;EAAE,SAAS;EAAM,WAAW;EAAM,iBAAiB;CAAK,CAAC;CAE1F,MAAM,cAAc,YAAoB;EACtC,MAAM,IAAI;GAAE,GAAG,MAAM,IAAI;GAAG;EAAQ,CAAC;CACvC;CAEA,MAAM,gBAAgB,WAA6D;EACjF,MAAM,UAAU,MAAM,IAAI;EAC1B,MAAM,IAAI;GACR,GAAG;GACH,WAAW,OAAO,aAAa,QAAQ;GACvC,iBAAiB,OAAO,mBAAmB,QAAQ;EACrD,CAAC;CACH;CAKA,MAAM,wBAAwB,MAAM,IAAI,CAAC,CAAC,aAAa;CACvD,MAAM,mBAAmB,cAAsB,MAAM,IAAI;EAAE,GAAG,MAAM,IAAI;EAAG;CAAU,CAAC;;CAGtF,MAAM,cAAqB,MAAM,IAAI;CAErC,OAAO;EAAE;EAAO;EAAY;EAAc;EAAiB;EAAiB;CAAM;AACpF;;;AClBA,MAAM,4BACH,cACA,UACA,YAAY;CACX,QAAQ,QAAQ,QAAQ,IAAI,kBAAkB,mBAAmB,SAAS,CAAC;CAC3E,OAAO,KAAK,OAAO;AACrB;AAUF,MAAa,uBAAuB,OAAO,EACzC,SACA,iBACA,yBACA,eACA,wBACa;CACb,MAAM,OAAqB;EAAE,MAAM;EAAc,OAAO,gBAAgB;CAAE;CAE1E,MAAM,SAAS,yBAAyB,eAAe;CACvD,MAAM,WAAW,oBAAoB;EAAE;EAAS;EAAM,aAAa,CAAC,MAAM;CAAE,CAAC;CAC7E,MAAM,CAAC,WAAW,WAAW,eAAe,MAAM,QAAQ,IAAI;EAC5D,SAAS,aAAa,EAAE,SAAS,mBAAmB,CAAC;EACrD,SAAS,OAAO,OAAO;EACvB,SAAS,SAAS,eAAe;CACnC,CAAC;CAED,MAAM,QAAQ,YAAY;EAAE;EAAW;CAAkB,CAAC;CAC1D,MAAM,gBAAgB,oBAAoB,EAAE,YAAY,CAAC;CACzD,MAAM,cAAc,kBAAkB;EACpC,cAAc;EACd,cAAc,SAAS,OAAO,OAAO;CACvC,CAAC;CACD,MAAM,oBAAoB,mBAAmB;EAC3C,QAAQ,YAAY;EACpB,OAAO;EACP,YAAY,aAAa;GACvB,uBAAuB,CAAC,QAAQ,WAAW,eAAe,yBAAyB;GACnF,2BAA2B,QAAQ,WAAW,eAAe,yBAAyB;GACtF,oBAAoB,QAAQ,WAAW,eAAe,eAAe;EACvE;CACF,CAAC;CACD,MAAM,UAAyB;EAC7B,SAAS,iBAAiB,OAAO;EACjC;EACA;EACA,IAAI,UAAU;GACZ,OAAO,YAAY,WAAW;EAChC;EACA,IAAI,KAAK;GACP,OAAO,kBAAkB,IAAI;EAC/B;CACF;CAGA,MAAM,UAAU,oBAAoB;EAClC;EACA;EACA,aAAa,cAAc,WAAW,CAAC,YAAY,UAAU,CAAC;EAC9D,gBAAgB;CAClB,CAAC;CAED,MAAM,EAAE,QAAQ,UAAU,MAAM,gBAAgB,qBAAqB;EACnE;EACA;EACA,mBAAmB,QAAQ,MAAM;EACjC;EACA,uBAAuB;CACzB,CAAC;CAED,MAAM,MAAM;EACV,eAAe,uBAAuB;GACpC,eAAe;GACf,kBAAkB,SAAS;GAC3B;EACF,CAAC;EACD,KAAK,aAAa,EAAE,iBAAiB,SAAS,UAAU,CAAC;EACzD,eAAe,uBAAuB,EAAE,iBAAiB,SAAS,UAAU,CAAC;EAC7E,SAAS,iBAAiB,EAAE,eAAe,QAAQ,CAAC;EACpD,OAAO,eAAe;GAAE,aAAa,SAAS;GAAO,kBAAkB,SAAS;EAAW,CAAC;EAC5F,WAAW,mBAAmB,EAAE,eAAe,QAAQ,CAAC;CAC1D;CAEA,OAAO;EAAE;EAAS;EAAa;EAAS,GAAG;EAAU;CAAI;AAC3D;;;AChGA,MAAa,uBAAuB,UAA0B,CAAC,MAAM;CACnE,MAAM,SAAS,aAAa;CAC5B,MAAM,gBAAgB,oBAAoB,QAAQ,WAAW;CAM7D,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,UAAU,MAAM;EAC5B,QAAQ,YACN,UAAU,iBAAiB;GAAE;GAAS,aAAa,cAAc,QAAQ,CAAC,CAAC;EAAE,CAAC,IAAI;CACtF,CAAC;CAED,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,WAAW;GAAE,SAAS,MAAM;GAAS,OAAO,MAAM;EAAgB;EAC9E,QAAQ,EAAE,SAAS,YACjB,UACI,uBAAuB;GACrB;GACA,MAAM,QAAQ;IAAE,MAAM;IAAoB;GAAM,IAAI,EAAE,MAAM,mBAAmB;GAC/E,aAAa,cAAc,cAAc,CAAC,CAAC;EAC7C,CAAC,IACD;CACR,CAAC;CAED,MAAM,QAAQ,wBAAuD;EACnE,QAAQ,OAAO;EACf,YAAY,UAAW,MAAM,aAAa,MAAM,UAAU,MAAM,UAAU;EAC1E,QAAQ,YACN,qBAAqB;GACnB;GACA,iBAAiB,OAAO;GACxB,yBAAyB,OAAO;GAChC;GACA,mBAAmB,QAAQ;EAC7B,CAAC;CACL,CAAC;CAED,IAAI,QAAQ,SAAS,OAAO,WAAW,QAAQ,OAAO;CAEtD,MAAM,cAA+B;EACnC,MAAM,OAAO,OAAO,MAAM;EAC1B,OAAO;GACL,MAAM;GACN,QAAQ;GACR,WAAW,WAAW,IAAI,MAAM;GAChC,iBAAiB,CAAC,CAAC,KAAK;GACxB,SAAS,MAAM,MAAM,IAAI,CAAC,CAAC;EAC7B;CACF;CAEA,MAAM,UAAU;EACd,YAAY,OAAO;EACnB,sBAAsB,MAAM,MAAM,IAAI,CAAC,CAAC,UAAU;EAClD,sBAAsB,cAAsB,OAAO,aAAa,EAAE,UAAU,CAAC;EAC7E,0BAA0B,OAAO,cAAsB;GACrD,OAAO,aAAa,EAAE,UAAU,CAAC;GAEjC,MAAM,MAAM,QAAQ;EACtB;EACA,yBAAyB,oBAA4B,OAAO,aAAa,EAAE,gBAAgB,CAAC;EAC5F,YAAY,aAAkD;GAE5D,MAAM,oBAAoB,OAAO,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACxE,MAAM,mBAAmB,MAAM,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACtE,aAAa;IACX,kBAAkB;IAClB,iBAAiB;GACnB;EACF;EACA;CACF;CAWA,OAAO;EAAE,KATG,UAAU;GACpB,qBAAqB,WAAW,IAAI;GACpC,2BAA2B,WAAW,IAAI;GAC1C,yBAAyB;IACvB,MAAM,QAAQ,MAAM,MAAM,IAAI;IAC9B,OAAO,MAAM,UAAU,UAAU,MAAM,QAAQ;GACjD;EACF,CAEW;EAAG;CAAQ;AACxB"}
+{"version":3,"file":"index.js","names":["assert","createConfig","createProjectClients","z","createConfig","createProjectClients"],"sources":["../src/utils/assert.ts","../src/utils/async/coalesce.ts","../src/utils/store/derivedStore.ts","../src/utils/store/derivedAsyncStore.ts","../src/utils/async/poll/registry.ts","../src/utils/deepMerge.ts","../src/utils/persistor/adapters.ts","../src/utils/persistor/persistor.ts","../src/keboola/createLiveProject.ts","../src/keboola/errors.ts","../src/middlewares/loggingMiddleware.ts","../src/middlewares/retryMiddleware.ts","../src/serviceClientRegistry/utils.ts","../src/serviceClientRegistry/createServiceClientRegistry.ts","../src/keboola/createApi.ts","../src/keboola/createMiddlewareFor.ts","../src/keboola/bearer/createConfig.ts","../src/domain/defaultBranch.ts","../src/domain/stack.ts","../src/sdks/variables/variablesSdk.ts","../src/keboola/createServiceClients.ts","../src/keboola/bearer/createProjectClients.ts","../src/keboola/bearer/middleware.ts","../src/keboola/bearer/persistor.ts","../src/keboola/bearer/keboola.ts","../src/keboola/legacy/createConfig.ts","../src/keboola/legacy/createProjectClients.ts","../src/keboola/legacy/keboola.ts"],"sourcesContent":["export function assert<T>(value: T | undefined | null, message: string): asserts value is T {\n  if (value == null) {\n    throw new Error(message);\n  }\n}\n","import type { TaskFn } from './types';\n\n/**\n * Coalesces concurrent triggers onto a single, never-parallel run of `task`.\n * Triggers fired while a run is busy collapse into one trailing run, and each\n * resolves with the first run that started after it — so it never sees stale state.\n *\n * Example — A triggers, then B and C trigger while A's run is still going:\n *   1. trigger A      → run #1 starts\n *   2. trigger B, C   → run #1 busy, so they wait\n *   3. run #1 done    → A resolves\n *   4. run #2 starts  → covers B and C together (one trailing run, not two)\n *   5. run #2 done    → B and C resolve\n *\n * @returns a trigger; each call returns a promise of the task result.\n * @throws The returned promise rejects with whatever `task` throws or rejects\n * with — the caller handles it (try/catch, or `.catch` on `void trigger()`).\n */\nexport const coalesce = <T>(task: TaskFn<T>): (() => Promise<Awaited<T>>) => {\n  let running = false;\n  const waiters: PromiseWithResolvers<Awaited<T>>[] = [];\n\n  const drain = async () => {\n    running = true;\n    const batch = waiters.splice(0);\n\n    try {\n      const result = await task();\n      batch.forEach((waiter) => waiter.resolve(result));\n    } catch (error) {\n      batch.forEach((waiter) => waiter.reject(error));\n    }\n    // Drain any triggers that arrived during the task; tail position, so no stack growth.\n    if (waiters.length > 0) return drain();\n    running = false;\n  };\n\n  return () => {\n    const waiter = Promise.withResolvers<Awaited<T>>();\n    waiters.push(waiter);\n    if (!running) void drain();\n    return waiter.promise;\n  };\n};\n","import { createStore, type ReadableStore } from './store';\n\nconst isPlainObjectOrArray = (value: object): boolean => {\n  if (Array.isArray(value)) return true;\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n};\n\nexport const shallowEqual = <T>(a: T, b: T): boolean => {\n  if (Object.is(a, b)) return true;\n  if (typeof a !== 'object' || a === null || typeof b !== 'object' || b === null) return false;\n  if (!isPlainObjectOrArray(a) || !isPlainObjectOrArray(b)) return false;\n  const aKeys = Object.keys(a) as (keyof T)[];\n  const bKeys = Object.keys(b) as (keyof T)[];\n  return aKeys.length === bKeys.length && aKeys.every((key) => Object.is(a[key], b[key]));\n};\n\ntype DerivedStoreOptions<S, K, T> = {\n  source: ReadableStore<S>;\n  dependsOn: (state: S) => K;\n  build: (key: K) => T;\n  keyEquals?: (a: K, b: K) => boolean;\n};\n\nexport const createDerivedStore = <S, K, T>({\n  source,\n  dependsOn,\n  build,\n  keyEquals = shallowEqual,\n}: DerivedStoreOptions<S, K, T>): ReadableStore<T> => {\n  let key = dependsOn(source.get());\n  const store = createStore(build(key));\n\n  // The source subscription lives for the derived store's lifetime (both normally live as long as\n  // the client). `dispose()` tears down both it and the derived store, so a short-lived derived\n  // store can be cleaned up without leaking the source subscription or taking stale updates.\n  const unsubscribe = source.subscribe((state) => {\n    const next = dependsOn(state);\n    if (keyEquals(key, next)) return;\n    key = next;\n    store.set(build(next));\n  });\n\n  const get = store.get;\n\n  const subscribe = store.subscribe;\n\n  const dispose = () => {\n    unsubscribe();\n    store.dispose();\n  };\n\n  return { get, subscribe, dispose };\n};\n","import { shallowEqual } from './derivedStore';\nimport { createStore, type ReadableStore } from './store';\n\nexport type AsyncState<T> =\n  | { state: 'idle' }\n  | { state: 'pending' }\n  | { state: 'ready'; value: T }\n  | { state: 'errored'; error: unknown };\n\n// The terminal states `settled()` resolves with.\ntype SettledState<T> = Extract<AsyncState<T>, { state: 'ready' } | { state: 'errored' }>;\n\ntype DerivedAsyncStoreOptions<S, K, T> = {\n  source: ReadableStore<S>;\n  dependsOn: (state: S) => K | null;\n  build: (key: K, signal: AbortSignal) => Promise<T>;\n  keyEquals?: (a: K, b: K) => boolean;\n};\n\n// The async sibling of `createDerivedStore`: it derives a value that arrives later, exposed as an\n// `AsyncState<T>` cell. Two switchMap-style guarantees keep concurrent rebuilds honest:\n//   - generation guard: only the latest run may write state, so a stale build resolving after a\n//     newer key can never clobber the fresh result;\n//   - AbortController: a re-key (or a null key) aborts the previous run's `signal` so in-flight work\n//     can actually stop.\n// `dependsOn` returning `null` means \"nothing to build\" → the store goes `idle` and any in-flight run\n// is aborted. Like `createDerivedStore`, the subscription is permanent for the store's lifetime.\n//\n// Returns `{ store, settled }`: `store` is the reactive `AsyncState<T>` cell; `settled()` resolves\n// on the next terminal state with that state (`ready` or `errored`) — the awaitable bridge for\n// callers that need to `await` the build rather than react to it. It never rejects: a failed build\n// is data (`{ state: 'errored', error }`), so callers handle it the same way whether they await or\n// subscribe. Settles immediately if the store is already terminal; while `idle`/`pending` it waits.\nexport const createDerivedAsyncStore = <S, K, T>({\n  source,\n  dependsOn,\n  build,\n  keyEquals = shallowEqual,\n}: DerivedAsyncStoreOptions<S, K, T>): {\n  store: ReadableStore<AsyncState<T>>;\n  settled: () => Promise<SettledState<T>>;\n} => {\n  const store = createStore<AsyncState<T>>({ state: 'idle' });\n  let currentKey: K | null = null;\n  let generation = 0;\n  let controller: AbortController | null = null;\n\n  const run = (key: K) => {\n    controller?.abort();\n    controller = new AbortController();\n    const runGeneration = ++generation;\n    store.set({ state: 'pending' });\n    // `.then(onFulfilled, onRejected)` — the reject handler consumes every rejection (including the\n    // AbortError from a superseded run), so nothing goes unhandled; the generation guard drops the\n    // stale write either way.\n    build(key, controller.signal).then(\n      (value) => {\n        if (runGeneration === generation) store.set({ state: 'ready', value });\n      },\n      (error) => {\n        if (runGeneration === generation) store.set({ state: 'errored', error });\n      },\n    );\n  };\n\n  const sync = (state: S) => {\n    const next = dependsOn(state);\n    if (next === null) {\n      if (currentKey === null) return;\n      controller?.abort();\n      controller = null;\n      generation += 1;\n      currentKey = null;\n      store.set({ state: 'idle' });\n      return;\n    }\n    if (currentKey !== null && keyEquals(currentKey, next)) return;\n    currentKey = next;\n    run(next);\n  };\n  sync(source.get());\n\n  const unsubscribe = source.subscribe(sync);\n\n  const get = store.get;\n\n  const subscribe = store.subscribe;\n\n  const dispose = () => {\n    controller?.abort();\n    unsubscribe();\n    store.dispose();\n  };\n\n  const readable: ReadableStore<AsyncState<T>> = { get, subscribe, dispose };\n\n  const settled = (): Promise<SettledState<T>> =>\n    new Promise<SettledState<T>>((resolve) => {\n      let unsubscribeSettled = () => {};\n      const check = (state: AsyncState<T>) => {\n        if (state.state === 'ready' || state.state === 'errored') {\n          unsubscribeSettled();\n          resolve(state);\n        }\n      };\n      unsubscribeSettled = store.subscribe(check);\n      check(store.get());\n    });\n\n  return { store: readable, settled };\n};\n","import { createStore } from '../../store';\n\nimport {\n  emitter,\n  type ObservedPoller,\n  type PollerStartFn,\n  type PollerStopFn,\n  type PollSnapshot,\n} from './poll';\nimport { clamp, finiteOr } from './utils';\n\nconst DEFAULT_LIMIT = 50;\n\nexport type PollEntry = {\n  /** Monotonic, so a list has a key that outlives a re-render. */\n  key: number;\n  startedAt: number;\n  snapshot: PollSnapshot;\n  stop: PollerStopFn;\n  start: PollerStartFn<unknown>;\n};\n\nexport type PollRegistry = {\n  list: () => PollEntry[];\n  subscribe: (listener: () => void) => () => void;\n  clear: () => void;\n  stopAll: (reason?: string) => void;\n  collect: () => void;\n};\n\nconst isFinished = ({ snapshot }: PollEntry) =>\n  snapshot.state !== 'idle' && snapshot.state !== 'polling';\n\nexport const createPollRegistry = ({ limit = DEFAULT_LIMIT } = {}): PollRegistry => {\n  const entries = createStore<PollEntry[]>([]);\n  const unsubscribes = new Map<number, () => void>();\n\n  const maxEntries = clamp(finiteOr(limit, DEFAULT_LIMIT), 1);\n  let nextKey = 1;\n\n  const forget = (key: number) => {\n    unsubscribes.get(key)?.();\n    unsubscribes.delete(key);\n  };\n\n  const trim = (list: PollEntry[]) => {\n    let kept = list;\n\n    while (kept.length > maxEntries) {\n      const dropped = kept.findLast(isFinished) ?? kept.at(-1);\n\n      if (!dropped) break;\n\n      forget(dropped.key);\n      kept = kept.filter((entry) => entry !== dropped);\n    }\n\n    return kept;\n  };\n\n  const replace = (key: number, snapshot: PollSnapshot) =>\n    entries.set(entries.get().map((entry) => (entry.key === key ? { ...entry, snapshot } : entry)));\n\n  const register = (poller: ObservedPoller) => {\n    const key = nextKey++;\n    const entry: PollEntry = {\n      key,\n      startedAt: Date.now(),\n      snapshot: poller.debug(),\n      stop: poller.stop,\n      start: poller.start,\n    };\n\n    unsubscribes.set(\n      key,\n      poller.subscribe((snapshot) => replace(key, snapshot)),\n    );\n    entries.set(trim([entry, ...entries.get()]));\n  };\n\n  const collect = () => {\n    emitter.subscribe(register);\n  };\n\n  return {\n    list: entries.get,\n    collect,\n    subscribe: (listener) => entries.subscribe(() => listener()),\n    clear: () => {\n      entries.get().forEach(({ key }) => forget(key));\n      entries.set([]);\n    },\n    stopAll: (reason) => entries.get().forEach((entry) => entry.stop(reason)),\n  };\n};\n","import { isPlainObject } from './isPlainObject';\n\n/**\n * Recursively merge `patch` into `base`. Plain-object values are merged key-by-key; every\n * other value (primitives, arrays, or a type mismatch between the two sides) replaces the\n * base value. `undefined` patch values are skipped, so a partial patch leaves untouched\n * fields alone. Pure — neither argument is mutated; the result preserves `base`'s type.\n */\nexport const deepMerge = <T extends Record<string, unknown>>(\n  base: T,\n  patch: Record<string, unknown>,\n): T => {\n  const out: Record<string, unknown> = { ...base };\n\n  for (const [key, value] of Object.entries(patch)) {\n    if (value === undefined) continue;\n    const current = out[key];\n    out[key] = isPlainObject(current) && isPlainObject(value) ? deepMerge(current, value) : value;\n  }\n\n  return out as T;\n};\n","// Minimal, synchronous key/value contract — the Web Storage shape (`localStorage`/`sessionStorage`)\n// narrowed to what a persistor needs. Framework- and environment-agnostic.\nexport type StorageAdapter = {\n  getItem: (key: string) => string | null;\n  setItem: (key: string, value: string) => void;\n  removeItem: (key: string) => void;\n};\n\n// Persist nowhere: reads always miss, writes are dropped. The default when no storage is configured,\n// so a persistor is always constructable and simply becomes a no-op.\nexport const createNullStorage = (): StorageAdapter => ({\n  getItem: () => null,\n  setItem: () => {},\n  removeItem: () => {},\n});\n\n// In-process Map, living for the lifetime of the process. The Node default and the fallback the\n// Web Storage adapters degrade to when `localStorage`/`sessionStorage` is unavailable (SSR).\nexport const createMemoryStorage = (): StorageAdapter => {\n  const store = new Map<string, string>();\n  return {\n    getItem: (key) => store.get(key) ?? null,\n    setItem: (key, value) => {\n      store.set(key, value);\n    },\n    removeItem: (key) => {\n      store.delete(key);\n    },\n  };\n};\n\n// Wrap a Web Storage instance, degrading to memory when it is absent OR unusable. Merely accessing\n// the global (sandboxed iframe) or calling its methods (privacy mode, disabled/blocked storage) can\n// throw, so a canary write probes real usability at construction; any failure falls back to an\n// in-memory store so persistence never crashes the caller. Resolution happens when the factory is\n// called (not at import), so importing this module never touches browser globals.\nconst createWebStorage = (pick: () => Storage | null): StorageAdapter => {\n  let web: Storage | null = null;\n  try {\n    web = pick();\n    if (web) {\n      const probe = '__keboola_storage_probe__';\n      web.setItem(probe, probe);\n      web.removeItem(probe);\n    }\n  } catch (err) {\n    console.warn('createWebStorage: web storage unavailable, falling back to memory', err);\n    web = null;\n  }\n  if (!web) return createMemoryStorage();\n\n  const storage = web;\n  return {\n    getItem: (key) => storage.getItem(key),\n    setItem: (key, value) => {\n      storage.setItem(key, value);\n    },\n    removeItem: (key) => {\n      storage.removeItem(key);\n    },\n  };\n};\n\nexport const createLocalStorage = (): StorageAdapter =>\n  createWebStorage(() => ('localStorage' in globalThis ? globalThis.localStorage : null));\n\nexport const createSessionStorage = (): StorageAdapter =>\n  createWebStorage(() => ('sessionStorage' in globalThis ? globalThis.sessionStorage : null));\n","import { createNullStorage, type StorageAdapter } from './adapters';\n\n// A zod-compatible, structurally-typed validator. Kept structural so this package needs no zod\n// dependency — any schema exposing `safeParse` (e.g. a zod schema) satisfies it.\ntype Schema<T> = {\n  safeParse: (value: unknown) => { success: true; data: T } | { success: false };\n};\n\nexport type Persistor<T> = {\n  /** Read + validate the stored value; returns `defaultValue` when empty or corrupt. */\n  hydrate: () => T;\n  /** Serialize + write the value. */\n  persist: (value: T) => void;\n  /** Remove the stored value. */\n  clear: () => void;\n  /** Whether a value is currently persisted under the key. */\n  hasPersistedValue: () => boolean;\n};\n\ntype PersistorOptions<T> = {\n  storage?: StorageAdapter;\n  key: string;\n  schema: Schema<T>;\n  defaultValue: T;\n  encode?: (value: T) => string;\n  decode?: (raw: string) => unknown;\n};\n\n// A durable cell over a `StorageAdapter`: one key, encoded on write and validated on read. `hydrate`\n// is total — it never returns null and never throws: empty, unreadable, corrupt, or schema-invalid\n// storage all yield the caller-supplied `defaultValue`, so callers need no null-checks. `persist` and\n// `clear` are best-effort — a failing `encode()` (e.g. circular JSON) or a throwing adapter (quota,\n// blocked/privacy-mode storage) is logged and swallowed rather than crashing the caller. The schema\n// validates stored data only; give fields `.default(...)` to patch partial blobs instead of discarding.\nexport const createPersistor = <T>({\n  storage = createNullStorage(),\n  key,\n  schema,\n  defaultValue,\n  encode = JSON.stringify,\n  decode = JSON.parse,\n}: PersistorOptions<T>): Persistor<T> => {\n  // Best-effort key removal — adapters can throw (blocked storage), and dropping a corrupt entry must\n  // never take down `hydrate`.\n  const clear = (): void => {\n    try {\n      storage.removeItem(key);\n    } catch (err) {\n      console.warn(`createPersistor: failed to clear \"${key}\"`, err);\n    }\n  };\n\n  // Callers use this to decide synchronously (during render) whether a restore is worth waiting for,\n  // so a throwing adapter must read as \"nothing stored\" rather than propagate.\n  const hasPersistedValue = (): boolean => {\n    try {\n      return !!storage.getItem(key);\n    } catch (err) {\n      console.warn(`createPersistor: failed to read \"${key}\", assuming empty`, err);\n      return false;\n    }\n  };\n\n  const hydrate = (): T => {\n    let raw: string | null;\n    try {\n      raw = storage.getItem(key);\n    } catch (err) {\n      console.warn(`createPersistor: failed to read \"${key}\", using default`, err);\n      return defaultValue;\n    }\n    if (raw === null) return defaultValue;\n\n    let decoded: unknown;\n    try {\n      decoded = decode(raw);\n    } catch (err) {\n      console.warn(`createPersistor: failed to decode \"${key}\", resetting`, err);\n      clear();\n      return defaultValue;\n    }\n\n    const parsed = schema.safeParse(decoded);\n    if (parsed.success) return parsed.data;\n    clear();\n    return defaultValue;\n  };\n\n  const persist = (value: T): void => {\n    let raw: string;\n    try {\n      raw = encode(value);\n    } catch (err) {\n      console.warn(`createPersistor: failed to encode \"${key}\", not persisting`, err);\n      return;\n    }\n    try {\n      storage.setItem(key, raw);\n    } catch (err) {\n      console.warn(`createPersistor: failed to write \"${key}\"`, err);\n    }\n  };\n\n  return { hydrate, persist, clear, hasPersistedValue };\n};\n","import type { StorageToken } from '../clients/storage/types';\nimport type { createDefaultBranch } from '../domain/defaultBranch';\nimport { createProject, type Project } from '../domain/project';\nimport type { createStack } from '../domain/stack';\nimport type { createStorageTable } from '../domain/storageTable';\nimport type { MiddlewareFn } from '../fetchClient';\nimport { coalesce, createStore } from '../utils';\n\n// Storage API endpoints that mutate fields carried by the verified token, so the\n// live project must re-verify after them. Each pattern is matched against the URL pathname.\nconst STORAGE_TOKEN_MUTATING_PATTERNS = [\n  // Bucket lifecycle (create / delete / register) — changes token.bucketPermissions.\n  // At most one trailing segment, so sub-resources (tables, listing, metadata, refresh)\n  // under /buckets/{id}/... don't trigger a re-verify.\n  /\\/buckets(\\/[^/]+)?$/,\n  // Project feature toggles — changes token.owner.features. Anchored to\n  // /projects/{id}/features so /manage/features and /users/{id}/features don't match.\n  /\\/projects\\/[^/]+\\/features(\\/[^/]+)?$/,\n];\n\nexport const isStorageTokenMutatingRequest = (request: Request): boolean => {\n  if (request.method === 'GET') return false;\n  const { pathname } = new URL(request.url);\n  return STORAGE_TOKEN_MUTATING_PATTERNS.some((pattern) => pattern.test(pathname));\n};\n\nconst createProjectRefreshMiddleware =\n  (\n    shouldRefresh: (request: Request) => boolean,\n    requestRefresh: () => Promise<void>,\n  ): MiddlewareFn =>\n  (next) =>\n  async (request) => {\n    const response = await next(request);\n    // Await the re-verify before resolving the mutating request, so a caller that\n    // reads `api.context.project` right after it can never observe pre-mutation state.\n    if (shouldRefresh(request.request)) await requestRefresh();\n    return response;\n  };\n\n/**\n * The live project store: seeded from the verified token, re-verified (coalesced) after a\n * token-mutating request or an explicit re-scope. Its `middleware` drives the auto re-verify.\n */\nexport const createLiveProject = ({\n  initialToken,\n  verify,\n}: {\n  initialToken: StorageToken;\n  verify: () => Promise<StorageToken>;\n}) => {\n  const store = createStore(createProject({ sapiToken: initialToken }));\n  const refresh = coalesce(async () => store.set(createProject({ sapiToken: await verify() })));\n  const middleware = createProjectRefreshMiddleware(isStorageTokenMutatingRequest, refresh);\n  return { store, getProject: () => store.get(), subscribe: store.subscribe, middleware, refresh };\n};\n\nexport type ClientContext = {\n  /**\n   * The stack this client is configured against, canonical form (absolute, no trailing slash) — the\n   * `baseUrl` every request is built on. Distinct from `stack.host`, which is the index response's\n   * own `host` field: the API pod that served the request (`connection-api-756b66f7c8-ql5sr`), not a\n   * stack hostname. It varies between two calls to the same stack and is never used to route a\n   * request. For the stack's hostname, look the stack id up in `STACKS` (`@keboola/api-client/constants`).\n   */\n  baseUrl: string;\n  stack: ReturnType<typeof createStack>;\n  defaultBranch: ReturnType<typeof createDefaultBranch>;\n  readonly project: Project;\n  readonly st: ReturnType<typeof createStorageTable>;\n};\n","/**\n * The single error the keboola client / session throws. It carries a stable `type` (the switchable\n * contract) and a human-readable message derived from that type — no per-call message strings.\n */\nexport const KeboolaErrorType = {\n  Unconfigured: 'unconfigured',\n  NotAuthenticated: 'not-authenticated',\n  AlreadyAuthenticated: 'already-authenticated',\n  NoStorageToken: 'no-storage-token',\n  NoManagementToken: 'no-management-token',\n  MissingProject: 'missing-project',\n  NotBearer: 'not-bearer',\n  NotReady: 'not-ready',\n  InvalidBuildTransition: 'invalid-build-transition',\n} as const;\n\nexport type KeboolaErrorType = (typeof KeboolaErrorType)[keyof typeof KeboolaErrorType];\n\nconst MESSAGES: Record<KeboolaErrorType, string> = {\n  [KeboolaErrorType.Unconfigured]: 'The session is not configured — set a baseUrl first.',\n  [KeboolaErrorType.NotAuthenticated]: 'The session is not authenticated — sign in first.',\n  [KeboolaErrorType.AlreadyAuthenticated]:\n    'The session is already authenticated — reset before authenticating again.',\n  [KeboolaErrorType.NoStorageToken]: 'No storage token — authenticate the storage realm first.',\n  [KeboolaErrorType.NoManagementToken]:\n    'No management token — authenticate the management realm first.',\n  [KeboolaErrorType.MissingProject]:\n    'A bearer storage session requires a project — call setProject(projectId) first.',\n  [KeboolaErrorType.NotBearer]: 'This operation requires a bearer (OAuth) session.',\n  [KeboolaErrorType.NotReady]: 'The client is not ready — authenticate the storage realm first.',\n  [KeboolaErrorType.InvalidBuildTransition]:\n    'Invalid storage build transition — the build goes idle → initializing → ready | failed.',\n};\n\nexport class KeboolaError extends Error {\n  readonly type: KeboolaErrorType;\n\n  constructor(type: KeboolaErrorType) {\n    super(MESSAGES[type]);\n    this.type = type;\n    this.name = 'KeboolaError';\n    Object.setPrototypeOf(this, KeboolaError.prototype);\n  }\n}\n\nexport const isKeboolaError = (error: unknown): error is KeboolaError =>\n  error instanceof KeboolaError;\n\n/** Throw a {@link KeboolaError} of `type` when `value` is null/undefined; otherwise narrow it. */\nexport function assert<T>(value: T | null | undefined, type: KeboolaErrorType): asserts value is T {\n  if (value == null) throw new KeboolaError(type);\n}\n","import { ApiError } from '../errors';\nimport { type HttpMethod, isApiError, type MiddlewareFn } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\nimport { generateUUID } from '../utils';\n\nconst CORRELATION_ID_HEADER = 'X-Correlation-ID';\n\nconst ALWAYS_REDACTED_HEADERS = [\n  KeboolaHttpHeader.MANAGEMENT_API_TOKEN,\n  KeboolaHttpHeader.STORAGE_API_TOKEN,\n  'authorization',\n  'cookie',\n  'set-cookie',\n];\n\nconst ALWAYS_REDACTED_QUERY_PARAMS = new Set([\n  'token',\n  'apikey',\n  'api_key',\n  'access_token',\n  'refresh_token',\n  'code',\n  'state',\n  'signature',\n  'sig',\n  'x-amz-signature',\n  'x-amz-credential',\n  'x-amz-security-token',\n  'password',\n  'secret',\n]);\n\nconst REDACTED = '[REDACTED]';\n\nconst getRedactedUrl = (rawUrl: string): string => {\n  const url = new URL(rawUrl);\n  if (url.username) url.username = REDACTED;\n  if (url.password) url.password = REDACTED;\n\n  url.searchParams.forEach((_value, key) => {\n    if (ALWAYS_REDACTED_QUERY_PARAMS.has(key.toLowerCase())) {\n      url.searchParams.set(key, REDACTED);\n    }\n  });\n  return url.toString();\n};\n\n// Returns the request's correlation ID, generating and attaching one if missing.\n//\n// Forwarded via the X-Correlation-ID header so downstream services log the same ID,\n// letting all log lines for a single user action be stitched together across service\n// boundaries. Reuse when the caller already set one (preserves the chain inside a\n// larger trace); otherwise mint a fresh UUID to start a new trace.\nconst ensureCorrelationId = (request: Request): string => {\n  const correlationId = request.headers.get(CORRELATION_ID_HEADER) ?? generateUUID();\n  request.headers.set(CORRELATION_ID_HEADER, correlationId);\n  return correlationId;\n};\n\nconst getRedactedHeaders = (headers: Headers, redacted: string[]): Record<string, string> => {\n  const redactedSet = new Set(\n    [...ALWAYS_REDACTED_HEADERS, ...redacted].map((h) => h.toLowerCase()),\n  );\n\n  const result: Record<string, string> = {};\n  headers.forEach((value, name) => {\n    result[name] = redactedSet.has(name.toLowerCase()) ? REDACTED : value;\n  });\n  return result;\n};\n\nexport type RequestLog = {\n  url: string;\n  headers: Record<string, string>;\n};\n\nexport type ResponseLog = {\n  status: number;\n  statusText: string;\n  headers: Record<string, string>;\n};\n\ntype BaseLog = {\n  correlationId: string;\n  method: HttpMethod;\n  durationMs: number;\n  request: RequestLog;\n};\n\ntype SuccessLog = BaseLog & {\n  response: ResponseLog;\n};\n\ntype ErrorLog = BaseLog & {\n  error: Error;\n};\n\nexport type Log = SuccessLog | ErrorLog;\n\nexport type Logger = {\n  info?: (log: SuccessLog) => void;\n  error?: (log: ErrorLog) => void;\n};\n\nexport type LogLevel = 'error-only' | 'all';\n\nexport type LoggingOptions = {\n  logger?: Logger;\n  level?: LogLevel;\n  redactHeaders?: string[];\n};\n\nconst getRequestLog = (request: Request, redactedHeaders: string[]): RequestLog => ({\n  url: getRedactedUrl(request.url),\n  headers: getRedactedHeaders(request.headers, redactedHeaders),\n});\n\nconst getResponseLog = (response: Response, redactedHeaders: string[]): ResponseLog => ({\n  status: response.status,\n  statusText: response.statusText,\n  headers: getRedactedHeaders(response.headers, redactedHeaders),\n});\n\n// On failure the logger receives the thrown error itself, but an ApiError carries the raw\n// fetch Request/Response whose headers were never redacted (only the middleware's own log\n// payload is). Hand the logger a copy with the same redaction applied to its headers and URL;\n// the original error is still thrown untouched so error handlers keep full fidelity.\nconst redactApiError = (error: ApiError, redactedHeaders: string[]): ApiError =>\n  new ApiError({\n    request: new Request(getRedactedUrl(error.request.url), {\n      method: error.request.method,\n      headers: getRedactedHeaders(error.request.headers, redactedHeaders),\n    }),\n    response: new Response(null, {\n      status: error.response.status,\n      statusText: error.response.statusText,\n      headers: getRedactedHeaders(error.response.headers, redactedHeaders),\n    }),\n    data: error.data,\n  });\n\nconst formatLog = (level: 'info' | 'error', log: Log): string => {\n  const parts = [`[${level.toUpperCase()}]`, `${Math.round(log.durationMs)}ms`, log.method];\n  parts.push(log.request.url);\n  if ('response' in log) parts.push(String(log.response.status));\n  return parts.join(' ');\n};\n\nconst createSafeLogger = (logger?: Logger, level: LogLevel = 'error-only'): Required<Logger> => {\n  return {\n    info: (log) => {\n      if (level !== 'all') return;\n      try {\n        if (logger?.info) {\n          logger.info(log);\n          return;\n        }\n\n        console.info(formatLog('info', log));\n      } catch {\n        /* never let logging break the request */\n      }\n    },\n    error: (log) => {\n      try {\n        if (logger?.error) {\n          logger.error(log);\n          return;\n        }\n\n        console.error(formatLog('error', log));\n      } catch {\n        /* never let logging break the request */\n      }\n    },\n  };\n};\n\nexport const createLoggingMiddleware = (options: LoggingOptions = {}): MiddlewareFn => {\n  const safeLogger = createSafeLogger(options.logger, options.level);\n  const redactHeaders = options.redactHeaders ?? [];\n\n  return (next) => async (fetchRequest) => {\n    const correlationId = ensureCorrelationId(fetchRequest.request);\n    const start = performance.now();\n    const method = fetchRequest.request.method.toLowerCase() as HttpMethod;\n    const requestLog = getRequestLog(fetchRequest.request, redactHeaders);\n\n    try {\n      const result = await next(fetchRequest);\n      safeLogger.info({\n        correlationId,\n        method,\n        durationMs: performance.now() - start,\n        request: requestLog,\n        response: getResponseLog(result.response, redactHeaders),\n      });\n      return result;\n    } catch (error) {\n      if (error instanceof Error)\n        safeLogger.error({\n          correlationId,\n          method,\n          durationMs: performance.now() - start,\n          request: requestLog,\n          error: isApiError(error) ? redactApiError(error, redactHeaders) : error,\n        });\n\n      throw error;\n    }\n  };\n};\n","import { ApiError } from '../errors';\nimport type { MiddlewareFn } from '../fetchClient';\nimport { HttpStatus } from '../internal';\nimport { delay } from '../utils';\n\nconst DEFAULT_MAX_RETRIES = 5;\nconst DEFAULT_RETRYABLE_STATUSES: number[] = [\n  HttpStatus.INTERNAL_SERVER_ERROR,\n  HttpStatus.BAD_GATEWAY,\n  HttpStatus.SERVICE_UNAVAILABLE,\n  HttpStatus.GATEWAY_TIMEOUT,\n];\nconst DEFAULT_BACKOFF_FACTOR = 0.3;\n\nexport type RetryOptions = {\n  maxRetries?: number;\n  backoffFactor?: number;\n  shouldRetry?: (error: unknown, attempt: number) => boolean;\n};\n\nconst defaultShouldRetry = (error: unknown): boolean =>\n  error instanceof ApiError && DEFAULT_RETRYABLE_STATUSES.includes(error.response.status);\n\nexport const createRetryMiddleware = (options?: RetryOptions): MiddlewareFn => {\n  const {\n    maxRetries = DEFAULT_MAX_RETRIES,\n    backoffFactor = DEFAULT_BACKOFF_FACTOR,\n    shouldRetry = defaultShouldRetry,\n  } = options ?? {};\n\n  if (!Number.isInteger(maxRetries) || maxRetries < 0) {\n    throw new RangeError('maxRetries must be a non-negative integer');\n  }\n  if (!Number.isFinite(backoffFactor) || backoffFactor < 0) {\n    throw new RangeError('backoffFactor must be a finite non-negative number');\n  }\n\n  return (next) => async (request) => {\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      try {\n        return await next({ ...request, request: request.request.clone() });\n      } catch (error) {\n        if (attempt === maxRetries || !shouldRetry(error, attempt)) {\n          throw error;\n        }\n\n        const delayMs = backoffFactor * 1000 * Math.pow(2, attempt);\n        await delay(delayMs, request.request.signal ?? undefined);\n      }\n    }\n\n    throw new Error('unreachable');\n  };\n};\n","export const isBuiltInProperty = (property: string | symbol) =>\n  typeof property === 'symbol' ||\n  property === 'then' ||\n  property === 'constructor' ||\n  property === 'toString' ||\n  property === 'valueOf';\n\n/**\n * Creates a dummy client that intercepts method calls and invokes the provided onCall callback.\n */\nexport const createDummyClient = <T extends Record<string, unknown>>({\n  onCall,\n}: {\n  onCall: (path: string[], args: unknown[]) => void;\n}): T => {\n  const createProxy = (path: string[] = []) =>\n    new Proxy(() => {}, {\n      // Create a new proxy for nested property access\n      get: (_target, prop) => {\n        // Don't intercept Symbol properties or special methods\n        if (isBuiltInProperty(prop)) return undefined;\n        return createProxy([...path, prop]);\n      },\n      // When called as a function, invoke the interceptor\n      apply: (_target, _thisArgs, args) => onCall(path, args),\n    });\n\n  return createProxy() as unknown as T;\n};\n","import { createDummyClient } from './utils';\n\ntype OnUnavailableFn = (info: {\n  serviceId: string;\n  path: string[];\n  args: unknown[];\n  clientName: string;\n}) => void;\n\ntype ClientConfig<ServiceId extends string, ClientName extends string> = {\n  serviceId: ServiceId;\n  clientName: ClientName;\n  clientFn: (serviceUrl: string) => unknown;\n};\n\ntype ClientMeta<ServiceId extends string> = {\n  clientName: string;\n  serviceId: ServiceId;\n  isAvailable: boolean;\n};\n\ntype Options<ServiceId extends string> = {\n  getServiceBaseUrl: (serviceId: ServiceId) => string | null;\n  onUnavailable?: OnUnavailableFn;\n};\n\ntype BuildResult<\n  ServiceId extends string,\n  ClientName extends string,\n  Configs extends ClientConfig<ServiceId, ClientName>[],\n> = {\n  client: {\n    [Config in Configs[number] as Config['clientName']]: ReturnType<Config['clientFn']>;\n  };\n  meta: ClientMeta<ServiceId>[];\n};\n\ntype Registry<\n  ServiceId extends string,\n  ClientName extends string,\n  Configs extends ClientConfig<ServiceId, ClientName>[],\n> = {\n  add: <const Config extends ClientConfig<ServiceId, ClientName>>(\n    config: Config,\n  ) => Registry<ServiceId, ClientName, [...Configs, Config]>;\n  build: () => BuildResult<ServiceId, ClientName, Configs>;\n};\n\nexport const createServiceClientRegistry =\n  <ServiceId extends string, ClientName extends string = string>() =>\n  ({\n    getServiceBaseUrl,\n    onUnavailable,\n  }: Options<ServiceId>): Registry<ServiceId, ClientName, []> => {\n    const dummy = (serviceId: string, clientName: string) =>\n      createDummyClient({\n        onCall: (path, args) => {\n          onUnavailable?.({\n            serviceId,\n            path,\n            args,\n            clientName,\n          });\n        },\n      });\n\n    const configs: ClientConfig<ServiceId, ClientName>[] = [];\n\n    const resolveClient = ({\n      serviceId,\n      clientFn,\n      clientName,\n    }: ClientConfig<ServiceId, ClientName>) => {\n      const serviceBaseUrl = getServiceBaseUrl(serviceId);\n      return serviceBaseUrl ? clientFn(serviceBaseUrl) : dummy(serviceId, clientName);\n    };\n\n    type AnyConfig = ClientConfig<ServiceId, ClientName>;\n    const registry: Registry<ServiceId, ClientName, AnyConfig[]> = {\n      add: (config) => {\n        configs.push(config);\n        return registry;\n      },\n      build: () => {\n        const clientMap: Record<string, unknown> = {};\n        const clientMeta: ClientMeta<ServiceId>[] = [];\n\n        configs.forEach((config) => {\n          clientMap[config.clientName] = resolveClient(config);\n          clientMeta.push({\n            clientName: config.clientName,\n            serviceId: config.serviceId,\n            isAvailable: !!getServiceBaseUrl(config.serviceId),\n          });\n        });\n\n        // The dynamically-built map can't be statically proven against the\n        // per-config mapped type; the public key safety comes from the fluent\n        // `add` chain asserted at the bottom of this factory.\n        return {\n          client: clientMap,\n          meta: clientMeta,\n        } as BuildResult<ServiceId, ClientName, AnyConfig[]>;\n      },\n    };\n\n    return registry as Registry<ServiceId, ClientName, []>;\n  };\n","import type { createAuthClient } from '../clients/auth/authClient';\nimport type { createManagementClient } from '../clients/management';\nimport { isBuiltInProperty } from '../serviceClientRegistry';\n\nimport type { createProjectClients } from './bearer/createProjectClients';\nimport { assert, KeboolaErrorType } from './errors';\n\ntype AuthClient = ReturnType<typeof createAuthClient>;\ntype ManagementClient = ReturnType<typeof createManagementClient>;\n\n/**\n * Everything on `api` except `auth` and `management` — the project-scoped half of `KeboolaApi`.\n *\n * - Holds no credential; the token and its refresh loop live on the session that built it.\n */\nexport type ProjectClients = Awaited<ReturnType<typeof createProjectClients>>;\n\nexport type KeboolaApi = ProjectClients & {\n  auth: ReturnType<typeof createAuthClient>;\n  management: ReturnType<typeof createManagementClient>;\n};\n\ntype ApiState = {\n  getAuthClient: () => AuthClient | null;\n  getManagementClient: () => ManagementClient | null;\n  getProjectClients: () => ProjectClients | null;\n};\n\nexport const createApi = (state: ApiState) =>\n  new Proxy({} as KeboolaApi, {\n    get(_target, property) {\n      if (isBuiltInProperty(property)) return undefined;\n\n      if (property === 'auth') {\n        const authClient = state.getAuthClient();\n        assert(authClient, KeboolaErrorType.Unconfigured);\n        return authClient;\n      }\n\n      if (property === 'management') {\n        const management = state.getManagementClient();\n        assert(management, KeboolaErrorType.NoManagementToken);\n        return management;\n      }\n\n      const clients = state.getProjectClients();\n      assert(clients, KeboolaErrorType.NotReady);\n\n      return clients[property as keyof ProjectClients];\n    },\n  });\n","import type { MiddlewareFn } from '../fetchClient';\n\n/**\n * Service clients reached through the registry — the key is the `clientName`\n * the user accesses them by (e.g. `api.dataScience`), not the `serviceId`.\n */\nexport type ServiceClientName =\n  | 'vault'\n  | 'dataScience'\n  | 'apps'\n  | 'encryption'\n  | 'editor'\n  | 'syncActions'\n  | 'telemetry'\n  | 'queryService'\n  | 'queue'\n  | 'chat'\n  | 'ai'\n  | 'import'\n  | 'kaiAgent'\n  | 'oauth'\n  | 'omnisearch'\n  | 'stream'\n  | 'notifications'\n  | 'scheduler'\n  | 'metastore'\n  | 'billing';\n\n/** Clients instantiated directly (not stack-discovered), keyed by their property name. */\ntype NonServiceClientName = 'storage' | 'management' | 'auth';\n\nexport type MiddlewareTarget = ServiceClientName | NonServiceClientName;\n\nexport type Middlewares =\n  | MiddlewareFn[]\n  | ({ all?: MiddlewareFn[] } & Partial<Record<MiddlewareTarget, MiddlewareFn[]>>);\n\nexport const createMiddlewareFor = (middlewares: Middlewares | undefined) => {\n  return (target: MiddlewareTarget, baseline: MiddlewareFn[] = []): MiddlewareFn[] => {\n    if (Array.isArray(middlewares)) return [...baseline, ...middlewares];\n\n    const all = middlewares?.all ?? [];\n    const targeted = middlewares?.[target] ?? [];\n    return [...baseline, ...all, ...targeted];\n  };\n};\n\nexport type MiddlewareFor = ReturnType<typeof createMiddlewareFor>;\n","import { createStore, type ReadableStore } from '../../utils';\nimport { KeboolaError, KeboolaErrorType } from '../errors';\n\n// Config owns its credential model — the subset of a login/refresh response it actually needs, so it\n// doesn't couple to the auth schema.\nexport type TokenSet = {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number; // seconds\n};\n// The active tokens plus when this access token was issued/refreshed (ms epoch). `issuedAt` +\n// `expiresIn` is the single source of truth for expiry: the refresh policy derives its\n// proactive-refresh time from it, and the dev tools count down against it.\nexport type Credential = TokenSet & { issuedAt: number };\n\n// Session phases, each a superset of the previous: anonymous ⊂ authenticated ⊂ scoped.\n// \"Has a credential\" is `status !== 'anonymous'` (authenticated and scoped both); \"has a project\" is\n// `status === 'scoped'`. Prefer the accessors below (`requireCredential`, `getBaseUrl`) over raw\n// status checks so that grouping lives in one place.\nexport type State =\n  | { status: 'anonymous'; baseUrl: string | null }\n  | { status: 'authenticated'; baseUrl: string; credential: Credential }\n  | { status: 'scoped'; baseUrl: string; credential: Credential; projectId: number };\n\nconst INITIAL: State = { status: 'anonymous', baseUrl: null };\n\nconst stamp = (tokens: TokenSet): Credential => ({ ...tokens, issuedAt: Date.now() });\n\nexport const createConfig = (initial: State = INITIAL) => {\n  const store = createStore<State>(initial);\n  let expiredNotified = false;\n  let epoch = 0;\n\n  const setBaseUrl = (baseUrl: string) => {\n    // baseUrl is fixed once authenticated — a credential is bound to the stack that issued it.\n    if (store.get().status !== 'anonymous')\n      throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);\n    store.set({ status: 'anonymous', baseUrl });\n  };\n\n  const authenticate = (tokens: TokenSet) => {\n    const state = store.get();\n    if (state.status !== 'anonymous') throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);\n    // A credential is only meaningful against a stack: enforce baseUrl so we never hold a session we\n    // couldn't refresh (no auth client without it).\n    if (!state.baseUrl) throw new KeboolaError(KeboolaErrorType.Unconfigured);\n    expiredNotified = false; // re-arm the expiry latch for the new session\n    epoch += 1;\n    store.set({ status: 'authenticated', baseUrl: state.baseUrl, credential: stamp(tokens) });\n  };\n\n  const setProjectId = (projectId: number) => {\n    const state = store.get();\n    if (state.status === 'anonymous') throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n    store.set({\n      status: 'scoped',\n      baseUrl: state.baseUrl,\n      credential: state.credential,\n      projectId,\n    });\n  };\n\n  /**\n   * Drop the project scope, keeping the credential — the inverse of `setProjectId`, for leaving a\n   * project without signing out. The project clients are keyed on the scope, so they tear down and\n   * the storage build returns to `idle`; the session stays usable for `auth` and `management`.\n   * No-op unless currently scoped.\n   */\n  const clearProjectId = () => {\n    const state = store.get();\n    if (state.status !== 'scoped') return;\n    store.set({ status: 'authenticated', baseUrl: state.baseUrl, credential: state.credential });\n  };\n\n  /** Drop the credential (sign out); keeps the configured baseUrl. */\n  const reset = () => {\n    epoch += 1;\n    store.set({ status: 'anonymous', baseUrl: store.get().baseUrl });\n  };\n\n  /** Apply a token refresh: replace the credential (fresh tokens, new issue time); no-op before auth. */\n  const applyRefresh = (tokens: TokenSet) => {\n    const state = store.get();\n    if (state.status === 'anonymous') return;\n    store.set({ ...state, credential: stamp(tokens) });\n  };\n\n  /**\n   * Dev/test lever: backdate the current token's issue time by a full lifetime so it reads as\n   * expired, making the refresh policy rotate it on the next request. No-op before auth.\n   */\n  const forceExpire = () => {\n    const state = store.get();\n    if (state.status === 'anonymous') return;\n    const issuedAt = Date.now() - state.credential.expiresIn * 1000;\n    store.set({ ...state, credential: { ...state.credential, issuedAt } });\n  };\n\n  /**\n   * The current credential, asserting the session is authenticated (or scoped). Single point for that\n   * check so callers (token attach, refresh) don't each re-narrow the state.\n   */\n  const requireCredential = (): Credential => {\n    const state = store.get();\n    if (state.status === 'anonymous') throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n    return state.credential;\n  };\n\n  const getBaseUrl = (): string | null => store.get().baseUrl;\n\n  /**\n   * Which sign-in this is — a counter, bumped by `authenticate` and `reset`.\n   *\n   * - For anything long-lived that must not outlive the credential it was built against: capture it,\n   *   compare it later. A rotation does not move it; only a new session or a sign-out does.\n   * - Distinct from `notifyExpired`'s latch, which answers \"report this death once\" rather than\n   *   \"which session are we in\".\n   */\n  const getEpoch = (): number => epoch;\n\n  /**\n   * Session-expiry latch (fire-once):\n   * - why: concurrent 401s all report expiry, but the app must sign out once; and the credential /\n   *   auth middleware are long-lived singletons, so the latch can't live in them — it must reset\n   *   per session.\n   * - how: returns `true` only for the first call since the last `authenticate` (which re-arms it),\n   *   so the caller runs its sign-out exactly once per session death.\n   */\n  const notifyExpired = (): boolean => {\n    if (expiredNotified) return false;\n    expiredNotified = true;\n    return true;\n  };\n\n  const debug = (): State => store.get();\n\n  // Read-only view: every write goes through the methods above so the state-machine invariants hold.\n  const readable: ReadableStore<State> = {\n    get: store.get,\n    subscribe: store.subscribe,\n    dispose: store.dispose,\n  };\n\n  return {\n    store: readable,\n    setBaseUrl,\n    authenticate,\n    setProjectId,\n    clearProjectId,\n    reset,\n    applyRefresh,\n    forceExpire,\n    requireCredential,\n    getBaseUrl,\n    getEpoch,\n    notifyExpired,\n    debug,\n  };\n};\n","import type { DevBranch } from '../clients/storage/branches/types';\nimport { assert } from '../utils';\n\ntype BranchType = 'default' | 'dev';\n\ntype Options = {\n  devBranches: DevBranch[];\n};\n\nexport const createDefaultBranch = ({ devBranches }: Options) => {\n  const defaultBranch = devBranches.find((branch) => branch.isDefault);\n  assert(defaultBranch, 'No default branch found for the project.');\n\n  const getType = (branchId?: string | number): BranchType => {\n    if (branchId == null || branchId === 'default') return 'default';\n    return Number(branchId) === defaultBranch.id ? 'default' : 'dev';\n  };\n\n  return {\n    id: defaultBranch.id,\n    name: defaultBranch.name,\n    getType,\n    isDev: (branchId?: string | number) => getType(branchId) === 'dev',\n    isDefault: (branchId?: string | number) => getType(branchId) === 'default',\n  };\n};\n","import type { ServiceId, StackInfo } from '../clients/storage/types';\n\nexport type ServiceUrls = Partial<Record<ServiceId, (url: string) => string | undefined | null>>;\n\nconst SERVICE_URL_OVERRIDES: ServiceUrls = {\n  // The service URL for the Kai Assistant is incomplete; we need to add the `/api` suffix to get the full URL for the API.\n  // I assume the service is versioned.\n  'kai-assistant': (url) => `${url}/api`,\n};\n\ntype Options = {\n  stackInfo: StackInfo;\n  clientServiceUrls?: ServiceUrls;\n};\n\nexport const createStack = ({ stackInfo, clientServiceUrls }: Options) => {\n  const { services, components, features, ...infoRest } = stackInfo;\n\n  const serviceMap = new Map(\n    services.map((service) => {\n      const devOverride = clientServiceUrls?.[service.id]?.(service.url);\n      const prodOverride = SERVICE_URL_OVERRIDES[service.id]?.(service.url);\n      const url = devOverride ?? prodOverride ?? service.url;\n      return [service.id, url];\n    }),\n  );\n\n  const componentMap = new Map(components.map((component) => [component.id, component]));\n  const featureSet = new Set(features);\n\n  const hasFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => featureSet.has(x));\n  };\n\n  const hasComponent = (...componentId: string[]) => {\n    if (componentId.length === 0) return false;\n    return componentId.every((x) => componentMap.has(x));\n  };\n\n  const getComponent = (componentId: string) => componentMap.get(componentId) ?? null;\n\n  const hasService = (serviceId: ServiceId) => serviceMap.has(serviceId);\n\n  const getServiceUrl = (serviceId: ServiceId) => serviceMap.get(serviceId) ?? null;\n\n  return {\n    ...infoRest,\n    services,\n    features,\n    components,\n    hasFeature,\n    getServiceUrl,\n    hasService,\n    getComponent,\n    hasComponent,\n  };\n};\n","import type * as storage from '../../clients/storage';\n\nconst VARIABLES_COMPONENT_ID = 'keboola.variables';\n\n// The storage client takes the branch as the string the spec declares.\ntype BranchId = string;\n\ntype VariableDefinition = { name: string; type?: string };\ntype VariableValue = { name: string; value?: unknown };\n\n/** Reference to a `keboola.variables` config + the values row a config points at. */\ntype VariablesRef = { variablesId: string; variablesValuesId: string };\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n};\n\n/** Union the definitions by name; on a name conflict the target's definition is kept. */\nexport const mergeVariableDefinitions = (\n  target: VariableDefinition[],\n  source: VariableDefinition[],\n): VariableDefinition[] => {\n  const targetNames = new Set(target.map((definition) => definition.name));\n\n  return [...target, ...source.filter((definition) => !targetNames.has(definition.name))];\n};\n\n/** Add values missing in the target; on a name conflict the value is updated to the source's. */\nexport const mergeVariableValues = (\n  target: VariableValue[],\n  source: VariableValue[],\n): VariableValue[] => {\n  const sourceByName = new Map(source.map((value) => [value.name, value.value]));\n  const targetNames = new Set(target.map((value) => value.name));\n\n  return [\n    ...target.map((value) =>\n      sourceByName.has(value.name) ? { ...value, value: sourceByName.get(value.name) } : value,\n    ),\n    ...source.filter((value) => !targetNames.has(value.name)),\n  ];\n};\n\n/**\n * Orchestration for `keboola.variables` configs: copy a config, or merge two configs into a fresh\n * one (union definitions, upsert values — source wins on a name conflict). Each result is a brand\n * new config + values row, so the caller can reference it without sharing lineage with the source.\n */\nexport const createVariablesSdk = ({ storageClient }: Options) => {\n  const configs = storageClient.configurations;\n  const rows = storageClient.configurationRows;\n\n  const readVariables = async (\n    configId: string,\n    valuesRowId: string | undefined,\n    branchId: BranchId,\n  ) => {\n    const config = await configs.getConfiguration({\n      componentId: VARIABLES_COMPONENT_ID,\n      configId,\n      branchId,\n    });\n    // variables configs carry a single values row — read the referenced one, or the only one\n    const row = config.rows.find((candidate) => candidate.id === valuesRowId) ?? config.rows[0];\n\n    const rawDefinitions = config.configuration?.variables;\n    const rawValues = row?.configuration?.values;\n\n    // guard the array shape — a non-array from Storage would throw in the merge helpers' .map()\n    return {\n      definitions: (Array.isArray(rawDefinitions) ? rawDefinitions : []) as VariableDefinition[],\n      values: (Array.isArray(rawValues) ? rawValues : []) as VariableValue[],\n    };\n  };\n\n  const createVariables = async (\n    definitions: VariableDefinition[],\n    values: VariableValue[],\n    branchId: BranchId,\n  ): Promise<VariablesRef> => {\n    const config = await configs.createConfiguration({\n      branchId,\n      componentId: VARIABLES_COMPONENT_ID,\n      name: 'Variables definition',\n      configuration: { variables: definitions },\n    });\n\n    try {\n      const row = await rows.createConfigurationRow({\n        branchId: String(branchId),\n        componentId: VARIABLES_COMPONENT_ID,\n        configurationId: config.id,\n        name: 'Default values',\n        configuration: { values },\n      });\n\n      return { variablesId: config.id, variablesValuesId: row.id };\n    } catch (error) {\n      // the values row failed — best-effort drop the orphaned config, but always surface the original error\n      await configs\n        .deleteConfiguration({\n          branchId,\n          componentId: VARIABLES_COMPONENT_ID,\n          configId: config.id,\n        })\n        .catch((cleanupError: unknown) => {\n          // keep the cleanup failure on the original error rather than letting it mask the real cause\n          if (error instanceof Error && error.cause === undefined) {\n            error.cause = cleanupError;\n          }\n        });\n      throw error;\n    }\n  };\n\n  return {\n    /** Copy a variables config into a fresh, independent config + values row. */\n    copy: async ({\n      variablesId,\n      variablesValuesId,\n      branchId = 'default',\n    }: {\n      variablesId: string;\n      variablesValuesId?: string;\n      branchId?: BranchId;\n    }): Promise<VariablesRef> => {\n      const { definitions, values } = await readVariables(variablesId, variablesValuesId, branchId);\n\n      return createVariables(definitions, values, branchId);\n    },\n\n    /** Merge the source's variables into the target's and create a fresh merged config + values row. */\n    merge: async ({\n      targetVariablesId,\n      targetValuesId,\n      sourceVariablesId,\n      sourceValuesId,\n      branchId = 'default',\n    }: {\n      targetVariablesId: string;\n      targetValuesId?: string;\n      sourceVariablesId: string;\n      sourceValuesId?: string;\n      branchId?: BranchId;\n    }): Promise<VariablesRef> => {\n      const [target, source] = await Promise.all([\n        readVariables(targetVariablesId, targetValuesId, branchId),\n        readVariables(sourceVariablesId, sourceValuesId, branchId),\n      ]);\n\n      return createVariables(\n        mergeVariableDefinitions(target.definitions, source.definitions),\n        mergeVariableValues(target.values, source.values),\n        branchId,\n      );\n    },\n  };\n};\n","import { createAiClient } from '../clients/ai';\nimport { createAppsClient } from '../clients/apps';\nimport type { AuthStrategy } from '../clients/auth';\nimport { createBillingClient } from '../clients/billing';\nimport { createChatClient } from '../clients/chat';\nimport { createDataScienceClient } from '../clients/dataScience';\nimport { createEditorClient } from '../clients/editor';\nimport { createEncryptionClient } from '../clients/encryption';\nimport { createImportClient } from '../clients/import';\nimport { createKaiAgentClient } from '../clients/kaiAgent';\nimport { createMetastoreClient } from '../clients/metastore';\nimport { createNotificationsClient } from '../clients/notifications';\nimport { createOauthClient } from '../clients/oauth';\nimport { createOmnisearchClient } from '../clients/omnisearch';\nimport { createQueryServiceClient } from '../clients/queryService';\nimport { createQueueClient } from '../clients/queue';\nimport { createSchedulerClient } from '../clients/scheduler';\nimport type { ServiceId } from '../clients/storage/types';\nimport { createStreamClient } from '../clients/stream';\nimport { createSyncActionsClient } from '../clients/syncActions';\nimport { createTelemetryClient } from '../clients/telemetry';\nimport { createVaultClient } from '../clients/vault';\nimport { ServiceUnavailableError } from '../errors';\nimport type { MiddlewareFn } from '../fetchClient';\nimport { createServiceClientRegistry } from '../serviceClientRegistry';\n\nimport { type MiddlewareFor, type ServiceClientName } from './createMiddlewareFor';\n\ntype Options = {\n  baseUrl: string;\n  auth: AuthStrategy;\n  getServiceBaseUrl: (serviceId: ServiceId) => string | null;\n  middlewareFor: MiddlewareFor;\n  attachTokenMiddleware: MiddlewareFn;\n};\n\nexport const createServiceClients = ({\n  baseUrl,\n  auth,\n  getServiceBaseUrl,\n  middlewareFor,\n  attachTokenMiddleware,\n}: Options) =>\n  createServiceClientRegistry<ServiceId, ServiceClientName>()({\n    getServiceBaseUrl,\n    onUnavailable: ({ serviceId, path, clientName }) => {\n      throw new ServiceUnavailableError(serviceId, path, clientName);\n    },\n  })\n    .add({\n      serviceId: 'vault',\n      clientName: 'vault',\n      clientFn: (serviceBaseUrl) =>\n        createVaultClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('vault', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'data-science',\n      clientName: 'dataScience',\n      clientFn: (serviceBaseUrl) =>\n        createDataScienceClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('dataScience', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      // Deliberately the `data-science` service: the `/v2` App Deployments surface is the same\n      // sandboxes-service deployment one path prefix over, so it resolves off that URL with `/v2`\n      // appended. The `apps.<stack>` vanity host serves the same routes at its root but is absent\n      // from the stack's service index, so it cannot be resolved.\n      // Second client composing a prefix onto a service URL after `omnisearch` below; at a third,\n      // give `.add()` a `pathPrefix` the registry joins so the join can't be got wrong per call site.\n      serviceId: 'data-science',\n      clientName: 'apps',\n      clientFn: (serviceBaseUrl) =>\n        createAppsClient({\n          baseUrl: `${serviceBaseUrl}/v2`,\n          middlewares: middlewareFor('apps', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'encryption',\n      clientName: 'encryption',\n      clientFn: (serviceBaseUrl) =>\n        createEncryptionClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('encryption'),\n        }),\n    })\n    .add({\n      serviceId: 'editor',\n      clientName: 'editor',\n      clientFn: (serviceBaseUrl) =>\n        createEditorClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('editor', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'sync-actions',\n      clientName: 'syncActions',\n      clientFn: (serviceBaseUrl) =>\n        createSyncActionsClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('syncActions', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'telemetry',\n      clientName: 'telemetry',\n      clientFn: (serviceBaseUrl) =>\n        createTelemetryClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('telemetry', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'query',\n      clientName: 'queryService',\n      clientFn: (serviceBaseUrl) =>\n        createQueryServiceClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('queryService', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'queue',\n      clientName: 'queue',\n      clientFn: (serviceBaseUrl) =>\n        createQueueClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('queue', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'kai-assistant',\n      clientName: 'chat',\n      clientFn: (serviceBaseUrl) =>\n        createChatClient({\n          storageApiUrl: baseUrl,\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('chat', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'ai',\n      clientName: 'ai',\n      clientFn: (serviceBaseUrl) =>\n        createAiClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('ai', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      // Deliberately the `ai` service: omnisearch is a separate deployment that the ai-service\n      // ingress exposes under `/omnisearch`, so it resolves off that URL with the prefix appended —\n      // the same shape as the `kai-assistant` `/api` override in `domain/stack.ts`.\n      serviceId: 'ai',\n      clientName: 'omnisearch',\n      clientFn: (serviceBaseUrl) =>\n        createOmnisearchClient({\n          baseUrl: `${serviceBaseUrl}/omnisearch`,\n          middlewares: middlewareFor('omnisearch', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'import',\n      clientName: 'import',\n      clientFn: (serviceBaseUrl) =>\n        createImportClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('import', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'kai-agent',\n      clientName: 'kaiAgent',\n      clientFn: (serviceBaseUrl) =>\n        createKaiAgentClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('kaiAgent', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'oauth',\n      clientName: 'oauth',\n      clientFn: (serviceBaseUrl) =>\n        createOauthClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('oauth', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'scheduler',\n      clientName: 'scheduler',\n      clientFn: (serviceBaseUrl) =>\n        createSchedulerClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('scheduler', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'stream',\n      clientName: 'stream',\n      clientFn: (serviceBaseUrl) =>\n        createStreamClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('stream', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'notification',\n      clientName: 'notifications',\n      clientFn: (serviceBaseUrl) =>\n        createNotificationsClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('notifications', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'billing',\n      clientName: 'billing',\n      clientFn: (serviceBaseUrl) =>\n        createBillingClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('billing', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'metastore',\n      clientName: 'metastore',\n      clientFn: (serviceBaseUrl) =>\n        createMetastoreClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('metastore', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .build();\n","import type { AuthStrategy } from '../../clients/auth';\nimport { createStorageClient } from '../../clients/storage';\nimport { ProjectFeature } from '../../constants/projectFeatures';\nimport { createDefaultBranch } from '../../domain/defaultBranch';\nimport { createStack, type ServiceUrls } from '../../domain/stack';\nimport { createStorageTable } from '../../domain/storageTable';\nimport { type MiddlewareFn, normalizeBaseUrl } from '../../fetchClient';\nimport { KeboolaHttpHeader } from '../../internal';\nimport { createConfigurationSdk } from '../../sdks/configurations';\nimport { createSemanticLayerSdk } from '../../sdks/semanticLayer';\nimport { createStorageSdk } from '../../sdks/storage';\nimport { createTagSdk } from '../../sdks/tag';\nimport { createVariablesSdk } from '../../sdks/variables';\nimport { createVaultSdk } from '../../sdks/vault';\nimport { createDerivedStore } from '../../utils';\nimport { type ClientContext, createLiveProject } from '../createLiveProject';\nimport { type MiddlewareFor } from '../createMiddlewareFor';\nimport { createServiceClients } from '../createServiceClients';\n\n/**\n * Bearer (OAuth) project surface. Same handshake + assembly as the legacy build. The\n * `Authorization: Bearer` header + transparent refresh come from the engine-shared `authMiddleware`\n * (one instance for management + every project client). This build only adds the project-scoped\n * `X-KBC-ProjectId` header, composed *outside* the auth middleware so the header is present\n * before it clones the request for the 401 replay. Bearer has no static token header, so this\n * combined `attach` rides on every client — including the operational storage and the bootstrap reader.\n */\nexport const createProjectClients = async ({\n  baseUrl,\n  projectId,\n  authMiddleware,\n  middlewareFor,\n  clientServiceUrls,\n}: {\n  baseUrl: string;\n  authMiddleware: MiddlewareFn;\n  projectId: number;\n  middlewareFor: MiddlewareFor;\n  clientServiceUrls?: ServiceUrls;\n}) => {\n  // Bearer contributes no static auth header — the auth middleware stamps the live token on every\n  // request. `token: ''` only satisfies the strategy type; it never reaches the wire here.\n  const auth: AuthStrategy = { type: 'bearer', token: '', projectId };\n\n  const projectIdMiddleware: MiddlewareFn = (next) => (request) => {\n    request.request.headers.set(KeboolaHttpHeader.PROJECT_ID, String(projectId));\n    return next(request);\n  };\n  // projectId outer so its header is set before the auth middleware clones for the 401 replay.\n  const attach: MiddlewareFn = (next) => projectIdMiddleware(authMiddleware(next));\n\n  const reader = createStorageClient({ baseUrl, auth, middlewares: [attach] });\n  const [stackInfo, sapiToken, devBranches] = await Promise.all([\n    reader.getStackInfo({ exclude: 'componentDetails' }),\n    reader.tokens.verify(),\n    reader.branches.getDevBranches(),\n  ]);\n\n  const stack = createStack({ stackInfo, clientServiceUrls });\n  const defaultBranch = createDefaultBranch({ devBranches });\n  const liveProject = createLiveProject({\n    initialToken: sapiToken,\n    verify: () => reader.tokens.verify(),\n  });\n  const storageTableStore = createDerivedStore({\n    source: liveProject.store,\n    build: createStorageTable,\n    dependsOn: (project) => ({\n      useLegacyBucketPrefix: !project.hasFeature(ProjectFeature.DisableLegacyBucketPrefix),\n      hasProtectedDefaultBranch: project.hasFeature(ProjectFeature.SoxProtectedDefaultBranch),\n      hasStorageBranches: project.hasFeature(ProjectFeature.StorageBranches),\n    }),\n  });\n\n  const context: ClientContext = {\n    baseUrl: normalizeBaseUrl(baseUrl),\n    stack,\n    defaultBranch,\n    get project() {\n      return liveProject.getProject();\n    },\n    get st() {\n      return storageTableStore.get();\n    },\n  };\n\n  // Bearer has no static auth header, so the operational storage client carries `attach` too.\n  const storage = createStorageClient({\n    baseUrl,\n    auth,\n    middlewares: middlewareFor('storage', [attach, liveProject.middleware]),\n  });\n\n  const { client: services, meta: serviceMeta } = createServiceClients({\n    baseUrl,\n    auth,\n    getServiceBaseUrl: context.stack.getServiceUrl,\n    middlewareFor,\n    attachTokenMiddleware: attach,\n  });\n\n  const sdk = {\n    configuration: createConfigurationSdk({\n      storageClient: storage,\n      encryptionClient: services.encryption,\n      context,\n    }),\n    tag: createTagSdk({ metastoreClient: services.metastore }),\n    semanticLayer: createSemanticLayerSdk({ metastoreClient: services.metastore }),\n    storage: createStorageSdk({ storageClient: storage }),\n    vault: createVaultSdk({ vaultClient: services.vault, encryptionClient: services.encryption }),\n    variables: createVariablesSdk({ storageClient: storage }),\n  };\n\n  return { context, serviceMeta, storage, ...services, sdk };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\n\nimport { type BearerCredential, isUnauthorized } from './credential';\n\n/**\n * Bearer auth for every outgoing request:\n * - Stamps the current access token (from the credential) as the `Authorization` header.\n * - On a 401, force-refreshes the token and replays the request once.\n * - If the replay still 401s, the fresh token is rejected → marks the session expired.\n *\n * When the session is anonymous (`getAccessToken` → `null`) the request is passed through untouched\n * with no 401 dance — so pre-auth calls on the auth client (`login`, `refresh`) work and a failed\n * login is never mistaken for session expiry.\n *\n * Holds no token and never touches config — all token and refresh state lives in the credential.\n */\nexport const createBearerAuthMiddleware = (credential: BearerCredential): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getAccessToken({ forceRefresh: false });\n    // Anonymous request (e.g. login / refresh) — nothing to authenticate; pass through untouched.\n    if (token === null) return next(request);\n\n    // Cloned up front for the 401 replay: the body stream may be consumed by the first attempt.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${token}`);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getAccessToken({ forceRefresh: true });\n      // Went anonymous mid-flight (concurrent sign-out) — don't replay, surface the original 401.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${refreshed}`);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        // Refreshed and replayed, still 401 — the fresh token is rejected, so the session is dead.\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import * as z from 'zod';\n\nimport { createPersistor } from '../../utils/persistor';\nimport type { StorageAdapter } from '../types';\n\nconst SESSION_KEY = 'keboola:bearer-session';\n\nconst persistedSessionSchema = z.object({\n  baseUrl: z.string().nullable(),\n  projectId: z.number().nullable(),\n  refreshToken: z.string().nullable(),\n});\n\nexport type PersistedSession = z.infer<typeof persistedSessionSchema>;\n\nconst EMPTY_PERSISTED_SESSION: PersistedSession = {\n  baseUrl: null,\n  projectId: null,\n  refreshToken: null,\n};\n\nexport const createSessionPersistor = (storage?: StorageAdapter) =>\n  createPersistor<PersistedSession>({\n    storage,\n    key: SESSION_KEY,\n    schema: persistedSessionSchema,\n    defaultValue: EMPTY_PERSISTED_SESSION,\n  });\n","import { createAuthClient } from '../../clients/auth/authClient';\nimport { createManagementClient } from '../../clients/management';\nimport { ApiError } from '../../errors';\nimport { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { HttpStatus, KeboolaHttpHeader } from '../../internal';\nimport { createRetryMiddleware } from '../../middlewares';\nimport { createDerivedAsyncStore, createDerivedStore, lazy } from '../../utils';\nimport { createApi, type ProjectClients } from '../createApi';\nimport { createMiddlewareFor } from '../createMiddlewareFor';\nimport { assert, KeboolaError, KeboolaErrorType } from '../errors';\nimport type { KeboolaOptions } from '../types';\n\nimport { createConfig, type State, type TokenSet } from './createConfig';\nimport { createProjectClients } from './createProjectClients';\nimport { type BearerCredential, createBearerCredential, isUnauthorized } from './credential';\nimport { createBearerAuthMiddleware } from './middleware';\nimport { createSessionPersistor } from './persistor';\nimport type { RestoreResult, SessionSnapshot } from './types';\n\nexport const createKeboola = (options: KeboolaOptions = {}) => {\n  const persistor = createSessionPersistor(options.storage);\n  const config = createConfig();\n  const middlewareFor = createMiddlewareFor(options.middlewares);\n\n  // Retry a 503 (refresh contention) on any auth call — outermost, so it wraps the whole chain. This\n  // covers both the credential's `refresh` closure below and `restore()`, which share this client.\n  const retryContention = createRetryMiddleware({\n    shouldRetry: (error) =>\n      error instanceof ApiError && error.response.status === HttpStatus.SERVICE_UNAVAILABLE,\n  });\n\n  // Bare auth client — retry only, NO auth middleware. This is the transport for `refresh()` and\n  // `restore()`: routing a token refresh through the auth middleware would re-enter the (deduped)\n  // refresh via its 401/near-expiry path and deadlock, so those calls must bypass it.\n  const authClientBare = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => state.baseUrl,\n    build: (baseUrl) =>\n      baseUrl\n        ? createAuthClient({ baseUrl, middlewares: middlewareFor('auth', [retryContention]) })\n        : null,\n  });\n\n  const refresh = async () => {\n    const client = authClientBare.get();\n    assert(client, KeboolaErrorType.NotReady);\n    // Pin the sign-in this rotation belongs to. `applyRefresh` only asks whether *a* session exists,\n    // so a rotation resolving after its own session ended would overwrite the credential of whoever\n    // signed in since — and the whole new session, `api` included, would then ride the old user's\n    // tokens. Refuse it instead; the live session still holds its own, unrotated credential.\n    const epoch = config.getEpoch();\n    const refreshed = await client.token\n      .refresh(config.requireCredential().refreshToken)\n      .catch((error: unknown) => {\n        // Refused *and* late. The rejection has to be re-labelled before it travels on, because\n        // `credential`'s own catch reads a 401 as \"this session is dead\" and reports it — and\n        // `authenticate` re-armed the latch, so that report signs out whoever signed in since.\n        if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n        throw error;\n      });\n    if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n    config.applyRefresh(refreshed);\n    return refreshed.accessToken;\n  };\n\n  // `null` while anonymous, so the auth middleware passes pre-auth requests (login) through unstamped.\n  const getToken = () => {\n    const state = config.store.get();\n    if (state.status === 'anonymous') return null;\n    const { accessToken, issuedAt, expiresIn } = state.credential;\n    return { accessToken, timing: { issuedAt, expiresIn } };\n  };\n\n  /**\n   * The session's state, once it is known to carry a credential.\n   *\n   * - Returns the state rather than nothing, so the caller reads `baseUrl` and `credential` off a\n   *   narrowed union instead of re-checking the status to get at them.\n   * - `NotAuthenticated`, the same refusal `requireScopedProject` opens with. The two differ only in\n   *   how far they go: this one stops at \"somebody is signed in\", which is all a request naming its\n   *   own project needs.\n   */\n  const requireAuthenticated = (): Exclude<State, { status: 'anonymous' }> => {\n    const state = config.store.get();\n    if (state.status === 'anonymous') throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n    return state;\n  };\n\n  /**\n   * The project this session is scoped to, right now.\n   *\n   * - Read at every point that stamps a project, never snapshotted across an `await`: the scope moves\n   *   with `setProject`/`clearProject`, and neither ends the session, so it is not in the epoch and\n   *   `assertSameSession` cannot see it change.\n   * - `NotReady` rather than `NotAuthenticated` when merely unscoped — the credential is fine, the\n   *   project is what is missing. A credential alone does not authorize a project request: kai-agent\n   *   reads the project from the header, not the token, and cannot attribute a call that omits it.\n   */\n  const requireScopedProject = (): number => {\n    const state = requireAuthenticated();\n    if (state.status !== 'scoped') throw new KeboolaError(KeboolaErrorType.NotReady);\n    return state.projectId;\n  };\n\n  /**\n   * The project client sets `forProject` has handed out, keyed by project id.\n   *\n   * - Not keyed by stack: `setBaseUrl` throws once authenticated and `signOut` empties this, so one\n   *   entry can never belong to a different `baseUrl` than the live session.\n   * - A `lazy` per key, not a bare promise: concurrent callers share one bootstrap, later ones replay\n   *   the resolved set, and a rejected build clears only its own slot — so a build orphaned by a\n   *   sign-out cannot evict the entry that replaced it.\n   */\n  const extraProjects = new Map<number, () => Promise<ProjectClients>>();\n\n  const signOut = () => {\n    config.reset();\n    // The credential outlives the session, so its in-flight rotation would otherwise be handed to\n    // the next one — which then rotates nothing of its own and eats `refresh`'s epoch refusal.\n    credential.abandonRefresh();\n    extraProjects.clear();\n    persistor.clear();\n  };\n\n  // Sign out once per session death: `config.notifyExpired` latches (re-armed on `authenticate`), so\n  // concurrent 401s from any realm collapse to a single sign-out.\n  const onSessionExpired = () => {\n    if (config.notifyExpired()) signOut();\n  };\n\n  const credential = createBearerCredential({ refresh, getToken, onSessionExpired });\n\n  // Refuses anything belonging to sign-in `epoch` once the session has moved on. One line, but it is\n  // the whole session pin — everything below is about *where* to call it.\n  const sessionGuard = (epoch: number) => () => {\n    if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n  };\n\n  /**\n   * The auth middleware, refusing to carry a request across a change of session.\n   *\n   * - The middleware holds no token — it reads the credential live — so anything built on it acts as\n   *   whoever is signed in *at request time*, not whoever built it. Rebuilding a store on sign-out\n   *   only stops new reads; a request already in flight completes as the next user, still stamped\n   *   with the old project. `config`'s epoch moves on `authenticate` and `reset` and never on a\n   *   rotation, so it is exactly \"which sign-in is this\".\n   * - `epochFor` says which sign-in a request answers to, resolved per request:\n   *   1. a client set pins to the sign-in that *built* it (`pinToSession`) — a set the caller still\n   *      holds must not ride the session that replaced it;\n   *   2. `api.auth` pins to the sign-in the request *started* on, because its store is keyed on\n   *      `baseUrl` alone: it is built once, while anonymous, so a build-time pin would freeze at that\n   *      epoch and refuse every authenticated call.\n   * - The guard covers every credential read, not only the wire request, so it wraps the credential\n   *   rather than sitting beside it. The 401 path rotates the token by calling the credential\n   *   directly: a straggler from a dead session would otherwise spend the *live* session's\n   *   single-use refresh token, and sign that session out if the rotation itself came back 401.\n   * - `expiresSession` decides whether a 401 that survives a rotation means the session is dead.\n   *   True for this session's own realms; false where the 401 may be about the project instead of\n   *   the credential (see `forProject`).\n   * - `inner` is for middleware that **re-invokes `next`** — a retry. Composed outside the pin it\n   *   would re-enter it per attempt, and with a per-request `epochFor` each attempt would re-pin to\n   *   whoever is signed in by then: a 503 backoff is exactly long enough for a sign-out to land, and\n   *   the retry then goes out as the next user. Inside, one epoch covers every attempt and each\n   *   attempt still passes the guard. Anything new that retries belongs here, not in the array.\n   */\n  const createPinnedAuthMiddleware = (\n    epochFor: () => number,\n    {\n      expiresSession = true,\n      inner = [],\n    }: { expiresSession?: boolean; inner?: MiddlewareFn[] } = {},\n  ): MiddlewareFn => {\n    return (next) => (request) => {\n      const assertSameSession = sessionGuard(epochFor());\n      const pinnedCredential: BearerCredential = {\n        ...credential,\n        getAccessToken: async (options) => {\n          assertSameSession();\n          return credential.getAccessToken(options);\n        },\n        // A 401 the rotation did not fix is not this realm's evidence of a dead credential.\n        notifyExpired: expiresSession ? credential.notifyExpired : () => {},\n      };\n      // Innermost, below `inner`: the 401 path replays by calling `next` itself and a retry sends\n      // the request again, and those repeats — one carrying the freshly rotated token — are the\n      // requests that must not go out.\n      const guarded: MiddlewareFn = (wire) => (repeated) => {\n        assertSameSession();\n        return wire(repeated);\n      };\n      const chain = inner.reduceRight<ReturnType<MiddlewareFn>>(\n        (acc, middleware) => middleware(acc),\n        guarded(next),\n      );\n      return createBearerAuthMiddleware(pinnedCredential)(chain)(request);\n    };\n  };\n\n  /**\n   * Pin something long-lived to the sign-in live right now.\n   *\n   * - `assertSameSession` is for whatever no middleware chain covers: a bootstrap whose every\n   *   request passed the guard before the sign-out resolves anyway and must not be handed back, and\n   *   `getAuthHeaders`, which emits the credential by hand.\n   */\n  const pinToSession = (options?: {\n    expiresSession?: boolean;\n  }): {\n    assertSameSession: () => void;\n    pinnedAuthMiddleware: MiddlewareFn;\n  } => {\n    const epoch = config.getEpoch();\n    return {\n      assertSameSession: sessionGuard(epoch),\n      pinnedAuthMiddleware: createPinnedAuthMiddleware(() => epoch, options),\n    };\n  };\n\n  // Exposed auth client (`api.auth`) — carries the auth middleware so the authenticated auth-service\n  // endpoints (`token.introspect`, `session.revokeAll`, `password.change`) are authorized. `login`\n  // stays anonymous: the middleware no-ops when `getToken()` is `null`. Refreshes still go through\n  // `authClientBare`.\n  //\n  // Pinned per request rather than per build: one instance serves every session, so there is no\n  // build epoch worth comparing — but a single request still may not cross a turnover. Unpinned, a\n  // call whose 401 landed across a sign-in replayed as the *next* user and resolved that user's\n  // payload to the previous one's caller.\n  //\n  // `retryContention` goes *inside* that pin rather than beside it in the array, where it would be\n  // the outermost middleware and re-pin every attempt — see `createPinnedAuthMiddleware`.\n  const authClient = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => state.baseUrl,\n    build: (baseUrl) =>\n      baseUrl\n        ? createAuthClient({\n            baseUrl,\n            middlewares: middlewareFor('auth', [\n              createPinnedAuthMiddleware(config.getEpoch, { inner: [retryContention] }),\n            ]),\n          })\n        : null,\n  });\n\n  // Keyed on baseUrl-when-authenticated (a primitive): rebuilds on login/logout and stack change, but\n  // NOT on a token rotation — the credential isn't in the key, and the middleware reads it live. Bearer\n  // carries no static header (the middleware stamps it), so `token: ''` never reaches the wire.\n  const management = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => (state.status === 'anonymous' ? null : state.baseUrl),\n    build: (baseUrl) =>\n      baseUrl\n        ? createManagementClient({\n            baseUrl,\n            auth: { type: 'bearer', token: '' },\n            middlewares: middlewareFor('management', [pinToSession().pinnedAuthMiddleware]),\n          })\n        : null,\n  });\n\n  const projectClientsAsync = createDerivedAsyncStore({\n    source: config.store,\n    // Keyed on baseUrl + projectId only — a rotation (new credential, same project) must not rebuild.\n    dependsOn: (state) =>\n      state.status === 'scoped' ? { baseUrl: state.baseUrl, projectId: state.projectId } : null,\n    // The generation guard already drops a stale build's *value*, so only the requests need pinning.\n    build: ({ baseUrl, projectId }) => {\n      return createProjectClients({\n        baseUrl,\n        authMiddleware: pinToSession().pinnedAuthMiddleware,\n        projectId,\n        middlewareFor,\n        clientServiceUrls: options.clientServiceUrls,\n      });\n    },\n  });\n\n  // `async` so an unauthenticated call rejects like every other failure here, rather than throwing\n  // synchronously past a caller's `.catch`.\n  const forProject = async (projectId: number): Promise<ProjectClients> => {\n    const state = requireAuthenticated();\n\n    const cached = extraProjects.get(projectId);\n    if (cached) return cached();\n\n    // The pin is what makes `reset()` a teardown here and not a cache eviction: a set is a plain\n    // object the caller keeps, and nothing else stops it outliving the credential it was built\n    // against. Unlike the scoped build there is no store to drop it, so the resolution is checked\n    // too, not only the requests.\n    //\n    // `expiresSession: false` because this is the only surface taking a caller-supplied project id,\n    // and connection collapses every bearer failure into one `invalid_token` 401 so scope cannot be\n    // probed — \"no access to this project\" is the same response as a revoked token. A rotation that\n    // succeeds settles it: the credential is alive, so a 401 that survives it is about the project.\n    // Left as `true`, a mistyped id would rotate, replay, 401 again and sign the whole session out.\n    // A credential that really is dead still surfaces — `refresh` itself 401s, which is unambiguous.\n    const { assertSameSession, pinnedAuthMiddleware } = pinToSession({ expiresSession: false });\n\n    const build = lazy(async () => {\n      const clients = await createProjectClients({\n        baseUrl: state.baseUrl,\n        authMiddleware: pinnedAuthMiddleware,\n        projectId,\n        middlewareFor,\n        clientServiceUrls: options.clientServiceUrls,\n      });\n      // A bootstrap that outlived its session resolves anyway — every one of its requests passed\n      // the guard before the sign-out. Refuse it here rather than hand back a set already dead.\n      assertSameSession();\n      return clients;\n    });\n    extraProjects.set(projectId, build);\n    return build();\n  };\n\n  if (options.baseUrl) config.setBaseUrl(options.baseUrl);\n\n  // Mirror the live session into storage: persist the durable subset (projected inline here, so it is\n  // clear exactly what we store) whenever a credential is present — login, project switch, token\n  // rotation. Skip when there is no credential so a bare `setBaseUrl` never overwrites a stored session\n  // before `restore()` reads it; `signOut` is what clears storage.\n  config.store.subscribe((state) => {\n    if (state.status === 'anonymous') return;\n\n    persistor.persist({\n      baseUrl: state.baseUrl,\n      projectId: state.status === 'scoped' ? state.projectId : null,\n      refreshToken: state.credential.refreshToken,\n    });\n  });\n\n  const debug = (): SessionSnapshot => ({\n    type: 'Bearer',\n    config: config.debug(),\n    authReady: authClient.get() !== null,\n    managementReady: management.get() !== null,\n    storage: projectClientsAsync.store.get().state,\n  });\n\n  const session = {\n    hasPersistedValue: persistor.hasPersistedValue,\n    setBaseUrl: config.setBaseUrl,\n    isStorageReady: () => projectClientsAsync.store.get().state === 'ready',\n    authenticate: (tokens: TokenSet) => config.authenticate(tokens),\n    setProject: config.setProjectId,\n    setProjectAsync: async (projectId: number) => {\n      config.setProjectId(projectId);\n      await projectClientsAsync.settled();\n    },\n    /**\n     * Leave the current project but stay signed in — the storage build returns to `idle`, so a\n     * consumer gating on it falls back to its project picker. The persisted session is rewritten with\n     * `projectId: null` by the subscription above, so a reload lands on the picker rather than\n     * re-entering the project. Use `reset` to sign out instead.\n     */\n    clearProject: config.clearProjectId,\n    /**\n     * The clients for one project, off this session — for reaching a second project without leaving\n     * the first.\n     *\n     * - `setProjectAsync` *moves* the session (and `api`) to another project; this *adds* one. The\n     *   returned set is the caller's to hold and never appears on `api`.\n     * - Every set shares this session's auth middleware, so one rotation serves all of them. A second\n     *   `createKeboola()` does not: both hold the same single-use refresh token, and the first to\n     *   rotate invalidates the other's, whose next refresh 401s and signs it out.\n     * - Independent of the scope, including for the scoped project itself — asking for that one\n     *   builds a second set with its own `liveProject`, so prefer `api.*` there.\n     */\n    forProject,\n    reset: signOut,\n    /**\n     * Dev/test only: mark the current access token as expired so the bearer credential rotates it on\n     * the next request. Pair with any authenticated call (e.g. `api.storage.tokens.verify()`) to force\n     * the rotation immediately and observe the new credential.\n     */\n    debugForceRefresh: config.forceExpire,\n    /**\n     * The headers that authorize one off-client request, resolved fresh each call.\n     *\n     * - For a transport this package does not own — the chat SSE stream, whose `fetch` the AI SDK\n     *   holds. Anything with a service client on `api` should use that instead.\n     * - Returns the assembled bag, never the bare token: no caller handles the credential as a\n     *   string, and `X-KBC-ProjectId` is composed here rather than in every consuming app.\n     * - Resolved per call, through the credential — so a near-expiry token rotates and a revoked\n     *   one is never re-sent. A snapshot held by the caller would do neither.\n     * - Throws rather than emitting a half-formed `Bearer null`: a session with no credential has\n     *   nothing to authorize with.\n     * - Pinned to the sign-in it was called on, like every client here. This is the one\n     *   credential-emitting surface with no middleware chain for the guard to sit in, so the check\n     *   is written out around the `await` that rotates the token.\n     *\n     * `projectId` names the project the headers authorize, for a caller reaching a project the\n     * session is not scoped to:\n     *\n     * - **Omitted**, the session's own scope answers — unchanged, and re-read *after* the rotation\n     *   rather than carried across it. The epoch the pin compares moves on a sign-in and a sign-out\n     *   only, so a project switch mid-rotation is invisible to it.\n     * - **Given**, it is what the header says, and the scope is not consulted at all. A caller that\n     *   names a project has said everything the request needs: the credential is user-level and the\n     *   project is a header on top of it, so an authenticated session suffices where an unnamed call\n     *   requires a scoped one. Nothing about the session can change the answer, so there is nothing\n     *   to re-read after the `await`.\n     * - **Not checked against an access set**, because this session cannot acquire one:\n     *   `forProject` — the only other surface taking a caller-supplied project id — records that\n     *   connection collapses every bearer failure into a single `invalid_token` 401, so \"no access\n     *   to this project\" and \"revoked token\" are the same response. Whether the caller may reach a\n     *   project is the caller's own knowledge, from `token.introspect`. What is guaranteed here is\n     *   that the header names what was asked for and never something else — which is the failure\n     *   worth preventing: a turn sent somewhere the transcript above it did not come from.\n     */\n    getAuthHeaders: async (projectId?: number): Promise<Record<string, string>> => {\n      const { assertSameSession } = pinToSession();\n      // Refuse before the rotation, so a session that could not have authorized the call anyway\n      // never spends its single-use refresh token on it. A named project lowers the bar to \"signed\n      // in\" rather than removing it — `Bearer null` is still not a thing to send.\n      if (projectId === undefined) requireScopedProject();\n      else requireAuthenticated();\n\n      const accessToken = await credential.getAccessToken();\n      // A sign-out across the rotation does not surface as a failure here: `refresh` refuses the\n      // rotation for belonging to the session that ended, and the proactive path swallows that\n      // refusal (`credential.ts`) and falls back to the token it started with. So this resolves —\n      // with the dead session's token and the project it was on. `assert` below cannot see it.\n      assertSameSession();\n      // Re-read, never the pre-`await` snapshot: a `setProject` during the rotation would otherwise\n      // stamp the freshly rotated token with the project this session has already left, and a\n      // `clearProject` would resolve a header bag for a scope that no longer exists. A project the\n      // caller named is not the session's to move, so it is used as given.\n      const authorizedProjectId = projectId ?? requireScopedProject();\n      // `null` means anonymous, which the guard above already rejected — reachable only if a\n      // sign-out lands while the rotation is in flight.\n      assert(accessToken, KeboolaErrorType.NotAuthenticated);\n\n      return {\n        [HttpHeader.AUTHORIZATION]: `Bearer ${accessToken}`,\n        [KeboolaHttpHeader.PROJECT_ID]: String(authorizedProjectId),\n      };\n    },\n\n    restore: async (): Promise<RestoreResult> => {\n      const persisted = persistor.hydrate();\n      // Need both the refresh token and the stack it belongs to — a blob missing either is unusable.\n      if (!persisted.refreshToken || !persisted.baseUrl) return { status: 'empty' };\n\n      // The configured stack is authoritative. If the caller targets a different stack than the stored\n      // session, that session isn't ours — discard it (the refresh token only validates against its own\n      // stack, so we never send it elsewhere). With no stack configured, adopt the stored one.\n      const configured = config.getBaseUrl();\n      if (configured && configured !== persisted.baseUrl) {\n        persistor.clear();\n        return { status: 'empty' };\n      }\n      if (!configured) config.setBaseUrl(persisted.baseUrl);\n\n      // Bare client: the refresh transport, bypassing the auth middleware (see `authClientBare`).\n      const client = authClientBare.get();\n      assert(client, KeboolaErrorType.NotReady);\n      // Pinned like every other credential-emitting path here. `config.authenticate` only asks\n      // whether the session is anonymous — which a sign-out makes true — so a sign-out landing while\n      // the stored token is on the wire would be undone: the restore would sign the user back in.\n      // It resolves as `empty` rather than throwing, because that is what the sign-out left behind:\n      // it cleared storage, so there is no persisted session any more, and a boot-time restore\n      // should land the app on its sign-in screen, not on an error.\n      const startedOn = config.getEpoch();\n      try {\n        const refreshed = await client.token.refresh(persisted.refreshToken);\n        if (config.getEpoch() !== startedOn) return { status: 'empty' };\n        config.authenticate(refreshed);\n        if (persisted.projectId !== null) {\n          config.setProjectId(persisted.projectId);\n          await projectClientsAsync.settled();\n        }\n        return { status: 'restored' };\n      } catch (err) {\n        // Lost the race rather than found a dead token. The stored refresh token is single-use, so\n        // two concurrent restores cannot both rotate it — and by now the winner has persisted its\n        // own session, which `persistor.clear()` below would wipe: alive in memory, gone on the\n        // next reload. Says nothing about the token, because this call proved nothing about it.\n        if (config.getEpoch() !== startedOn) return { status: 'empty' };\n        if (isUnauthorized(err)) {\n          persistor.clear();\n          return { status: 'expired' };\n        }\n        throw err;\n      }\n    },\n    subscribe: (listener: (snapshot: SessionSnapshot) => void) => {\n      // Fire on both config mutations and storage-build transitions, so `ready` is observable.\n      const unsubscribeConfig = config.store.subscribe(() => listener(debug()));\n      const unsubscribeBuild = projectClientsAsync.store.subscribe(() => listener(debug()));\n      return () => {\n        unsubscribeConfig();\n        unsubscribeBuild();\n      };\n    },\n    debug,\n  };\n\n  const api = createApi({\n    getAuthClient: () => authClient.get(),\n    getManagementClient: () => management.get(),\n    getProjectClients: () => {\n      const state = projectClientsAsync.store.get();\n      return state.state === 'ready' ? state.value : null;\n    },\n  });\n\n  return { api, session };\n};\n","import { createStore } from '../../utils';\n\nexport type State = {\n  baseUrl: string | null;\n  sapiToken: string | null;\n  managementToken: string | null;\n};\n\n// The legacy config is a plain observable state store: the host injects the baseUrl and tokens, and\n// consumers derive their clients from `store` (see `keboola.ts`). No lifecycle events — the derived\n// stores react to state changes directly.\nexport const createConfig = () => {\n  const store = createStore<State>({ baseUrl: null, sapiToken: null, managementToken: null });\n\n  const setBaseUrl = (baseUrl: string) => {\n    store.set({ ...store.get(), baseUrl });\n  };\n\n  const authenticate = (tokens: { sapiToken?: string; managementToken?: string }) => {\n    const current = store.get();\n    store.set({\n      ...current,\n      sapiToken: tokens.sapiToken ?? current.sapiToken,\n      managementToken: tokens.managementToken ?? current.managementToken,\n    });\n  };\n\n  // SAPI token accessors over the config store — the single source of truth. The storage build reads\n  // `getStorageToken` on every request; in-band rotations write back via `setStorageToken`, which\n  // surfaces to observers as an ordinary store change.\n  const getStorageToken = () => store.get().sapiToken ?? '';\n  const setStorageToken = (sapiToken: string) => store.set({ ...store.get(), sapiToken });\n\n  /** Current state, for diagnostics. */\n  const debug = (): State => store.get();\n\n  return { store, setBaseUrl, authenticate, getStorageToken, setStorageToken, debug };\n};\n","import type { AuthStrategy } from '../../clients/auth';\nimport { createStorageClient } from '../../clients/storage';\nimport { ProjectFeature } from '../../constants/projectFeatures';\nimport { createDefaultBranch } from '../../domain/defaultBranch';\nimport { createStack, type ServiceUrls } from '../../domain/stack';\nimport { createStorageTable } from '../../domain/storageTable';\nimport { type MiddlewareFn, normalizeBaseUrl } from '../../fetchClient';\nimport { KeboolaHttpHeader } from '../../internal';\nimport { createConfigurationSdk } from '../../sdks/configurations';\nimport { createSemanticLayerSdk } from '../../sdks/semanticLayer';\nimport { createStorageSdk } from '../../sdks/storage';\nimport { createTagSdk } from '../../sdks/tag';\nimport { createVariablesSdk } from '../../sdks/variables';\nimport { createVaultSdk } from '../../sdks/vault';\nimport { createDerivedStore } from '../../utils';\nimport { type ClientContext, createLiveProject } from '../createLiveProject';\nimport { type MiddlewareFor } from '../createMiddlewareFor';\nimport { createServiceClients } from '../createServiceClients';\n\nconst createAttachStorageToken =\n  (getToken: () => string): MiddlewareFn =>\n  (next) =>\n  (request) => {\n    request.request.headers.set(KeboolaHttpHeader.STORAGE_API_TOKEN, getToken());\n    return next(request);\n  };\n\ntype Options = {\n  baseUrl: string;\n  getStorageToken: () => string;\n  onStorageTokenRefreshed: (token: string) => void;\n  middlewareFor: MiddlewareFor;\n  clientServiceUrls?: ServiceUrls;\n};\n\nexport const createProjectClients = async ({\n  baseUrl,\n  getStorageToken,\n  onStorageTokenRefreshed,\n  middlewareFor,\n  clientServiceUrls,\n}: Options) => {\n  const auth: AuthStrategy = { type: 'sapi-token', token: getStorageToken() };\n\n  const attach = createAttachStorageToken(getStorageToken);\n  const _storage = createStorageClient({ baseUrl, auth, middlewares: [attach] });\n  const [stackInfo, sapiToken, devBranches] = await Promise.all([\n    _storage.getStackInfo({ exclude: 'componentDetails' }),\n    _storage.tokens.verify(),\n    _storage.branches.getDevBranches(),\n  ]);\n\n  const stack = createStack({ stackInfo, clientServiceUrls });\n  const defaultBranch = createDefaultBranch({ devBranches });\n  const liveProject = createLiveProject({\n    initialToken: sapiToken,\n    verify: () => _storage.tokens.verify(),\n  });\n  const storageTableStore = createDerivedStore({\n    source: liveProject.store,\n    build: createStorageTable,\n    dependsOn: (project) => ({\n      useLegacyBucketPrefix: !project.hasFeature(ProjectFeature.DisableLegacyBucketPrefix),\n      hasProtectedDefaultBranch: project.hasFeature(ProjectFeature.SoxProtectedDefaultBranch),\n      hasStorageBranches: project.hasFeature(ProjectFeature.StorageBranches),\n    }),\n  });\n  const context: ClientContext = {\n    baseUrl: normalizeBaseUrl(baseUrl),\n    stack,\n    defaultBranch,\n    get project() {\n      return liveProject.getProject();\n    },\n    get st() {\n      return storageTableStore.get();\n    },\n  };\n\n  // Static storage-token header + in-band refresh (onRefreshToken rotates the shared liveToken store).\n  const storage = createStorageClient({\n    baseUrl,\n    auth,\n    middlewares: middlewareFor('storage', [liveProject.middleware]),\n    onRefreshToken: onStorageTokenRefreshed,\n  });\n\n  const { client: services, meta: serviceMeta } = createServiceClients({\n    baseUrl,\n    auth,\n    getServiceBaseUrl: context.stack.getServiceUrl,\n    middlewareFor,\n    attachTokenMiddleware: attach,\n  });\n\n  const sdk = {\n    configuration: createConfigurationSdk({\n      storageClient: storage,\n      encryptionClient: services.encryption,\n      context,\n    }),\n    tag: createTagSdk({ metastoreClient: services.metastore }),\n    semanticLayer: createSemanticLayerSdk({ metastoreClient: services.metastore }),\n    storage: createStorageSdk({ storageClient: storage }),\n    vault: createVaultSdk({ vaultClient: services.vault, encryptionClient: services.encryption }),\n    variables: createVariablesSdk({ storageClient: storage }),\n  };\n\n  return { context, serviceMeta, storage, ...services, sdk };\n};\n","import { createAuthClient } from '../../clients/auth/authClient';\nimport { createManagementClient } from '../../clients/management';\nimport { createDerivedAsyncStore, createDerivedStore } from '../../utils';\nimport { createApi } from '../createApi';\nimport { createMiddlewareFor } from '../createMiddlewareFor';\nimport type { KeboolaOptions } from '../types';\n\nimport { createConfig, type State } from './createConfig';\nimport { createProjectClients } from './createProjectClients';\nimport type { SessionSnapshot } from './types';\n\ntype ProjectClients = Awaited<ReturnType<typeof createProjectClients>>;\n\nexport const createLegacyKeboola = (options: KeboolaOptions = {}) => {\n  const config = createConfig();\n  const middlewareFor = createMiddlewareFor(options.middlewares);\n\n  // The clients are derived from config state: each rebuilds only when the slice it depends on\n  // changes. auth needs a baseUrl; management builds token-less up front and upgrades once a manage\n  // token lands; storage builds once the SAPI token arrives (a later in-band rotation keeps the same\n  // baseUrl key, so it does not rebuild).\n  const authClient = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => state.baseUrl,\n    build: (baseUrl) =>\n      baseUrl ? createAuthClient({ baseUrl, middlewares: middlewareFor('auth', []) }) : null,\n  });\n\n  const management = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => ({ baseUrl: state.baseUrl, token: state.managementToken }),\n    build: ({ baseUrl, token }) =>\n      baseUrl\n        ? createManagementClient({\n            baseUrl,\n            auth: token ? { type: 'management-token', token } : { type: 'management-token' },\n            middlewares: middlewareFor('management', []),\n          })\n        : null,\n  });\n\n  const build = createDerivedAsyncStore<State, string, ProjectClients>({\n    source: config.store,\n    dependsOn: (state) => (state.sapiToken && state.baseUrl ? state.baseUrl : null),\n    build: (baseUrl) =>\n      createProjectClients({\n        baseUrl,\n        getStorageToken: config.getStorageToken,\n        onStorageTokenRefreshed: config.setStorageToken,\n        middlewareFor,\n        clientServiceUrls: options.clientServiceUrls,\n      }),\n  });\n\n  if (options.baseUrl) config.setBaseUrl(options.baseUrl);\n\n  const debug = (): SessionSnapshot => {\n    const info = config.debug();\n    return {\n      type: 'Sapi',\n      config: info,\n      authReady: authClient.get() !== null,\n      managementReady: !!info.managementToken,\n      storage: build.store.get().state,\n    };\n  };\n\n  const session = {\n    setBaseUrl: config.setBaseUrl,\n    isStorageReady: () => build.store.get().state === 'ready',\n    authenticateStorage: (sapiToken: string) => config.authenticate({ sapiToken }),\n    authenticateStorageAsync: async (sapiToken: string) => {\n      config.authenticate({ sapiToken });\n      // `authenticate` mutates synchronously, so the build is already pending; `settled` awaits it.\n      await build.settled();\n    },\n    authenticateManagement: (managementToken: string) => config.authenticate({ managementToken }),\n    subscribe: (listener: (snapshot: SessionSnapshot) => void) => {\n      // Fire on both config mutations and storage-build transitions, so `ready` is observable.\n      const unsubscribeConfig = config.store.subscribe(() => listener(debug()));\n      const unsubscribeBuild = build.store.subscribe(() => listener(debug()));\n      return () => {\n        unsubscribeConfig();\n        unsubscribeBuild();\n      };\n    },\n    debug,\n  };\n\n  const api = createApi({\n    getAuthClient: () => authClient.get(),\n    getManagementClient: () => management.get(),\n    getProjectClients: () => {\n      const state = build.store.get();\n      return state.state === 'ready' ? state.value : null;\n    },\n  });\n\n  return { api, session };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAgB,OAAU,OAA6B,SAAqC;CAC1F,IAAI,SAAS,MACX,MAAM,IAAI,MAAM,OAAO;AAE3B;;;;;;;;;;;;;;;;;;;ACcA,MAAa,YAAe,SAAiD;CAC3E,IAAI,UAAU;CACd,MAAM,UAA8C,CAAC;CAErD,MAAM,QAAQ,YAAY;EACxB,UAAU;EACV,MAAM,QAAQ,QAAQ,OAAO,CAAC;EAE9B,IAAI;GACF,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,SAAS,WAAW,OAAO,QAAQ,MAAM,CAAC;EAClD,SAAS,OAAO;GACd,MAAM,SAAS,WAAW,OAAO,OAAO,KAAK,CAAC;EAChD;EAEA,IAAI,QAAQ,SAAS,GAAG,OAAO,MAAM;EACrC,UAAU;CACZ;CAEA,aAAa;EACX,MAAM,SAAS,QAAQ,cAA0B;EACjD,QAAQ,KAAK,MAAM;EACnB,IAAI,CAAC,SAAS,MAAW;EACzB,OAAO,OAAO;CAChB;AACF;;;ACzCA,MAAM,wBAAwB,UAA2B;CACvD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO;CACjC,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,MAAa,gBAAmB,GAAM,MAAkB;CACtD,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,OAAO;CAC5B,IAAI,OAAO,MAAM,YAAY,MAAM,QAAQ,OAAO,MAAM,YAAY,MAAM,MAAM,OAAO;CACvF,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,OAAO;CACjE,MAAM,QAAQ,OAAO,KAAK,CAAC;CAC3B,MAAM,QAAQ,OAAO,KAAK,CAAC;CAC3B,OAAO,MAAM,WAAW,MAAM,UAAU,MAAM,OAAO,QAAQ,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC;AACxF;AASA,MAAa,sBAA+B,EAC1C,QACA,WACA,OACA,YAAY,mBACwC;CACpD,IAAI,MAAM,UAAU,OAAO,IAAI,CAAC;CAChC,MAAM,QAAQ,YAAY,MAAM,GAAG,CAAC;CAKpC,MAAM,cAAc,OAAO,WAAW,UAAU;EAC9C,MAAM,OAAO,UAAU,KAAK;EAC5B,IAAI,UAAU,KAAK,IAAI,GAAG;EAC1B,MAAM;EACN,MAAM,IAAI,MAAM,IAAI,CAAC;CACvB,CAAC;CAED,MAAM,MAAM,MAAM;CAElB,MAAM,YAAY,MAAM;CAExB,MAAM,gBAAgB;EACpB,YAAY;EACZ,MAAM,QAAQ;CAChB;CAEA,OAAO;EAAE;EAAK;EAAW;CAAQ;AACnC;;;ACpBA,MAAa,2BAAoC,EAC/C,QACA,WACA,OACA,YAAY,mBAIT;CACH,MAAM,QAAQ,YAA2B,EAAE,OAAO,OAAO,CAAC;CAC1D,IAAI,aAAuB;CAC3B,IAAI,aAAa;CACjB,IAAI,aAAqC;CAEzC,MAAM,OAAO,QAAW;EACtB,YAAY,MAAM;EAClB,aAAa,IAAI,gBAAgB;EACjC,MAAM,gBAAgB,EAAE;EACxB,MAAM,IAAI,EAAE,OAAO,UAAU,CAAC;EAI9B,MAAM,KAAK,WAAW,MAAM,CAAC,CAAC,MAC3B,UAAU;GACT,IAAI,kBAAkB,YAAY,MAAM,IAAI;IAAE,OAAO;IAAS;GAAM,CAAC;EACvE,IACC,UAAU;GACT,IAAI,kBAAkB,YAAY,MAAM,IAAI;IAAE,OAAO;IAAW;GAAM,CAAC;EACzE,CACF;CACF;CAEA,MAAM,QAAQ,UAAa;EACzB,MAAM,OAAO,UAAU,KAAK;EAC5B,IAAI,SAAS,MAAM;GACjB,IAAI,eAAe,MAAM;GACzB,YAAY,MAAM;GAClB,aAAa;GACb,cAAc;GACd,aAAa;GACb,MAAM,IAAI,EAAE,OAAO,OAAO,CAAC;GAC3B;EACF;EACA,IAAI,eAAe,QAAQ,UAAU,YAAY,IAAI,GAAG;EACxD,aAAa;EACb,IAAI,IAAI;CACV;CACA,KAAK,OAAO,IAAI,CAAC;CAEjB,MAAM,cAAc,OAAO,UAAU,IAAI;CAEzC,MAAM,MAAM,MAAM;CAElB,MAAM,YAAY,MAAM;CAExB,MAAM,gBAAgB;EACpB,YAAY,MAAM;EAClB,YAAY;EACZ,MAAM,QAAQ;CAChB;CAEA,MAAM,WAAyC;EAAE;EAAK;EAAW;CAAQ;CAEzE,MAAM,gBACJ,IAAI,SAA0B,YAAY;EACxC,IAAI,2BAA2B,CAAC;EAChC,MAAM,SAAS,UAAyB;GACtC,IAAI,MAAM,UAAU,WAAW,MAAM,UAAU,WAAW;IACxD,mBAAmB;IACnB,QAAQ,KAAK;GACf;EACF;EACA,qBAAqB,MAAM,UAAU,KAAK;EAC1C,MAAM,MAAM,IAAI,CAAC;CACnB,CAAC;CAEH,OAAO;EAAE,OAAO;EAAU;CAAQ;AACpC;;;ACnGA,MAAM,gBAAgB;AAmBtB,MAAM,cAAc,EAAE,eACpB,SAAS,UAAU,UAAU,SAAS,UAAU;AAElD,MAAa,sBAAsB,EAAE,QAAQ,kBAAkB,CAAC,MAAoB;CAClF,MAAM,UAAU,YAAyB,CAAC,CAAC;CAC3C,MAAM,+BAAe,IAAI,IAAwB;CAEjD,MAAM,aAAa,MAAM,SAAS,OAAO,aAAa,GAAG,CAAC;CAC1D,IAAI,UAAU;CAEd,MAAM,UAAU,QAAgB;EAC9B,aAAa,IAAI,GAAG,CAAC,GAAG;EACxB,aAAa,OAAO,GAAG;CACzB;CAEA,MAAM,QAAQ,SAAsB;EAClC,IAAI,OAAO;EAEX,OAAO,KAAK,SAAS,YAAY;GAC/B,MAAM,UAAU,KAAK,SAAS,UAAU,KAAK,KAAK,GAAG,EAAE;GAEvD,IAAI,CAAC,SAAS;GAEd,OAAO,QAAQ,GAAG;GAClB,OAAO,KAAK,QAAQ,UAAU,UAAU,OAAO;EACjD;EAEA,OAAO;CACT;CAEA,MAAM,WAAW,KAAa,aAC5B,QAAQ,IAAI,QAAQ,IAAI,CAAC,CAAC,KAAK,UAAW,MAAM,QAAQ,MAAM;EAAE,GAAG;EAAO;CAAS,IAAI,KAAM,CAAC;CAEhG,MAAM,YAAY,WAA2B;EAC3C,MAAM,MAAM;EACZ,MAAM,QAAmB;GACvB;GACA,WAAW,KAAK,IAAI;GACpB,UAAU,OAAO,MAAM;GACvB,MAAM,OAAO;GACb,OAAO,OAAO;EAChB;EAEA,aAAa,IACX,KACA,OAAO,WAAW,aAAa,QAAQ,KAAK,QAAQ,CAAC,CACvD;EACA,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC;CAC7C;CAEA,MAAM,gBAAgB;EACpB,QAAQ,UAAU,QAAQ;CAC5B;CAEA,OAAO;EACL,MAAM,QAAQ;EACd;EACA,YAAY,aAAa,QAAQ,gBAAgB,SAAS,CAAC;EAC3D,aAAa;GACX,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,OAAO,GAAG,CAAC;GAC9C,QAAQ,IAAI,CAAC,CAAC;EAChB;EACA,UAAU,WAAW,QAAQ,IAAI,CAAC,CAAC,SAAS,UAAU,MAAM,KAAK,MAAM,CAAC;CAC1E;AACF;;;;;;;;;ACtFA,MAAa,aACX,MACA,UACM;CACN,MAAM,MAA+B,EAAE,GAAG,KAAK;CAE/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,UAAU,IAAI;EACpB,IAAI,OAAO,cAAc,OAAO,KAAK,cAAc,KAAK,IAAI,UAAU,SAAS,KAAK,IAAI;CAC1F;CAEA,OAAO;AACT;;;ACXA,MAAa,2BAA2C;CACtD,eAAe;CACf,eAAe,CAAC;CAChB,kBAAkB,CAAC;AACrB;AAIA,MAAa,4BAA4C;CACvD,MAAM,wBAAQ,IAAI,IAAoB;CACtC,OAAO;EACL,UAAU,QAAQ,MAAM,IAAI,GAAG,KAAK;EACpC,UAAU,KAAK,UAAU;GACvB,MAAM,IAAI,KAAK,KAAK;EACtB;EACA,aAAa,QAAQ;GACnB,MAAM,OAAO,GAAG;EAClB;CACF;AACF;AAOA,MAAM,oBAAoB,SAA+C;CACvE,IAAI,MAAsB;CAC1B,IAAI;EACF,MAAM,KAAK;EACX,IAAI,KAAK;GACP,MAAM,QAAQ;GACd,IAAI,QAAQ,OAAO,KAAK;GACxB,IAAI,WAAW,KAAK;EACtB;CACF,SAAS,KAAK;EACZ,QAAQ,KAAK,qEAAqE,GAAG;EACrF,MAAM;CACR;CACA,IAAI,CAAC,KAAK,OAAO,oBAAoB;CAErC,MAAM,UAAU;CAChB,OAAO;EACL,UAAU,QAAQ,QAAQ,QAAQ,GAAG;EACrC,UAAU,KAAK,UAAU;GACvB,QAAQ,QAAQ,KAAK,KAAK;EAC5B;EACA,aAAa,QAAQ;GACnB,QAAQ,WAAW,GAAG;EACxB;CACF;AACF;AAEA,MAAa,2BACX,uBAAwB,kBAAkB,aAAa,WAAW,eAAe,IAAK;AAExF,MAAa,6BACX,uBAAwB,oBAAoB,aAAa,WAAW,iBAAiB,IAAK;;;ACjC5F,MAAa,mBAAsB,EACjC,UAAU,kBAAkB,GAC5B,KACA,QACA,cACA,SAAS,KAAK,WACd,SAAS,KAAK,YACyB;CAGvC,MAAM,cAAoB;EACxB,IAAI;GACF,QAAQ,WAAW,GAAG;EACxB,SAAS,KAAK;GACZ,QAAQ,KAAK,qCAAqC,IAAI,IAAI,GAAG;EAC/D;CACF;CAIA,MAAM,0BAAmC;EACvC,IAAI;GACF,OAAO,CAAC,CAAC,QAAQ,QAAQ,GAAG;EAC9B,SAAS,KAAK;GACZ,QAAQ,KAAK,oCAAoC,IAAI,oBAAoB,GAAG;GAC5E,OAAO;EACT;CACF;CAEA,MAAM,gBAAmB;EACvB,IAAI;EACJ,IAAI;GACF,MAAM,QAAQ,QAAQ,GAAG;EAC3B,SAAS,KAAK;GACZ,QAAQ,KAAK,oCAAoC,IAAI,mBAAmB,GAAG;GAC3E,OAAO;EACT;EACA,IAAI,QAAQ,MAAM,OAAO;EAEzB,IAAI;EACJ,IAAI;GACF,UAAU,OAAO,GAAG;EACtB,SAAS,KAAK;GACZ,QAAQ,KAAK,sCAAsC,IAAI,eAAe,GAAG;GACzE,MAAM;GACN,OAAO;EACT;EAEA,MAAM,SAAS,OAAO,UAAU,OAAO;EACvC,IAAI,OAAO,SAAS,OAAO,OAAO;EAClC,MAAM;EACN,OAAO;CACT;CAEA,MAAM,WAAW,UAAmB;EAClC,IAAI;EACJ,IAAI;GACF,MAAM,OAAO,KAAK;EACpB,SAAS,KAAK;GACZ,QAAQ,KAAK,sCAAsC,IAAI,oBAAoB,GAAG;GAC9E;EACF;EACA,IAAI;GACF,QAAQ,QAAQ,KAAK,GAAG;EAC1B,SAAS,KAAK;GACZ,QAAQ,KAAK,qCAAqC,IAAI,IAAI,GAAG;EAC/D;CACF;CAEA,OAAO;EAAE;EAAS;EAAS;EAAO;CAAkB;AACtD;;;AC9FA,MAAM,kCAAkC,CAItC,wBAGA,wCACF;AAEA,MAAa,iCAAiC,YAA8B;CAC1E,IAAI,QAAQ,WAAW,OAAO,OAAO;CACrC,MAAM,EAAE,aAAa,IAAI,IAAI,QAAQ,GAAG;CACxC,OAAO,gCAAgC,MAAM,YAAY,QAAQ,KAAK,QAAQ,CAAC;AACjF;AAEA,MAAM,kCAEF,eACA,oBAED,SACD,OAAO,YAAY;CACjB,MAAM,WAAW,MAAM,KAAK,OAAO;CAGnC,IAAI,cAAc,QAAQ,OAAO,GAAG,MAAM,eAAe;CACzD,OAAO;AACT;;;;;AAMF,MAAa,qBAAqB,EAChC,cACA,aAII;CACJ,MAAM,QAAQ,YAAY,cAAc,EAAE,WAAW,aAAa,CAAC,CAAC;CACpE,MAAM,UAAU,SAAS,YAAY,MAAM,IAAI,cAAc,EAAE,WAAW,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC;CAC5F,MAAM,aAAa,+BAA+B,+BAA+B,OAAO;CACxF,OAAO;EAAE;EAAO,kBAAkB,MAAM,IAAI;EAAG,WAAW,MAAM;EAAW;EAAY;CAAQ;AACjG;;;;;;;ACnDA,MAAa,mBAAmB;CAC9B,cAAc;CACd,kBAAkB;CAClB,sBAAsB;CACtB,gBAAgB;CAChB,mBAAmB;CACnB,gBAAgB;CAChB,WAAW;CACX,UAAU;CACV,wBAAwB;AAC1B;AAIA,MAAM,WAA6C;EAChD,iBAAiB,eAAe;EAChC,iBAAiB,mBAAmB;EACpC,iBAAiB,uBAChB;EACD,iBAAiB,iBAAiB;EAClC,iBAAiB,oBAChB;EACD,iBAAiB,iBAChB;EACD,iBAAiB,YAAY;EAC7B,iBAAiB,WAAW;EAC5B,iBAAiB,yBAChB;AACJ;AAEA,IAAa,eAAb,MAAa,qBAAqB,MAAM;CACtC;CAEA,YAAY,MAAwB;EAClC,MAAM,SAAS,KAAK;EACpB,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,OAAO,eAAe,MAAM,aAAa,SAAS;CACpD;AACF;AAEA,MAAa,kBAAkB,UAC7B,iBAAiB;;AAGnB,SAAgBA,SAAU,OAA6B,MAA4C;CACjG,IAAI,SAAS,MAAM,MAAM,IAAI,aAAa,IAAI;AAChD;;;AC9CA,MAAM,wBAAwB;AAE9B,MAAM,0BAA0B;CAC9B,kBAAkB;CAClB,kBAAkB;CAClB;CACA;CACA;AACF;AAEA,MAAM,+CAA+B,IAAI,IAAI;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,WAAW;AAEjB,MAAM,kBAAkB,WAA2B;CACjD,MAAM,MAAM,IAAI,IAAI,MAAM;CAC1B,IAAI,IAAI,UAAU,IAAI,WAAW;CACjC,IAAI,IAAI,UAAU,IAAI,WAAW;CAEjC,IAAI,aAAa,SAAS,QAAQ,QAAQ;EACxC,IAAI,6BAA6B,IAAI,IAAI,YAAY,CAAC,GACpD,IAAI,aAAa,IAAI,KAAK,QAAQ;CAEtC,CAAC;CACD,OAAO,IAAI,SAAS;AACtB;AAQA,MAAM,uBAAuB,YAA6B;CACxD,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,qBAAqB,KAAK,aAAa;CACjF,QAAQ,QAAQ,IAAI,uBAAuB,aAAa;CACxD,OAAO;AACT;AAEA,MAAM,sBAAsB,SAAkB,aAA+C;CAC3F,MAAM,cAAc,IAAI,IACtB,CAAC,GAAG,yBAAyB,GAAG,QAAQ,CAAC,CAAC,KAAK,MAAM,EAAE,YAAY,CAAC,CACtE;CAEA,MAAM,SAAiC,CAAC;CACxC,QAAQ,SAAS,OAAO,SAAS;EAC/B,OAAO,QAAQ,YAAY,IAAI,KAAK,YAAY,CAAC,IAAI,WAAW;CAClE,CAAC;CACD,OAAO;AACT;AA2CA,MAAM,iBAAiB,SAAkB,qBAA2C;CAClF,KAAK,eAAe,QAAQ,GAAG;CAC/B,SAAS,mBAAmB,QAAQ,SAAS,eAAe;AAC9D;AAEA,MAAM,kBAAkB,UAAoB,qBAA4C;CACtF,QAAQ,SAAS;CACjB,YAAY,SAAS;CACrB,SAAS,mBAAmB,SAAS,SAAS,eAAe;AAC/D;AAMA,MAAM,kBAAkB,OAAiB,oBACvC,IAAI,SAAS;CACX,SAAS,IAAI,QAAQ,eAAe,MAAM,QAAQ,GAAG,GAAG;EACtD,QAAQ,MAAM,QAAQ;EACtB,SAAS,mBAAmB,MAAM,QAAQ,SAAS,eAAe;CACpE,CAAC;CACD,UAAU,IAAI,SAAS,MAAM;EAC3B,QAAQ,MAAM,SAAS;EACvB,YAAY,MAAM,SAAS;EAC3B,SAAS,mBAAmB,MAAM,SAAS,SAAS,eAAe;CACrE,CAAC;CACD,MAAM,MAAM;AACd,CAAC;AAEH,MAAM,aAAa,OAAyB,QAAqB;CAC/D,MAAM,QAAQ;EAAC,IAAI,MAAM,YAAY,EAAE;EAAI,GAAG,KAAK,MAAM,IAAI,UAAU,EAAE;EAAK,IAAI;CAAM;CACxF,MAAM,KAAK,IAAI,QAAQ,GAAG;CAC1B,IAAI,cAAc,KAAK,MAAM,KAAK,OAAO,IAAI,SAAS,MAAM,CAAC;CAC7D,OAAO,MAAM,KAAK,GAAG;AACvB;AAEA,MAAM,oBAAoB,QAAiB,QAAkB,iBAAmC;CAC9F,OAAO;EACL,OAAO,QAAQ;GACb,IAAI,UAAU,OAAO;GACrB,IAAI;IACF,IAAI,QAAQ,MAAM;KAChB,OAAO,KAAK,GAAG;KACf;IACF;IAEA,QAAQ,KAAK,UAAU,QAAQ,GAAG,CAAC;GACrC,QAAQ,CAER;EACF;EACA,QAAQ,QAAQ;GACd,IAAI;IACF,IAAI,QAAQ,OAAO;KACjB,OAAO,MAAM,GAAG;KAChB;IACF;IAEA,QAAQ,MAAM,UAAU,SAAS,GAAG,CAAC;GACvC,QAAQ,CAER;EACF;CACF;AACF;AAEA,MAAa,2BAA2B,UAA0B,CAAC,MAAoB;CACrF,MAAM,aAAa,iBAAiB,QAAQ,QAAQ,QAAQ,KAAK;CACjE,MAAM,gBAAgB,QAAQ,iBAAiB,CAAC;CAEhD,QAAQ,SAAS,OAAO,iBAAiB;EACvC,MAAM,gBAAgB,oBAAoB,aAAa,OAAO;EAC9D,MAAM,QAAQ,YAAY,IAAI;EAC9B,MAAM,SAAS,aAAa,QAAQ,OAAO,YAAY;EACvD,MAAM,aAAa,cAAc,aAAa,SAAS,aAAa;EAEpE,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,YAAY;GACtC,WAAW,KAAK;IACd;IACA;IACA,YAAY,YAAY,IAAI,IAAI;IAChC,SAAS;IACT,UAAU,eAAe,OAAO,UAAU,aAAa;GACzD,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,IAAI,iBAAiB,OACnB,WAAW,MAAM;IACf;IACA;IACA,YAAY,YAAY,IAAI,IAAI;IAChC,SAAS;IACT,OAAO,WAAW,KAAK,IAAI,eAAe,OAAO,aAAa,IAAI;GACpE,CAAC;GAEH,MAAM;EACR;CACF;AACF;;;AC9MA,MAAM,sBAAsB;AAC5B,MAAM,6BAAuC;CAC3C,WAAW;CACX,WAAW;CACX,WAAW;CACX,WAAW;AACb;AACA,MAAM,yBAAyB;AAQ/B,MAAM,sBAAsB,UAC1B,iBAAiB,YAAY,2BAA2B,SAAS,MAAM,SAAS,MAAM;AAExF,MAAa,yBAAyB,YAAyC;CAC7E,MAAM,EACJ,aAAa,qBACb,gBAAgB,wBAChB,cAAc,uBACZ,WAAW,CAAC;CAEhB,IAAI,CAAC,OAAO,UAAU,UAAU,KAAK,aAAa,GAChD,MAAM,IAAI,WAAW,2CAA2C;CAElE,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,gBAAgB,GACrD,MAAM,IAAI,WAAW,oDAAoD;CAG3E,QAAQ,SAAS,OAAO,YAAY;EAClC,KAAK,IAAI,UAAU,GAAG,WAAW,YAAY,WAC3C,IAAI;GACF,OAAO,MAAM,KAAK;IAAE,GAAG;IAAS,SAAS,QAAQ,QAAQ,MAAM;GAAE,CAAC;EACpE,SAAS,OAAO;GACd,IAAI,YAAY,cAAc,CAAC,YAAY,OAAO,OAAO,GACvD,MAAM;GAGR,MAAM,UAAU,gBAAgB,MAAO,KAAK,IAAI,GAAG,OAAO;GAC1D,MAAM,MAAM,SAAS,QAAQ,QAAQ,UAAU,KAAA,CAAS;EAC1D;EAGF,MAAM,IAAI,MAAM,aAAa;CAC/B;AACF;;;ACrDA,MAAa,qBAAqB,aAChC,OAAO,aAAa,YACpB,aAAa,UACb,aAAa,iBACb,aAAa,cACb,aAAa;;;;AAKf,MAAa,qBAAwD,EACnE,aAGO;CACP,MAAM,eAAe,OAAiB,CAAC,MACrC,IAAI,YAAY,CAAC,GAAG;EAElB,MAAM,SAAS,SAAS;GAEtB,IAAI,kBAAkB,IAAI,GAAG,OAAO,KAAA;GACpC,OAAO,YAAY,CAAC,GAAG,MAAM,IAAI,CAAC;EACpC;EAEA,QAAQ,SAAS,WAAW,SAAS,OAAO,MAAM,IAAI;CACxD,CAAC;CAEH,OAAO,YAAY;AACrB;;;ACoBA,MAAa,qCAEV,EACC,mBACA,oBAC6D;CAC7D,MAAM,SAAS,WAAmB,eAChC,kBAAkB,EAChB,SAAS,MAAM,SAAS;EACtB,gBAAgB;GACd;GACA;GACA;GACA;EACF,CAAC;CACH,EACF,CAAC;CAEH,MAAM,UAAiD,CAAC;CAExD,MAAM,iBAAiB,EACrB,WACA,UACA,iBACyC;EACzC,MAAM,iBAAiB,kBAAkB,SAAS;EAClD,OAAO,iBAAiB,SAAS,cAAc,IAAI,MAAM,WAAW,UAAU;CAChF;CAGA,MAAM,WAAyD;EAC7D,MAAM,WAAW;GACf,QAAQ,KAAK,MAAM;GACnB,OAAO;EACT;EACA,aAAa;GACX,MAAM,YAAqC,CAAC;GAC5C,MAAM,aAAsC,CAAC;GAE7C,QAAQ,SAAS,WAAW;IAC1B,UAAU,OAAO,cAAc,cAAc,MAAM;IACnD,WAAW,KAAK;KACd,YAAY,OAAO;KACnB,WAAW,OAAO;KAClB,aAAa,CAAC,CAAC,kBAAkB,OAAO,SAAS;IACnD,CAAC;GACH,CAAC;GAKD,OAAO;IACL,QAAQ;IACR,MAAM;GACR;EACF;CACF;CAEA,OAAO;AACT;;;AC/EF,MAAa,aAAa,UACxB,IAAI,MAAM,CAAC,GAAiB,EAC1B,IAAI,SAAS,UAAU;CACrB,IAAI,kBAAkB,QAAQ,GAAG,OAAO,KAAA;CAExC,IAAI,aAAa,QAAQ;EACvB,MAAM,aAAa,MAAM,cAAc;EACvC,SAAO,YAAY,iBAAiB,YAAY;EAChD,OAAO;CACT;CAEA,IAAI,aAAa,cAAc;EAC7B,MAAM,aAAa,MAAM,oBAAoB;EAC7C,SAAO,YAAY,iBAAiB,iBAAiB;EACrD,OAAO;CACT;CAEA,MAAM,UAAU,MAAM,kBAAkB;CACxC,SAAO,SAAS,iBAAiB,QAAQ;CAEzC,OAAO,QAAQ;AACjB,EACF,CAAC;;;ACbH,MAAa,uBAAuB,gBAAyC;CAC3E,QAAQ,QAA0B,WAA2B,CAAC,MAAsB;EAClF,IAAI,MAAM,QAAQ,WAAW,GAAG,OAAO,CAAC,GAAG,UAAU,GAAG,WAAW;EAEnE,MAAM,MAAM,aAAa,OAAO,CAAC;EACjC,MAAM,WAAW,cAAc,WAAW,CAAC;EAC3C,OAAO;GAAC,GAAG;GAAU,GAAG;GAAK,GAAG;EAAQ;CAC1C;AACF;;;ACrBA,MAAM,UAAiB;CAAE,QAAQ;CAAa,SAAS;AAAK;AAE5D,MAAM,SAAS,YAAkC;CAAE,GAAG;CAAQ,UAAU,KAAK,IAAI;AAAE;AAEnF,MAAaC,kBAAgB,UAAiB,YAAY;CACxD,MAAM,QAAQ,YAAmB,OAAO;CACxC,IAAI,kBAAkB;CACtB,IAAI,QAAQ;CAEZ,MAAM,cAAc,YAAoB;EAEtC,IAAI,MAAM,IAAI,CAAC,CAAC,WAAW,aACzB,MAAM,IAAI,aAAa,iBAAiB,oBAAoB;EAC9D,MAAM,IAAI;GAAE,QAAQ;GAAa;EAAQ,CAAC;CAC5C;CAEA,MAAM,gBAAgB,WAAqB;EACzC,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa,MAAM,IAAI,aAAa,iBAAiB,oBAAoB;EAG9F,IAAI,CAAC,MAAM,SAAS,MAAM,IAAI,aAAa,iBAAiB,YAAY;EACxE,kBAAkB;EAClB,SAAS;EACT,MAAM,IAAI;GAAE,QAAQ;GAAiB,SAAS,MAAM;GAAS,YAAY,MAAM,MAAM;EAAE,CAAC;CAC1F;CAEA,MAAM,gBAAgB,cAAsB;EAC1C,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;EAC1F,MAAM,IAAI;GACR,QAAQ;GACR,SAAS,MAAM;GACf,YAAY,MAAM;GAClB;EACF,CAAC;CACH;;;;;;;CAQA,MAAM,uBAAuB;EAC3B,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,UAAU;EAC/B,MAAM,IAAI;GAAE,QAAQ;GAAiB,SAAS,MAAM;GAAS,YAAY,MAAM;EAAW,CAAC;CAC7F;;CAGA,MAAM,cAAc;EAClB,SAAS;EACT,MAAM,IAAI;GAAE,QAAQ;GAAa,SAAS,MAAM,IAAI,CAAC,CAAC;EAAQ,CAAC;CACjE;;CAGA,MAAM,gBAAgB,WAAqB;EACzC,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa;EAClC,MAAM,IAAI;GAAE,GAAG;GAAO,YAAY,MAAM,MAAM;EAAE,CAAC;CACnD;;;;;CAMA,MAAM,oBAAoB;EACxB,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa;EAClC,MAAM,WAAW,KAAK,IAAI,IAAI,MAAM,WAAW,YAAY;EAC3D,MAAM,IAAI;GAAE,GAAG;GAAO,YAAY;IAAE,GAAG,MAAM;IAAY;GAAS;EAAE,CAAC;CACvE;;;;;CAMA,MAAM,0BAAsC;EAC1C,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;EAC1F,OAAO,MAAM;CACf;CAEA,MAAM,mBAAkC,MAAM,IAAI,CAAC,CAAC;;;;;;;;;CAUpD,MAAM,iBAAyB;;;;;;;;;CAU/B,MAAM,sBAA+B;EACnC,IAAI,iBAAiB,OAAO;EAC5B,kBAAkB;EAClB,OAAO;CACT;CAEA,MAAM,cAAqB,MAAM,IAAI;CASrC,OAAO;EACL,OAAO;GANP,KAAK,MAAM;GACX,WAAW,MAAM;GACjB,SAAS,MAAM;EAID;EACd;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACrJA,MAAa,uBAAuB,EAAE,kBAA2B;CAC/D,MAAM,gBAAgB,YAAY,MAAM,WAAW,OAAO,SAAS;CACnE,OAAO,eAAe,0CAA0C;CAEhE,MAAM,WAAW,aAA2C;EAC1D,IAAI,YAAY,QAAQ,aAAa,WAAW,OAAO;EACvD,OAAO,OAAO,QAAQ,MAAM,cAAc,KAAK,YAAY;CAC7D;CAEA,OAAO;EACL,IAAI,cAAc;EAClB,MAAM,cAAc;EACpB;EACA,QAAQ,aAA+B,QAAQ,QAAQ,MAAM;EAC7D,YAAY,aAA+B,QAAQ,QAAQ,MAAM;CACnE;AACF;;;ACrBA,MAAM,wBAAqC,EAGzC,kBAAkB,QAAQ,GAAG,IAAI,MACnC;AAOA,MAAa,eAAe,EAAE,WAAW,wBAAiC;CACxE,MAAM,EAAE,UAAU,YAAY,UAAU,GAAG,aAAa;CAExD,MAAM,aAAa,IAAI,IACrB,SAAS,KAAK,YAAY;EACxB,MAAM,cAAc,oBAAoB,QAAQ,GAAG,GAAG,QAAQ,GAAG;EACjE,MAAM,eAAe,sBAAsB,QAAQ,GAAG,GAAG,QAAQ,GAAG;EACpE,MAAM,MAAM,eAAe,gBAAgB,QAAQ;EACnD,OAAO,CAAC,QAAQ,IAAI,GAAG;CACzB,CAAC,CACH;CAEA,MAAM,eAAe,IAAI,IAAI,WAAW,KAAK,cAAc,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC;CACrF,MAAM,aAAa,IAAI,IAAI,QAAQ;CAEnC,MAAM,cAAc,GAAG,YAAsB;EAC3C,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,WAAW,IAAI,CAAC,CAAC;CAC/C;CAEA,MAAM,gBAAgB,GAAG,gBAA0B;EACjD,IAAI,YAAY,WAAW,GAAG,OAAO;EACrC,OAAO,YAAY,OAAO,MAAM,aAAa,IAAI,CAAC,CAAC;CACrD;CAEA,MAAM,gBAAgB,gBAAwB,aAAa,IAAI,WAAW,KAAK;CAE/E,MAAM,cAAc,cAAyB,WAAW,IAAI,SAAS;CAErE,MAAM,iBAAiB,cAAyB,WAAW,IAAI,SAAS,KAAK;CAE7E,OAAO;EACL,GAAG;EACH;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACvDA,MAAM,yBAAyB;;AAgB/B,MAAa,4BACX,QACA,WACyB;CACzB,MAAM,cAAc,IAAI,IAAI,OAAO,KAAK,eAAe,WAAW,IAAI,CAAC;CAEvE,OAAO,CAAC,GAAG,QAAQ,GAAG,OAAO,QAAQ,eAAe,CAAC,YAAY,IAAI,WAAW,IAAI,CAAC,CAAC;AACxF;;AAGA,MAAa,uBACX,QACA,WACoB;CACpB,MAAM,eAAe,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,MAAM,MAAM,MAAM,KAAK,CAAC,CAAC;CAC7E,MAAM,cAAc,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC;CAE7D,OAAO,CACL,GAAG,OAAO,KAAK,UACb,aAAa,IAAI,MAAM,IAAI,IAAI;EAAE,GAAG;EAAO,OAAO,aAAa,IAAI,MAAM,IAAI;CAAE,IAAI,KACrF,GACA,GAAG,OAAO,QAAQ,UAAU,CAAC,YAAY,IAAI,MAAM,IAAI,CAAC,CAC1D;AACF;;;;;;AAOA,MAAa,sBAAsB,EAAE,oBAA6B;CAChE,MAAM,UAAU,cAAc;CAC9B,MAAM,OAAO,cAAc;CAE3B,MAAM,gBAAgB,OACpB,UACA,aACA,aACG;EACH,MAAM,SAAS,MAAM,QAAQ,iBAAiB;GAC5C,aAAa;GACb;GACA;EACF,CAAC;EAED,MAAM,MAAM,OAAO,KAAK,MAAM,cAAc,UAAU,OAAO,WAAW,KAAK,OAAO,KAAK;EAEzF,MAAM,iBAAiB,OAAO,eAAe;EAC7C,MAAM,YAAY,KAAK,eAAe;EAGtC,OAAO;GACL,aAAc,MAAM,QAAQ,cAAc,IAAI,iBAAiB,CAAC;GAChE,QAAS,MAAM,QAAQ,SAAS,IAAI,YAAY,CAAC;EACnD;CACF;CAEA,MAAM,kBAAkB,OACtB,aACA,QACA,aAC0B;EAC1B,MAAM,SAAS,MAAM,QAAQ,oBAAoB;GAC/C;GACA,aAAa;GACb,MAAM;GACN,eAAe,EAAE,WAAW,YAAY;EAC1C,CAAC;EAED,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,uBAAuB;IAC5C,UAAU,OAAO,QAAQ;IACzB,aAAa;IACb,iBAAiB,OAAO;IACxB,MAAM;IACN,eAAe,EAAE,OAAO;GAC1B,CAAC;GAED,OAAO;IAAE,aAAa,OAAO;IAAI,mBAAmB,IAAI;GAAG;EAC7D,SAAS,OAAO;GAEd,MAAM,QACH,oBAAoB;IACnB;IACA,aAAa;IACb,UAAU,OAAO;GACnB,CAAC,CAAC,CACD,OAAO,iBAA0B;IAEhC,IAAI,iBAAiB,SAAS,MAAM,UAAU,KAAA,GAC5C,MAAM,QAAQ;GAElB,CAAC;GACH,MAAM;EACR;CACF;CAEA,OAAO;;EAEL,MAAM,OAAO,EACX,aACA,mBACA,WAAW,gBAKgB;GAC3B,MAAM,EAAE,aAAa,WAAW,MAAM,cAAc,aAAa,mBAAmB,QAAQ;GAE5F,OAAO,gBAAgB,aAAa,QAAQ,QAAQ;EACtD;;EAGA,OAAO,OAAO,EACZ,mBACA,gBACA,mBACA,gBACA,WAAW,gBAOgB;GAC3B,MAAM,CAAC,QAAQ,UAAU,MAAM,QAAQ,IAAI,CACzC,cAAc,mBAAmB,gBAAgB,QAAQ,GACzD,cAAc,mBAAmB,gBAAgB,QAAQ,CAC3D,CAAC;GAED,OAAO,gBACL,yBAAyB,OAAO,aAAa,OAAO,WAAW,GAC/D,oBAAoB,OAAO,QAAQ,OAAO,MAAM,GAChD,QACF;EACF;CACF;AACF;;;ACzHA,MAAa,wBAAwB,EACnC,SACA,MACA,mBACA,eACA,4BAEA,4BAA0D,CAAC,CAAC;CAC1D;CACA,gBAAgB,EAAE,WAAW,MAAM,iBAAiB;EAClD,MAAM,IAAI,wBAAwB,WAAW,MAAM,UAAU;CAC/D;AACF,CAAC,CAAC,CACC,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,kBAAkB;EAChB,SAAS;EACT,aAAa,cAAc,SAAS,CAAC,qBAAqB,CAAC;EAC3D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,wBAAwB;EACtB,SAAS;EACT,aAAa,cAAc,eAAe,CAAC,qBAAqB,CAAC;EACjE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CAOH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,iBAAiB;EACf,SAAS,GAAG,eAAe;EAC3B,aAAa,cAAc,QAAQ,CAAC,qBAAqB,CAAC;EAC1D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,uBAAuB;EACrB,SAAS;EACT,aAAa,cAAc,YAAY;CACzC,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,mBAAmB;EACjB,SAAS;EACT,aAAa,cAAc,UAAU,CAAC,qBAAqB,CAAC;EAC5D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,wBAAwB;EACtB,SAAS;EACT,aAAa,cAAc,eAAe,CAAC,qBAAqB,CAAC;EACjE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,sBAAsB;EACpB,SAAS;EACT,aAAa,cAAc,aAAa,CAAC,qBAAqB,CAAC;EAC/D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,yBAAyB;EACvB,SAAS;EACT,aAAa,cAAc,gBAAgB,CAAC,qBAAqB,CAAC;EAClE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,kBAAkB;EAChB,SAAS;EACT,aAAa,cAAc,SAAS,CAAC,qBAAqB,CAAC;EAC3D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,iBAAiB;EACf,eAAe;EACf,SAAS;EACT,aAAa,cAAc,QAAQ,CAAC,qBAAqB,CAAC;EAC1D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,eAAe;EACb,SAAS;EACT,aAAa,cAAc,MAAM,CAAC,qBAAqB,CAAC;EACxD;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CAIH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,uBAAuB;EACrB,SAAS,GAAG,eAAe;EAC3B,aAAa,cAAc,cAAc,CAAC,qBAAqB,CAAC;EAChE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,mBAAmB;EACjB,SAAS;EACT,aAAa,cAAc,UAAU,CAAC,qBAAqB,CAAC;EAC5D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,qBAAqB;EACnB,SAAS;EACT,aAAa,cAAc,YAAY,CAAC,qBAAqB,CAAC;EAC9D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,kBAAkB;EAChB,SAAS;EACT,aAAa,cAAc,SAAS,CAAC,qBAAqB,CAAC;EAC3D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,sBAAsB;EACpB,SAAS;EACT,aAAa,cAAc,aAAa,CAAC,qBAAqB,CAAC;EAC/D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,mBAAmB;EACjB,SAAS;EACT,aAAa,cAAc,UAAU,CAAC,qBAAqB,CAAC;EAC5D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,0BAA0B;EACxB,SAAS;EACT,aAAa,cAAc,iBAAiB,CAAC,qBAAqB,CAAC;EACnE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,oBAAoB;EAClB,SAAS;EACT,aAAa,cAAc,WAAW,CAAC,qBAAqB,CAAC;EAC7D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACT,sBAAsB;EACpB,SAAS;EACT,aAAa,cAAc,aAAa,CAAC,qBAAqB,CAAC;EAC/D;CACF,CAAC;AACL,CAAC,CAAC,CACD,MAAM;;;;;;;;;;;ACvOX,MAAaC,yBAAuB,OAAO,EACzC,SACA,WACA,gBACA,eACA,wBAOI;CAGJ,MAAM,OAAqB;EAAE,MAAM;EAAU,OAAO;EAAI;CAAU;CAElE,MAAM,uBAAqC,UAAU,YAAY;EAC/D,QAAQ,QAAQ,QAAQ,IAAI,kBAAkB,YAAY,OAAO,SAAS,CAAC;EAC3E,OAAO,KAAK,OAAO;CACrB;CAEA,MAAM,UAAwB,SAAS,oBAAoB,eAAe,IAAI,CAAC;CAE/E,MAAM,SAAS,oBAAoB;EAAE;EAAS;EAAM,aAAa,CAAC,MAAM;CAAE,CAAC;CAC3E,MAAM,CAAC,WAAW,WAAW,eAAe,MAAM,QAAQ,IAAI;EAC5D,OAAO,aAAa,EAAE,SAAS,mBAAmB,CAAC;EACnD,OAAO,OAAO,OAAO;EACrB,OAAO,SAAS,eAAe;CACjC,CAAC;CAED,MAAM,QAAQ,YAAY;EAAE;EAAW;CAAkB,CAAC;CAC1D,MAAM,gBAAgB,oBAAoB,EAAE,YAAY,CAAC;CACzD,MAAM,cAAc,kBAAkB;EACpC,cAAc;EACd,cAAc,OAAO,OAAO,OAAO;CACrC,CAAC;CACD,MAAM,oBAAoB,mBAAmB;EAC3C,QAAQ,YAAY;EACpB,OAAO;EACP,YAAY,aAAa;GACvB,uBAAuB,CAAC,QAAQ,WAAW,eAAe,yBAAyB;GACnF,2BAA2B,QAAQ,WAAW,eAAe,yBAAyB;GACtF,oBAAoB,QAAQ,WAAW,eAAe,eAAe;EACvE;CACF,CAAC;CAED,MAAM,UAAyB;EAC7B,SAAS,iBAAiB,OAAO;EACjC;EACA;EACA,IAAI,UAAU;GACZ,OAAO,YAAY,WAAW;EAChC;EACA,IAAI,KAAK;GACP,OAAO,kBAAkB,IAAI;EAC/B;CACF;CAGA,MAAM,UAAU,oBAAoB;EAClC;EACA;EACA,aAAa,cAAc,WAAW,CAAC,QAAQ,YAAY,UAAU,CAAC;CACxE,CAAC;CAED,MAAM,EAAE,QAAQ,UAAU,MAAM,gBAAgB,qBAAqB;EACnE;EACA;EACA,mBAAmB,QAAQ,MAAM;EACjC;EACA,uBAAuB;CACzB,CAAC;CAED,MAAM,MAAM;EACV,eAAe,uBAAuB;GACpC,eAAe;GACf,kBAAkB,SAAS;GAC3B;EACF,CAAC;EACD,KAAK,aAAa,EAAE,iBAAiB,SAAS,UAAU,CAAC;EACzD,eAAe,uBAAuB,EAAE,iBAAiB,SAAS,UAAU,CAAC;EAC7E,SAAS,iBAAiB,EAAE,eAAe,QAAQ,CAAC;EACpD,OAAO,eAAe;GAAE,aAAa,SAAS;GAAO,kBAAkB,SAAS;EAAW,CAAC;EAC5F,WAAW,mBAAmB,EAAE,eAAe,QAAQ,CAAC;CAC1D;CAEA,OAAO;EAAE;EAAS;EAAa;EAAS,GAAG;EAAU;CAAI;AAC3D;;;;;;;;;;;;;;;ACnGA,MAAa,8BAA8B,eAA+C;CACxF,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,eAAe,EAAE,cAAc,MAAM,CAAC;EAErE,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAGvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAI,WAAW,eAAe,UAAU,OAAO;EAEvE,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,eAAe,EAAE,cAAc,KAAK,CAAC;GAExE,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAI,WAAW,eAAe,UAAU,WAAW;GAExE,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IAEnB,IAAI,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;ACxCA,MAAM,cAAc;AAEpB,MAAM,yBAAyBC,IAAE,OAAO;CACtC,SAASA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAWA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,cAAcA,IAAE,OAAO,CAAC,CAAC,SAAS;AACpC,CAAC;AAID,MAAM,0BAA4C;CAChD,SAAS;CACT,WAAW;CACX,cAAc;AAChB;AAEA,MAAa,0BAA0B,YACrC,gBAAkC;CAChC;CACA,KAAK;CACL,QAAQ;CACR,cAAc;AAChB,CAAC;;;ACRH,MAAa,iBAAiB,UAA0B,CAAC,MAAM;CAC7D,MAAM,YAAY,uBAAuB,QAAQ,OAAO;CACxD,MAAM,SAASC,eAAa;CAC5B,MAAM,gBAAgB,oBAAoB,QAAQ,WAAW;CAI7D,MAAM,kBAAkB,sBAAsB,EAC5C,cAAc,UACZ,iBAAiB,YAAY,MAAM,SAAS,WAAW,WAAW,oBACtE,CAAC;CAKD,MAAM,iBAAiB,mBAAmB;EACxC,QAAQ,OAAO;EACf,YAAY,UAAU,MAAM;EAC5B,QAAQ,YACN,UACI,iBAAiB;GAAE;GAAS,aAAa,cAAc,QAAQ,CAAC,eAAe,CAAC;EAAE,CAAC,IACnF;CACR,CAAC;CAED,MAAM,UAAU,YAAY;EAC1B,MAAM,SAAS,eAAe,IAAI;EAClC,SAAO,QAAQ,iBAAiB,QAAQ;EAKxC,MAAM,QAAQ,OAAO,SAAS;EAC9B,MAAM,YAAY,MAAM,OAAO,MAC5B,QAAQ,OAAO,kBAAkB,CAAC,CAAC,YAAY,CAAC,CAChD,OAAO,UAAmB;GAIzB,IAAI,OAAO,SAAS,MAAM,OAAO,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;GACzF,MAAM;EACR,CAAC;EACH,IAAI,OAAO,SAAS,MAAM,OAAO,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;EACzF,OAAO,aAAa,SAAS;EAC7B,OAAO,UAAU;CACnB;CAGA,MAAM,iBAAiB;EACrB,MAAM,QAAQ,OAAO,MAAM,IAAI;EAC/B,IAAI,MAAM,WAAW,aAAa,OAAO;EACzC,MAAM,EAAE,aAAa,UAAU,cAAc,MAAM;EACnD,OAAO;GAAE;GAAa,QAAQ;IAAE;IAAU;GAAU;EAAE;CACxD;;;;;;;;;;CAWA,MAAM,6BAAsE;EAC1E,MAAM,QAAQ,OAAO,MAAM,IAAI;EAC/B,IAAI,MAAM,WAAW,aAAa,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;EAC1F,OAAO;CACT;;;;;;;;;;;CAYA,MAAM,6BAAqC;EACzC,MAAM,QAAQ,qBAAqB;EACnC,IAAI,MAAM,WAAW,UAAU,MAAM,IAAI,aAAa,iBAAiB,QAAQ;EAC/E,OAAO,MAAM;CACf;;;;;;;;;;CAWA,MAAM,gCAAgB,IAAI,IAA2C;CAErE,MAAM,gBAAgB;EACpB,OAAO,MAAM;EAGb,WAAW,eAAe;EAC1B,cAAc,MAAM;EACpB,UAAU,MAAM;CAClB;CAIA,MAAM,yBAAyB;EAC7B,IAAI,OAAO,cAAc,GAAG,QAAQ;CACtC;CAEA,MAAM,aAAa,uBAAuB;EAAE;EAAS;EAAU;CAAiB,CAAC;CAIjF,MAAM,gBAAgB,gBAAwB;EAC5C,IAAI,OAAO,SAAS,MAAM,OAAO,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;CAC3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BA,MAAM,8BACJ,UACA,EACE,iBAAiB,MACjB,QAAQ,CAAC,MAC+C,CAAC,MAC1C;EACjB,QAAQ,UAAU,YAAY;GAC5B,MAAM,oBAAoB,aAAa,SAAS,CAAC;GACjD,MAAM,mBAAqC;IACzC,GAAG;IACH,gBAAgB,OAAO,YAAY;KACjC,kBAAkB;KAClB,OAAO,WAAW,eAAe,OAAO;IAC1C;IAEA,eAAe,iBAAiB,WAAW,sBAAsB,CAAC;GACpE;GAIA,MAAM,WAAyB,UAAU,aAAa;IACpD,kBAAkB;IAClB,OAAO,KAAK,QAAQ;GACtB;GACA,MAAM,QAAQ,MAAM,aACjB,KAAK,eAAe,WAAW,GAAG,GACnC,QAAQ,IAAI,CACd;GACA,OAAO,2BAA2B,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO;EACpE;CACF;;;;;;;;CASA,MAAM,gBAAgB,YAKjB;EACH,MAAM,QAAQ,OAAO,SAAS;EAC9B,OAAO;GACL,mBAAmB,aAAa,KAAK;GACrC,sBAAsB,iCAAiC,OAAO,OAAO;EACvE;CACF;CAcA,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,UAAU,MAAM;EAC5B,QAAQ,YACN,UACI,iBAAiB;GACf;GACA,aAAa,cAAc,QAAQ,CACjC,2BAA2B,OAAO,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAC1E,CAAC;EACH,CAAC,IACD;CACR,CAAC;CAKD,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,UAAW,MAAM,WAAW,cAAc,OAAO,MAAM;EACnE,QAAQ,YACN,UACI,uBAAuB;GACrB;GACA,MAAM;IAAE,MAAM;IAAU,OAAO;GAAG;GAClC,aAAa,cAAc,cAAc,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC;EAChF,CAAC,IACD;CACR,CAAC;CAED,MAAM,sBAAsB,wBAAwB;EAClD,QAAQ,OAAO;EAEf,YAAY,UACV,MAAM,WAAW,WAAW;GAAE,SAAS,MAAM;GAAS,WAAW,MAAM;EAAU,IAAI;EAEvF,QAAQ,EAAE,SAAS,gBAAgB;GACjC,OAAOC,uBAAqB;IAC1B;IACA,gBAAgB,aAAa,CAAC,CAAC;IAC/B;IACA;IACA,mBAAmB,QAAQ;GAC7B,CAAC;EACH;CACF,CAAC;CAID,MAAM,aAAa,OAAO,cAA+C;EACvE,MAAM,QAAQ,qBAAqB;EAEnC,MAAM,SAAS,cAAc,IAAI,SAAS;EAC1C,IAAI,QAAQ,OAAO,OAAO;EAa1B,MAAM,EAAE,mBAAmB,yBAAyB,aAAa,EAAE,gBAAgB,MAAM,CAAC;EAE1F,MAAM,QAAQ,KAAK,YAAY;GAC7B,MAAM,UAAU,MAAMA,uBAAqB;IACzC,SAAS,MAAM;IACf,gBAAgB;IAChB;IACA;IACA,mBAAmB,QAAQ;GAC7B,CAAC;GAGD,kBAAkB;GAClB,OAAO;EACT,CAAC;EACD,cAAc,IAAI,WAAW,KAAK;EAClC,OAAO,MAAM;CACf;CAEA,IAAI,QAAQ,SAAS,OAAO,WAAW,QAAQ,OAAO;CAMtD,OAAO,MAAM,WAAW,UAAU;EAChC,IAAI,MAAM,WAAW,aAAa;EAElC,UAAU,QAAQ;GAChB,SAAS,MAAM;GACf,WAAW,MAAM,WAAW,WAAW,MAAM,YAAY;GACzD,cAAc,MAAM,WAAW;EACjC,CAAC;CACH,CAAC;CAED,MAAM,eAAgC;EACpC,MAAM;EACN,QAAQ,OAAO,MAAM;EACrB,WAAW,WAAW,IAAI,MAAM;EAChC,iBAAiB,WAAW,IAAI,MAAM;EACtC,SAAS,oBAAoB,MAAM,IAAI,CAAC,CAAC;CAC3C;CAEA,MAAM,UAAU;EACd,mBAAmB,UAAU;EAC7B,YAAY,OAAO;EACnB,sBAAsB,oBAAoB,MAAM,IAAI,CAAC,CAAC,UAAU;EAChE,eAAe,WAAqB,OAAO,aAAa,MAAM;EAC9D,YAAY,OAAO;EACnB,iBAAiB,OAAO,cAAsB;GAC5C,OAAO,aAAa,SAAS;GAC7B,MAAM,oBAAoB,QAAQ;EACpC;;;;;;;EAOA,cAAc,OAAO;;;;;;;;;;;;;EAarB;EACA,OAAO;;;;;;EAMP,mBAAmB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmC1B,gBAAgB,OAAO,cAAwD;GAC7E,MAAM,EAAE,sBAAsB,aAAa;GAI3C,IAAI,cAAc,KAAA,GAAW,qBAAqB;QAC7C,qBAAqB;GAE1B,MAAM,cAAc,MAAM,WAAW,eAAe;GAKpD,kBAAkB;GAKlB,MAAM,sBAAsB,aAAa,qBAAqB;GAG9D,SAAO,aAAa,iBAAiB,gBAAgB;GAErD,OAAO;KACJ,WAAW,gBAAgB,UAAU;KACrC,kBAAkB,aAAa,OAAO,mBAAmB;GAC5D;EACF;EAEA,SAAS,YAAoC;GAC3C,MAAM,YAAY,UAAU,QAAQ;GAEpC,IAAI,CAAC,UAAU,gBAAgB,CAAC,UAAU,SAAS,OAAO,EAAE,QAAQ,QAAQ;GAK5E,MAAM,aAAa,OAAO,WAAW;GACrC,IAAI,cAAc,eAAe,UAAU,SAAS;IAClD,UAAU,MAAM;IAChB,OAAO,EAAE,QAAQ,QAAQ;GAC3B;GACA,IAAI,CAAC,YAAY,OAAO,WAAW,UAAU,OAAO;GAGpD,MAAM,SAAS,eAAe,IAAI;GAClC,SAAO,QAAQ,iBAAiB,QAAQ;GAOxC,MAAM,YAAY,OAAO,SAAS;GAClC,IAAI;IACF,MAAM,YAAY,MAAM,OAAO,MAAM,QAAQ,UAAU,YAAY;IACnE,IAAI,OAAO,SAAS,MAAM,WAAW,OAAO,EAAE,QAAQ,QAAQ;IAC9D,OAAO,aAAa,SAAS;IAC7B,IAAI,UAAU,cAAc,MAAM;KAChC,OAAO,aAAa,UAAU,SAAS;KACvC,MAAM,oBAAoB,QAAQ;IACpC;IACA,OAAO,EAAE,QAAQ,WAAW;GAC9B,SAAS,KAAK;IAKZ,IAAI,OAAO,SAAS,MAAM,WAAW,OAAO,EAAE,QAAQ,QAAQ;IAC9D,IAAI,eAAe,GAAG,GAAG;KACvB,UAAU,MAAM;KAChB,OAAO,EAAE,QAAQ,UAAU;IAC7B;IACA,MAAM;GACR;EACF;EACA,YAAY,aAAkD;GAE5D,MAAM,oBAAoB,OAAO,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACxE,MAAM,mBAAmB,oBAAoB,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACpF,aAAa;IACX,kBAAkB;IAClB,iBAAiB;GACnB;EACF;EACA;CACF;CAWA,OAAO;EAAE,KATG,UAAU;GACpB,qBAAqB,WAAW,IAAI;GACpC,2BAA2B,WAAW,IAAI;GAC1C,yBAAyB;IACvB,MAAM,QAAQ,oBAAoB,MAAM,IAAI;IAC5C,OAAO,MAAM,UAAU,UAAU,MAAM,QAAQ;GACjD;EACF,CAEW;EAAG;CAAQ;AACxB;;;ACjfA,MAAa,qBAAqB;CAChC,MAAM,QAAQ,YAAmB;EAAE,SAAS;EAAM,WAAW;EAAM,iBAAiB;CAAK,CAAC;CAE1F,MAAM,cAAc,YAAoB;EACtC,MAAM,IAAI;GAAE,GAAG,MAAM,IAAI;GAAG;EAAQ,CAAC;CACvC;CAEA,MAAM,gBAAgB,WAA6D;EACjF,MAAM,UAAU,MAAM,IAAI;EAC1B,MAAM,IAAI;GACR,GAAG;GACH,WAAW,OAAO,aAAa,QAAQ;GACvC,iBAAiB,OAAO,mBAAmB,QAAQ;EACrD,CAAC;CACH;CAKA,MAAM,wBAAwB,MAAM,IAAI,CAAC,CAAC,aAAa;CACvD,MAAM,mBAAmB,cAAsB,MAAM,IAAI;EAAE,GAAG,MAAM,IAAI;EAAG;CAAU,CAAC;;CAGtF,MAAM,cAAqB,MAAM,IAAI;CAErC,OAAO;EAAE;EAAO;EAAY;EAAc;EAAiB;EAAiB;CAAM;AACpF;;;AClBA,MAAM,4BACH,cACA,UACA,YAAY;CACX,QAAQ,QAAQ,QAAQ,IAAI,kBAAkB,mBAAmB,SAAS,CAAC;CAC3E,OAAO,KAAK,OAAO;AACrB;AAUF,MAAa,uBAAuB,OAAO,EACzC,SACA,iBACA,yBACA,eACA,wBACa;CACb,MAAM,OAAqB;EAAE,MAAM;EAAc,OAAO,gBAAgB;CAAE;CAE1E,MAAM,SAAS,yBAAyB,eAAe;CACvD,MAAM,WAAW,oBAAoB;EAAE;EAAS;EAAM,aAAa,CAAC,MAAM;CAAE,CAAC;CAC7E,MAAM,CAAC,WAAW,WAAW,eAAe,MAAM,QAAQ,IAAI;EAC5D,SAAS,aAAa,EAAE,SAAS,mBAAmB,CAAC;EACrD,SAAS,OAAO,OAAO;EACvB,SAAS,SAAS,eAAe;CACnC,CAAC;CAED,MAAM,QAAQ,YAAY;EAAE;EAAW;CAAkB,CAAC;CAC1D,MAAM,gBAAgB,oBAAoB,EAAE,YAAY,CAAC;CACzD,MAAM,cAAc,kBAAkB;EACpC,cAAc;EACd,cAAc,SAAS,OAAO,OAAO;CACvC,CAAC;CACD,MAAM,oBAAoB,mBAAmB;EAC3C,QAAQ,YAAY;EACpB,OAAO;EACP,YAAY,aAAa;GACvB,uBAAuB,CAAC,QAAQ,WAAW,eAAe,yBAAyB;GACnF,2BAA2B,QAAQ,WAAW,eAAe,yBAAyB;GACtF,oBAAoB,QAAQ,WAAW,eAAe,eAAe;EACvE;CACF,CAAC;CACD,MAAM,UAAyB;EAC7B,SAAS,iBAAiB,OAAO;EACjC;EACA;EACA,IAAI,UAAU;GACZ,OAAO,YAAY,WAAW;EAChC;EACA,IAAI,KAAK;GACP,OAAO,kBAAkB,IAAI;EAC/B;CACF;CAGA,MAAM,UAAU,oBAAoB;EAClC;EACA;EACA,aAAa,cAAc,WAAW,CAAC,YAAY,UAAU,CAAC;EAC9D,gBAAgB;CAClB,CAAC;CAED,MAAM,EAAE,QAAQ,UAAU,MAAM,gBAAgB,qBAAqB;EACnE;EACA;EACA,mBAAmB,QAAQ,MAAM;EACjC;EACA,uBAAuB;CACzB,CAAC;CAED,MAAM,MAAM;EACV,eAAe,uBAAuB;GACpC,eAAe;GACf,kBAAkB,SAAS;GAC3B;EACF,CAAC;EACD,KAAK,aAAa,EAAE,iBAAiB,SAAS,UAAU,CAAC;EACzD,eAAe,uBAAuB,EAAE,iBAAiB,SAAS,UAAU,CAAC;EAC7E,SAAS,iBAAiB,EAAE,eAAe,QAAQ,CAAC;EACpD,OAAO,eAAe;GAAE,aAAa,SAAS;GAAO,kBAAkB,SAAS;EAAW,CAAC;EAC5F,WAAW,mBAAmB,EAAE,eAAe,QAAQ,CAAC;CAC1D;CAEA,OAAO;EAAE;EAAS;EAAa;EAAS,GAAG;EAAU;CAAI;AAC3D;;;AChGA,MAAa,uBAAuB,UAA0B,CAAC,MAAM;CACnE,MAAM,SAAS,aAAa;CAC5B,MAAM,gBAAgB,oBAAoB,QAAQ,WAAW;CAM7D,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,UAAU,MAAM;EAC5B,QAAQ,YACN,UAAU,iBAAiB;GAAE;GAAS,aAAa,cAAc,QAAQ,CAAC,CAAC;EAAE,CAAC,IAAI;CACtF,CAAC;CAED,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,WAAW;GAAE,SAAS,MAAM;GAAS,OAAO,MAAM;EAAgB;EAC9E,QAAQ,EAAE,SAAS,YACjB,UACI,uBAAuB;GACrB;GACA,MAAM,QAAQ;IAAE,MAAM;IAAoB;GAAM,IAAI,EAAE,MAAM,mBAAmB;GAC/E,aAAa,cAAc,cAAc,CAAC,CAAC;EAC7C,CAAC,IACD;CACR,CAAC;CAED,MAAM,QAAQ,wBAAuD;EACnE,QAAQ,OAAO;EACf,YAAY,UAAW,MAAM,aAAa,MAAM,UAAU,MAAM,UAAU;EAC1E,QAAQ,YACN,qBAAqB;GACnB;GACA,iBAAiB,OAAO;GACxB,yBAAyB,OAAO;GAChC;GACA,mBAAmB,QAAQ;EAC7B,CAAC;CACL,CAAC;CAED,IAAI,QAAQ,SAAS,OAAO,WAAW,QAAQ,OAAO;CAEtD,MAAM,cAA+B;EACnC,MAAM,OAAO,OAAO,MAAM;EAC1B,OAAO;GACL,MAAM;GACN,QAAQ;GACR,WAAW,WAAW,IAAI,MAAM;GAChC,iBAAiB,CAAC,CAAC,KAAK;GACxB,SAAS,MAAM,MAAM,IAAI,CAAC,CAAC;EAC7B;CACF;CAEA,MAAM,UAAU;EACd,YAAY,OAAO;EACnB,sBAAsB,MAAM,MAAM,IAAI,CAAC,CAAC,UAAU;EAClD,sBAAsB,cAAsB,OAAO,aAAa,EAAE,UAAU,CAAC;EAC7E,0BAA0B,OAAO,cAAsB;GACrD,OAAO,aAAa,EAAE,UAAU,CAAC;GAEjC,MAAM,MAAM,QAAQ;EACtB;EACA,yBAAyB,oBAA4B,OAAO,aAAa,EAAE,gBAAgB,CAAC;EAC5F,YAAY,aAAkD;GAE5D,MAAM,oBAAoB,OAAO,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACxE,MAAM,mBAAmB,MAAM,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACtE,aAAa;IACX,kBAAkB;IAClB,iBAAiB;GACnB;EACF;EACA;CACF;CAWA,OAAO;EAAE,KATG,UAAU;GACpB,qBAAqB,WAAW,IAAI;GACpC,2BAA2B,WAAW,IAAI;GAC1C,yBAAyB;IACvB,MAAM,QAAQ,MAAM,MAAM,IAAI;IAC9B,OAAO,MAAM,UAAU,UAAU,MAAM,QAAQ;GACjD;EACF,CAEW;EAAG;CAAQ;AACxB"}