@keboola/api-client 39.0.0 → 41.0.0

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["createStore","createStore","createStore","clamp","finiteOr","isPlainObject","createStore","createProject","assert","KeboolaHttpHeader","generateUUID","ApiError","isApiError","HttpStatus","ApiError","delay","createConfig","createStore","ServiceUnavailableError","createVaultClient","createDataScienceClient","createAppsClient","createEncryptionClient","createEditorClient","createSyncActionsClient","createTelemetryClient","createQueryServiceClient","createQueueClient","createChatClient","createAiClient","createOmnisearchClient","createImportClient","createKaiAgentClient","createBusinessWorkspaceApiClient","createOauthClient","createSchedulerClient","createStreamClient","createNotificationsClient","createBillingClient","createMetastoreClient","createProjectClients","KeboolaHttpHeader","createStorageClient","createStorageTable","ProjectFeature","normalizeBaseUrl","createConfigurationSdk","createTagSdk","createSemanticLayerSdk","createStorageSdk","createVaultSdk","HttpHeader","isUnauthorized","z","createConfig","ApiError","HttpStatus","createAuthClient","createBearerCredential","createManagementClient","createProjectClients","lazy","HttpHeader","KeboolaHttpHeader","isUnauthorized","createStore","KeboolaHttpHeader","createStorageClient","createStorageTable","ProjectFeature","normalizeBaseUrl","createConfigurationSdk","createTagSdk","createSemanticLayerSdk","createStorageSdk","createVaultSdk","createAuthClient","createManagementClient"],"sources":["../src/utils/assert.ts","../src/utils/async/coalesce.ts","../src/utils/store/derivedStore.ts","../src/utils/store/derivedAsyncStore.ts","../src/utils/async/poll/registry.ts","../src/utils/deepMerge.ts","../src/utils/persistor/adapters.ts","../src/utils/persistor/persistor.ts","../src/keboola/createLiveProject.ts","../src/keboola/errors.ts","../src/middlewares/loggingMiddleware.ts","../src/middlewares/retryMiddleware.ts","../src/serviceClientRegistry/utils.ts","../src/serviceClientRegistry/createServiceClientRegistry.ts","../src/keboola/createApi.ts","../src/keboola/createMiddlewareFor.ts","../src/keboola/bearer/createConfig.ts","../src/domain/defaultBranch.ts","../src/domain/stack.ts","../src/sdks/variables/variablesSdk.ts","../src/keboola/createServiceClients.ts","../src/keboola/bearer/createProjectClients.ts","../src/keboola/bearer/middleware.ts","../src/keboola/bearer/persistor.ts","../src/keboola/bearer/keboola.ts","../src/keboola/legacy/createConfig.ts","../src/keboola/legacy/createProjectClients.ts","../src/keboola/legacy/keboola.ts"],"sourcesContent":["export function assert<T>(value: T | undefined | null, message: string): asserts value is T {\n  if (value == null) {\n    throw new Error(message);\n  }\n}\n","import type { TaskFn } from './types';\n\n/**\n * Coalesces concurrent triggers onto a single, never-parallel run of `task`.\n * Triggers fired while a run is busy collapse into one trailing run, and each\n * resolves with the first run that started after it — so it never sees stale state.\n *\n * Example — A triggers, then B and C trigger while A's run is still going:\n *   1. trigger A      → run #1 starts\n *   2. trigger B, C   → run #1 busy, so they wait\n *   3. run #1 done    → A resolves\n *   4. run #2 starts  → covers B and C together (one trailing run, not two)\n *   5. run #2 done    → B and C resolve\n *\n * @returns a trigger; each call returns a promise of the task result.\n * @throws The returned promise rejects with whatever `task` throws or rejects\n * with — the caller handles it (try/catch, or `.catch` on `void trigger()`).\n */\nexport const coalesce = <T>(task: TaskFn<T>): (() => Promise<Awaited<T>>) => {\n  let running = false;\n  const waiters: PromiseWithResolvers<Awaited<T>>[] = [];\n\n  const drain = async () => {\n    running = true;\n    const batch = waiters.splice(0);\n\n    try {\n      const result = await task();\n      batch.forEach((waiter) => waiter.resolve(result));\n    } catch (error) {\n      batch.forEach((waiter) => waiter.reject(error));\n    }\n    // Drain any triggers that arrived during the task; tail position, so no stack growth.\n    if (waiters.length > 0) return drain();\n    running = false;\n  };\n\n  return () => {\n    const waiter = Promise.withResolvers<Awaited<T>>();\n    waiters.push(waiter);\n    if (!running) void drain();\n    return waiter.promise;\n  };\n};\n","import { createStore, type ReadableStore } from './store';\n\nconst isPlainObjectOrArray = (value: object): boolean => {\n  if (Array.isArray(value)) return true;\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n};\n\nexport const shallowEqual = <T>(a: T, b: T): boolean => {\n  if (Object.is(a, b)) return true;\n  if (typeof a !== 'object' || a === null || typeof b !== 'object' || b === null) return false;\n  if (!isPlainObjectOrArray(a) || !isPlainObjectOrArray(b)) return false;\n  const aKeys = Object.keys(a) as (keyof T)[];\n  const bKeys = Object.keys(b) as (keyof T)[];\n  return aKeys.length === bKeys.length && aKeys.every((key) => Object.is(a[key], b[key]));\n};\n\ntype DerivedStoreOptions<S, K, T> = {\n  source: ReadableStore<S>;\n  dependsOn: (state: S) => K;\n  build: (key: K) => T;\n  keyEquals?: (a: K, b: K) => boolean;\n};\n\nexport const createDerivedStore = <S, K, T>({\n  source,\n  dependsOn,\n  build,\n  keyEquals = shallowEqual,\n}: DerivedStoreOptions<S, K, T>): ReadableStore<T> => {\n  let key = dependsOn(source.get());\n  const store = createStore(build(key));\n\n  // The source subscription lives for the derived store's lifetime (both normally live as long as\n  // the client). `dispose()` tears down both it and the derived store, so a short-lived derived\n  // store can be cleaned up without leaking the source subscription or taking stale updates.\n  const unsubscribe = source.subscribe((state) => {\n    const next = dependsOn(state);\n    if (keyEquals(key, next)) return;\n    key = next;\n    store.set(build(next));\n  });\n\n  const get = store.get;\n\n  const subscribe = store.subscribe;\n\n  const dispose = () => {\n    unsubscribe();\n    store.dispose();\n  };\n\n  return { get, subscribe, dispose };\n};\n","import { shallowEqual } from './derivedStore';\nimport { createStore, type ReadableStore } from './store';\n\nexport type AsyncState<T> =\n  | { state: 'idle' }\n  | { state: 'pending' }\n  | { state: 'ready'; value: T }\n  | { state: 'errored'; error: unknown };\n\n// The terminal states `settled()` resolves with.\ntype SettledState<T> = Extract<AsyncState<T>, { state: 'ready' } | { state: 'errored' }>;\n\ntype DerivedAsyncStoreOptions<S, K, T> = {\n  source: ReadableStore<S>;\n  dependsOn: (state: S) => K | null;\n  build: (key: K, signal: AbortSignal) => Promise<T>;\n  keyEquals?: (a: K, b: K) => boolean;\n};\n\n// The async sibling of `createDerivedStore`: it derives a value that arrives later, exposed as an\n// `AsyncState<T>` cell. Two switchMap-style guarantees keep concurrent rebuilds honest:\n//   - generation guard: only the latest run may write state, so a stale build resolving after a\n//     newer key can never clobber the fresh result;\n//   - AbortController: a re-key (or a null key) aborts the previous run's `signal` so in-flight work\n//     can actually stop.\n// `dependsOn` returning `null` means \"nothing to build\" → the store goes `idle` and any in-flight run\n// is aborted. Like `createDerivedStore`, the subscription is permanent for the store's lifetime.\n//\n// Returns `{ store, settled }`: `store` is the reactive `AsyncState<T>` cell; `settled()` resolves\n// on the next terminal state with that state (`ready` or `errored`) — the awaitable bridge for\n// callers that need to `await` the build rather than react to it. It never rejects: a failed build\n// is data (`{ state: 'errored', error }`), so callers handle it the same way whether they await or\n// subscribe. Settles immediately if the store is already terminal; while `idle`/`pending` it waits.\nexport const createDerivedAsyncStore = <S, K, T>({\n  source,\n  dependsOn,\n  build,\n  keyEquals = shallowEqual,\n}: DerivedAsyncStoreOptions<S, K, T>): {\n  store: ReadableStore<AsyncState<T>>;\n  settled: () => Promise<SettledState<T>>;\n} => {\n  const store = createStore<AsyncState<T>>({ state: 'idle' });\n  let currentKey: K | null = null;\n  let generation = 0;\n  let controller: AbortController | null = null;\n\n  const run = (key: K) => {\n    controller?.abort();\n    controller = new AbortController();\n    const runGeneration = ++generation;\n    store.set({ state: 'pending' });\n    // `.then(onFulfilled, onRejected)` — the reject handler consumes every rejection (including the\n    // AbortError from a superseded run), so nothing goes unhandled; the generation guard drops the\n    // stale write either way.\n    build(key, controller.signal).then(\n      (value) => {\n        if (runGeneration === generation) store.set({ state: 'ready', value });\n      },\n      (error) => {\n        if (runGeneration === generation) store.set({ state: 'errored', error });\n      },\n    );\n  };\n\n  const sync = (state: S) => {\n    const next = dependsOn(state);\n    if (next === null) {\n      if (currentKey === null) return;\n      controller?.abort();\n      controller = null;\n      generation += 1;\n      currentKey = null;\n      store.set({ state: 'idle' });\n      return;\n    }\n    if (currentKey !== null && keyEquals(currentKey, next)) return;\n    currentKey = next;\n    run(next);\n  };\n  sync(source.get());\n\n  const unsubscribe = source.subscribe(sync);\n\n  const get = store.get;\n\n  const subscribe = store.subscribe;\n\n  const dispose = () => {\n    controller?.abort();\n    unsubscribe();\n    store.dispose();\n  };\n\n  const readable: ReadableStore<AsyncState<T>> = { get, subscribe, dispose };\n\n  const settled = (): Promise<SettledState<T>> =>\n    new Promise<SettledState<T>>((resolve) => {\n      let unsubscribeSettled = () => {};\n      const check = (state: AsyncState<T>) => {\n        if (state.state === 'ready' || state.state === 'errored') {\n          unsubscribeSettled();\n          resolve(state);\n        }\n      };\n      unsubscribeSettled = store.subscribe(check);\n      check(store.get());\n    });\n\n  return { store: readable, settled };\n};\n","import { createStore } from '../../store';\n\nimport {\n  emitter,\n  type ObservedPoller,\n  type PollerStartFn,\n  type PollerStopFn,\n  type PollSnapshot,\n} from './poll';\nimport { clamp, finiteOr } from './utils';\n\nconst DEFAULT_LIMIT = 50;\n\nexport type PollEntry = {\n  /** Monotonic, so a list has a key that outlives a re-render. */\n  key: number;\n  startedAt: number;\n  snapshot: PollSnapshot;\n  stop: PollerStopFn;\n  start: PollerStartFn<unknown>;\n};\n\nexport type PollRegistry = {\n  list: () => PollEntry[];\n  subscribe: (listener: () => void) => () => void;\n  clear: () => void;\n  stopAll: (reason?: string) => void;\n  collect: () => void;\n};\n\nconst isFinished = ({ snapshot }: PollEntry) =>\n  snapshot.state !== 'idle' && snapshot.state !== 'polling';\n\nexport const createPollRegistry = ({ limit = DEFAULT_LIMIT } = {}): PollRegistry => {\n  const entries = createStore<PollEntry[]>([]);\n  const unsubscribes = new Map<number, () => void>();\n\n  const maxEntries = clamp(finiteOr(limit, DEFAULT_LIMIT), 1);\n  let nextKey = 1;\n\n  const forget = (key: number) => {\n    unsubscribes.get(key)?.();\n    unsubscribes.delete(key);\n  };\n\n  const trim = (list: PollEntry[]) => {\n    let kept = list;\n\n    while (kept.length > maxEntries) {\n      const dropped = kept.findLast(isFinished) ?? kept.at(-1);\n\n      if (!dropped) break;\n\n      forget(dropped.key);\n      kept = kept.filter((entry) => entry !== dropped);\n    }\n\n    return kept;\n  };\n\n  const replace = (key: number, snapshot: PollSnapshot) =>\n    entries.set(entries.get().map((entry) => (entry.key === key ? { ...entry, snapshot } : entry)));\n\n  const register = (poller: ObservedPoller) => {\n    const key = nextKey++;\n    const entry: PollEntry = {\n      key,\n      startedAt: Date.now(),\n      snapshot: poller.debug(),\n      stop: poller.stop,\n      start: poller.start,\n    };\n\n    unsubscribes.set(\n      key,\n      poller.subscribe((snapshot) => replace(key, snapshot)),\n    );\n    entries.set(trim([entry, ...entries.get()]));\n  };\n\n  const collect = () => {\n    emitter.subscribe(register);\n  };\n\n  return {\n    list: entries.get,\n    collect,\n    subscribe: (listener) => entries.subscribe(() => listener()),\n    clear: () => {\n      entries.get().forEach(({ key }) => forget(key));\n      entries.set([]);\n    },\n    stopAll: (reason) => entries.get().forEach((entry) => entry.stop(reason)),\n  };\n};\n","import { isPlainObject } from './isPlainObject';\n\n/**\n * Recursively merge `patch` into `base`. Plain-object values are merged key-by-key; every\n * other value (primitives, arrays, or a type mismatch between the two sides) replaces the\n * base value. `undefined` patch values are skipped, so a partial patch leaves untouched\n * fields alone. Pure — neither argument is mutated; the result preserves `base`'s type.\n */\nexport const deepMerge = <T extends Record<string, unknown>>(\n  base: T,\n  patch: Record<string, unknown>,\n): T => {\n  const out: Record<string, unknown> = { ...base };\n\n  for (const [key, value] of Object.entries(patch)) {\n    if (value === undefined) continue;\n    const current = out[key];\n    out[key] = isPlainObject(current) && isPlainObject(value) ? deepMerge(current, value) : value;\n  }\n\n  return out as T;\n};\n","// Minimal, synchronous key/value contract — the Web Storage shape (`localStorage`/`sessionStorage`)\n// narrowed to what a persistor needs. Framework- and environment-agnostic.\nexport type StorageAdapter = {\n  getItem: (key: string) => string | null;\n  setItem: (key: string, value: string) => void;\n  removeItem: (key: string) => void;\n};\n\n// Persist nowhere: reads always miss, writes are dropped. The default when no storage is configured,\n// so a persistor is always constructable and simply becomes a no-op.\nexport const createNullStorage = (): StorageAdapter => ({\n  getItem: () => null,\n  setItem: () => {},\n  removeItem: () => {},\n});\n\n// In-process Map, living for the lifetime of the process. The Node default and the fallback the\n// Web Storage adapters degrade to when `localStorage`/`sessionStorage` is unavailable (SSR).\nexport const createMemoryStorage = (): StorageAdapter => {\n  const store = new Map<string, string>();\n  return {\n    getItem: (key) => store.get(key) ?? null,\n    setItem: (key, value) => {\n      store.set(key, value);\n    },\n    removeItem: (key) => {\n      store.delete(key);\n    },\n  };\n};\n\n// Wrap a Web Storage instance, degrading to memory when it is absent OR unusable. Merely accessing\n// the global (sandboxed iframe) or calling its methods (privacy mode, disabled/blocked storage) can\n// throw, so a canary write probes real usability at construction; any failure falls back to an\n// in-memory store so persistence never crashes the caller. Resolution happens when the factory is\n// called (not at import), so importing this module never touches browser globals.\nconst createWebStorage = (pick: () => Storage | null): StorageAdapter => {\n  let web: Storage | null = null;\n  try {\n    web = pick();\n    if (web) {\n      const probe = '__keboola_storage_probe__';\n      web.setItem(probe, probe);\n      web.removeItem(probe);\n    }\n  } catch (err) {\n    console.warn('createWebStorage: web storage unavailable, falling back to memory', err);\n    web = null;\n  }\n  if (!web) return createMemoryStorage();\n\n  const storage = web;\n  return {\n    getItem: (key) => storage.getItem(key),\n    setItem: (key, value) => {\n      storage.setItem(key, value);\n    },\n    removeItem: (key) => {\n      storage.removeItem(key);\n    },\n  };\n};\n\nexport const createLocalStorage = (): StorageAdapter =>\n  createWebStorage(() => ('localStorage' in globalThis ? globalThis.localStorage : null));\n\nexport const createSessionStorage = (): StorageAdapter =>\n  createWebStorage(() => ('sessionStorage' in globalThis ? globalThis.sessionStorage : null));\n","import { createNullStorage, type StorageAdapter } from './adapters';\n\n// A zod-compatible, structurally-typed validator. Kept structural so this package needs no zod\n// dependency — any schema exposing `safeParse` (e.g. a zod schema) satisfies it.\ntype Schema<T> = {\n  safeParse: (value: unknown) => { success: true; data: T } | { success: false };\n};\n\nexport type Persistor<T> = {\n  /** Read + validate the stored value; returns `defaultValue` when empty or corrupt. */\n  hydrate: () => T;\n  /** Serialize + write the value. */\n  persist: (value: T) => void;\n  /** Remove the stored value. */\n  clear: () => void;\n  /** Whether a value is currently persisted under the key. */\n  hasPersistedValue: () => boolean;\n};\n\ntype PersistorOptions<T> = {\n  storage?: StorageAdapter;\n  key: string;\n  schema: Schema<T>;\n  defaultValue: T;\n  encode?: (value: T) => string;\n  decode?: (raw: string) => unknown;\n};\n\n// A durable cell over a `StorageAdapter`: one key, encoded on write and validated on read. `hydrate`\n// is total — it never returns null and never throws: empty, unreadable, corrupt, or schema-invalid\n// storage all yield the caller-supplied `defaultValue`, so callers need no null-checks. `persist` and\n// `clear` are best-effort — a failing `encode()` (e.g. circular JSON) or a throwing adapter (quota,\n// blocked/privacy-mode storage) is logged and swallowed rather than crashing the caller. The schema\n// validates stored data only; give fields `.default(...)` to patch partial blobs instead of discarding.\nexport const createPersistor = <T>({\n  storage = createNullStorage(),\n  key,\n  schema,\n  defaultValue,\n  encode = JSON.stringify,\n  decode = JSON.parse,\n}: PersistorOptions<T>): Persistor<T> => {\n  // Best-effort key removal — adapters can throw (blocked storage), and dropping a corrupt entry must\n  // never take down `hydrate`.\n  const clear = (): void => {\n    try {\n      storage.removeItem(key);\n    } catch (err) {\n      console.warn(`createPersistor: failed to clear \"${key}\"`, err);\n    }\n  };\n\n  // Callers use this to decide synchronously (during render) whether a restore is worth waiting for,\n  // so a throwing adapter must read as \"nothing stored\" rather than propagate.\n  const hasPersistedValue = (): boolean => {\n    try {\n      return !!storage.getItem(key);\n    } catch (err) {\n      console.warn(`createPersistor: failed to read \"${key}\", assuming empty`, err);\n      return false;\n    }\n  };\n\n  const hydrate = (): T => {\n    let raw: string | null;\n    try {\n      raw = storage.getItem(key);\n    } catch (err) {\n      console.warn(`createPersistor: failed to read \"${key}\", using default`, err);\n      return defaultValue;\n    }\n    if (raw === null) return defaultValue;\n\n    let decoded: unknown;\n    try {\n      decoded = decode(raw);\n    } catch (err) {\n      console.warn(`createPersistor: failed to decode \"${key}\", resetting`, err);\n      clear();\n      return defaultValue;\n    }\n\n    const parsed = schema.safeParse(decoded);\n    if (parsed.success) return parsed.data;\n    clear();\n    return defaultValue;\n  };\n\n  const persist = (value: T): void => {\n    let raw: string;\n    try {\n      raw = encode(value);\n    } catch (err) {\n      console.warn(`createPersistor: failed to encode \"${key}\", not persisting`, err);\n      return;\n    }\n    try {\n      storage.setItem(key, raw);\n    } catch (err) {\n      console.warn(`createPersistor: failed to write \"${key}\"`, err);\n    }\n  };\n\n  return { hydrate, persist, clear, hasPersistedValue };\n};\n","import type { StorageToken } from '../clients/storage/types';\nimport type { createDefaultBranch } from '../domain/defaultBranch';\nimport { createProject, type Project } from '../domain/project';\nimport type { createStack } from '../domain/stack';\nimport type { createStorageTable } from '../domain/storageTable';\nimport type { MiddlewareFn } from '../fetchClient';\nimport { coalesce, createStore } from '../utils';\n\n// Storage API endpoints that mutate fields carried by the verified token, so the\n// live project must re-verify after them. Each pattern is matched against the URL pathname.\nconst STORAGE_TOKEN_MUTATING_PATTERNS = [\n  // Bucket lifecycle (create / delete / register) — changes token.bucketPermissions.\n  // At most one trailing segment, so sub-resources (tables, listing, metadata, refresh)\n  // under /buckets/{id}/... don't trigger a re-verify.\n  /\\/buckets(\\/[^/]+)?$/,\n  // Project feature toggles — changes token.owner.features. Anchored to\n  // /projects/{id}/features so /manage/features and /users/{id}/features don't match.\n  /\\/projects\\/[^/]+\\/features(\\/[^/]+)?$/,\n];\n\nexport const isStorageTokenMutatingRequest = (request: Request): boolean => {\n  if (request.method === 'GET') return false;\n  const { pathname } = new URL(request.url);\n  return STORAGE_TOKEN_MUTATING_PATTERNS.some((pattern) => pattern.test(pathname));\n};\n\nconst createProjectRefreshMiddleware =\n  (\n    shouldRefresh: (request: Request) => boolean,\n    requestRefresh: () => Promise<void>,\n  ): MiddlewareFn =>\n  (next) =>\n  async (request) => {\n    const response = await next(request);\n    // Await the re-verify before resolving the mutating request, so a caller that\n    // reads `api.context.project` right after it can never observe pre-mutation state.\n    if (shouldRefresh(request.request)) await requestRefresh();\n    return response;\n  };\n\n/**\n * The live project store: seeded from the verified token, re-verified (coalesced) after a\n * token-mutating request or an explicit re-scope. Its `middleware` drives the auto re-verify.\n */\nexport const createLiveProject = ({\n  initialToken,\n  verify,\n}: {\n  initialToken: StorageToken;\n  verify: () => Promise<StorageToken>;\n}) => {\n  const store = createStore(createProject({ sapiToken: initialToken }));\n  const refresh = coalesce(async () => store.set(createProject({ sapiToken: await verify() })));\n  const middleware = createProjectRefreshMiddleware(isStorageTokenMutatingRequest, refresh);\n  return { store, getProject: () => store.get(), subscribe: store.subscribe, middleware, refresh };\n};\n\nexport type ClientContext = {\n  /**\n   * The stack this client is configured against, canonical form (absolute, no trailing slash) — the\n   * `baseUrl` every request is built on. Distinct from `stack.host`, which is the index response's\n   * own `host` field: the API pod that served the request (`connection-api-756b66f7c8-ql5sr`), not a\n   * stack hostname. It varies between two calls to the same stack and is never used to route a\n   * request. For the stack's hostname, look the stack id up in `STACKS` (`@keboola/api-client/constants`).\n   */\n  baseUrl: string;\n  stack: ReturnType<typeof createStack>;\n  defaultBranch: ReturnType<typeof createDefaultBranch>;\n  readonly project: Project;\n  readonly st: ReturnType<typeof createStorageTable>;\n};\n","/**\n * The single error the keboola client / session throws. It carries a stable `type` (the switchable\n * contract) and a human-readable message derived from that type — no per-call message strings.\n */\nexport const KeboolaErrorType = {\n  Unconfigured: 'unconfigured',\n  NotAuthenticated: 'not-authenticated',\n  AlreadyAuthenticated: 'already-authenticated',\n  NoStorageToken: 'no-storage-token',\n  NoManagementToken: 'no-management-token',\n  MissingProject: 'missing-project',\n  NotBearer: 'not-bearer',\n  NotReady: 'not-ready',\n  InvalidBuildTransition: 'invalid-build-transition',\n} as const;\n\nexport type KeboolaErrorType = (typeof KeboolaErrorType)[keyof typeof KeboolaErrorType];\n\nconst MESSAGES: Record<KeboolaErrorType, string> = {\n  [KeboolaErrorType.Unconfigured]: 'The session is not configured — set a baseUrl first.',\n  [KeboolaErrorType.NotAuthenticated]: 'The session is not authenticated — sign in first.',\n  [KeboolaErrorType.AlreadyAuthenticated]:\n    'The session is already authenticated — reset before authenticating again.',\n  [KeboolaErrorType.NoStorageToken]: 'No storage token — authenticate the storage realm first.',\n  [KeboolaErrorType.NoManagementToken]:\n    'No management token — authenticate the management realm first.',\n  [KeboolaErrorType.MissingProject]:\n    'A bearer storage session requires a project — call setProject(projectId) first.',\n  [KeboolaErrorType.NotBearer]: 'This operation requires a bearer (OAuth) session.',\n  [KeboolaErrorType.NotReady]: 'The client is not ready — authenticate the storage realm first.',\n  [KeboolaErrorType.InvalidBuildTransition]:\n    'Invalid storage build transition — the build goes idle → initializing → ready | failed.',\n};\n\nexport class KeboolaError extends Error {\n  readonly type: KeboolaErrorType;\n\n  constructor(type: KeboolaErrorType) {\n    super(MESSAGES[type]);\n    this.type = type;\n    this.name = 'KeboolaError';\n    Object.setPrototypeOf(this, KeboolaError.prototype);\n  }\n}\n\nexport const isKeboolaError = (error: unknown): error is KeboolaError =>\n  error instanceof KeboolaError;\n\n/** Throw a {@link KeboolaError} of `type` when `value` is null/undefined; otherwise narrow it. */\nexport function assert<T>(value: T | null | undefined, type: KeboolaErrorType): asserts value is T {\n  if (value == null) throw new KeboolaError(type);\n}\n","import { ApiError } from '../errors';\nimport { type HttpMethod, isApiError, type MiddlewareFn } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\nimport { generateUUID } from '../utils';\n\nconst CORRELATION_ID_HEADER = 'X-Correlation-ID';\n\nconst ALWAYS_REDACTED_HEADERS = [\n  KeboolaHttpHeader.MANAGEMENT_API_TOKEN,\n  KeboolaHttpHeader.STORAGE_API_TOKEN,\n  'authorization',\n  'cookie',\n  'set-cookie',\n];\n\nconst ALWAYS_REDACTED_QUERY_PARAMS = new Set([\n  'token',\n  'apikey',\n  'api_key',\n  'access_token',\n  'refresh_token',\n  'code',\n  'state',\n  'signature',\n  'sig',\n  'x-amz-signature',\n  'x-amz-credential',\n  'x-amz-security-token',\n  'password',\n  'secret',\n]);\n\nconst REDACTED = '[REDACTED]';\n\nconst getRedactedUrl = (rawUrl: string): string => {\n  const url = new URL(rawUrl);\n  if (url.username) url.username = REDACTED;\n  if (url.password) url.password = REDACTED;\n\n  url.searchParams.forEach((_value, key) => {\n    if (ALWAYS_REDACTED_QUERY_PARAMS.has(key.toLowerCase())) {\n      url.searchParams.set(key, REDACTED);\n    }\n  });\n  return url.toString();\n};\n\n// Returns the request's correlation ID, generating and attaching one if missing.\n//\n// Forwarded via the X-Correlation-ID header so downstream services log the same ID,\n// letting all log lines for a single user action be stitched together across service\n// boundaries. Reuse when the caller already set one (preserves the chain inside a\n// larger trace); otherwise mint a fresh UUID to start a new trace.\nconst ensureCorrelationId = (request: Request): string => {\n  const correlationId = request.headers.get(CORRELATION_ID_HEADER) ?? generateUUID();\n  request.headers.set(CORRELATION_ID_HEADER, correlationId);\n  return correlationId;\n};\n\nconst getRedactedHeaders = (headers: Headers, redacted: string[]): Record<string, string> => {\n  const redactedSet = new Set(\n    [...ALWAYS_REDACTED_HEADERS, ...redacted].map((h) => h.toLowerCase()),\n  );\n\n  const result: Record<string, string> = {};\n  headers.forEach((value, name) => {\n    result[name] = redactedSet.has(name.toLowerCase()) ? REDACTED : value;\n  });\n  return result;\n};\n\nexport type RequestLog = {\n  url: string;\n  headers: Record<string, string>;\n};\n\nexport type ResponseLog = {\n  status: number;\n  statusText: string;\n  headers: Record<string, string>;\n};\n\ntype BaseLog = {\n  correlationId: string;\n  method: HttpMethod;\n  durationMs: number;\n  request: RequestLog;\n};\n\ntype SuccessLog = BaseLog & {\n  response: ResponseLog;\n};\n\ntype ErrorLog = BaseLog & {\n  error: Error;\n};\n\nexport type Log = SuccessLog | ErrorLog;\n\nexport type Logger = {\n  info?: (log: SuccessLog) => void;\n  error?: (log: ErrorLog) => void;\n};\n\nexport type LogLevel = 'error-only' | 'all';\n\nexport type LoggingOptions = {\n  logger?: Logger;\n  level?: LogLevel;\n  redactHeaders?: string[];\n};\n\nconst getRequestLog = (request: Request, redactedHeaders: string[]): RequestLog => ({\n  url: getRedactedUrl(request.url),\n  headers: getRedactedHeaders(request.headers, redactedHeaders),\n});\n\nconst getResponseLog = (response: Response, redactedHeaders: string[]): ResponseLog => ({\n  status: response.status,\n  statusText: response.statusText,\n  headers: getRedactedHeaders(response.headers, redactedHeaders),\n});\n\n// On failure the logger receives the thrown error itself, but an ApiError carries the raw\n// fetch Request/Response whose headers were never redacted (only the middleware's own log\n// payload is). Hand the logger a copy with the same redaction applied to its headers and URL;\n// the original error is still thrown untouched so error handlers keep full fidelity.\nconst redactApiError = (error: ApiError, redactedHeaders: string[]): ApiError =>\n  new ApiError({\n    request: new Request(getRedactedUrl(error.request.url), {\n      method: error.request.method,\n      headers: getRedactedHeaders(error.request.headers, redactedHeaders),\n    }),\n    response: new Response(null, {\n      status: error.response.status,\n      statusText: error.response.statusText,\n      headers: getRedactedHeaders(error.response.headers, redactedHeaders),\n    }),\n    data: error.data,\n  });\n\nconst formatLog = (level: 'info' | 'error', log: Log): string => {\n  const parts = [`[${level.toUpperCase()}]`, `${Math.round(log.durationMs)}ms`, log.method];\n  parts.push(log.request.url);\n  if ('response' in log) parts.push(String(log.response.status));\n  return parts.join(' ');\n};\n\nconst createSafeLogger = (logger?: Logger, level: LogLevel = 'error-only'): Required<Logger> => {\n  return {\n    info: (log) => {\n      if (level !== 'all') return;\n      try {\n        if (logger?.info) {\n          logger.info(log);\n          return;\n        }\n\n        console.info(formatLog('info', log));\n      } catch {\n        /* never let logging break the request */\n      }\n    },\n    error: (log) => {\n      try {\n        if (logger?.error) {\n          logger.error(log);\n          return;\n        }\n\n        console.error(formatLog('error', log));\n      } catch {\n        /* never let logging break the request */\n      }\n    },\n  };\n};\n\nexport const createLoggingMiddleware = (options: LoggingOptions = {}): MiddlewareFn => {\n  const safeLogger = createSafeLogger(options.logger, options.level);\n  const redactHeaders = options.redactHeaders ?? [];\n\n  return (next) => async (fetchRequest) => {\n    const correlationId = ensureCorrelationId(fetchRequest.request);\n    const start = performance.now();\n    const method = fetchRequest.request.method.toLowerCase() as HttpMethod;\n    const requestLog = getRequestLog(fetchRequest.request, redactHeaders);\n\n    try {\n      const result = await next(fetchRequest);\n      safeLogger.info({\n        correlationId,\n        method,\n        durationMs: performance.now() - start,\n        request: requestLog,\n        response: getResponseLog(result.response, redactHeaders),\n      });\n      return result;\n    } catch (error) {\n      if (error instanceof Error)\n        safeLogger.error({\n          correlationId,\n          method,\n          durationMs: performance.now() - start,\n          request: requestLog,\n          error: isApiError(error) ? redactApiError(error, redactHeaders) : error,\n        });\n\n      throw error;\n    }\n  };\n};\n","import { ApiError } from '../errors';\nimport type { MiddlewareFn } from '../fetchClient';\nimport { HttpStatus } from '../internal';\nimport { delay } from '../utils';\n\nconst DEFAULT_MAX_RETRIES = 5;\nconst DEFAULT_RETRYABLE_STATUSES: number[] = [\n  HttpStatus.INTERNAL_SERVER_ERROR,\n  HttpStatus.BAD_GATEWAY,\n  HttpStatus.SERVICE_UNAVAILABLE,\n  HttpStatus.GATEWAY_TIMEOUT,\n];\nconst DEFAULT_BACKOFF_FACTOR = 0.3;\n\nexport type RetryOptions = {\n  maxRetries?: number;\n  backoffFactor?: number;\n  shouldRetry?: (error: unknown, attempt: number) => boolean;\n};\n\nconst defaultShouldRetry = (error: unknown): boolean =>\n  error instanceof ApiError && DEFAULT_RETRYABLE_STATUSES.includes(error.response.status);\n\nexport const createRetryMiddleware = (options?: RetryOptions): MiddlewareFn => {\n  const {\n    maxRetries = DEFAULT_MAX_RETRIES,\n    backoffFactor = DEFAULT_BACKOFF_FACTOR,\n    shouldRetry = defaultShouldRetry,\n  } = options ?? {};\n\n  if (!Number.isInteger(maxRetries) || maxRetries < 0) {\n    throw new RangeError('maxRetries must be a non-negative integer');\n  }\n  if (!Number.isFinite(backoffFactor) || backoffFactor < 0) {\n    throw new RangeError('backoffFactor must be a finite non-negative number');\n  }\n\n  return (next) => async (request) => {\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      try {\n        return await next({ ...request, request: request.request.clone() });\n      } catch (error) {\n        if (attempt === maxRetries || !shouldRetry(error, attempt)) {\n          throw error;\n        }\n\n        const delayMs = backoffFactor * 1000 * Math.pow(2, attempt);\n        await delay(delayMs, request.request.signal ?? undefined);\n      }\n    }\n\n    throw new Error('unreachable');\n  };\n};\n","export const isBuiltInProperty = (property: string | symbol) =>\n  typeof property === 'symbol' ||\n  property === 'then' ||\n  property === 'constructor' ||\n  property === 'toString' ||\n  property === 'valueOf';\n\n/**\n * Creates a dummy client that intercepts method calls and invokes the provided onCall callback.\n */\nexport const createDummyClient = <T extends Record<string, unknown>>({\n  onCall,\n}: {\n  onCall: (path: string[], args: unknown[]) => void;\n}): T => {\n  const createProxy = (path: string[] = []) =>\n    new Proxy(() => {}, {\n      // Create a new proxy for nested property access\n      get: (_target, prop) => {\n        // Don't intercept Symbol properties or special methods\n        if (isBuiltInProperty(prop)) return undefined;\n        return createProxy([...path, prop]);\n      },\n      // When called as a function, invoke the interceptor\n      apply: (_target, _thisArgs, args) => onCall(path, args),\n    });\n\n  return createProxy() as unknown as T;\n};\n","import { createDummyClient } from './utils';\n\ntype OnUnavailableFn = (info: {\n  serviceId: string;\n  path: string[];\n  args: unknown[];\n  clientName: string;\n}) => void;\n\ntype ClientConfig<ServiceId extends string, ClientName extends string> = {\n  serviceId: ServiceId;\n  clientName: ClientName;\n  clientFn: (serviceUrl: string) => unknown;\n};\n\ntype ClientMeta<ServiceId extends string> = {\n  clientName: string;\n  serviceId: ServiceId;\n  isAvailable: boolean;\n};\n\ntype Options<ServiceId extends string> = {\n  getServiceBaseUrl: (serviceId: ServiceId) => string | null;\n  onUnavailable?: OnUnavailableFn;\n};\n\ntype BuildResult<\n  ServiceId extends string,\n  ClientName extends string,\n  Configs extends ClientConfig<ServiceId, ClientName>[],\n> = {\n  client: {\n    [Config in Configs[number] as Config['clientName']]: ReturnType<Config['clientFn']>;\n  };\n  meta: ClientMeta<ServiceId>[];\n};\n\ntype Registry<\n  ServiceId extends string,\n  ClientName extends string,\n  Configs extends ClientConfig<ServiceId, ClientName>[],\n> = {\n  add: <const Config extends ClientConfig<ServiceId, ClientName>>(\n    config: Config,\n  ) => Registry<ServiceId, ClientName, [...Configs, Config]>;\n  build: () => BuildResult<ServiceId, ClientName, Configs>;\n};\n\nexport const createServiceClientRegistry =\n  <ServiceId extends string, ClientName extends string = string>() =>\n  ({\n    getServiceBaseUrl,\n    onUnavailable,\n  }: Options<ServiceId>): Registry<ServiceId, ClientName, []> => {\n    const dummy = (serviceId: string, clientName: string) =>\n      createDummyClient({\n        onCall: (path, args) => {\n          onUnavailable?.({\n            serviceId,\n            path,\n            args,\n            clientName,\n          });\n        },\n      });\n\n    const configs: ClientConfig<ServiceId, ClientName>[] = [];\n\n    const resolveClient = ({\n      serviceId,\n      clientFn,\n      clientName,\n    }: ClientConfig<ServiceId, ClientName>) => {\n      const serviceBaseUrl = getServiceBaseUrl(serviceId);\n      return serviceBaseUrl ? clientFn(serviceBaseUrl) : dummy(serviceId, clientName);\n    };\n\n    type AnyConfig = ClientConfig<ServiceId, ClientName>;\n    const registry: Registry<ServiceId, ClientName, AnyConfig[]> = {\n      add: (config) => {\n        configs.push(config);\n        return registry;\n      },\n      build: () => {\n        const clientMap: Record<string, unknown> = {};\n        const clientMeta: ClientMeta<ServiceId>[] = [];\n\n        configs.forEach((config) => {\n          clientMap[config.clientName] = resolveClient(config);\n          clientMeta.push({\n            clientName: config.clientName,\n            serviceId: config.serviceId,\n            isAvailable: !!getServiceBaseUrl(config.serviceId),\n          });\n        });\n\n        // The dynamically-built map can't be statically proven against the\n        // per-config mapped type; the public key safety comes from the fluent\n        // `add` chain asserted at the bottom of this factory.\n        return {\n          client: clientMap,\n          meta: clientMeta,\n        } as BuildResult<ServiceId, ClientName, AnyConfig[]>;\n      },\n    };\n\n    return registry as Registry<ServiceId, ClientName, []>;\n  };\n","import type { createAuthClient } from '../clients/auth/authClient';\nimport type { createManagementClient } from '../clients/management';\nimport { isBuiltInProperty } from '../serviceClientRegistry';\n\nimport type { createProjectClients } from './bearer/createProjectClients';\nimport { assert, KeboolaErrorType } from './errors';\n\ntype AuthClient = ReturnType<typeof createAuthClient>;\ntype ManagementClient = ReturnType<typeof createManagementClient>;\n\n/**\n * Everything on `api` except `auth` and `management` — the project-scoped half of `KeboolaApi`.\n *\n * - Holds no credential; the token and its refresh loop live on the session that built it.\n */\nexport type ProjectClients = Awaited<ReturnType<typeof createProjectClients>>;\n\nexport type KeboolaApi = ProjectClients & {\n  auth: ReturnType<typeof createAuthClient>;\n  management: ReturnType<typeof createManagementClient>;\n};\n\ntype ApiState = {\n  getAuthClient: () => AuthClient | null;\n  getManagementClient: () => ManagementClient | null;\n  getProjectClients: () => ProjectClients | null;\n};\n\nexport const createApi = (state: ApiState) =>\n  new Proxy({} as KeboolaApi, {\n    get(_target, property) {\n      if (isBuiltInProperty(property)) return undefined;\n\n      if (property === 'auth') {\n        const authClient = state.getAuthClient();\n        assert(authClient, KeboolaErrorType.Unconfigured);\n        return authClient;\n      }\n\n      if (property === 'management') {\n        const management = state.getManagementClient();\n        assert(management, KeboolaErrorType.NoManagementToken);\n        return management;\n      }\n\n      const clients = state.getProjectClients();\n      assert(clients, KeboolaErrorType.NotReady);\n\n      return clients[property as keyof ProjectClients];\n    },\n  });\n","import type { MiddlewareFn } from '../fetchClient';\n\n/**\n * Service clients reached through the registry — the key is the `clientName`\n * the user accesses them by (e.g. `api.dataScience`), not the `serviceId`.\n */\nexport type ServiceClientName =\n  | 'vault'\n  | 'dataScience'\n  | 'apps'\n  | 'encryption'\n  | 'editor'\n  | 'syncActions'\n  | 'telemetry'\n  | 'queryService'\n  | 'queue'\n  | 'chat'\n  | 'ai'\n  | 'import'\n  | 'kaiAgent'\n  | 'businessWorkspaceApi'\n  | 'oauth'\n  | 'omnisearch'\n  | 'stream'\n  | 'notifications'\n  | 'scheduler'\n  | 'metastore'\n  | 'billing';\n\n/** Clients instantiated directly (not stack-discovered), keyed by their property name. */\ntype NonServiceClientName = 'storage' | 'management' | 'auth';\n\nexport type MiddlewareTarget = ServiceClientName | NonServiceClientName;\n\nexport type Middlewares =\n  | MiddlewareFn[]\n  | ({ all?: MiddlewareFn[] } & Partial<Record<MiddlewareTarget, MiddlewareFn[]>>);\n\nexport const createMiddlewareFor = (middlewares: Middlewares | undefined) => {\n  return (target: MiddlewareTarget, baseline: MiddlewareFn[] = []): MiddlewareFn[] => {\n    if (Array.isArray(middlewares)) return [...baseline, ...middlewares];\n\n    const all = middlewares?.all ?? [];\n    const targeted = middlewares?.[target] ?? [];\n    return [...baseline, ...all, ...targeted];\n  };\n};\n\nexport type MiddlewareFor = ReturnType<typeof createMiddlewareFor>;\n","import { createStore, type ReadableStore } from '../../utils';\nimport { KeboolaError, KeboolaErrorType } from '../errors';\n\n// Config owns its credential model — the subset of a login/refresh response it actually needs, so it\n// doesn't couple to the auth schema.\nexport type TokenSet = {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number; // seconds\n};\n// The active tokens plus when this access token was issued/refreshed (ms epoch). `issuedAt` +\n// `expiresIn` is the single source of truth for expiry: the refresh policy derives its\n// proactive-refresh time from it, and the dev tools count down against it.\nexport type Credential = TokenSet & { issuedAt: number };\n\n// Session phases, each a superset of the previous: anonymous ⊂ authenticated ⊂ scoped.\n// \"Has a credential\" is `status !== 'anonymous'` (authenticated and scoped both); \"has a project\" is\n// `status === 'scoped'`. Prefer the accessors below (`requireCredential`, `getBaseUrl`) over raw\n// status checks so that grouping lives in one place.\nexport type State =\n  | { status: 'anonymous'; baseUrl: string | null }\n  | { status: 'authenticated'; baseUrl: string; credential: Credential }\n  | { status: 'scoped'; baseUrl: string; credential: Credential; projectId: number };\n\nconst INITIAL: State = { status: 'anonymous', baseUrl: null };\n\nconst stamp = (tokens: TokenSet): Credential => ({ ...tokens, issuedAt: Date.now() });\n\nexport const createConfig = (initial: State = INITIAL) => {\n  const store = createStore<State>(initial);\n  let expiredNotified = false;\n  let epoch = 0;\n\n  const setBaseUrl = (baseUrl: string) => {\n    // baseUrl is fixed once authenticated — a credential is bound to the stack that issued it.\n    if (store.get().status !== 'anonymous')\n      throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);\n    store.set({ status: 'anonymous', baseUrl });\n  };\n\n  const authenticate = (tokens: TokenSet) => {\n    const state = store.get();\n    if (state.status !== 'anonymous') throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);\n    // A credential is only meaningful against a stack: enforce baseUrl so we never hold a session we\n    // couldn't refresh (no auth client without it).\n    if (!state.baseUrl) throw new KeboolaError(KeboolaErrorType.Unconfigured);\n    expiredNotified = false; // re-arm the expiry latch for the new session\n    epoch += 1;\n    store.set({ status: 'authenticated', baseUrl: state.baseUrl, credential: stamp(tokens) });\n  };\n\n  const setProjectId = (projectId: number) => {\n    const state = store.get();\n    if (state.status === 'anonymous') throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n    store.set({\n      status: 'scoped',\n      baseUrl: state.baseUrl,\n      credential: state.credential,\n      projectId,\n    });\n  };\n\n  /**\n   * Drop the project scope, keeping the credential — the inverse of `setProjectId`, for leaving a\n   * project without signing out. The project clients are keyed on the scope, so they tear down and\n   * the storage build returns to `idle`; the session stays usable for `auth` and `management`.\n   * No-op unless currently scoped.\n   */\n  const clearProjectId = () => {\n    const state = store.get();\n    if (state.status !== 'scoped') return;\n    store.set({ status: 'authenticated', baseUrl: state.baseUrl, credential: state.credential });\n  };\n\n  /** Drop the credential (sign out); keeps the configured baseUrl. */\n  const reset = () => {\n    epoch += 1;\n    store.set({ status: 'anonymous', baseUrl: store.get().baseUrl });\n  };\n\n  /** Apply a token refresh: replace the credential (fresh tokens, new issue time); no-op before auth. */\n  const applyRefresh = (tokens: TokenSet) => {\n    const state = store.get();\n    if (state.status === 'anonymous') return;\n    store.set({ ...state, credential: stamp(tokens) });\n  };\n\n  /**\n   * Dev/test lever: backdate the current token's issue time by a full lifetime so it reads as\n   * expired, making the refresh policy rotate it on the next request. No-op before auth.\n   */\n  const forceExpire = () => {\n    const state = store.get();\n    if (state.status === 'anonymous') return;\n    const issuedAt = Date.now() - state.credential.expiresIn * 1000;\n    store.set({ ...state, credential: { ...state.credential, issuedAt } });\n  };\n\n  /**\n   * The current credential, asserting the session is authenticated (or scoped). Single point for that\n   * check so callers (token attach, refresh) don't each re-narrow the state.\n   */\n  const requireCredential = (): Credential => {\n    const state = store.get();\n    if (state.status === 'anonymous') throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n    return state.credential;\n  };\n\n  const getBaseUrl = (): string | null => store.get().baseUrl;\n\n  /**\n   * Which sign-in this is — a counter, bumped by `authenticate` and `reset`.\n   *\n   * - For anything long-lived that must not outlive the credential it was built against: capture it,\n   *   compare it later. A rotation does not move it; only a new session or a sign-out does.\n   * - Distinct from `notifyExpired`'s latch, which answers \"report this death once\" rather than\n   *   \"which session are we in\".\n   */\n  const getEpoch = (): number => epoch;\n\n  /**\n   * Session-expiry latch (fire-once):\n   * - why: concurrent 401s all report expiry, but the app must sign out once; and the credential /\n   *   auth middleware are long-lived singletons, so the latch can't live in them — it must reset\n   *   per session.\n   * - how: returns `true` only for the first call since the last `authenticate` (which re-arms it),\n   *   so the caller runs its sign-out exactly once per session death.\n   */\n  const notifyExpired = (): boolean => {\n    if (expiredNotified) return false;\n    expiredNotified = true;\n    return true;\n  };\n\n  const debug = (): State => store.get();\n\n  // Read-only view: every write goes through the methods above so the state-machine invariants hold.\n  const readable: ReadableStore<State> = {\n    get: store.get,\n    subscribe: store.subscribe,\n    dispose: store.dispose,\n  };\n\n  return {\n    store: readable,\n    setBaseUrl,\n    authenticate,\n    setProjectId,\n    clearProjectId,\n    reset,\n    applyRefresh,\n    forceExpire,\n    requireCredential,\n    getBaseUrl,\n    getEpoch,\n    notifyExpired,\n    debug,\n  };\n};\n","import type { DevBranch } from '../clients/storage/branches/types';\nimport { assert } from '../utils';\n\ntype BranchType = 'default' | 'dev';\n\ntype Options = {\n  devBranches: DevBranch[];\n};\n\nexport const createDefaultBranch = ({ devBranches }: Options) => {\n  const defaultBranch = devBranches.find((branch) => branch.isDefault);\n  assert(defaultBranch, 'No default branch found for the project.');\n\n  const getType = (branchId?: string | number): BranchType => {\n    if (branchId == null || branchId === 'default') return 'default';\n    return Number(branchId) === defaultBranch.id ? 'default' : 'dev';\n  };\n\n  return {\n    id: defaultBranch.id,\n    name: defaultBranch.name,\n    getType,\n    isDev: (branchId?: string | number) => getType(branchId) === 'dev',\n    isDefault: (branchId?: string | number) => getType(branchId) === 'default',\n  };\n};\n","import type { ServiceId, StackInfo } from '../clients/storage/types';\n\nexport type ServiceUrls = Partial<Record<ServiceId, (url: string) => string | undefined | null>>;\n\nconst SERVICE_URL_OVERRIDES: ServiceUrls = {\n  // The service URL for the Kai Assistant is incomplete; we need to add the `/api` suffix to get the full URL for the API.\n  // I assume the service is versioned.\n  'kai-assistant': (url) => `${url}/api`,\n};\n\ntype Options = {\n  stackInfo: StackInfo;\n  clientServiceUrls?: ServiceUrls;\n};\n\nexport const createStack = ({ stackInfo, clientServiceUrls }: Options) => {\n  const { services, components, features, ...infoRest } = stackInfo;\n\n  const serviceMap = new Map(\n    services.map((service) => {\n      const devOverride = clientServiceUrls?.[service.id]?.(service.url);\n      const prodOverride = SERVICE_URL_OVERRIDES[service.id]?.(service.url);\n      const url = devOverride ?? prodOverride ?? service.url;\n      return [service.id, url];\n    }),\n  );\n\n  const componentMap = new Map(components.map((component) => [component.id, component]));\n  const featureSet = new Set(features);\n\n  const hasFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => featureSet.has(x));\n  };\n\n  const hasComponent = (...componentId: string[]) => {\n    if (componentId.length === 0) return false;\n    return componentId.every((x) => componentMap.has(x));\n  };\n\n  const getComponent = (componentId: string) => componentMap.get(componentId) ?? null;\n\n  const hasService = (serviceId: ServiceId) => serviceMap.has(serviceId);\n\n  const getServiceUrl = (serviceId: ServiceId) => serviceMap.get(serviceId) ?? null;\n\n  return {\n    ...infoRest,\n    services,\n    features,\n    components,\n    hasFeature,\n    getServiceUrl,\n    hasService,\n    getComponent,\n    hasComponent,\n  };\n};\n","import type * as storage from '../../clients/storage';\n\nconst VARIABLES_COMPONENT_ID = 'keboola.variables';\n\n// The storage client takes the branch as the string the spec declares.\ntype BranchId = string;\n\ntype VariableDefinition = { name: string; type?: string };\ntype VariableValue = { name: string; value?: unknown };\n\n/** Reference to a `keboola.variables` config + the values row a config points at. */\ntype VariablesRef = { variablesId: string; variablesValuesId: string };\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n};\n\n/** Union the definitions by name; on a name conflict the target's definition is kept. */\nexport const mergeVariableDefinitions = (\n  target: VariableDefinition[],\n  source: VariableDefinition[],\n): VariableDefinition[] => {\n  const targetNames = new Set(target.map((definition) => definition.name));\n\n  return [...target, ...source.filter((definition) => !targetNames.has(definition.name))];\n};\n\n/** Add values missing in the target; on a name conflict the value is updated to the source's. */\nexport const mergeVariableValues = (\n  target: VariableValue[],\n  source: VariableValue[],\n): VariableValue[] => {\n  const sourceByName = new Map(source.map((value) => [value.name, value.value]));\n  const targetNames = new Set(target.map((value) => value.name));\n\n  return [\n    ...target.map((value) =>\n      sourceByName.has(value.name) ? { ...value, value: sourceByName.get(value.name) } : value,\n    ),\n    ...source.filter((value) => !targetNames.has(value.name)),\n  ];\n};\n\n/**\n * Orchestration for `keboola.variables` configs: copy a config, or merge two configs into a fresh\n * one (union definitions, upsert values — source wins on a name conflict). Each result is a brand\n * new config + values row, so the caller can reference it without sharing lineage with the source.\n */\nexport const createVariablesSdk = ({ storageClient }: Options) => {\n  const configs = storageClient.configurations;\n  const rows = storageClient.configurationRows;\n\n  const readVariables = async (\n    configId: string,\n    valuesRowId: string | undefined,\n    branchId: BranchId,\n  ) => {\n    const config = await configs.getConfiguration({\n      componentId: VARIABLES_COMPONENT_ID,\n      configId,\n      branchId,\n    });\n    // variables configs carry a single values row — read the referenced one, or the only one\n    const row = config.rows.find((candidate) => candidate.id === valuesRowId) ?? config.rows[0];\n\n    const rawDefinitions = config.configuration?.variables;\n    const rawValues = row?.configuration?.values;\n\n    // guard the array shape — a non-array from Storage would throw in the merge helpers' .map()\n    return {\n      definitions: (Array.isArray(rawDefinitions) ? rawDefinitions : []) as VariableDefinition[],\n      values: (Array.isArray(rawValues) ? rawValues : []) as VariableValue[],\n    };\n  };\n\n  const createVariables = async (\n    definitions: VariableDefinition[],\n    values: VariableValue[],\n    branchId: BranchId,\n  ): Promise<VariablesRef> => {\n    const config = await configs.createConfiguration({\n      branchId,\n      componentId: VARIABLES_COMPONENT_ID,\n      name: 'Variables definition',\n      configuration: { variables: definitions },\n    });\n\n    try {\n      const row = await rows.createConfigurationRow({\n        branchId: String(branchId),\n        componentId: VARIABLES_COMPONENT_ID,\n        configurationId: config.id,\n        name: 'Default values',\n        configuration: { values },\n      });\n\n      return { variablesId: config.id, variablesValuesId: row.id };\n    } catch (error) {\n      // the values row failed — best-effort drop the orphaned config, but always surface the original error\n      await configs\n        .deleteConfiguration({\n          branchId,\n          componentId: VARIABLES_COMPONENT_ID,\n          configId: config.id,\n        })\n        .catch((cleanupError: unknown) => {\n          // keep the cleanup failure on the original error rather than letting it mask the real cause\n          if (error instanceof Error && error.cause === undefined) {\n            error.cause = cleanupError;\n          }\n        });\n      throw error;\n    }\n  };\n\n  return {\n    /** Copy a variables config into a fresh, independent config + values row. */\n    copy: async ({\n      variablesId,\n      variablesValuesId,\n      branchId = 'default',\n    }: {\n      variablesId: string;\n      variablesValuesId?: string;\n      branchId?: BranchId;\n    }): Promise<VariablesRef> => {\n      const { definitions, values } = await readVariables(variablesId, variablesValuesId, branchId);\n\n      return createVariables(definitions, values, branchId);\n    },\n\n    /** Merge the source's variables into the target's and create a fresh merged config + values row. */\n    merge: async ({\n      targetVariablesId,\n      targetValuesId,\n      sourceVariablesId,\n      sourceValuesId,\n      branchId = 'default',\n    }: {\n      targetVariablesId: string;\n      targetValuesId?: string;\n      sourceVariablesId: string;\n      sourceValuesId?: string;\n      branchId?: BranchId;\n    }): Promise<VariablesRef> => {\n      const [target, source] = await Promise.all([\n        readVariables(targetVariablesId, targetValuesId, branchId),\n        readVariables(sourceVariablesId, sourceValuesId, branchId),\n      ]);\n\n      return createVariables(\n        mergeVariableDefinitions(target.definitions, source.definitions),\n        mergeVariableValues(target.values, source.values),\n        branchId,\n      );\n    },\n  };\n};\n","import { createAiClient } from '../clients/ai';\nimport { createAppsClient } from '../clients/apps';\nimport type { AuthStrategy } from '../clients/auth';\nimport { createBillingClient } from '../clients/billing';\nimport { createBusinessWorkspaceApiClient } from '../clients/businessWorkspaceApi';\nimport { createChatClient } from '../clients/chat';\nimport { createDataScienceClient } from '../clients/dataScience';\nimport { createEditorClient } from '../clients/editor';\nimport { createEncryptionClient } from '../clients/encryption';\nimport { createImportClient } from '../clients/import';\nimport { createKaiAgentClient } from '../clients/kaiAgent';\nimport { createMetastoreClient } from '../clients/metastore';\nimport { createNotificationsClient } from '../clients/notifications';\nimport { createOauthClient } from '../clients/oauth';\nimport { createOmnisearchClient } from '../clients/omnisearch';\nimport { createQueryServiceClient } from '../clients/queryService';\nimport { createQueueClient } from '../clients/queue';\nimport { createSchedulerClient } from '../clients/scheduler';\nimport type { ServiceId } from '../clients/storage/types';\nimport { createStreamClient } from '../clients/stream';\nimport { createSyncActionsClient } from '../clients/syncActions';\nimport { createTelemetryClient } from '../clients/telemetry';\nimport { createVaultClient } from '../clients/vault';\nimport { ServiceUnavailableError } from '../errors';\nimport type { MiddlewareFn } from '../fetchClient';\nimport { createServiceClientRegistry } from '../serviceClientRegistry';\n\nimport { type MiddlewareFor, type ServiceClientName } from './createMiddlewareFor';\n\ntype Options = {\n  baseUrl: string;\n  auth: AuthStrategy;\n  getServiceBaseUrl: (serviceId: ServiceId) => string | null;\n  middlewareFor: MiddlewareFor;\n  attachTokenMiddleware: MiddlewareFn;\n};\n\nexport const createServiceClients = ({\n  baseUrl,\n  auth,\n  getServiceBaseUrl,\n  middlewareFor,\n  attachTokenMiddleware,\n}: Options) =>\n  createServiceClientRegistry<ServiceId, ServiceClientName>()({\n    getServiceBaseUrl,\n    onUnavailable: ({ serviceId, path, clientName }) => {\n      throw new ServiceUnavailableError(serviceId, path, clientName);\n    },\n  })\n    .add({\n      serviceId: 'vault',\n      clientName: 'vault',\n      clientFn: (serviceBaseUrl) =>\n        createVaultClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('vault', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'data-science',\n      clientName: 'dataScience',\n      clientFn: (serviceBaseUrl) =>\n        createDataScienceClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('dataScience', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      // Deliberately the `data-science` service: the `/v2` App Deployments surface is the same\n      // sandboxes-service deployment one path prefix over, so it resolves off that URL with `/v2`\n      // appended. The `apps.<stack>` vanity host serves the same routes at its root but is absent\n      // from the stack's service index, so it cannot be resolved.\n      // Second client composing a prefix onto a service URL after `omnisearch` below; at a third,\n      // give `.add()` a `pathPrefix` the registry joins so the join can't be got wrong per call site.\n      serviceId: 'data-science',\n      clientName: 'apps',\n      clientFn: (serviceBaseUrl) =>\n        createAppsClient({\n          baseUrl: `${serviceBaseUrl}/v2`,\n          middlewares: middlewareFor('apps', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'encryption',\n      clientName: 'encryption',\n      clientFn: (serviceBaseUrl) =>\n        createEncryptionClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('encryption'),\n        }),\n    })\n    .add({\n      serviceId: 'editor',\n      clientName: 'editor',\n      clientFn: (serviceBaseUrl) =>\n        createEditorClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('editor', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'sync-actions',\n      clientName: 'syncActions',\n      clientFn: (serviceBaseUrl) =>\n        createSyncActionsClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('syncActions', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'telemetry',\n      clientName: 'telemetry',\n      clientFn: (serviceBaseUrl) =>\n        createTelemetryClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('telemetry', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'query',\n      clientName: 'queryService',\n      clientFn: (serviceBaseUrl) =>\n        createQueryServiceClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('queryService', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'queue',\n      clientName: 'queue',\n      clientFn: (serviceBaseUrl) =>\n        createQueueClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('queue', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'kai-assistant',\n      clientName: 'chat',\n      clientFn: (serviceBaseUrl) =>\n        createChatClient({\n          storageApiUrl: baseUrl,\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('chat', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'ai',\n      clientName: 'ai',\n      clientFn: (serviceBaseUrl) =>\n        createAiClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('ai', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      // Deliberately the `ai` service: omnisearch is a separate deployment that the ai-service\n      // ingress exposes under `/omnisearch`, so it resolves off that URL with the prefix appended —\n      // the same shape as the `kai-assistant` `/api` override in `domain/stack.ts`.\n      serviceId: 'ai',\n      clientName: 'omnisearch',\n      clientFn: (serviceBaseUrl) =>\n        createOmnisearchClient({\n          baseUrl: `${serviceBaseUrl}/omnisearch`,\n          middlewares: middlewareFor('omnisearch', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'import',\n      clientName: 'import',\n      clientFn: (serviceBaseUrl) =>\n        createImportClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('import', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'kai-agent',\n      clientName: 'kaiAgent',\n      clientFn: (serviceBaseUrl) =>\n        createKaiAgentClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('kaiAgent', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'business-workspace',\n      clientName: 'businessWorkspaceApi',\n      clientFn: (serviceBaseUrl) =>\n        createBusinessWorkspaceApiClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('businessWorkspaceApi', [attachTokenMiddleware]),\n          publicMiddlewares: middlewareFor('businessWorkspaceApi'),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'oauth',\n      clientName: 'oauth',\n      clientFn: (serviceBaseUrl) =>\n        createOauthClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('oauth', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'scheduler',\n      clientName: 'scheduler',\n      clientFn: (serviceBaseUrl) =>\n        createSchedulerClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('scheduler', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'stream',\n      clientName: 'stream',\n      clientFn: (serviceBaseUrl) =>\n        createStreamClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('stream', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'notification',\n      clientName: 'notifications',\n      clientFn: (serviceBaseUrl) =>\n        createNotificationsClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('notifications', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'billing',\n      clientName: 'billing',\n      clientFn: (serviceBaseUrl) =>\n        createBillingClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('billing', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'metastore',\n      clientName: 'metastore',\n      clientFn: (serviceBaseUrl) =>\n        createMetastoreClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('metastore', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .build();\n","import type { AuthStrategy } from '../../clients/auth';\nimport { createStorageClient } from '../../clients/storage';\nimport { ProjectFeature } from '../../constants/projectFeatures';\nimport { createDefaultBranch } from '../../domain/defaultBranch';\nimport { createStack, type ServiceUrls } from '../../domain/stack';\nimport { createStorageTable } from '../../domain/storageTable';\nimport { type MiddlewareFn, normalizeBaseUrl } from '../../fetchClient';\nimport { KeboolaHttpHeader } from '../../internal';\nimport { createConfigurationSdk } from '../../sdks/configurations';\nimport { createSemanticLayerSdk } from '../../sdks/semanticLayer';\nimport { createStorageSdk } from '../../sdks/storage';\nimport { createTagSdk } from '../../sdks/tag';\nimport { createVariablesSdk } from '../../sdks/variables';\nimport { createVaultSdk } from '../../sdks/vault';\nimport { createDerivedStore } from '../../utils';\nimport { type ClientContext, createLiveProject } from '../createLiveProject';\nimport { type MiddlewareFor } from '../createMiddlewareFor';\nimport { createServiceClients } from '../createServiceClients';\n\n/**\n * Bearer (OAuth) project surface. Same handshake + assembly as the legacy build. The\n * `Authorization: Bearer` header + transparent refresh come from the engine-shared `authMiddleware`\n * (one instance for management + every project client). This build only adds the project-scoped\n * `X-KBC-ProjectId` header, composed *outside* the auth middleware so the header is present\n * before it clones the request for the 401 replay. Bearer has no static token header, so this\n * combined `attach` rides on every client — including the operational storage and the bootstrap reader.\n */\nexport const createProjectClients = async ({\n  baseUrl,\n  projectId,\n  authMiddleware,\n  middlewareFor,\n  clientServiceUrls,\n}: {\n  baseUrl: string;\n  authMiddleware: MiddlewareFn;\n  projectId: number;\n  middlewareFor: MiddlewareFor;\n  clientServiceUrls?: ServiceUrls;\n}) => {\n  // Bearer contributes no static auth header — the auth middleware stamps the live token on every\n  // request. `token: ''` only satisfies the strategy type; it never reaches the wire here.\n  const auth: AuthStrategy = { type: 'bearer', token: '', projectId };\n\n  const projectIdMiddleware: MiddlewareFn = (next) => (request) => {\n    request.request.headers.set(KeboolaHttpHeader.PROJECT_ID, String(projectId));\n    return next(request);\n  };\n  // projectId outer so its header is set before the auth middleware clones for the 401 replay.\n  const attach: MiddlewareFn = (next) => projectIdMiddleware(authMiddleware(next));\n\n  const reader = createStorageClient({ baseUrl, auth, middlewares: [attach] });\n  const [stackInfo, sapiToken, devBranches] = await Promise.all([\n    reader.getStackInfo({ exclude: 'componentDetails' }),\n    reader.tokens.verify(),\n    reader.branches.getDevBranches(),\n  ]);\n\n  const stack = createStack({ stackInfo, clientServiceUrls });\n  const defaultBranch = createDefaultBranch({ devBranches });\n  const liveProject = createLiveProject({\n    initialToken: sapiToken,\n    verify: () => reader.tokens.verify(),\n  });\n  const storageTableStore = createDerivedStore({\n    source: liveProject.store,\n    build: createStorageTable,\n    dependsOn: (project) => ({\n      useLegacyBucketPrefix: !project.hasFeature(ProjectFeature.DisableLegacyBucketPrefix),\n      hasProtectedDefaultBranch: project.hasFeature(ProjectFeature.SoxProtectedDefaultBranch),\n      hasStorageBranches: project.hasFeature(ProjectFeature.StorageBranches),\n    }),\n  });\n\n  const context: ClientContext = {\n    baseUrl: normalizeBaseUrl(baseUrl),\n    stack,\n    defaultBranch,\n    get project() {\n      return liveProject.getProject();\n    },\n    get st() {\n      return storageTableStore.get();\n    },\n  };\n\n  // Bearer has no static auth header, so the operational storage client carries `attach` too.\n  const storage = createStorageClient({\n    baseUrl,\n    auth,\n    middlewares: middlewareFor('storage', [attach, liveProject.middleware]),\n  });\n\n  const { client: services, meta: serviceMeta } = createServiceClients({\n    baseUrl,\n    auth,\n    getServiceBaseUrl: context.stack.getServiceUrl,\n    middlewareFor,\n    attachTokenMiddleware: attach,\n  });\n\n  const sdk = {\n    configuration: createConfigurationSdk({\n      storageClient: storage,\n      encryptionClient: services.encryption,\n      context,\n    }),\n    tag: createTagSdk({ metastoreClient: services.metastore }),\n    semanticLayer: createSemanticLayerSdk({ metastoreClient: services.metastore }),\n    storage: createStorageSdk({ storageClient: storage }),\n    vault: createVaultSdk({ vaultClient: services.vault, encryptionClient: services.encryption }),\n    variables: createVariablesSdk({ storageClient: storage }),\n  };\n\n  return { context, serviceMeta, storage, ...services, sdk };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\n\nimport { type BearerCredential, isUnauthorized } from './credential';\n\n/**\n * Bearer auth for every outgoing request:\n * - Stamps the current access token (from the credential) as the `Authorization` header.\n * - On a 401, force-refreshes the token and replays the request once.\n * - If the replay still 401s, the fresh token is rejected → marks the session expired.\n *\n * When the session is anonymous (`getAccessToken` → `null`) the request is passed through untouched\n * with no 401 dance — so pre-auth calls on the auth client (`login`, `refresh`) work and a failed\n * login is never mistaken for session expiry.\n *\n * Holds no token and never touches config — all token and refresh state lives in the credential.\n */\nexport const createBearerAuthMiddleware = (credential: BearerCredential): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getAccessToken({ forceRefresh: false });\n    // Anonymous request (e.g. login / refresh) — nothing to authenticate; pass through untouched.\n    if (token === null) return next(request);\n\n    // Cloned up front for the 401 replay: the body stream may be consumed by the first attempt.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${token}`);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getAccessToken({ forceRefresh: true });\n      // Went anonymous mid-flight (concurrent sign-out) — don't replay, surface the original 401.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${refreshed}`);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        // Refreshed and replayed, still 401 — the fresh token is rejected, so the session is dead.\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import * as z from 'zod';\n\nimport { createPersistor } from '../../utils/persistor';\nimport type { StorageAdapter } from '../types';\n\nconst SESSION_KEY = 'keboola:bearer-session';\n\nconst persistedSessionSchema = z.object({\n  baseUrl: z.string().nullable(),\n  projectId: z.number().nullable(),\n  refreshToken: z.string().nullable(),\n});\n\nexport type PersistedSession = z.infer<typeof persistedSessionSchema>;\n\nconst EMPTY_PERSISTED_SESSION: PersistedSession = {\n  baseUrl: null,\n  projectId: null,\n  refreshToken: null,\n};\n\nexport const createSessionPersistor = (storage?: StorageAdapter) =>\n  createPersistor<PersistedSession>({\n    storage,\n    key: SESSION_KEY,\n    schema: persistedSessionSchema,\n    defaultValue: EMPTY_PERSISTED_SESSION,\n  });\n","import { createAuthClient } from '../../clients/auth/authClient';\nimport { createManagementClient } from '../../clients/management';\nimport { ApiError } from '../../errors';\nimport { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { HttpStatus, KeboolaHttpHeader } from '../../internal';\nimport { createRetryMiddleware } from '../../middlewares';\nimport { createDerivedAsyncStore, createDerivedStore, lazy } from '../../utils';\nimport { createApi, type ProjectClients } from '../createApi';\nimport { createMiddlewareFor } from '../createMiddlewareFor';\nimport { assert, KeboolaError, KeboolaErrorType } from '../errors';\nimport type { KeboolaOptions } from '../types';\n\nimport { createConfig, type State, type TokenSet } from './createConfig';\nimport { createProjectClients } from './createProjectClients';\nimport { type BearerCredential, createBearerCredential, isUnauthorized } from './credential';\nimport { createBearerAuthMiddleware } from './middleware';\nimport { createSessionPersistor } from './persistor';\nimport type { RestoreResult, SessionSnapshot } from './types';\n\nexport const createKeboola = (options: KeboolaOptions = {}) => {\n  const persistor = createSessionPersistor(options.storage);\n  const config = createConfig();\n  const middlewareFor = createMiddlewareFor(options.middlewares);\n\n  // Retry a 503 (refresh contention) on any auth call — outermost, so it wraps the whole chain. This\n  // covers both the credential's `refresh` closure below and `restore()`, which share this client.\n  const retryContention = createRetryMiddleware({\n    shouldRetry: (error) =>\n      error instanceof ApiError && error.response.status === HttpStatus.SERVICE_UNAVAILABLE,\n  });\n\n  // Bare auth client — retry only, NO auth middleware. This is the transport for `refresh()` and\n  // `restore()`: routing a token refresh through the auth middleware would re-enter the (deduped)\n  // refresh via its 401/near-expiry path and deadlock, so those calls must bypass it.\n  const authClientBare = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => state.baseUrl,\n    build: (baseUrl) =>\n      baseUrl\n        ? createAuthClient({ baseUrl, middlewares: middlewareFor('auth', [retryContention]) })\n        : null,\n  });\n\n  const refresh = async () => {\n    const client = authClientBare.get();\n    assert(client, KeboolaErrorType.NotReady);\n    // Pin the sign-in this rotation belongs to. `applyRefresh` only asks whether *a* session exists,\n    // so a rotation resolving after its own session ended would overwrite the credential of whoever\n    // signed in since — and the whole new session, `api` included, would then ride the old user's\n    // tokens. Refuse it instead; the live session still holds its own, unrotated credential.\n    const epoch = config.getEpoch();\n    const refreshed = await client.token\n      .refresh(config.requireCredential().refreshToken)\n      .catch((error: unknown) => {\n        // Refused *and* late. The rejection has to be re-labelled before it travels on, because\n        // `credential`'s own catch reads a 401 as \"this session is dead\" and reports it — and\n        // `authenticate` re-armed the latch, so that report signs out whoever signed in since.\n        if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n        throw error;\n      });\n    if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n    config.applyRefresh(refreshed);\n    return refreshed.accessToken;\n  };\n\n  // `null` while anonymous, so the auth middleware passes pre-auth requests (login) through unstamped.\n  const getToken = () => {\n    const state = config.store.get();\n    if (state.status === 'anonymous') return null;\n    const { accessToken, issuedAt, expiresIn } = state.credential;\n    return { accessToken, timing: { issuedAt, expiresIn } };\n  };\n\n  /**\n   * The session's state, once it is known to carry a credential.\n   *\n   * - Returns the state rather than nothing, so the caller reads `baseUrl` and `credential` off a\n   *   narrowed union instead of re-checking the status to get at them.\n   * - `NotAuthenticated`, the same refusal `requireScopedProject` opens with. The two differ only in\n   *   how far they go: this one stops at \"somebody is signed in\", which is all a request naming its\n   *   own project needs.\n   */\n  const requireAuthenticated = (): Exclude<State, { status: 'anonymous' }> => {\n    const state = config.store.get();\n    if (state.status === 'anonymous') throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n    return state;\n  };\n\n  /**\n   * The project this session is scoped to, right now.\n   *\n   * - Read at every point that stamps a project, never snapshotted across an `await`: the scope moves\n   *   with `setProject`/`clearProject`, and neither ends the session, so it is not in the epoch and\n   *   `assertSameSession` cannot see it change.\n   * - `NotReady` rather than `NotAuthenticated` when merely unscoped — the credential is fine, the\n   *   project is what is missing. A credential alone does not authorize a project request: kai-agent\n   *   reads the project from the header, not the token, and cannot attribute a call that omits it.\n   */\n  const requireScopedProject = (): number => {\n    const state = requireAuthenticated();\n    if (state.status !== 'scoped') throw new KeboolaError(KeboolaErrorType.NotReady);\n    return state.projectId;\n  };\n\n  /**\n   * The project client sets `forProject` has handed out, keyed by project id.\n   *\n   * - Not keyed by stack: `setBaseUrl` throws once authenticated and `signOut` empties this, so one\n   *   entry can never belong to a different `baseUrl` than the live session.\n   * - A `lazy` per key, not a bare promise: concurrent callers share one bootstrap, later ones replay\n   *   the resolved set, and a rejected build clears only its own slot — so a build orphaned by a\n   *   sign-out cannot evict the entry that replaced it.\n   */\n  const extraProjects = new Map<number, () => Promise<ProjectClients>>();\n\n  const signOut = () => {\n    config.reset();\n    // The credential outlives the session, so its in-flight rotation would otherwise be handed to\n    // the next one — which then rotates nothing of its own and eats `refresh`'s epoch refusal.\n    credential.abandonRefresh();\n    extraProjects.clear();\n    persistor.clear();\n  };\n\n  // Sign out once per session death: `config.notifyExpired` latches (re-armed on `authenticate`), so\n  // concurrent 401s from any realm collapse to a single sign-out.\n  const onSessionExpired = () => {\n    if (config.notifyExpired()) signOut();\n  };\n\n  const credential = createBearerCredential({ refresh, getToken, onSessionExpired });\n\n  // Refuses anything belonging to sign-in `epoch` once the session has moved on. One line, but it is\n  // the whole session pin — everything below is about *where* to call it.\n  const sessionGuard = (epoch: number) => () => {\n    if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n  };\n\n  /**\n   * The auth middleware, refusing to carry a request across a change of session.\n   *\n   * - The middleware holds no token — it reads the credential live — so anything built on it acts as\n   *   whoever is signed in *at request time*, not whoever built it. Rebuilding a store on sign-out\n   *   only stops new reads; a request already in flight completes as the next user, still stamped\n   *   with the old project. `config`'s epoch moves on `authenticate` and `reset` and never on a\n   *   rotation, so it is exactly \"which sign-in is this\".\n   * - `epochFor` says which sign-in a request answers to, resolved per request:\n   *   1. a client set pins to the sign-in that *built* it (`pinToSession`) — a set the caller still\n   *      holds must not ride the session that replaced it;\n   *   2. `api.auth` pins to the sign-in the request *started* on, because its store is keyed on\n   *      `baseUrl` alone: it is built once, while anonymous, so a build-time pin would freeze at that\n   *      epoch and refuse every authenticated call.\n   * - The guard covers every credential read, not only the wire request, so it wraps the credential\n   *   rather than sitting beside it. The 401 path rotates the token by calling the credential\n   *   directly: a straggler from a dead session would otherwise spend the *live* session's\n   *   single-use refresh token, and sign that session out if the rotation itself came back 401.\n   * - `expiresSession` decides whether a 401 that survives a rotation means the session is dead.\n   *   True for this session's own realms; false where the 401 may be about the project instead of\n   *   the credential (see `forProject`).\n   * - `inner` is for middleware that **re-invokes `next`** — a retry. Composed outside the pin it\n   *   would re-enter it per attempt, and with a per-request `epochFor` each attempt would re-pin to\n   *   whoever is signed in by then: a 503 backoff is exactly long enough for a sign-out to land, and\n   *   the retry then goes out as the next user. Inside, one epoch covers every attempt and each\n   *   attempt still passes the guard. Anything new that retries belongs here, not in the array.\n   */\n  const createPinnedAuthMiddleware = (\n    epochFor: () => number,\n    {\n      expiresSession = true,\n      inner = [],\n    }: { expiresSession?: boolean; inner?: MiddlewareFn[] } = {},\n  ): MiddlewareFn => {\n    return (next) => (request) => {\n      const assertSameSession = sessionGuard(epochFor());\n      const pinnedCredential: BearerCredential = {\n        ...credential,\n        getAccessToken: async (options) => {\n          assertSameSession();\n          return credential.getAccessToken(options);\n        },\n        // A 401 the rotation did not fix is not this realm's evidence of a dead credential.\n        notifyExpired: expiresSession ? credential.notifyExpired : () => {},\n      };\n      // Innermost, below `inner`: the 401 path replays by calling `next` itself and a retry sends\n      // the request again, and those repeats — one carrying the freshly rotated token — are the\n      // requests that must not go out.\n      const guarded: MiddlewareFn = (wire) => (repeated) => {\n        assertSameSession();\n        return wire(repeated);\n      };\n      const chain = inner.reduceRight<ReturnType<MiddlewareFn>>(\n        (acc, middleware) => middleware(acc),\n        guarded(next),\n      );\n      return createBearerAuthMiddleware(pinnedCredential)(chain)(request);\n    };\n  };\n\n  /**\n   * Pin something long-lived to the sign-in live right now.\n   *\n   * - `assertSameSession` is for whatever no middleware chain covers: a bootstrap whose every\n   *   request passed the guard before the sign-out resolves anyway and must not be handed back, and\n   *   `getAuthHeaders`, which emits the credential by hand.\n   */\n  const pinToSession = (options?: {\n    expiresSession?: boolean;\n  }): {\n    assertSameSession: () => void;\n    pinnedAuthMiddleware: MiddlewareFn;\n  } => {\n    const epoch = config.getEpoch();\n    return {\n      assertSameSession: sessionGuard(epoch),\n      pinnedAuthMiddleware: createPinnedAuthMiddleware(() => epoch, options),\n    };\n  };\n\n  // Exposed auth client (`api.auth`) — carries the auth middleware so the authenticated auth-service\n  // endpoints (`token.introspect`, `session.revokeAll`, `password.change`) are authorized. `login`\n  // stays anonymous: the middleware no-ops when `getToken()` is `null`. Refreshes still go through\n  // `authClientBare`.\n  //\n  // Pinned per request rather than per build: one instance serves every session, so there is no\n  // build epoch worth comparing — but a single request still may not cross a turnover. Unpinned, a\n  // call whose 401 landed across a sign-in replayed as the *next* user and resolved that user's\n  // payload to the previous one's caller.\n  //\n  // `retryContention` goes *inside* that pin rather than beside it in the array, where it would be\n  // the outermost middleware and re-pin every attempt — see `createPinnedAuthMiddleware`.\n  const authClient = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => state.baseUrl,\n    build: (baseUrl) =>\n      baseUrl\n        ? createAuthClient({\n            baseUrl,\n            middlewares: middlewareFor('auth', [\n              createPinnedAuthMiddleware(config.getEpoch, { inner: [retryContention] }),\n            ]),\n          })\n        : null,\n  });\n\n  // Keyed on baseUrl-when-authenticated (a primitive): rebuilds on login/logout and stack change, but\n  // NOT on a token rotation — the credential isn't in the key, and the middleware reads it live. Bearer\n  // carries no static header (the middleware stamps it), so `token: ''` never reaches the wire.\n  const management = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => (state.status === 'anonymous' ? null : state.baseUrl),\n    build: (baseUrl) =>\n      baseUrl\n        ? createManagementClient({\n            baseUrl,\n            auth: { type: 'bearer', token: '' },\n            middlewares: middlewareFor('management', [pinToSession().pinnedAuthMiddleware]),\n          })\n        : null,\n  });\n\n  const projectClientsAsync = createDerivedAsyncStore({\n    source: config.store,\n    // Keyed on baseUrl + projectId only — a rotation (new credential, same project) must not rebuild.\n    dependsOn: (state) =>\n      state.status === 'scoped' ? { baseUrl: state.baseUrl, projectId: state.projectId } : null,\n    // The generation guard already drops a stale build's *value*, so only the requests need pinning.\n    build: ({ baseUrl, projectId }) => {\n      return createProjectClients({\n        baseUrl,\n        authMiddleware: pinToSession().pinnedAuthMiddleware,\n        projectId,\n        middlewareFor,\n        clientServiceUrls: options.clientServiceUrls,\n      });\n    },\n  });\n\n  // `async` so an unauthenticated call rejects like every other failure here, rather than throwing\n  // synchronously past a caller's `.catch`.\n  const forProject = async (projectId: number): Promise<ProjectClients> => {\n    const state = requireAuthenticated();\n\n    const cached = extraProjects.get(projectId);\n    if (cached) return cached();\n\n    // The pin is what makes `reset()` a teardown here and not a cache eviction: a set is a plain\n    // object the caller keeps, and nothing else stops it outliving the credential it was built\n    // against. Unlike the scoped build there is no store to drop it, so the resolution is checked\n    // too, not only the requests.\n    //\n    // `expiresSession: false` because this is the only surface taking a caller-supplied project id,\n    // and connection collapses every bearer failure into one `invalid_token` 401 so scope cannot be\n    // probed — \"no access to this project\" is the same response as a revoked token. A rotation that\n    // succeeds settles it: the credential is alive, so a 401 that survives it is about the project.\n    // Left as `true`, a mistyped id would rotate, replay, 401 again and sign the whole session out.\n    // A credential that really is dead still surfaces — `refresh` itself 401s, which is unambiguous.\n    const { assertSameSession, pinnedAuthMiddleware } = pinToSession({ expiresSession: false });\n\n    const build = lazy(async () => {\n      const clients = await createProjectClients({\n        baseUrl: state.baseUrl,\n        authMiddleware: pinnedAuthMiddleware,\n        projectId,\n        middlewareFor,\n        clientServiceUrls: options.clientServiceUrls,\n      });\n      // A bootstrap that outlived its session resolves anyway — every one of its requests passed\n      // the guard before the sign-out. Refuse it here rather than hand back a set already dead.\n      assertSameSession();\n      return clients;\n    });\n    extraProjects.set(projectId, build);\n    return build();\n  };\n\n  if (options.baseUrl) config.setBaseUrl(options.baseUrl);\n\n  // Mirror the live session into storage: persist the durable subset (projected inline here, so it is\n  // clear exactly what we store) whenever a credential is present — login, project switch, token\n  // rotation. Skip when there is no credential so a bare `setBaseUrl` never overwrites a stored session\n  // before `restore()` reads it; `signOut` is what clears storage.\n  config.store.subscribe((state) => {\n    if (state.status === 'anonymous') return;\n\n    persistor.persist({\n      baseUrl: state.baseUrl,\n      projectId: state.status === 'scoped' ? state.projectId : null,\n      refreshToken: state.credential.refreshToken,\n    });\n  });\n\n  const debug = (): SessionSnapshot => ({\n    type: 'Bearer',\n    config: config.debug(),\n    authReady: authClient.get() !== null,\n    managementReady: management.get() !== null,\n    storage: projectClientsAsync.store.get().state,\n  });\n\n  const session = {\n    hasPersistedValue: persistor.hasPersistedValue,\n    setBaseUrl: config.setBaseUrl,\n    isStorageReady: () => projectClientsAsync.store.get().state === 'ready',\n    authenticate: (tokens: TokenSet) => config.authenticate(tokens),\n    setProject: config.setProjectId,\n    setProjectAsync: async (projectId: number) => {\n      config.setProjectId(projectId);\n      await projectClientsAsync.settled();\n    },\n    /**\n     * Leave the current project but stay signed in — the storage build returns to `idle`, so a\n     * consumer gating on it falls back to its project picker. The persisted session is rewritten with\n     * `projectId: null` by the subscription above, so a reload lands on the picker rather than\n     * re-entering the project. Use `reset` to sign out instead.\n     */\n    clearProject: config.clearProjectId,\n    /**\n     * The clients for one project, off this session — for reaching a second project without leaving\n     * the first.\n     *\n     * - `setProjectAsync` *moves* the session (and `api`) to another project; this *adds* one. The\n     *   returned set is the caller's to hold and never appears on `api`.\n     * - Every set shares this session's auth middleware, so one rotation serves all of them. A second\n     *   `createKeboola()` does not: both hold the same single-use refresh token, and the first to\n     *   rotate invalidates the other's, whose next refresh 401s and signs it out.\n     * - Independent of the scope, including for the scoped project itself — asking for that one\n     *   builds a second set with its own `liveProject`, so prefer `api.*` there.\n     */\n    forProject,\n    reset: signOut,\n    /**\n     * Dev/test only: mark the current access token as expired so the bearer credential rotates it on\n     * the next request. Pair with any authenticated call (e.g. `api.storage.tokens.verify()`) to force\n     * the rotation immediately and observe the new credential.\n     */\n    debugForceRefresh: config.forceExpire,\n    /**\n     * The headers that authorize one off-client request, resolved fresh each call.\n     *\n     * - For a transport this package does not own — the chat SSE stream, whose `fetch` the AI SDK\n     *   holds. Anything with a service client on `api` should use that instead.\n     * - Returns the assembled bag, never the bare token: no caller handles the credential as a\n     *   string, and `X-KBC-ProjectId` is composed here rather than in every consuming app.\n     * - Resolved per call, through the credential — so a near-expiry token rotates and a revoked\n     *   one is never re-sent. A snapshot held by the caller would do neither.\n     * - Throws rather than emitting a half-formed `Bearer null`: a session with no credential has\n     *   nothing to authorize with.\n     * - Pinned to the sign-in it was called on, like every client here. This is the one\n     *   credential-emitting surface with no middleware chain for the guard to sit in, so the check\n     *   is written out around the `await` that rotates the token.\n     *\n     * `projectId` names the project the headers authorize, for a caller reaching a project the\n     * session is not scoped to:\n     *\n     * - **Omitted**, the session's own scope answers — unchanged, and re-read *after* the rotation\n     *   rather than carried across it. The epoch the pin compares moves on a sign-in and a sign-out\n     *   only, so a project switch mid-rotation is invisible to it.\n     * - **Given**, it is what the header says, and the scope is not consulted at all. A caller that\n     *   names a project has said everything the request needs: the credential is user-level and the\n     *   project is a header on top of it, so an authenticated session suffices where an unnamed call\n     *   requires a scoped one. Nothing about the session can change the answer, so there is nothing\n     *   to re-read after the `await`.\n     * - **Not checked against an access set**, because this session cannot acquire one:\n     *   `forProject` — the only other surface taking a caller-supplied project id — records that\n     *   connection collapses every bearer failure into a single `invalid_token` 401, so \"no access\n     *   to this project\" and \"revoked token\" are the same response. Whether the caller may reach a\n     *   project is the caller's own knowledge, from `token.introspect`. What is guaranteed here is\n     *   that the header names what was asked for and never something else — which is the failure\n     *   worth preventing: a turn sent somewhere the transcript above it did not come from.\n     */\n    getAuthHeaders: async (projectId?: number): Promise<Record<string, string>> => {\n      const { assertSameSession } = pinToSession();\n      // Refuse before the rotation, so a session that could not have authorized the call anyway\n      // never spends its single-use refresh token on it. A named project lowers the bar to \"signed\n      // in\" rather than removing it — `Bearer null` is still not a thing to send.\n      if (projectId === undefined) requireScopedProject();\n      else requireAuthenticated();\n\n      const accessToken = await credential.getAccessToken();\n      // A sign-out across the rotation does not surface as a failure here: `refresh` refuses the\n      // rotation for belonging to the session that ended, and the proactive path swallows that\n      // refusal (`credential.ts`) and falls back to the token it started with. So this resolves —\n      // with the dead session's token and the project it was on. `assert` below cannot see it.\n      assertSameSession();\n      // Re-read, never the pre-`await` snapshot: a `setProject` during the rotation would otherwise\n      // stamp the freshly rotated token with the project this session has already left, and a\n      // `clearProject` would resolve a header bag for a scope that no longer exists. A project the\n      // caller named is not the session's to move, so it is used as given.\n      const authorizedProjectId = projectId ?? requireScopedProject();\n      // `null` means anonymous, which the guard above already rejected — reachable only if a\n      // sign-out lands while the rotation is in flight.\n      assert(accessToken, KeboolaErrorType.NotAuthenticated);\n\n      return {\n        [HttpHeader.AUTHORIZATION]: `Bearer ${accessToken}`,\n        [KeboolaHttpHeader.PROJECT_ID]: String(authorizedProjectId),\n      };\n    },\n\n    restore: async (): Promise<RestoreResult> => {\n      const persisted = persistor.hydrate();\n      // Need both the refresh token and the stack it belongs to — a blob missing either is unusable.\n      if (!persisted.refreshToken || !persisted.baseUrl) return { status: 'empty' };\n\n      // The configured stack is authoritative. If the caller targets a different stack than the stored\n      // session, that session isn't ours — discard it (the refresh token only validates against its own\n      // stack, so we never send it elsewhere). With no stack configured, adopt the stored one.\n      const configured = config.getBaseUrl();\n      if (configured && configured !== persisted.baseUrl) {\n        persistor.clear();\n        return { status: 'empty' };\n      }\n      if (!configured) config.setBaseUrl(persisted.baseUrl);\n\n      // Bare client: the refresh transport, bypassing the auth middleware (see `authClientBare`).\n      const client = authClientBare.get();\n      assert(client, KeboolaErrorType.NotReady);\n      // Pinned like every other credential-emitting path here. `config.authenticate` only asks\n      // whether the session is anonymous — which a sign-out makes true — so a sign-out landing while\n      // the stored token is on the wire would be undone: the restore would sign the user back in.\n      // It resolves as `empty` rather than throwing, because that is what the sign-out left behind:\n      // it cleared storage, so there is no persisted session any more, and a boot-time restore\n      // should land the app on its sign-in screen, not on an error.\n      const startedOn = config.getEpoch();\n      try {\n        const refreshed = await client.token.refresh(persisted.refreshToken);\n        if (config.getEpoch() !== startedOn) return { status: 'empty' };\n        config.authenticate(refreshed);\n        if (persisted.projectId !== null) {\n          config.setProjectId(persisted.projectId);\n          await projectClientsAsync.settled();\n        }\n        return { status: 'restored' };\n      } catch (err) {\n        // Lost the race rather than found a dead token. The stored refresh token is single-use, so\n        // two concurrent restores cannot both rotate it — and by now the winner has persisted its\n        // own session, which `persistor.clear()` below would wipe: alive in memory, gone on the\n        // next reload. Says nothing about the token, because this call proved nothing about it.\n        if (config.getEpoch() !== startedOn) return { status: 'empty' };\n        if (isUnauthorized(err)) {\n          persistor.clear();\n          return { status: 'expired' };\n        }\n        throw err;\n      }\n    },\n    subscribe: (listener: (snapshot: SessionSnapshot) => void) => {\n      // Fire on both config mutations and storage-build transitions, so `ready` is observable.\n      const unsubscribeConfig = config.store.subscribe(() => listener(debug()));\n      const unsubscribeBuild = projectClientsAsync.store.subscribe(() => listener(debug()));\n      return () => {\n        unsubscribeConfig();\n        unsubscribeBuild();\n      };\n    },\n    debug,\n  };\n\n  const api = createApi({\n    getAuthClient: () => authClient.get(),\n    getManagementClient: () => management.get(),\n    getProjectClients: () => {\n      const state = projectClientsAsync.store.get();\n      return state.state === 'ready' ? state.value : null;\n    },\n  });\n\n  return { api, session };\n};\n","import { createStore } from '../../utils';\n\nexport type State = {\n  baseUrl: string | null;\n  sapiToken: string | null;\n  managementToken: string | null;\n};\n\n// The legacy config is a plain observable state store: the host injects the baseUrl and tokens, and\n// consumers derive their clients from `store` (see `keboola.ts`). No lifecycle events — the derived\n// stores react to state changes directly.\nexport const createConfig = () => {\n  const store = createStore<State>({ baseUrl: null, sapiToken: null, managementToken: null });\n\n  const setBaseUrl = (baseUrl: string) => {\n    store.set({ ...store.get(), baseUrl });\n  };\n\n  const authenticate = (tokens: { sapiToken?: string; managementToken?: string }) => {\n    const current = store.get();\n    store.set({\n      ...current,\n      sapiToken: tokens.sapiToken ?? current.sapiToken,\n      managementToken: tokens.managementToken ?? current.managementToken,\n    });\n  };\n\n  // SAPI token accessors over the config store — the single source of truth. The storage build reads\n  // `getStorageToken` on every request; in-band rotations write back via `setStorageToken`, which\n  // surfaces to observers as an ordinary store change.\n  const getStorageToken = () => store.get().sapiToken ?? '';\n  const setStorageToken = (sapiToken: string) => store.set({ ...store.get(), sapiToken });\n\n  /** Current state, for diagnostics. */\n  const debug = (): State => store.get();\n\n  return { store, setBaseUrl, authenticate, getStorageToken, setStorageToken, debug };\n};\n","import type { AuthStrategy } from '../../clients/auth';\nimport { createStorageClient } from '../../clients/storage';\nimport { ProjectFeature } from '../../constants/projectFeatures';\nimport { createDefaultBranch } from '../../domain/defaultBranch';\nimport { createStack, type ServiceUrls } from '../../domain/stack';\nimport { createStorageTable } from '../../domain/storageTable';\nimport { type MiddlewareFn, normalizeBaseUrl } from '../../fetchClient';\nimport { KeboolaHttpHeader } from '../../internal';\nimport { createConfigurationSdk } from '../../sdks/configurations';\nimport { createSemanticLayerSdk } from '../../sdks/semanticLayer';\nimport { createStorageSdk } from '../../sdks/storage';\nimport { createTagSdk } from '../../sdks/tag';\nimport { createVariablesSdk } from '../../sdks/variables';\nimport { createVaultSdk } from '../../sdks/vault';\nimport { createDerivedStore } from '../../utils';\nimport { type ClientContext, createLiveProject } from '../createLiveProject';\nimport { type MiddlewareFor } from '../createMiddlewareFor';\nimport { createServiceClients } from '../createServiceClients';\n\nconst createAttachStorageToken =\n  (getToken: () => string): MiddlewareFn =>\n  (next) =>\n  (request) => {\n    request.request.headers.set(KeboolaHttpHeader.STORAGE_API_TOKEN, getToken());\n    return next(request);\n  };\n\ntype Options = {\n  baseUrl: string;\n  getStorageToken: () => string;\n  onStorageTokenRefreshed: (token: string) => void;\n  middlewareFor: MiddlewareFor;\n  clientServiceUrls?: ServiceUrls;\n};\n\nexport const createProjectClients = async ({\n  baseUrl,\n  getStorageToken,\n  onStorageTokenRefreshed,\n  middlewareFor,\n  clientServiceUrls,\n}: Options) => {\n  const auth: AuthStrategy = { type: 'sapi-token', token: getStorageToken() };\n\n  const attach = createAttachStorageToken(getStorageToken);\n  const _storage = createStorageClient({ baseUrl, auth, middlewares: [attach] });\n  const [stackInfo, sapiToken, devBranches] = await Promise.all([\n    _storage.getStackInfo({ exclude: 'componentDetails' }),\n    _storage.tokens.verify(),\n    _storage.branches.getDevBranches(),\n  ]);\n\n  const stack = createStack({ stackInfo, clientServiceUrls });\n  const defaultBranch = createDefaultBranch({ devBranches });\n  const liveProject = createLiveProject({\n    initialToken: sapiToken,\n    verify: () => _storage.tokens.verify(),\n  });\n  const storageTableStore = createDerivedStore({\n    source: liveProject.store,\n    build: createStorageTable,\n    dependsOn: (project) => ({\n      useLegacyBucketPrefix: !project.hasFeature(ProjectFeature.DisableLegacyBucketPrefix),\n      hasProtectedDefaultBranch: project.hasFeature(ProjectFeature.SoxProtectedDefaultBranch),\n      hasStorageBranches: project.hasFeature(ProjectFeature.StorageBranches),\n    }),\n  });\n  const context: ClientContext = {\n    baseUrl: normalizeBaseUrl(baseUrl),\n    stack,\n    defaultBranch,\n    get project() {\n      return liveProject.getProject();\n    },\n    get st() {\n      return storageTableStore.get();\n    },\n  };\n\n  // Static storage-token header + in-band refresh (onRefreshToken rotates the shared liveToken store).\n  const storage = createStorageClient({\n    baseUrl,\n    auth,\n    middlewares: middlewareFor('storage', [liveProject.middleware]),\n    onRefreshToken: onStorageTokenRefreshed,\n  });\n\n  const { client: services, meta: serviceMeta } = createServiceClients({\n    baseUrl,\n    auth,\n    getServiceBaseUrl: context.stack.getServiceUrl,\n    middlewareFor,\n    attachTokenMiddleware: attach,\n  });\n\n  const sdk = {\n    configuration: createConfigurationSdk({\n      storageClient: storage,\n      encryptionClient: services.encryption,\n      context,\n    }),\n    tag: createTagSdk({ metastoreClient: services.metastore }),\n    semanticLayer: createSemanticLayerSdk({ metastoreClient: services.metastore }),\n    storage: createStorageSdk({ storageClient: storage }),\n    vault: createVaultSdk({ vaultClient: services.vault, encryptionClient: services.encryption }),\n    variables: createVariablesSdk({ storageClient: storage }),\n  };\n\n  return { context, serviceMeta, storage, ...services, sdk };\n};\n","import { createAuthClient } from '../../clients/auth/authClient';\nimport { createManagementClient } from '../../clients/management';\nimport { createDerivedAsyncStore, createDerivedStore } from '../../utils';\nimport { createApi } from '../createApi';\nimport { createMiddlewareFor } from '../createMiddlewareFor';\nimport type { KeboolaOptions } from '../types';\n\nimport { createConfig, type State } from './createConfig';\nimport { createProjectClients } from './createProjectClients';\nimport type { SessionSnapshot } from './types';\n\ntype ProjectClients = Awaited<ReturnType<typeof createProjectClients>>;\n\nexport const createLegacyKeboola = (options: KeboolaOptions = {}) => {\n  const config = createConfig();\n  const middlewareFor = createMiddlewareFor(options.middlewares);\n\n  // The clients are derived from config state: each rebuilds only when the slice it depends on\n  // changes. auth needs a baseUrl; management builds token-less up front and upgrades once a manage\n  // token lands; storage builds once the SAPI token arrives (a later in-band rotation keeps the same\n  // baseUrl key, so it does not rebuild).\n  const authClient = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => state.baseUrl,\n    build: (baseUrl) =>\n      baseUrl ? createAuthClient({ baseUrl, middlewares: middlewareFor('auth', []) }) : null,\n  });\n\n  const management = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => ({ baseUrl: state.baseUrl, token: state.managementToken }),\n    build: ({ baseUrl, token }) =>\n      baseUrl\n        ? createManagementClient({\n            baseUrl,\n            auth: token ? { type: 'management-token', token } : { type: 'management-token' },\n            middlewares: middlewareFor('management', []),\n          })\n        : null,\n  });\n\n  const build = createDerivedAsyncStore<State, string, ProjectClients>({\n    source: config.store,\n    dependsOn: (state) => (state.sapiToken && state.baseUrl ? state.baseUrl : null),\n    build: (baseUrl) =>\n      createProjectClients({\n        baseUrl,\n        getStorageToken: config.getStorageToken,\n        onStorageTokenRefreshed: config.setStorageToken,\n        middlewareFor,\n        clientServiceUrls: options.clientServiceUrls,\n      }),\n  });\n\n  if (options.baseUrl) config.setBaseUrl(options.baseUrl);\n\n  const debug = (): SessionSnapshot => {\n    const info = config.debug();\n    return {\n      type: 'Sapi',\n      config: info,\n      authReady: authClient.get() !== null,\n      managementReady: !!info.managementToken,\n      storage: build.store.get().state,\n    };\n  };\n\n  const session = {\n    setBaseUrl: config.setBaseUrl,\n    isStorageReady: () => build.store.get().state === 'ready',\n    authenticateStorage: (sapiToken: string) => config.authenticate({ sapiToken }),\n    authenticateStorageAsync: async (sapiToken: string) => {\n      config.authenticate({ sapiToken });\n      // `authenticate` mutates synchronously, so the build is already pending; `settled` awaits it.\n      await build.settled();\n    },\n    authenticateManagement: (managementToken: string) => config.authenticate({ managementToken }),\n    subscribe: (listener: (snapshot: SessionSnapshot) => void) => {\n      // Fire on both config mutations and storage-build transitions, so `ready` is observable.\n      const unsubscribeConfig = config.store.subscribe(() => listener(debug()));\n      const unsubscribeBuild = build.store.subscribe(() => listener(debug()));\n      return () => {\n        unsubscribeConfig();\n        unsubscribeBuild();\n      };\n    },\n    debug,\n  };\n\n  const api = createApi({\n    getAuthClient: () => authClient.get(),\n    getManagementClient: () => management.get(),\n    getProjectClients: () => {\n      const state = build.store.get();\n      return state.state === 'ready' ? state.value : null;\n    },\n  });\n\n  return { api, session };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAgB,OAAU,OAA6B,SAAqC;CAC1F,IAAI,SAAS,MACX,MAAM,IAAI,MAAM,OAAO;AAE3B;;;;;;;;;;;;;;;;;;;ACcA,MAAa,YAAe,SAAiD;CAC3E,IAAI,UAAU;CACd,MAAM,UAA8C,CAAC;CAErD,MAAM,QAAQ,YAAY;EACxB,UAAU;EACV,MAAM,QAAQ,QAAQ,OAAO,CAAC;EAE9B,IAAI;GACF,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,SAAS,WAAW,OAAO,QAAQ,MAAM,CAAC;EAClD,SAAS,OAAO;GACd,MAAM,SAAS,WAAW,OAAO,OAAO,KAAK,CAAC;EAChD;EAEA,IAAI,QAAQ,SAAS,GAAG,OAAO,MAAM;EACrC,UAAU;CACZ;CAEA,aAAa;EACX,MAAM,SAAS,QAAQ,cAA0B;EACjD,QAAQ,KAAK,MAAM;EACnB,IAAI,CAAC,SAAS,MAAW;EACzB,OAAO,OAAO;CAChB;AACF;;;ACzCA,MAAM,wBAAwB,UAA2B;CACvD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO;CACjC,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,MAAa,gBAAmB,GAAM,MAAkB;CACtD,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,OAAO;CAC5B,IAAI,OAAO,MAAM,YAAY,MAAM,QAAQ,OAAO,MAAM,YAAY,MAAM,MAAM,OAAO;CACvF,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,OAAO;CACjE,MAAM,QAAQ,OAAO,KAAK,CAAC;CAC3B,MAAM,QAAQ,OAAO,KAAK,CAAC;CAC3B,OAAO,MAAM,WAAW,MAAM,UAAU,MAAM,OAAO,QAAQ,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC;AACxF;AASA,MAAa,sBAA+B,EAC1C,QACA,WACA,OACA,YAAY,mBACwC;CACpD,IAAI,MAAM,UAAU,OAAO,IAAI,CAAC;CAChC,MAAM,QAAQA,cAAAA,YAAY,MAAM,GAAG,CAAC;CAKpC,MAAM,cAAc,OAAO,WAAW,UAAU;EAC9C,MAAM,OAAO,UAAU,KAAK;EAC5B,IAAI,UAAU,KAAK,IAAI,GAAG;EAC1B,MAAM;EACN,MAAM,IAAI,MAAM,IAAI,CAAC;CACvB,CAAC;CAED,MAAM,MAAM,MAAM;CAElB,MAAM,YAAY,MAAM;CAExB,MAAM,gBAAgB;EACpB,YAAY;EACZ,MAAM,QAAQ;CAChB;CAEA,OAAO;EAAE;EAAK;EAAW;CAAQ;AACnC;;;ACpBA,MAAa,2BAAoC,EAC/C,QACA,WACA,OACA,YAAY,mBAIT;CACH,MAAM,QAAQC,cAAAA,YAA2B,EAAE,OAAO,OAAO,CAAC;CAC1D,IAAI,aAAuB;CAC3B,IAAI,aAAa;CACjB,IAAI,aAAqC;CAEzC,MAAM,OAAO,QAAW;EACtB,YAAY,MAAM;EAClB,aAAa,IAAI,gBAAgB;EACjC,MAAM,gBAAgB,EAAE;EACxB,MAAM,IAAI,EAAE,OAAO,UAAU,CAAC;EAI9B,MAAM,KAAK,WAAW,MAAM,CAAC,CAAC,MAC3B,UAAU;GACT,IAAI,kBAAkB,YAAY,MAAM,IAAI;IAAE,OAAO;IAAS;GAAM,CAAC;EACvE,IACC,UAAU;GACT,IAAI,kBAAkB,YAAY,MAAM,IAAI;IAAE,OAAO;IAAW;GAAM,CAAC;EACzE,CACF;CACF;CAEA,MAAM,QAAQ,UAAa;EACzB,MAAM,OAAO,UAAU,KAAK;EAC5B,IAAI,SAAS,MAAM;GACjB,IAAI,eAAe,MAAM;GACzB,YAAY,MAAM;GAClB,aAAa;GACb,cAAc;GACd,aAAa;GACb,MAAM,IAAI,EAAE,OAAO,OAAO,CAAC;GAC3B;EACF;EACA,IAAI,eAAe,QAAQ,UAAU,YAAY,IAAI,GAAG;EACxD,aAAa;EACb,IAAI,IAAI;CACV;CACA,KAAK,OAAO,IAAI,CAAC;CAEjB,MAAM,cAAc,OAAO,UAAU,IAAI;CAEzC,MAAM,MAAM,MAAM;CAElB,MAAM,YAAY,MAAM;CAExB,MAAM,gBAAgB;EACpB,YAAY,MAAM;EAClB,YAAY;EACZ,MAAM,QAAQ;CAChB;CAEA,MAAM,WAAyC;EAAE;EAAK;EAAW;CAAQ;CAEzE,MAAM,gBACJ,IAAI,SAA0B,YAAY;EACxC,IAAI,2BAA2B,CAAC;EAChC,MAAM,SAAS,UAAyB;GACtC,IAAI,MAAM,UAAU,WAAW,MAAM,UAAU,WAAW;IACxD,mBAAmB;IACnB,QAAQ,KAAK;GACf;EACF;EACA,qBAAqB,MAAM,UAAU,KAAK;EAC1C,MAAM,MAAM,IAAI,CAAC;CACnB,CAAC;CAEH,OAAO;EAAE,OAAO;EAAU;CAAQ;AACpC;;;ACnGA,MAAM,gBAAgB;AAmBtB,MAAM,cAAc,EAAE,eACpB,SAAS,UAAU,UAAU,SAAS,UAAU;AAElD,MAAa,sBAAsB,EAAE,QAAQ,kBAAkB,CAAC,MAAoB;CAClF,MAAM,UAAUC,cAAAA,YAAyB,CAAC,CAAC;CAC3C,MAAM,+BAAe,IAAI,IAAwB;CAEjD,MAAM,aAAaC,kBAAAA,MAAMC,kBAAAA,SAAS,OAAO,aAAa,GAAG,CAAC;CAC1D,IAAI,UAAU;CAEd,MAAM,UAAU,QAAgB;EAC9B,aAAa,IAAI,GAAG,CAAC,GAAG;EACxB,aAAa,OAAO,GAAG;CACzB;CAEA,MAAM,QAAQ,SAAsB;EAClC,IAAI,OAAO;EAEX,OAAO,KAAK,SAAS,YAAY;GAC/B,MAAM,UAAU,KAAK,SAAS,UAAU,KAAK,KAAK,GAAG,EAAE;GAEvD,IAAI,CAAC,SAAS;GAEd,OAAO,QAAQ,GAAG;GAClB,OAAO,KAAK,QAAQ,UAAU,UAAU,OAAO;EACjD;EAEA,OAAO;CACT;CAEA,MAAM,WAAW,KAAa,aAC5B,QAAQ,IAAI,QAAQ,IAAI,CAAC,CAAC,KAAK,UAAW,MAAM,QAAQ,MAAM;EAAE,GAAG;EAAO;CAAS,IAAI,KAAM,CAAC;CAEhG,MAAM,YAAY,WAA2B;EAC3C,MAAM,MAAM;EACZ,MAAM,QAAmB;GACvB;GACA,WAAW,KAAK,IAAI;GACpB,UAAU,OAAO,MAAM;GACvB,MAAM,OAAO;GACb,OAAO,OAAO;EAChB;EAEA,aAAa,IACX,KACA,OAAO,WAAW,aAAa,QAAQ,KAAK,QAAQ,CAAC,CACvD;EACA,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC;CAC7C;CAEA,MAAM,gBAAgB;EACpB,kBAAA,QAAQ,UAAU,QAAQ;CAC5B;CAEA,OAAO;EACL,MAAM,QAAQ;EACd;EACA,YAAY,aAAa,QAAQ,gBAAgB,SAAS,CAAC;EAC3D,aAAa;GACX,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,OAAO,GAAG,CAAC;GAC9C,QAAQ,IAAI,CAAC,CAAC;EAChB;EACA,UAAU,WAAW,QAAQ,IAAI,CAAC,CAAC,SAAS,UAAU,MAAM,KAAK,MAAM,CAAC;CAC1E;AACF;;;;;;;;;ACtFA,MAAa,aACX,MACA,UACM;CACN,MAAM,MAA+B,EAAE,GAAG,KAAK;CAE/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,UAAU,IAAI;EACpB,IAAI,OAAOC,sBAAAA,cAAc,OAAO,KAAKA,sBAAAA,cAAc,KAAK,IAAI,UAAU,SAAS,KAAK,IAAI;CAC1F;CAEA,OAAO;AACT;;;ACXA,MAAa,2BAA2C;CACtD,eAAe;CACf,eAAe,CAAC;CAChB,kBAAkB,CAAC;AACrB;AAIA,MAAa,4BAA4C;CACvD,MAAM,wBAAQ,IAAI,IAAoB;CACtC,OAAO;EACL,UAAU,QAAQ,MAAM,IAAI,GAAG,KAAK;EACpC,UAAU,KAAK,UAAU;GACvB,MAAM,IAAI,KAAK,KAAK;EACtB;EACA,aAAa,QAAQ;GACnB,MAAM,OAAO,GAAG;EAClB;CACF;AACF;AAOA,MAAM,oBAAoB,SAA+C;CACvE,IAAI,MAAsB;CAC1B,IAAI;EACF,MAAM,KAAK;EACX,IAAI,KAAK;GACP,MAAM,QAAQ;GACd,IAAI,QAAQ,OAAO,KAAK;GACxB,IAAI,WAAW,KAAK;EACtB;CACF,SAAS,KAAK;EACZ,QAAQ,KAAK,qEAAqE,GAAG;EACrF,MAAM;CACR;CACA,IAAI,CAAC,KAAK,OAAO,oBAAoB;CAErC,MAAM,UAAU;CAChB,OAAO;EACL,UAAU,QAAQ,QAAQ,QAAQ,GAAG;EACrC,UAAU,KAAK,UAAU;GACvB,QAAQ,QAAQ,KAAK,KAAK;EAC5B;EACA,aAAa,QAAQ;GACnB,QAAQ,WAAW,GAAG;EACxB;CACF;AACF;AAEA,MAAa,2BACX,uBAAwB,kBAAkB,aAAa,WAAW,eAAe,IAAK;AAExF,MAAa,6BACX,uBAAwB,oBAAoB,aAAa,WAAW,iBAAiB,IAAK;;;ACjC5F,MAAa,mBAAsB,EACjC,UAAU,kBAAkB,GAC5B,KACA,QACA,cACA,SAAS,KAAK,WACd,SAAS,KAAK,YACyB;CAGvC,MAAM,cAAoB;EACxB,IAAI;GACF,QAAQ,WAAW,GAAG;EACxB,SAAS,KAAK;GACZ,QAAQ,KAAK,qCAAqC,IAAI,IAAI,GAAG;EAC/D;CACF;CAIA,MAAM,0BAAmC;EACvC,IAAI;GACF,OAAO,CAAC,CAAC,QAAQ,QAAQ,GAAG;EAC9B,SAAS,KAAK;GACZ,QAAQ,KAAK,oCAAoC,IAAI,oBAAoB,GAAG;GAC5E,OAAO;EACT;CACF;CAEA,MAAM,gBAAmB;EACvB,IAAI;EACJ,IAAI;GACF,MAAM,QAAQ,QAAQ,GAAG;EAC3B,SAAS,KAAK;GACZ,QAAQ,KAAK,oCAAoC,IAAI,mBAAmB,GAAG;GAC3E,OAAO;EACT;EACA,IAAI,QAAQ,MAAM,OAAO;EAEzB,IAAI;EACJ,IAAI;GACF,UAAU,OAAO,GAAG;EACtB,SAAS,KAAK;GACZ,QAAQ,KAAK,sCAAsC,IAAI,eAAe,GAAG;GACzE,MAAM;GACN,OAAO;EACT;EAEA,MAAM,SAAS,OAAO,UAAU,OAAO;EACvC,IAAI,OAAO,SAAS,OAAO,OAAO;EAClC,MAAM;EACN,OAAO;CACT;CAEA,MAAM,WAAW,UAAmB;EAClC,IAAI;EACJ,IAAI;GACF,MAAM,OAAO,KAAK;EACpB,SAAS,KAAK;GACZ,QAAQ,KAAK,sCAAsC,IAAI,oBAAoB,GAAG;GAC9E;EACF;EACA,IAAI;GACF,QAAQ,QAAQ,KAAK,GAAG;EAC1B,SAAS,KAAK;GACZ,QAAQ,KAAK,qCAAqC,IAAI,IAAI,GAAG;EAC/D;CACF;CAEA,OAAO;EAAE;EAAS;EAAS;EAAO;CAAkB;AACtD;;;AC9FA,MAAM,kCAAkC,CAItC,wBAGA,wCACF;AAEA,MAAa,iCAAiC,YAA8B;CAC1E,IAAI,QAAQ,WAAW,OAAO,OAAO;CACrC,MAAM,EAAE,aAAa,IAAI,IAAI,QAAQ,GAAG;CACxC,OAAO,gCAAgC,MAAM,YAAY,QAAQ,KAAK,QAAQ,CAAC;AACjF;AAEA,MAAM,kCAEF,eACA,oBAED,SACD,OAAO,YAAY;CACjB,MAAM,WAAW,MAAM,KAAK,OAAO;CAGnC,IAAI,cAAc,QAAQ,OAAO,GAAG,MAAM,eAAe;CACzD,OAAO;AACT;;;;;AAMF,MAAa,qBAAqB,EAChC,cACA,aAII;CACJ,MAAM,QAAQC,cAAAA,YAAYC,gBAAAA,cAAc,EAAE,WAAW,aAAa,CAAC,CAAC;CACpE,MAAM,UAAU,SAAS,YAAY,MAAM,IAAIA,gBAAAA,cAAc,EAAE,WAAW,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC;CAC5F,MAAM,aAAa,+BAA+B,+BAA+B,OAAO;CACxF,OAAO;EAAE;EAAO,kBAAkB,MAAM,IAAI;EAAG,WAAW,MAAM;EAAW;EAAY;CAAQ;AACjG;;;;;;;ACnDA,MAAa,mBAAmB;CAC9B,cAAc;CACd,kBAAkB;CAClB,sBAAsB;CACtB,gBAAgB;CAChB,mBAAmB;CACnB,gBAAgB;CAChB,WAAW;CACX,UAAU;CACV,wBAAwB;AAC1B;AAIA,MAAM,WAA6C;EAChD,iBAAiB,eAAe;EAChC,iBAAiB,mBAAmB;EACpC,iBAAiB,uBAChB;EACD,iBAAiB,iBAAiB;EAClC,iBAAiB,oBAChB;EACD,iBAAiB,iBAChB;EACD,iBAAiB,YAAY;EAC7B,iBAAiB,WAAW;EAC5B,iBAAiB,yBAChB;AACJ;AAEA,IAAa,eAAb,MAAa,qBAAqB,MAAM;CACtC;CAEA,YAAY,MAAwB;EAClC,MAAM,SAAS,KAAK;EACpB,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,OAAO,eAAe,MAAM,aAAa,SAAS;CACpD;AACF;AAEA,MAAa,kBAAkB,UAC7B,iBAAiB;;AAGnB,SAAgBC,SAAU,OAA6B,MAA4C;CACjG,IAAI,SAAS,MAAM,MAAM,IAAI,aAAa,IAAI;AAChD;;;AC9CA,MAAM,wBAAwB;AAE9B,MAAM,0BAA0B;CAC9BC,0BAAAA,kBAAkB;CAClBA,0BAAAA,kBAAkB;CAClB;CACA;CACA;AACF;AAEA,MAAM,+CAA+B,IAAI,IAAI;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,WAAW;AAEjB,MAAM,kBAAkB,WAA2B;CACjD,MAAM,MAAM,IAAI,IAAI,MAAM;CAC1B,IAAI,IAAI,UAAU,IAAI,WAAW;CACjC,IAAI,IAAI,UAAU,IAAI,WAAW;CAEjC,IAAI,aAAa,SAAS,QAAQ,QAAQ;EACxC,IAAI,6BAA6B,IAAI,IAAI,YAAY,CAAC,GACpD,IAAI,aAAa,IAAI,KAAK,QAAQ;CAEtC,CAAC;CACD,OAAO,IAAI,SAAS;AACtB;AAQA,MAAM,uBAAuB,YAA6B;CACxD,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,qBAAqB,KAAKC,qBAAAA,aAAa;CACjF,QAAQ,QAAQ,IAAI,uBAAuB,aAAa;CACxD,OAAO;AACT;AAEA,MAAM,sBAAsB,SAAkB,aAA+C;CAC3F,MAAM,cAAc,IAAI,IACtB,CAAC,GAAG,yBAAyB,GAAG,QAAQ,CAAC,CAAC,KAAK,MAAM,EAAE,YAAY,CAAC,CACtE;CAEA,MAAM,SAAiC,CAAC;CACxC,QAAQ,SAAS,OAAO,SAAS;EAC/B,OAAO,QAAQ,YAAY,IAAI,KAAK,YAAY,CAAC,IAAI,WAAW;CAClE,CAAC;CACD,OAAO;AACT;AA2CA,MAAM,iBAAiB,SAAkB,qBAA2C;CAClF,KAAK,eAAe,QAAQ,GAAG;CAC/B,SAAS,mBAAmB,QAAQ,SAAS,eAAe;AAC9D;AAEA,MAAM,kBAAkB,UAAoB,qBAA4C;CACtF,QAAQ,SAAS;CACjB,YAAY,SAAS;CACrB,SAAS,mBAAmB,SAAS,SAAS,eAAe;AAC/D;AAMA,MAAM,kBAAkB,OAAiB,oBACvC,IAAIC,0BAAAA,SAAS;CACX,SAAS,IAAI,QAAQ,eAAe,MAAM,QAAQ,GAAG,GAAG;EACtD,QAAQ,MAAM,QAAQ;EACtB,SAAS,mBAAmB,MAAM,QAAQ,SAAS,eAAe;CACpE,CAAC;CACD,UAAU,IAAI,SAAS,MAAM;EAC3B,QAAQ,MAAM,SAAS;EACvB,YAAY,MAAM,SAAS;EAC3B,SAAS,mBAAmB,MAAM,SAAS,SAAS,eAAe;CACrE,CAAC;CACD,MAAM,MAAM;AACd,CAAC;AAEH,MAAM,aAAa,OAAyB,QAAqB;CAC/D,MAAM,QAAQ;EAAC,IAAI,MAAM,YAAY,EAAE;EAAI,GAAG,KAAK,MAAM,IAAI,UAAU,EAAE;EAAK,IAAI;CAAM;CACxF,MAAM,KAAK,IAAI,QAAQ,GAAG;CAC1B,IAAI,cAAc,KAAK,MAAM,KAAK,OAAO,IAAI,SAAS,MAAM,CAAC;CAC7D,OAAO,MAAM,KAAK,GAAG;AACvB;AAEA,MAAM,oBAAoB,QAAiB,QAAkB,iBAAmC;CAC9F,OAAO;EACL,OAAO,QAAQ;GACb,IAAI,UAAU,OAAO;GACrB,IAAI;IACF,IAAI,QAAQ,MAAM;KAChB,OAAO,KAAK,GAAG;KACf;IACF;IAEA,QAAQ,KAAK,UAAU,QAAQ,GAAG,CAAC;GACrC,QAAQ,CAER;EACF;EACA,QAAQ,QAAQ;GACd,IAAI;IACF,IAAI,QAAQ,OAAO;KACjB,OAAO,MAAM,GAAG;KAChB;IACF;IAEA,QAAQ,MAAM,UAAU,SAAS,GAAG,CAAC;GACvC,QAAQ,CAER;EACF;CACF;AACF;AAEA,MAAa,2BAA2B,UAA0B,CAAC,MAAoB;CACrF,MAAM,aAAa,iBAAiB,QAAQ,QAAQ,QAAQ,KAAK;CACjE,MAAM,gBAAgB,QAAQ,iBAAiB,CAAC;CAEhD,QAAQ,SAAS,OAAO,iBAAiB;EACvC,MAAM,gBAAgB,oBAAoB,aAAa,OAAO;EAC9D,MAAM,QAAQ,YAAY,IAAI;EAC9B,MAAM,SAAS,aAAa,QAAQ,OAAO,YAAY;EACvD,MAAM,aAAa,cAAc,aAAa,SAAS,aAAa;EAEpE,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,YAAY;GACtC,WAAW,KAAK;IACd;IACA;IACA,YAAY,YAAY,IAAI,IAAI;IAChC,SAAS;IACT,UAAU,eAAe,OAAO,UAAU,aAAa;GACzD,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,IAAI,iBAAiB,OACnB,WAAW,MAAM;IACf;IACA;IACA,YAAY,YAAY,IAAI,IAAI;IAChC,SAAS;IACT,OAAOC,0BAAAA,WAAW,KAAK,IAAI,eAAe,OAAO,aAAa,IAAI;GACpE,CAAC;GAEH,MAAM;EACR;CACF;AACF;;;AC9MA,MAAM,sBAAsB;AAC5B,MAAM,6BAAuC;CAC3CC,0BAAAA,WAAW;CACXA,0BAAAA,WAAW;CACXA,0BAAAA,WAAW;CACXA,0BAAAA,WAAW;AACb;AACA,MAAM,yBAAyB;AAQ/B,MAAM,sBAAsB,UAC1B,iBAAiBC,0BAAAA,YAAY,2BAA2B,SAAS,MAAM,SAAS,MAAM;AAExF,MAAa,yBAAyB,YAAyC;CAC7E,MAAM,EACJ,aAAa,qBACb,gBAAgB,wBAChB,cAAc,uBACZ,WAAW,CAAC;CAEhB,IAAI,CAAC,OAAO,UAAU,UAAU,KAAK,aAAa,GAChD,MAAM,IAAI,WAAW,2CAA2C;CAElE,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,gBAAgB,GACrD,MAAM,IAAI,WAAW,oDAAoD;CAG3E,QAAQ,SAAS,OAAO,YAAY;EAClC,KAAK,IAAI,UAAU,GAAG,WAAW,YAAY,WAC3C,IAAI;GACF,OAAO,MAAM,KAAK;IAAE,GAAG;IAAS,SAAS,QAAQ,QAAQ,MAAM;GAAE,CAAC;EACpE,SAAS,OAAO;GACd,IAAI,YAAY,cAAc,CAAC,YAAY,OAAO,OAAO,GACvD,MAAM;GAGR,MAAM,UAAU,gBAAgB,MAAO,KAAK,IAAI,GAAG,OAAO;GAC1D,MAAMC,kBAAAA,MAAM,SAAS,QAAQ,QAAQ,UAAU,KAAA,CAAS;EAC1D;EAGF,MAAM,IAAI,MAAM,aAAa;CAC/B;AACF;;;ACrDA,MAAa,qBAAqB,aAChC,OAAO,aAAa,YACpB,aAAa,UACb,aAAa,iBACb,aAAa,cACb,aAAa;;;;AAKf,MAAa,qBAAwD,EACnE,aAGO;CACP,MAAM,eAAe,OAAiB,CAAC,MACrC,IAAI,YAAY,CAAC,GAAG;EAElB,MAAM,SAAS,SAAS;GAEtB,IAAI,kBAAkB,IAAI,GAAG,OAAO,KAAA;GACpC,OAAO,YAAY,CAAC,GAAG,MAAM,IAAI,CAAC;EACpC;EAEA,QAAQ,SAAS,WAAW,SAAS,OAAO,MAAM,IAAI;CACxD,CAAC;CAEH,OAAO,YAAY;AACrB;;;ACoBA,MAAa,qCAEV,EACC,mBACA,oBAC6D;CAC7D,MAAM,SAAS,WAAmB,eAChC,kBAAkB,EAChB,SAAS,MAAM,SAAS;EACtB,gBAAgB;GACd;GACA;GACA;GACA;EACF,CAAC;CACH,EACF,CAAC;CAEH,MAAM,UAAiD,CAAC;CAExD,MAAM,iBAAiB,EACrB,WACA,UACA,iBACyC;EACzC,MAAM,iBAAiB,kBAAkB,SAAS;EAClD,OAAO,iBAAiB,SAAS,cAAc,IAAI,MAAM,WAAW,UAAU;CAChF;CAGA,MAAM,WAAyD;EAC7D,MAAM,WAAW;GACf,QAAQ,KAAK,MAAM;GACnB,OAAO;EACT;EACA,aAAa;GACX,MAAM,YAAqC,CAAC;GAC5C,MAAM,aAAsC,CAAC;GAE7C,QAAQ,SAAS,WAAW;IAC1B,UAAU,OAAO,cAAc,cAAc,MAAM;IACnD,WAAW,KAAK;KACd,YAAY,OAAO;KACnB,WAAW,OAAO;KAClB,aAAa,CAAC,CAAC,kBAAkB,OAAO,SAAS;IACnD,CAAC;GACH,CAAC;GAKD,OAAO;IACL,QAAQ;IACR,MAAM;GACR;EACF;CACF;CAEA,OAAO;AACT;;;AC/EF,MAAa,aAAa,UACxB,IAAI,MAAM,CAAC,GAAiB,EAC1B,IAAI,SAAS,UAAU;CACrB,IAAI,kBAAkB,QAAQ,GAAG,OAAO,KAAA;CAExC,IAAI,aAAa,QAAQ;EACvB,MAAM,aAAa,MAAM,cAAc;EACvC,SAAO,YAAY,iBAAiB,YAAY;EAChD,OAAO;CACT;CAEA,IAAI,aAAa,cAAc;EAC7B,MAAM,aAAa,MAAM,oBAAoB;EAC7C,SAAO,YAAY,iBAAiB,iBAAiB;EACrD,OAAO;CACT;CAEA,MAAM,UAAU,MAAM,kBAAkB;CACxC,SAAO,SAAS,iBAAiB,QAAQ;CAEzC,OAAO,QAAQ;AACjB,EACF,CAAC;;;ACZH,MAAa,uBAAuB,gBAAyC;CAC3E,QAAQ,QAA0B,WAA2B,CAAC,MAAsB;EAClF,IAAI,MAAM,QAAQ,WAAW,GAAG,OAAO,CAAC,GAAG,UAAU,GAAG,WAAW;EAEnE,MAAM,MAAM,aAAa,OAAO,CAAC;EACjC,MAAM,WAAW,cAAc,WAAW,CAAC;EAC3C,OAAO;GAAC,GAAG;GAAU,GAAG;GAAK,GAAG;EAAQ;CAC1C;AACF;;;ACtBA,MAAM,UAAiB;CAAE,QAAQ;CAAa,SAAS;AAAK;AAE5D,MAAM,SAAS,YAAkC;CAAE,GAAG;CAAQ,UAAU,KAAK,IAAI;AAAE;AAEnF,MAAaC,kBAAgB,UAAiB,YAAY;CACxD,MAAM,QAAQC,cAAAA,YAAmB,OAAO;CACxC,IAAI,kBAAkB;CACtB,IAAI,QAAQ;CAEZ,MAAM,cAAc,YAAoB;EAEtC,IAAI,MAAM,IAAI,CAAC,CAAC,WAAW,aACzB,MAAM,IAAI,aAAa,iBAAiB,oBAAoB;EAC9D,MAAM,IAAI;GAAE,QAAQ;GAAa;EAAQ,CAAC;CAC5C;CAEA,MAAM,gBAAgB,WAAqB;EACzC,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa,MAAM,IAAI,aAAa,iBAAiB,oBAAoB;EAG9F,IAAI,CAAC,MAAM,SAAS,MAAM,IAAI,aAAa,iBAAiB,YAAY;EACxE,kBAAkB;EAClB,SAAS;EACT,MAAM,IAAI;GAAE,QAAQ;GAAiB,SAAS,MAAM;GAAS,YAAY,MAAM,MAAM;EAAE,CAAC;CAC1F;CAEA,MAAM,gBAAgB,cAAsB;EAC1C,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;EAC1F,MAAM,IAAI;GACR,QAAQ;GACR,SAAS,MAAM;GACf,YAAY,MAAM;GAClB;EACF,CAAC;CACH;;;;;;;CAQA,MAAM,uBAAuB;EAC3B,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,UAAU;EAC/B,MAAM,IAAI;GAAE,QAAQ;GAAiB,SAAS,MAAM;GAAS,YAAY,MAAM;EAAW,CAAC;CAC7F;;CAGA,MAAM,cAAc;EAClB,SAAS;EACT,MAAM,IAAI;GAAE,QAAQ;GAAa,SAAS,MAAM,IAAI,CAAC,CAAC;EAAQ,CAAC;CACjE;;CAGA,MAAM,gBAAgB,WAAqB;EACzC,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa;EAClC,MAAM,IAAI;GAAE,GAAG;GAAO,YAAY,MAAM,MAAM;EAAE,CAAC;CACnD;;;;;CAMA,MAAM,oBAAoB;EACxB,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa;EAClC,MAAM,WAAW,KAAK,IAAI,IAAI,MAAM,WAAW,YAAY;EAC3D,MAAM,IAAI;GAAE,GAAG;GAAO,YAAY;IAAE,GAAG,MAAM;IAAY;GAAS;EAAE,CAAC;CACvE;;;;;CAMA,MAAM,0BAAsC;EAC1C,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,WAAW,aAAa,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;EAC1F,OAAO,MAAM;CACf;CAEA,MAAM,mBAAkC,MAAM,IAAI,CAAC,CAAC;;;;;;;;;CAUpD,MAAM,iBAAyB;;;;;;;;;CAU/B,MAAM,sBAA+B;EACnC,IAAI,iBAAiB,OAAO;EAC5B,kBAAkB;EAClB,OAAO;CACT;CAEA,MAAM,cAAqB,MAAM,IAAI;CASrC,OAAO;EACL,OAAO;GANP,KAAK,MAAM;GACX,WAAW,MAAM;GACjB,SAAS,MAAM;EAID;EACd;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACrJA,MAAa,uBAAuB,EAAE,kBAA2B;CAC/D,MAAM,gBAAgB,YAAY,MAAM,WAAW,OAAO,SAAS;CACnE,OAAO,eAAe,0CAA0C;CAEhE,MAAM,WAAW,aAA2C;EAC1D,IAAI,YAAY,QAAQ,aAAa,WAAW,OAAO;EACvD,OAAO,OAAO,QAAQ,MAAM,cAAc,KAAK,YAAY;CAC7D;CAEA,OAAO;EACL,IAAI,cAAc;EAClB,MAAM,cAAc;EACpB;EACA,QAAQ,aAA+B,QAAQ,QAAQ,MAAM;EAC7D,YAAY,aAA+B,QAAQ,QAAQ,MAAM;CACnE;AACF;;;ACrBA,MAAM,wBAAqC,EAGzC,kBAAkB,QAAQ,GAAG,IAAI,MACnC;AAOA,MAAa,eAAe,EAAE,WAAW,wBAAiC;CACxE,MAAM,EAAE,UAAU,YAAY,UAAU,GAAG,aAAa;CAExD,MAAM,aAAa,IAAI,IACrB,SAAS,KAAK,YAAY;EACxB,MAAM,cAAc,oBAAoB,QAAQ,GAAG,GAAG,QAAQ,GAAG;EACjE,MAAM,eAAe,sBAAsB,QAAQ,GAAG,GAAG,QAAQ,GAAG;EACpE,MAAM,MAAM,eAAe,gBAAgB,QAAQ;EACnD,OAAO,CAAC,QAAQ,IAAI,GAAG;CACzB,CAAC,CACH;CAEA,MAAM,eAAe,IAAI,IAAI,WAAW,KAAK,cAAc,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC;CACrF,MAAM,aAAa,IAAI,IAAI,QAAQ;CAEnC,MAAM,cAAc,GAAG,YAAsB;EAC3C,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,WAAW,IAAI,CAAC,CAAC;CAC/C;CAEA,MAAM,gBAAgB,GAAG,gBAA0B;EACjD,IAAI,YAAY,WAAW,GAAG,OAAO;EACrC,OAAO,YAAY,OAAO,MAAM,aAAa,IAAI,CAAC,CAAC;CACrD;CAEA,MAAM,gBAAgB,gBAAwB,aAAa,IAAI,WAAW,KAAK;CAE/E,MAAM,cAAc,cAAyB,WAAW,IAAI,SAAS;CAErE,MAAM,iBAAiB,cAAyB,WAAW,IAAI,SAAS,KAAK;CAE7E,OAAO;EACL,GAAG;EACH;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACvDA,MAAM,yBAAyB;;AAgB/B,MAAa,4BACX,QACA,WACyB;CACzB,MAAM,cAAc,IAAI,IAAI,OAAO,KAAK,eAAe,WAAW,IAAI,CAAC;CAEvE,OAAO,CAAC,GAAG,QAAQ,GAAG,OAAO,QAAQ,eAAe,CAAC,YAAY,IAAI,WAAW,IAAI,CAAC,CAAC;AACxF;;AAGA,MAAa,uBACX,QACA,WACoB;CACpB,MAAM,eAAe,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,MAAM,MAAM,MAAM,KAAK,CAAC,CAAC;CAC7E,MAAM,cAAc,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC;CAE7D,OAAO,CACL,GAAG,OAAO,KAAK,UACb,aAAa,IAAI,MAAM,IAAI,IAAI;EAAE,GAAG;EAAO,OAAO,aAAa,IAAI,MAAM,IAAI;CAAE,IAAI,KACrF,GACA,GAAG,OAAO,QAAQ,UAAU,CAAC,YAAY,IAAI,MAAM,IAAI,CAAC,CAC1D;AACF;;;;;;AAOA,MAAa,sBAAsB,EAAE,oBAA6B;CAChE,MAAM,UAAU,cAAc;CAC9B,MAAM,OAAO,cAAc;CAE3B,MAAM,gBAAgB,OACpB,UACA,aACA,aACG;EACH,MAAM,SAAS,MAAM,QAAQ,iBAAiB;GAC5C,aAAa;GACb;GACA;EACF,CAAC;EAED,MAAM,MAAM,OAAO,KAAK,MAAM,cAAc,UAAU,OAAO,WAAW,KAAK,OAAO,KAAK;EAEzF,MAAM,iBAAiB,OAAO,eAAe;EAC7C,MAAM,YAAY,KAAK,eAAe;EAGtC,OAAO;GACL,aAAc,MAAM,QAAQ,cAAc,IAAI,iBAAiB,CAAC;GAChE,QAAS,MAAM,QAAQ,SAAS,IAAI,YAAY,CAAC;EACnD;CACF;CAEA,MAAM,kBAAkB,OACtB,aACA,QACA,aAC0B;EAC1B,MAAM,SAAS,MAAM,QAAQ,oBAAoB;GAC/C;GACA,aAAa;GACb,MAAM;GACN,eAAe,EAAE,WAAW,YAAY;EAC1C,CAAC;EAED,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,uBAAuB;IAC5C,UAAU,OAAO,QAAQ;IACzB,aAAa;IACb,iBAAiB,OAAO;IACxB,MAAM;IACN,eAAe,EAAE,OAAO;GAC1B,CAAC;GAED,OAAO;IAAE,aAAa,OAAO;IAAI,mBAAmB,IAAI;GAAG;EAC7D,SAAS,OAAO;GAEd,MAAM,QACH,oBAAoB;IACnB;IACA,aAAa;IACb,UAAU,OAAO;GACnB,CAAC,CAAC,CACD,OAAO,iBAA0B;IAEhC,IAAI,iBAAiB,SAAS,MAAM,UAAU,KAAA,GAC5C,MAAM,QAAQ;GAElB,CAAC;GACH,MAAM;EACR;CACF;CAEA,OAAO;;EAEL,MAAM,OAAO,EACX,aACA,mBACA,WAAW,gBAKgB;GAC3B,MAAM,EAAE,aAAa,WAAW,MAAM,cAAc,aAAa,mBAAmB,QAAQ;GAE5F,OAAO,gBAAgB,aAAa,QAAQ,QAAQ;EACtD;;EAGA,OAAO,OAAO,EACZ,mBACA,gBACA,mBACA,gBACA,WAAW,gBAOgB;GAC3B,MAAM,CAAC,QAAQ,UAAU,MAAM,QAAQ,IAAI,CACzC,cAAc,mBAAmB,gBAAgB,QAAQ,GACzD,cAAc,mBAAmB,gBAAgB,QAAQ,CAC3D,CAAC;GAED,OAAO,gBACL,yBAAyB,OAAO,aAAa,OAAO,WAAW,GAC/D,oBAAoB,OAAO,QAAQ,OAAO,MAAM,GAChD,QACF;EACF;CACF;AACF;;;ACxHA,MAAa,wBAAwB,EACnC,SACA,MACA,mBACA,eACA,4BAEA,4BAA0D,CAAC,CAAC;CAC1D;CACA,gBAAgB,EAAE,WAAW,MAAM,iBAAiB;EAClD,MAAM,IAAIC,gBAAAA,wBAAwB,WAAW,MAAM,UAAU;CAC/D;AACF,CAAC,CAAC,CACC,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,oBAAAA,kBAAkB;EAChB,SAAS;EACT,aAAa,cAAc,SAAS,CAAC,qBAAqB,CAAC;EAC3D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,oBAAAA,wBAAwB;EACtB,SAAS;EACT,aAAa,cAAc,eAAe,CAAC,qBAAqB,CAAC;EACjE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CAOH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,mBAAAA,iBAAiB;EACf,SAAS,GAAG,eAAe;EAC3B,aAAa,cAAc,QAAQ,CAAC,qBAAqB,CAAC;EAC1D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,yBAAAA,uBAAuB;EACrB,SAAS;EACT,aAAa,cAAc,YAAY;CACzC,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,qBAAAA,mBAAmB;EACjB,SAAS;EACT,aAAa,cAAc,UAAU,CAAC,qBAAqB,CAAC;EAC5D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,oBAAAA,wBAAwB;EACtB,SAAS;EACT,aAAa,cAAc,eAAe,CAAC,qBAAqB,CAAC;EACjE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,wBAAAA,sBAAsB;EACpB,SAAS;EACT,aAAa,cAAc,aAAa,CAAC,qBAAqB,CAAC;EAC/D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,qBAAAA,yBAAyB;EACvB,SAAS;EACT,aAAa,cAAc,gBAAgB,CAAC,qBAAqB,CAAC;EAClE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,cAAAA,kBAAkB;EAChB,SAAS;EACT,aAAa,cAAc,SAAS,CAAC,qBAAqB,CAAC;EAC3D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,mBAAAA,iBAAiB;EACf,eAAe;EACf,SAAS;EACT,aAAa,cAAc,QAAQ,CAAC,qBAAqB,CAAC;EAC1D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,iBAAAA,eAAe;EACb,SAAS;EACT,aAAa,cAAc,MAAM,CAAC,qBAAqB,CAAC;EACxD;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CAIH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,yBAAAA,uBAAuB;EACrB,SAAS,GAAG,eAAe;EAC3B,aAAa,cAAc,cAAc,CAAC,qBAAqB,CAAC;EAChE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,eAAAA,mBAAmB;EACjB,SAAS;EACT,aAAa,cAAc,UAAU,CAAC,qBAAqB,CAAC;EAC5D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,iBAAAA,qBAAqB;EACnB,SAAS;EACT,aAAa,cAAc,YAAY,CAAC,qBAAqB,CAAC;EAC9D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,6BAAAA,iCAAiC;EAC/B,SAAS;EACT,aAAa,cAAc,wBAAwB,CAAC,qBAAqB,CAAC;EAC1E,mBAAmB,cAAc,sBAAsB;EACvD;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,cAAAA,kBAAkB;EAChB,SAAS;EACT,aAAa,cAAc,SAAS,CAAC,qBAAqB,CAAC;EAC3D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,wBAAAA,sBAAsB;EACpB,SAAS;EACT,aAAa,cAAc,aAAa,CAAC,qBAAqB,CAAC;EAC/D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,qBAAAA,mBAAmB;EACjB,SAAS;EACT,aAAa,cAAc,UAAU,CAAC,qBAAqB,CAAC;EAC5D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,4BAAAA,0BAA0B;EACxB,SAAS;EACT,aAAa,cAAc,iBAAiB,CAAC,qBAAqB,CAAC;EACnE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,sBAAAA,oBAAoB;EAClB,SAAS;EACT,aAAa,cAAc,WAAW,CAAC,qBAAqB,CAAC;EAC7D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,kBAAAA,sBAAsB;EACpB,SAAS;EACT,aAAa,cAAc,aAAa,CAAC,qBAAqB,CAAC;EAC/D;CACF,CAAC;AACL,CAAC,CAAC,CACD,MAAM;;;;;;;;;;;ACnPX,MAAaC,yBAAuB,OAAO,EACzC,SACA,WACA,gBACA,eACA,wBAOI;CAGJ,MAAM,OAAqB;EAAE,MAAM;EAAU,OAAO;EAAI;CAAU;CAElE,MAAM,uBAAqC,UAAU,YAAY;EAC/D,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,kBAAkB,YAAY,OAAO,SAAS,CAAC;EAC3E,OAAO,KAAK,OAAO;CACrB;CAEA,MAAM,UAAwB,SAAS,oBAAoB,eAAe,IAAI,CAAC;CAE/E,MAAM,SAASC,gBAAAA,oBAAoB;EAAE;EAAS;EAAM,aAAa,CAAC,MAAM;CAAE,CAAC;CAC3E,MAAM,CAAC,WAAW,WAAW,eAAe,MAAM,QAAQ,IAAI;EAC5D,OAAO,aAAa,EAAE,SAAS,mBAAmB,CAAC;EACnD,OAAO,OAAO,OAAO;EACrB,OAAO,SAAS,eAAe;CACjC,CAAC;CAED,MAAM,QAAQ,YAAY;EAAE;EAAW;CAAkB,CAAC;CAC1D,MAAM,gBAAgB,oBAAoB,EAAE,YAAY,CAAC;CACzD,MAAM,cAAc,kBAAkB;EACpC,cAAc;EACd,cAAc,OAAO,OAAO,OAAO;CACrC,CAAC;CACD,MAAM,oBAAoB,mBAAmB;EAC3C,QAAQ,YAAY;EACpB,OAAOC,qBAAAA;EACP,YAAY,aAAa;GACvB,uBAAuB,CAAC,QAAQ,WAAWC,kBAAAA,eAAe,yBAAyB;GACnF,2BAA2B,QAAQ,WAAWA,kBAAAA,eAAe,yBAAyB;GACtF,oBAAoB,QAAQ,WAAWA,kBAAAA,eAAe,eAAe;EACvE;CACF,CAAC;CAED,MAAM,UAAyB;EAC7B,SAASC,0BAAAA,iBAAiB,OAAO;EACjC;EACA;EACA,IAAI,UAAU;GACZ,OAAO,YAAY,WAAW;EAChC;EACA,IAAI,KAAK;GACP,OAAO,kBAAkB,IAAI;EAC/B;CACF;CAGA,MAAM,UAAUH,gBAAAA,oBAAoB;EAClC;EACA;EACA,aAAa,cAAc,WAAW,CAAC,QAAQ,YAAY,UAAU,CAAC;CACxE,CAAC;CAED,MAAM,EAAE,QAAQ,UAAU,MAAM,gBAAgB,qBAAqB;EACnE;EACA;EACA,mBAAmB,QAAQ,MAAM;EACjC;EACA,uBAAuB;CACzB,CAAC;CAED,MAAM,MAAM;EACV,eAAeI,uBAAAA,uBAAuB;GACpC,eAAe;GACf,kBAAkB,SAAS;GAC3B;EACF,CAAC;EACD,KAAKC,YAAAA,aAAa,EAAE,iBAAiB,SAAS,UAAU,CAAC;EACzD,eAAeC,sBAAAA,uBAAuB,EAAE,iBAAiB,SAAS,UAAU,CAAC;EAC7E,SAASC,0BAAAA,iBAAiB,EAAE,eAAe,QAAQ,CAAC;EACpD,OAAOC,wBAAAA,eAAe;GAAE,aAAa,SAAS;GAAO,kBAAkB,SAAS;EAAW,CAAC;EAC5F,WAAW,mBAAmB,EAAE,eAAe,QAAQ,CAAC;CAC1D;CAEA,OAAO;EAAE;EAAS;EAAa;EAAS,GAAG;EAAU;CAAI;AAC3D;;;;;;;;;;;;;;;ACnGA,MAAa,8BAA8B,eAA+C;CACxF,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,eAAe,EAAE,cAAc,MAAM,CAAC;EAErE,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAGvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,WAAW,eAAe,UAAU,OAAO;EAEvE,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAACC,mBAAAA,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,eAAe,EAAE,cAAc,KAAK,CAAC;GAExE,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAID,0BAAAA,WAAW,eAAe,UAAU,WAAW;GAExE,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IAEnB,IAAIC,mBAAAA,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;ACxCA,MAAM,cAAc;AAEpB,MAAM,yBAAyBC,IAAE,OAAO;CACtC,SAASA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAWA,IAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,cAAcA,IAAE,OAAO,CAAC,CAAC,SAAS;AACpC,CAAC;AAID,MAAM,0BAA4C;CAChD,SAAS;CACT,WAAW;CACX,cAAc;AAChB;AAEA,MAAa,0BAA0B,YACrC,gBAAkC;CAChC;CACA,KAAK;CACL,QAAQ;CACR,cAAc;AAChB,CAAC;;;ACRH,MAAa,iBAAiB,UAA0B,CAAC,MAAM;CAC7D,MAAM,YAAY,uBAAuB,QAAQ,OAAO;CACxD,MAAM,SAASC,eAAa;CAC5B,MAAM,gBAAgB,oBAAoB,QAAQ,WAAW;CAI7D,MAAM,kBAAkB,sBAAsB,EAC5C,cAAc,UACZ,iBAAiBC,0BAAAA,YAAY,MAAM,SAAS,WAAWC,0BAAAA,WAAW,oBACtE,CAAC;CAKD,MAAM,iBAAiB,mBAAmB;EACxC,QAAQ,OAAO;EACf,YAAY,UAAU,MAAM;EAC5B,QAAQ,YACN,UACIC,mBAAAA,iBAAiB;GAAE;GAAS,aAAa,cAAc,QAAQ,CAAC,eAAe,CAAC;EAAE,CAAC,IACnF;CACR,CAAC;CAED,MAAM,UAAU,YAAY;EAC1B,MAAM,SAAS,eAAe,IAAI;EAClC,SAAO,QAAQ,iBAAiB,QAAQ;EAKxC,MAAM,QAAQ,OAAO,SAAS;EAC9B,MAAM,YAAY,MAAM,OAAO,MAC5B,QAAQ,OAAO,kBAAkB,CAAC,CAAC,YAAY,CAAC,CAChD,OAAO,UAAmB;GAIzB,IAAI,OAAO,SAAS,MAAM,OAAO,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;GACzF,MAAM;EACR,CAAC;EACH,IAAI,OAAO,SAAS,MAAM,OAAO,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;EACzF,OAAO,aAAa,SAAS;EAC7B,OAAO,UAAU;CACnB;CAGA,MAAM,iBAAiB;EACrB,MAAM,QAAQ,OAAO,MAAM,IAAI;EAC/B,IAAI,MAAM,WAAW,aAAa,OAAO;EACzC,MAAM,EAAE,aAAa,UAAU,cAAc,MAAM;EACnD,OAAO;GAAE;GAAa,QAAQ;IAAE;IAAU;GAAU;EAAE;CACxD;;;;;;;;;;CAWA,MAAM,6BAAsE;EAC1E,MAAM,QAAQ,OAAO,MAAM,IAAI;EAC/B,IAAI,MAAM,WAAW,aAAa,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;EAC1F,OAAO;CACT;;;;;;;;;;;CAYA,MAAM,6BAAqC;EACzC,MAAM,QAAQ,qBAAqB;EACnC,IAAI,MAAM,WAAW,UAAU,MAAM,IAAI,aAAa,iBAAiB,QAAQ;EAC/E,OAAO,MAAM;CACf;;;;;;;;;;CAWA,MAAM,gCAAgB,IAAI,IAA2C;CAErE,MAAM,gBAAgB;EACpB,OAAO,MAAM;EAGb,WAAW,eAAe;EAC1B,cAAc,MAAM;EACpB,UAAU,MAAM;CAClB;CAIA,MAAM,yBAAyB;EAC7B,IAAI,OAAO,cAAc,GAAG,QAAQ;CACtC;CAEA,MAAM,aAAaC,mBAAAA,uBAAuB;EAAE;EAAS;EAAU;CAAiB,CAAC;CAIjF,MAAM,gBAAgB,gBAAwB;EAC5C,IAAI,OAAO,SAAS,MAAM,OAAO,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;CAC3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BA,MAAM,8BACJ,UACA,EACE,iBAAiB,MACjB,QAAQ,CAAC,MAC+C,CAAC,MAC1C;EACjB,QAAQ,UAAU,YAAY;GAC5B,MAAM,oBAAoB,aAAa,SAAS,CAAC;GACjD,MAAM,mBAAqC;IACzC,GAAG;IACH,gBAAgB,OAAO,YAAY;KACjC,kBAAkB;KAClB,OAAO,WAAW,eAAe,OAAO;IAC1C;IAEA,eAAe,iBAAiB,WAAW,sBAAsB,CAAC;GACpE;GAIA,MAAM,WAAyB,UAAU,aAAa;IACpD,kBAAkB;IAClB,OAAO,KAAK,QAAQ;GACtB;GACA,MAAM,QAAQ,MAAM,aACjB,KAAK,eAAe,WAAW,GAAG,GACnC,QAAQ,IAAI,CACd;GACA,OAAO,2BAA2B,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO;EACpE;CACF;;;;;;;;CASA,MAAM,gBAAgB,YAKjB;EACH,MAAM,QAAQ,OAAO,SAAS;EAC9B,OAAO;GACL,mBAAmB,aAAa,KAAK;GACrC,sBAAsB,iCAAiC,OAAO,OAAO;EACvE;CACF;CAcA,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,UAAU,MAAM;EAC5B,QAAQ,YACN,UACID,mBAAAA,iBAAiB;GACf;GACA,aAAa,cAAc,QAAQ,CACjC,2BAA2B,OAAO,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAC1E,CAAC;EACH,CAAC,IACD;CACR,CAAC;CAKD,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,UAAW,MAAM,WAAW,cAAc,OAAO,MAAM;EACnE,QAAQ,YACN,UACIE,mBAAAA,uBAAuB;GACrB;GACA,MAAM;IAAE,MAAM;IAAU,OAAO;GAAG;GAClC,aAAa,cAAc,cAAc,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC;EAChF,CAAC,IACD;CACR,CAAC;CAED,MAAM,sBAAsB,wBAAwB;EAClD,QAAQ,OAAO;EAEf,YAAY,UACV,MAAM,WAAW,WAAW;GAAE,SAAS,MAAM;GAAS,WAAW,MAAM;EAAU,IAAI;EAEvF,QAAQ,EAAE,SAAS,gBAAgB;GACjC,OAAOC,uBAAqB;IAC1B;IACA,gBAAgB,aAAa,CAAC,CAAC;IAC/B;IACA;IACA,mBAAmB,QAAQ;GAC7B,CAAC;EACH;CACF,CAAC;CAID,MAAM,aAAa,OAAO,cAA+C;EACvE,MAAM,QAAQ,qBAAqB;EAEnC,MAAM,SAAS,cAAc,IAAI,SAAS;EAC1C,IAAI,QAAQ,OAAO,OAAO;EAa1B,MAAM,EAAE,mBAAmB,yBAAyB,aAAa,EAAE,gBAAgB,MAAM,CAAC;EAE1F,MAAM,QAAQC,kBAAAA,KAAK,YAAY;GAC7B,MAAM,UAAU,MAAMD,uBAAqB;IACzC,SAAS,MAAM;IACf,gBAAgB;IAChB;IACA;IACA,mBAAmB,QAAQ;GAC7B,CAAC;GAGD,kBAAkB;GAClB,OAAO;EACT,CAAC;EACD,cAAc,IAAI,WAAW,KAAK;EAClC,OAAO,MAAM;CACf;CAEA,IAAI,QAAQ,SAAS,OAAO,WAAW,QAAQ,OAAO;CAMtD,OAAO,MAAM,WAAW,UAAU;EAChC,IAAI,MAAM,WAAW,aAAa;EAElC,UAAU,QAAQ;GAChB,SAAS,MAAM;GACf,WAAW,MAAM,WAAW,WAAW,MAAM,YAAY;GACzD,cAAc,MAAM,WAAW;EACjC,CAAC;CACH,CAAC;CAED,MAAM,eAAgC;EACpC,MAAM;EACN,QAAQ,OAAO,MAAM;EACrB,WAAW,WAAW,IAAI,MAAM;EAChC,iBAAiB,WAAW,IAAI,MAAM;EACtC,SAAS,oBAAoB,MAAM,IAAI,CAAC,CAAC;CAC3C;CAEA,MAAM,UAAU;EACd,mBAAmB,UAAU;EAC7B,YAAY,OAAO;EACnB,sBAAsB,oBAAoB,MAAM,IAAI,CAAC,CAAC,UAAU;EAChE,eAAe,WAAqB,OAAO,aAAa,MAAM;EAC9D,YAAY,OAAO;EACnB,iBAAiB,OAAO,cAAsB;GAC5C,OAAO,aAAa,SAAS;GAC7B,MAAM,oBAAoB,QAAQ;EACpC;;;;;;;EAOA,cAAc,OAAO;;;;;;;;;;;;;EAarB;EACA,OAAO;;;;;;EAMP,mBAAmB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmC1B,gBAAgB,OAAO,cAAwD;GAC7E,MAAM,EAAE,sBAAsB,aAAa;GAI3C,IAAI,cAAc,KAAA,GAAW,qBAAqB;QAC7C,qBAAqB;GAE1B,MAAM,cAAc,MAAM,WAAW,eAAe;GAKpD,kBAAkB;GAKlB,MAAM,sBAAsB,aAAa,qBAAqB;GAG9D,SAAO,aAAa,iBAAiB,gBAAgB;GAErD,OAAO;KACJE,0BAAAA,WAAW,gBAAgB,UAAU;KACrCC,0BAAAA,kBAAkB,aAAa,OAAO,mBAAmB;GAC5D;EACF;EAEA,SAAS,YAAoC;GAC3C,MAAM,YAAY,UAAU,QAAQ;GAEpC,IAAI,CAAC,UAAU,gBAAgB,CAAC,UAAU,SAAS,OAAO,EAAE,QAAQ,QAAQ;GAK5E,MAAM,aAAa,OAAO,WAAW;GACrC,IAAI,cAAc,eAAe,UAAU,SAAS;IAClD,UAAU,MAAM;IAChB,OAAO,EAAE,QAAQ,QAAQ;GAC3B;GACA,IAAI,CAAC,YAAY,OAAO,WAAW,UAAU,OAAO;GAGpD,MAAM,SAAS,eAAe,IAAI;GAClC,SAAO,QAAQ,iBAAiB,QAAQ;GAOxC,MAAM,YAAY,OAAO,SAAS;GAClC,IAAI;IACF,MAAM,YAAY,MAAM,OAAO,MAAM,QAAQ,UAAU,YAAY;IACnE,IAAI,OAAO,SAAS,MAAM,WAAW,OAAO,EAAE,QAAQ,QAAQ;IAC9D,OAAO,aAAa,SAAS;IAC7B,IAAI,UAAU,cAAc,MAAM;KAChC,OAAO,aAAa,UAAU,SAAS;KACvC,MAAM,oBAAoB,QAAQ;IACpC;IACA,OAAO,EAAE,QAAQ,WAAW;GAC9B,SAAS,KAAK;IAKZ,IAAI,OAAO,SAAS,MAAM,WAAW,OAAO,EAAE,QAAQ,QAAQ;IAC9D,IAAIC,mBAAAA,eAAe,GAAG,GAAG;KACvB,UAAU,MAAM;KAChB,OAAO,EAAE,QAAQ,UAAU;IAC7B;IACA,MAAM;GACR;EACF;EACA,YAAY,aAAkD;GAE5D,MAAM,oBAAoB,OAAO,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACxE,MAAM,mBAAmB,oBAAoB,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACpF,aAAa;IACX,kBAAkB;IAClB,iBAAiB;GACnB;EACF;EACA;CACF;CAWA,OAAO;EAAE,KATG,UAAU;GACpB,qBAAqB,WAAW,IAAI;GACpC,2BAA2B,WAAW,IAAI;GAC1C,yBAAyB;IACvB,MAAM,QAAQ,oBAAoB,MAAM,IAAI;IAC5C,OAAO,MAAM,UAAU,UAAU,MAAM,QAAQ;GACjD;EACF,CAEW;EAAG;CAAQ;AACxB;;;ACjfA,MAAa,qBAAqB;CAChC,MAAM,QAAQC,cAAAA,YAAmB;EAAE,SAAS;EAAM,WAAW;EAAM,iBAAiB;CAAK,CAAC;CAE1F,MAAM,cAAc,YAAoB;EACtC,MAAM,IAAI;GAAE,GAAG,MAAM,IAAI;GAAG;EAAQ,CAAC;CACvC;CAEA,MAAM,gBAAgB,WAA6D;EACjF,MAAM,UAAU,MAAM,IAAI;EAC1B,MAAM,IAAI;GACR,GAAG;GACH,WAAW,OAAO,aAAa,QAAQ;GACvC,iBAAiB,OAAO,mBAAmB,QAAQ;EACrD,CAAC;CACH;CAKA,MAAM,wBAAwB,MAAM,IAAI,CAAC,CAAC,aAAa;CACvD,MAAM,mBAAmB,cAAsB,MAAM,IAAI;EAAE,GAAG,MAAM,IAAI;EAAG;CAAU,CAAC;;CAGtF,MAAM,cAAqB,MAAM,IAAI;CAErC,OAAO;EAAE;EAAO;EAAY;EAAc;EAAiB;EAAiB;CAAM;AACpF;;;AClBA,MAAM,4BACH,cACA,UACA,YAAY;CACX,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,kBAAkB,mBAAmB,SAAS,CAAC;CAC3E,OAAO,KAAK,OAAO;AACrB;AAUF,MAAa,uBAAuB,OAAO,EACzC,SACA,iBACA,yBACA,eACA,wBACa;CACb,MAAM,OAAqB;EAAE,MAAM;EAAc,OAAO,gBAAgB;CAAE;CAE1E,MAAM,SAAS,yBAAyB,eAAe;CACvD,MAAM,WAAWC,gBAAAA,oBAAoB;EAAE;EAAS;EAAM,aAAa,CAAC,MAAM;CAAE,CAAC;CAC7E,MAAM,CAAC,WAAW,WAAW,eAAe,MAAM,QAAQ,IAAI;EAC5D,SAAS,aAAa,EAAE,SAAS,mBAAmB,CAAC;EACrD,SAAS,OAAO,OAAO;EACvB,SAAS,SAAS,eAAe;CACnC,CAAC;CAED,MAAM,QAAQ,YAAY;EAAE;EAAW;CAAkB,CAAC;CAC1D,MAAM,gBAAgB,oBAAoB,EAAE,YAAY,CAAC;CACzD,MAAM,cAAc,kBAAkB;EACpC,cAAc;EACd,cAAc,SAAS,OAAO,OAAO;CACvC,CAAC;CACD,MAAM,oBAAoB,mBAAmB;EAC3C,QAAQ,YAAY;EACpB,OAAOC,qBAAAA;EACP,YAAY,aAAa;GACvB,uBAAuB,CAAC,QAAQ,WAAWC,kBAAAA,eAAe,yBAAyB;GACnF,2BAA2B,QAAQ,WAAWA,kBAAAA,eAAe,yBAAyB;GACtF,oBAAoB,QAAQ,WAAWA,kBAAAA,eAAe,eAAe;EACvE;CACF,CAAC;CACD,MAAM,UAAyB;EAC7B,SAASC,0BAAAA,iBAAiB,OAAO;EACjC;EACA;EACA,IAAI,UAAU;GACZ,OAAO,YAAY,WAAW;EAChC;EACA,IAAI,KAAK;GACP,OAAO,kBAAkB,IAAI;EAC/B;CACF;CAGA,MAAM,UAAUH,gBAAAA,oBAAoB;EAClC;EACA;EACA,aAAa,cAAc,WAAW,CAAC,YAAY,UAAU,CAAC;EAC9D,gBAAgB;CAClB,CAAC;CAED,MAAM,EAAE,QAAQ,UAAU,MAAM,gBAAgB,qBAAqB;EACnE;EACA;EACA,mBAAmB,QAAQ,MAAM;EACjC;EACA,uBAAuB;CACzB,CAAC;CAED,MAAM,MAAM;EACV,eAAeI,uBAAAA,uBAAuB;GACpC,eAAe;GACf,kBAAkB,SAAS;GAC3B;EACF,CAAC;EACD,KAAKC,YAAAA,aAAa,EAAE,iBAAiB,SAAS,UAAU,CAAC;EACzD,eAAeC,sBAAAA,uBAAuB,EAAE,iBAAiB,SAAS,UAAU,CAAC;EAC7E,SAASC,0BAAAA,iBAAiB,EAAE,eAAe,QAAQ,CAAC;EACpD,OAAOC,wBAAAA,eAAe;GAAE,aAAa,SAAS;GAAO,kBAAkB,SAAS;EAAW,CAAC;EAC5F,WAAW,mBAAmB,EAAE,eAAe,QAAQ,CAAC;CAC1D;CAEA,OAAO;EAAE;EAAS;EAAa;EAAS,GAAG;EAAU;CAAI;AAC3D;;;AChGA,MAAa,uBAAuB,UAA0B,CAAC,MAAM;CACnE,MAAM,SAAS,aAAa;CAC5B,MAAM,gBAAgB,oBAAoB,QAAQ,WAAW;CAM7D,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,UAAU,MAAM;EAC5B,QAAQ,YACN,UAAUC,mBAAAA,iBAAiB;GAAE;GAAS,aAAa,cAAc,QAAQ,CAAC,CAAC;EAAE,CAAC,IAAI;CACtF,CAAC;CAED,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,WAAW;GAAE,SAAS,MAAM;GAAS,OAAO,MAAM;EAAgB;EAC9E,QAAQ,EAAE,SAAS,YACjB,UACIC,mBAAAA,uBAAuB;GACrB;GACA,MAAM,QAAQ;IAAE,MAAM;IAAoB;GAAM,IAAI,EAAE,MAAM,mBAAmB;GAC/E,aAAa,cAAc,cAAc,CAAC,CAAC;EAC7C,CAAC,IACD;CACR,CAAC;CAED,MAAM,QAAQ,wBAAuD;EACnE,QAAQ,OAAO;EACf,YAAY,UAAW,MAAM,aAAa,MAAM,UAAU,MAAM,UAAU;EAC1E,QAAQ,YACN,qBAAqB;GACnB;GACA,iBAAiB,OAAO;GACxB,yBAAyB,OAAO;GAChC;GACA,mBAAmB,QAAQ;EAC7B,CAAC;CACL,CAAC;CAED,IAAI,QAAQ,SAAS,OAAO,WAAW,QAAQ,OAAO;CAEtD,MAAM,cAA+B;EACnC,MAAM,OAAO,OAAO,MAAM;EAC1B,OAAO;GACL,MAAM;GACN,QAAQ;GACR,WAAW,WAAW,IAAI,MAAM;GAChC,iBAAiB,CAAC,CAAC,KAAK;GACxB,SAAS,MAAM,MAAM,IAAI,CAAC,CAAC;EAC7B;CACF;CAEA,MAAM,UAAU;EACd,YAAY,OAAO;EACnB,sBAAsB,MAAM,MAAM,IAAI,CAAC,CAAC,UAAU;EAClD,sBAAsB,cAAsB,OAAO,aAAa,EAAE,UAAU,CAAC;EAC7E,0BAA0B,OAAO,cAAsB;GACrD,OAAO,aAAa,EAAE,UAAU,CAAC;GAEjC,MAAM,MAAM,QAAQ;EACtB;EACA,yBAAyB,oBAA4B,OAAO,aAAa,EAAE,gBAAgB,CAAC;EAC5F,YAAY,aAAkD;GAE5D,MAAM,oBAAoB,OAAO,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACxE,MAAM,mBAAmB,MAAM,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACtE,aAAa;IACX,kBAAkB;IAClB,iBAAiB;GACnB;EACF;EACA;CACF;CAWA,OAAO;EAAE,KATG,UAAU;GACpB,qBAAqB,WAAW,IAAI;GACpC,2BAA2B,WAAW,IAAI;GAC1C,yBAAyB;IACvB,MAAM,QAAQ,MAAM,MAAM,IAAI;IAC9B,OAAO,MAAM,UAAU,UAAU,MAAM,QAAQ;GACjD;EACF,CAEW;EAAG;CAAQ;AACxB"}
+{"version":3,"file":"index.cjs","names":["createStore","createStore","createStore","clamp","finiteOr","isPlainObject","createStore","createProject","assert","createStore","ServiceUnavailableError","createVaultClient","createDataScienceClient","createAppsClient","createEncryptionClient","createEditorClient","createSyncActionsClient","createTelemetryClient","createQueryServiceClient","createQueueClient","createChatClient","createAiClient","createOmnisearchClient","createImportClient","createKaiAgentClient","createBusinessWorkspaceApiClient","createOauthClient","createSchedulerClient","createStreamClient","createNotificationsClient","createBillingClient","createMetastoreClient","KeboolaHttpHeader","createStorageClient","createStorageTable","ProjectFeature","normalizeBaseUrl","createConfigurationSdk","createTagSdk","createSemanticLayerSdk","createKaiMemorySdk","createStorageSdk","createVaultSdk","createAuthClient","createManagementClient","createAuthClient","Result","isUnauthorized","dedupe","createBearerAuthMiddleware","Result","Result","Result","Result","Result","createStore","createEmitter","KeboolaHttpHeader","createStorageClient","createStorageClient","KeboolaHttpHeader","createStorageClient","createStorageTable","ProjectFeature","z","createAuthClient","createManagementClient","normalizeBaseUrl","Result","HttpHeader","KeboolaHttpHeader","lazy","KeboolaHttpHeader","generateUUID","ApiError","isApiError","HttpStatus","ApiError","delay"],"sources":["../src/utils/assert.ts","../src/utils/ensure.ts","../src/utils/async/coalesce.ts","../src/utils/store/derivedStore.ts","../src/utils/store/derivedAsyncStore.ts","../src/utils/async/poll/registry.ts","../src/utils/deepMerge.ts","../src/utils/persistor/adapters.ts","../src/utils/persistor/persistor.ts","../src/keboola/createLiveProject.ts","../src/keboola/errors.ts","../src/serviceClientRegistry/utils.ts","../src/serviceClientRegistry/createServiceClientRegistry.ts","../src/keboola/createApi.ts","../src/keboola/createMiddlewareFor.ts","../src/keboola/legacy/createConfig.ts","../src/domain/defaultBranch.ts","../src/domain/stack.ts","../src/sdks/variables/variablesSdk.ts","../src/keboola/createServiceClients.ts","../src/keboola/legacy/createProjectClients.ts","../src/keboola/legacy/keboola.ts","../src/keboola/bearer/credentials/renewal.ts","../src/keboola/bearer/credentials/credentials.ts","../src/keboola/bearer/state/factories.ts","../src/keboola/bearer/state/auth.ts","../src/keboola/bearer/state/projects.ts","../src/keboola/bearer/state/scope.ts","../src/keboola/bearer/state/stacks.ts","../src/keboola/bearer/state/state.ts","../src/keboola/bearer/context/resource.ts","../src/keboola/bearer/context/project.ts","../src/keboola/bearer/context/stack.ts","../src/keboola/bearer/perProject.ts","../src/keboola/bearer/persistor.ts","../src/keboola/bearer/perStack.ts","../src/keboola/bearer/keboola.ts","../src/middlewares/loggingMiddleware.ts","../src/middlewares/retryMiddleware.ts"],"sourcesContent":["export function assert<T>(value: T | undefined | null, message: string): asserts value is T {\n  if (value == null) {\n    throw new Error(message);\n  }\n}\n","/**\n * Read a key, or build its value and keep it.\n *\n * `Map.prototype.getOrInsertComputed` is this natively — swap to it once it clears the app's\n * `baseline-widely-available` build target. Vite transpiles syntax, not methods, so adopting it\n * early fails in the browser rather than at build.\n */\nexport const ensure = <K, V extends NonNullable<unknown>>(\n  map: Map<K, V>,\n  key: K,\n  build: () => V,\n): V => {\n  const existing = map.get(key);\n  if (existing !== undefined) return existing;\n\n  const created = build();\n  map.set(key, created);\n\n  return created;\n};\n","import type { TaskFn } from './types';\n\n/**\n * Coalesces concurrent triggers onto a single, never-parallel run of `task`.\n *\n * - Triggers fired while a run is busy collapse into one trailing run.\n * - Each trigger resolves with the first run started after it, so it never sees stale state.\n * - The returned promise rejects with whatever `task` throws.\n */\nexport const coalesce = <T>(task: TaskFn<T>): (() => Promise<Awaited<T>>) => {\n  let running = false;\n  const waiters: PromiseWithResolvers<Awaited<T>>[] = [];\n\n  const drain = async () => {\n    running = true;\n    const batch = waiters.splice(0);\n\n    try {\n      const result = await task();\n      batch.forEach((waiter) => waiter.resolve(result));\n    } catch (error) {\n      batch.forEach((waiter) => waiter.reject(error));\n    }\n    // Tail call, so draining mid-run triggers never grows the stack.\n    if (waiters.length > 0) return drain();\n    running = false;\n  };\n\n  return () => {\n    const waiter = Promise.withResolvers<Awaited<T>>();\n    waiters.push(waiter);\n    if (!running) void drain();\n    return waiter.promise;\n  };\n};\n","import { createStore, type ReadableStore } from './store';\n\nconst isPlainObjectOrArray = (value: object): boolean => {\n  if (Array.isArray(value)) return true;\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n};\n\nexport const shallowEqual = <T>(a: T, b: T): boolean => {\n  if (Object.is(a, b)) return true;\n  if (typeof a !== 'object' || a === null || typeof b !== 'object' || b === null) return false;\n  if (!isPlainObjectOrArray(a) || !isPlainObjectOrArray(b)) return false;\n  const aKeys = Object.keys(a) as (keyof T)[];\n  const bKeys = Object.keys(b) as (keyof T)[];\n  return aKeys.length === bKeys.length && aKeys.every((key) => Object.is(a[key], b[key]));\n};\n\ntype DerivedStoreOptions<S, K, T> = {\n  source: ReadableStore<S>;\n  dependsOn: (state: S) => K;\n  build: (key: K) => T;\n  keyEquals?: (a: K, b: K) => boolean;\n};\n\nexport const createDerivedStore = <S, K, T>({\n  source,\n  dependsOn,\n  build,\n  keyEquals = shallowEqual,\n}: DerivedStoreOptions<S, K, T>): ReadableStore<T> => {\n  let key = dependsOn(source.get());\n  const store = createStore(build(key));\n\n  // The source subscription lives for the derived store's lifetime (both normally live as long as\n  // the client). `dispose()` tears down both it and the derived store, so a short-lived derived\n  // store can be cleaned up without leaking the source subscription or taking stale updates.\n  const unsubscribe = source.subscribe((state) => {\n    const next = dependsOn(state);\n    if (keyEquals(key, next)) return;\n    key = next;\n    store.set(build(next));\n  });\n\n  const get = store.get;\n\n  const subscribe = store.subscribe;\n\n  const dispose = () => {\n    unsubscribe();\n    store.dispose();\n  };\n\n  return { get, subscribe, dispose };\n};\n","import { shallowEqual } from './derivedStore';\nimport { createStore, type ReadableStore } from './store';\n\nexport type AsyncState<T> =\n  | { state: 'idle' }\n  | { state: 'pending' }\n  | { state: 'ready'; value: T }\n  | { state: 'errored'; error: unknown };\n\n// The terminal states `settled()` resolves with.\ntype SettledState<T> = Extract<AsyncState<T>, { state: 'ready' } | { state: 'errored' }>;\n\ntype DerivedAsyncStoreOptions<S, K, T> = {\n  source: ReadableStore<S>;\n  dependsOn: (state: S) => K | null;\n  build: (key: K, signal: AbortSignal) => Promise<T>;\n  keyEquals?: (a: K, b: K) => boolean;\n};\n\n// Async sibling of `createDerivedStore`: an `AsyncState<T>` cell for a value that arrives later.\n// - Only the latest run writes state; a re-key or `null` key aborts the previous run's `signal`.\n// - `dependsOn` returning `null` means nothing to build → `idle`.\n// - The source subscription is permanent for the store's lifetime.\n// - `settled()` resolves with the next `ready`/`errored` state (at once if terminal); never rejects.\nexport const createDerivedAsyncStore = <S, K, T>({\n  source,\n  dependsOn,\n  build,\n  keyEquals = shallowEqual,\n}: DerivedAsyncStoreOptions<S, K, T>): {\n  store: ReadableStore<AsyncState<T>>;\n  settled: () => Promise<SettledState<T>>;\n} => {\n  const store = createStore<AsyncState<T>>({ state: 'idle' });\n  let currentKey: K | null = null;\n  let generation = 0;\n  let controller: AbortController | null = null;\n\n  const run = (key: K) => {\n    controller?.abort();\n    controller = new AbortController();\n    const runGeneration = ++generation;\n    store.set({ state: 'pending' });\n    // The reject handler consumes every rejection, including a superseded run's AbortError.\n    build(key, controller.signal).then(\n      (value) => {\n        if (runGeneration === generation) store.set({ state: 'ready', value });\n      },\n      (error) => {\n        if (runGeneration === generation) store.set({ state: 'errored', error });\n      },\n    );\n  };\n\n  const sync = (state: S) => {\n    const next = dependsOn(state);\n    if (next === null) {\n      if (currentKey === null) return;\n      controller?.abort();\n      controller = null;\n      generation += 1;\n      currentKey = null;\n      store.set({ state: 'idle' });\n      return;\n    }\n    if (currentKey !== null && keyEquals(currentKey, next)) return;\n    currentKey = next;\n    run(next);\n  };\n  sync(source.get());\n\n  const unsubscribe = source.subscribe(sync);\n\n  const get = store.get;\n\n  const subscribe = store.subscribe;\n\n  const dispose = () => {\n    controller?.abort();\n    unsubscribe();\n    store.dispose();\n  };\n\n  const readable: ReadableStore<AsyncState<T>> = { get, subscribe, dispose };\n\n  const settled = (): Promise<SettledState<T>> =>\n    new Promise<SettledState<T>>((resolve) => {\n      let unsubscribeSettled = () => {};\n      const check = (state: AsyncState<T>) => {\n        if (state.state === 'ready' || state.state === 'errored') {\n          unsubscribeSettled();\n          resolve(state);\n        }\n      };\n      unsubscribeSettled = store.subscribe(check);\n      check(store.get());\n    });\n\n  return { store: readable, settled };\n};\n","import { createStore } from '../../store';\n\nimport {\n  emitter,\n  type ObservedPoller,\n  type PollerStartFn,\n  type PollerStopFn,\n  type PollSnapshot,\n} from './poll';\nimport { clamp, finiteOr } from './utils';\n\nconst DEFAULT_LIMIT = 50;\n\nexport type PollEntry = {\n  /** Monotonic, so a list has a key that outlives a re-render. */\n  key: number;\n  startedAt: number;\n  snapshot: PollSnapshot;\n  stop: PollerStopFn;\n  start: PollerStartFn<unknown>;\n};\n\nexport type PollRegistry = {\n  list: () => PollEntry[];\n  subscribe: (listener: () => void) => () => void;\n  clear: () => void;\n  stopAll: (reason?: string) => void;\n  collect: () => void;\n};\n\nconst isFinished = ({ snapshot }: PollEntry) =>\n  snapshot.state !== 'idle' && snapshot.state !== 'polling';\n\nexport const createPollRegistry = ({ limit = DEFAULT_LIMIT } = {}): PollRegistry => {\n  const entries = createStore<PollEntry[]>([]);\n  const unsubscribes = new Map<number, () => void>();\n\n  const maxEntries = clamp(finiteOr(limit, DEFAULT_LIMIT), 1);\n  let nextKey = 1;\n\n  const forget = (key: number) => {\n    unsubscribes.get(key)?.();\n    unsubscribes.delete(key);\n  };\n\n  const trim = (list: PollEntry[]) => {\n    let kept = list;\n\n    while (kept.length > maxEntries) {\n      const dropped = kept.findLast(isFinished) ?? kept.at(-1);\n\n      if (!dropped) break;\n\n      forget(dropped.key);\n      kept = kept.filter((entry) => entry !== dropped);\n    }\n\n    return kept;\n  };\n\n  const replace = (key: number, snapshot: PollSnapshot) =>\n    entries.set(entries.get().map((entry) => (entry.key === key ? { ...entry, snapshot } : entry)));\n\n  const register = (poller: ObservedPoller) => {\n    const key = nextKey++;\n    const entry: PollEntry = {\n      key,\n      startedAt: Date.now(),\n      snapshot: poller.debug(),\n      stop: poller.stop,\n      start: poller.start,\n    };\n\n    unsubscribes.set(\n      key,\n      poller.subscribe((snapshot) => replace(key, snapshot)),\n    );\n    entries.set(trim([entry, ...entries.get()]));\n  };\n\n  const collect = () => {\n    emitter.subscribe(register);\n  };\n\n  return {\n    list: entries.get,\n    collect,\n    subscribe: (listener) => entries.subscribe(() => listener()),\n    clear: () => {\n      entries.get().forEach(({ key }) => forget(key));\n      entries.set([]);\n    },\n    stopAll: (reason) => entries.get().forEach((entry) => entry.stop(reason)),\n  };\n};\n","import { isPlainObject } from './isPlainObject';\n\n/**\n * Recursively merge `patch` into `base`. Plain-object values are merged key-by-key; every\n * other value (primitives, arrays, or a type mismatch between the two sides) replaces the\n * base value. `undefined` patch values are skipped, so a partial patch leaves untouched\n * fields alone. Pure — neither argument is mutated; the result preserves `base`'s type.\n */\nexport const deepMerge = <T extends Record<string, unknown>>(\n  base: T,\n  patch: Record<string, unknown>,\n): T => {\n  const out: Record<string, unknown> = { ...base };\n\n  for (const [key, value] of Object.entries(patch)) {\n    if (value === undefined) continue;\n    const current = out[key];\n    out[key] = isPlainObject(current) && isPlainObject(value) ? deepMerge(current, value) : value;\n  }\n\n  return out as T;\n};\n","// Minimal, synchronous key/value contract — the Web Storage shape (`localStorage`/`sessionStorage`)\n// narrowed to what a persistor needs. Framework- and environment-agnostic.\nexport type StorageAdapter = {\n  getItem: (key: string) => string | null;\n  setItem: (key: string, value: string) => void;\n  removeItem: (key: string) => void;\n};\n\n// Persist nowhere: reads always miss, writes are dropped. The default when no storage is configured,\n// so a persistor is always constructable and simply becomes a no-op.\nexport const createNullStorage = (): StorageAdapter => ({\n  getItem: () => null,\n  setItem: () => {},\n  removeItem: () => {},\n});\n\n// In-process Map, living for the lifetime of the process. The Node default and the fallback the\n// Web Storage adapters degrade to when `localStorage`/`sessionStorage` is unavailable (SSR).\nexport const createMemoryStorage = (): StorageAdapter => {\n  const store = new Map<string, string>();\n  return {\n    getItem: (key) => store.get(key) ?? null,\n    setItem: (key, value) => {\n      store.set(key, value);\n    },\n    removeItem: (key) => {\n      store.delete(key);\n    },\n  };\n};\n\n// Wrap a Web Storage instance, degrading to memory when it is absent OR unusable. Merely accessing\n// the global (sandboxed iframe) or calling its methods (privacy mode, disabled/blocked storage) can\n// throw, so a canary write probes real usability at construction; any failure falls back to an\n// in-memory store so persistence never crashes the caller. Resolution happens when the factory is\n// called (not at import), so importing this module never touches browser globals.\nconst createWebStorage = (pick: () => Storage | null): StorageAdapter => {\n  let web: Storage | null = null;\n  try {\n    web = pick();\n    if (web) {\n      const probe = '__keboola_storage_probe__';\n      web.setItem(probe, probe);\n      web.removeItem(probe);\n    }\n  } catch (err) {\n    console.warn('createWebStorage: web storage unavailable, falling back to memory', err);\n    web = null;\n  }\n  if (!web) return createMemoryStorage();\n\n  const storage = web;\n  return {\n    getItem: (key) => storage.getItem(key),\n    setItem: (key, value) => {\n      storage.setItem(key, value);\n    },\n    removeItem: (key) => {\n      storage.removeItem(key);\n    },\n  };\n};\n\nexport const createLocalStorage = (): StorageAdapter =>\n  createWebStorage(() => ('localStorage' in globalThis ? globalThis.localStorage : null));\n\nexport const createSessionStorage = (): StorageAdapter =>\n  createWebStorage(() => ('sessionStorage' in globalThis ? globalThis.sessionStorage : null));\n","import { createNullStorage, type StorageAdapter } from './adapters';\n\n// Structural so this package needs no zod dependency; any schema with `safeParse` fits.\ntype Schema<T> = {\n  safeParse: (value: unknown) => { success: true; data: T } | { success: false };\n};\n\nexport type Persistor<T> = {\n  /** Read + validate the stored value; returns `defaultValue` when empty or corrupt. */\n  hydrate: () => T;\n  persist: (value: T) => void;\n  clear: () => void;\n  hasPersistedValue: () => boolean;\n};\n\ntype PersistorOptions<T> = {\n  storage?: StorageAdapter;\n  key: string;\n  schema: Schema<T>;\n  defaultValue: T;\n  encode?: (value: T) => string;\n  decode?: (raw: string) => unknown;\n};\n\n// A durable cell over a `StorageAdapter`: one key, encoded on write, validated on read.\n// - `hydrate` never throws or returns null: empty, corrupt or invalid storage yields `defaultValue`.\n// - `persist` and `clear` are best-effort: encode or adapter failures are logged, not thrown.\n// - Give schema fields `.default(...)` to patch partial blobs instead of discarding them.\nexport const createPersistor = <T>({\n  storage = createNullStorage(),\n  key,\n  schema,\n  defaultValue,\n  encode = JSON.stringify,\n  decode = JSON.parse,\n}: PersistorOptions<T>): Persistor<T> => {\n  // Adapters can throw; dropping a corrupt entry must never break `hydrate`.\n  const clear = (): void => {\n    try {\n      storage.removeItem(key);\n    } catch (err) {\n      console.warn(`createPersistor: failed to clear \"${key}\"`, err);\n    }\n  };\n\n  // Called during render to decide whether to wait for a restore; a throwing adapter reads as empty.\n  const hasPersistedValue = (): boolean => {\n    try {\n      return !!storage.getItem(key);\n    } catch (err) {\n      console.warn(`createPersistor: failed to read \"${key}\", assuming empty`, err);\n      return false;\n    }\n  };\n\n  const hydrate = (): T => {\n    let raw: string | null;\n    try {\n      raw = storage.getItem(key);\n    } catch (err) {\n      console.warn(`createPersistor: failed to read \"${key}\", using default`, err);\n      return defaultValue;\n    }\n    if (raw === null) return defaultValue;\n\n    let decoded: unknown;\n    try {\n      decoded = decode(raw);\n    } catch (err) {\n      console.warn(`createPersistor: failed to decode \"${key}\", resetting`, err);\n      clear();\n      return defaultValue;\n    }\n\n    const parsed = schema.safeParse(decoded);\n    if (parsed.success) return parsed.data;\n    clear();\n    return defaultValue;\n  };\n\n  const persist = (value: T): void => {\n    let raw: string;\n    try {\n      raw = encode(value);\n    } catch (err) {\n      console.warn(`createPersistor: failed to encode \"${key}\", not persisting`, err);\n      return;\n    }\n    try {\n      storage.setItem(key, raw);\n    } catch (err) {\n      console.warn(`createPersistor: failed to write \"${key}\"`, err);\n    }\n  };\n\n  return { hydrate, persist, clear, hasPersistedValue };\n};\n","import type { StorageToken } from '../clients/storage/types';\nimport type { createDefaultBranch } from '../domain/defaultBranch';\nimport { createProject, type Project } from '../domain/project';\nimport type { createStack } from '../domain/stack';\nimport type { createStorageTable } from '../domain/storageTable';\nimport type { MiddlewareFn } from '../fetchClient';\nimport { coalesce, createStore } from '../utils';\n\n// Pathnames of Storage writes that change the verified token, so the project must re-verify.\nconst STORAGE_TOKEN_MUTATING_PATTERNS = [\n  // Bucket lifecycle → token.bucketPermissions; sub-resources under /buckets/{id}/... don't match.\n  /\\/buckets(\\/[^/]+)?$/,\n  // Feature toggles → token.owner.features; /manage/features and /users/{id}/features don't match.\n  /\\/projects\\/[^/]+\\/features(\\/[^/]+)?$/,\n];\n\nexport const isStorageTokenMutatingRequest = (request: Request): boolean => {\n  if (request.method === 'GET') return false;\n  const { pathname } = new URL(request.url);\n  return STORAGE_TOKEN_MUTATING_PATTERNS.some((pattern) => pattern.test(pathname));\n};\n\nconst createProjectRefreshMiddleware =\n  (\n    shouldRefresh: (request: Request) => boolean,\n    requestRefresh: () => Promise<void>,\n  ): MiddlewareFn =>\n  (next) =>\n  async (request) => {\n    const response = await next(request);\n    // Awaited so `api.context.project` read right after the request is never stale.\n    if (shouldRefresh(request.request)) await requestRefresh();\n    return response;\n  };\n\n/**\n * The live project store, re-verified (coalesced) after a token-mutating request or a re-scope.\n */\nexport const createLiveProject = ({\n  initialToken,\n  verify,\n}: {\n  initialToken: StorageToken;\n  verify: () => Promise<StorageToken>;\n}) => {\n  const store = createStore(createProject({ sapiToken: initialToken }));\n  const refresh = coalesce(async () => store.set(createProject({ sapiToken: await verify() })));\n  const middleware = createProjectRefreshMiddleware(isStorageTokenMutatingRequest, refresh);\n  return { store, getProject: () => store.get(), subscribe: store.subscribe, middleware, refresh };\n};\n\nexport type ClientContext = {\n  /**\n   * Canonical stack URL every request is built on. Not `stack.host`, which names the serving pod;\n   * for the stack's hostname look its id up in `STACKS`.\n   */\n  baseUrl: string;\n  stack: ReturnType<typeof createStack>;\n  defaultBranch: ReturnType<typeof createDefaultBranch>;\n  readonly project: Project;\n  readonly st: ReturnType<typeof createStorageTable>;\n};\n","/**\n * The single error the keboola client / session throws. It carries a stable `type` (the switchable\n * contract) and a human-readable message derived from that type — no per-call message strings.\n */\nexport const KeboolaErrorType = {\n  Unconfigured: 'unconfigured',\n  NotAuthenticated: 'not-authenticated',\n  SignInEnded: 'sign-in-ended',\n  AlreadyAuthenticated: 'already-authenticated',\n  NoStorageToken: 'no-storage-token',\n  NoManagementToken: 'no-management-token',\n  MissingProject: 'missing-project',\n  NotBearer: 'not-bearer',\n  NotReady: 'not-ready',\n  InvalidBuildTransition: 'invalid-build-transition',\n  StackActive: 'stack-active',\n  CredentialKindMismatch: 'credential-kind-mismatch',\n} as const;\n\nexport type KeboolaErrorType = (typeof KeboolaErrorType)[keyof typeof KeboolaErrorType];\n\nconst MESSAGES: Record<KeboolaErrorType, string> = {\n  [KeboolaErrorType.Unconfigured]: 'The session is not configured — set a baseUrl first.',\n  [KeboolaErrorType.NotAuthenticated]: 'The session is not authenticated — sign in first.',\n  [KeboolaErrorType.SignInEnded]:\n    'The sign-in this operation started under has ended — its result belongs to nobody.',\n  [KeboolaErrorType.AlreadyAuthenticated]:\n    'The session is already authenticated — reset before authenticating again.',\n  [KeboolaErrorType.NoStorageToken]: 'No storage token — authenticate the storage realm first.',\n  [KeboolaErrorType.NoManagementToken]:\n    'No management token — authenticate the management realm first.',\n  [KeboolaErrorType.MissingProject]:\n    'A bearer storage session requires a project — call setProject(projectId) first.',\n  [KeboolaErrorType.NotBearer]: 'This operation requires a bearer (OAuth) session.',\n  [KeboolaErrorType.NotReady]: 'The client is not ready — authenticate the storage realm first.',\n  [KeboolaErrorType.InvalidBuildTransition]:\n    'Invalid storage build transition — the build goes idle → initializing → ready | failed.',\n  [KeboolaErrorType.StackActive]: 'The active stack cannot be closed — select another first.',\n  [KeboolaErrorType.CredentialKindMismatch]:\n    'This client renews the other credential kind — log in the way its `credentials` mode expects.',\n};\n\nexport class KeboolaError extends Error {\n  readonly type: KeboolaErrorType;\n\n  constructor(type: KeboolaErrorType) {\n    super(MESSAGES[type]);\n    this.type = type;\n    this.name = 'KeboolaError';\n    Object.setPrototypeOf(this, KeboolaError.prototype);\n  }\n}\n\nexport const isKeboolaError = (error: unknown): error is KeboolaError =>\n  error instanceof KeboolaError;\n\n/** Throw a {@link KeboolaError} of `type` when `value` is null/undefined; otherwise narrow it. */\nexport function assert<T>(value: T | null | undefined, type: KeboolaErrorType): asserts value is T {\n  if (value == null) throw new KeboolaError(type);\n}\n","export const isBuiltInProperty = (property: string | symbol) =>\n  typeof property === 'symbol' ||\n  property === 'then' ||\n  property === 'constructor' ||\n  property === 'toString' ||\n  property === 'valueOf';\n\n/**\n * Creates a dummy client that intercepts method calls and invokes the provided onCall callback.\n */\nexport const createDummyClient = <T extends Record<string, unknown>>({\n  onCall,\n}: {\n  onCall: (path: string[], args: unknown[]) => void;\n}): T => {\n  const createProxy = (path: string[] = []) =>\n    new Proxy(() => {}, {\n      // Create a new proxy for nested property access\n      get: (_target, prop) => {\n        // Don't intercept Symbol properties or special methods\n        if (isBuiltInProperty(prop)) return undefined;\n        return createProxy([...path, prop]);\n      },\n      // When called as a function, invoke the interceptor\n      apply: (_target, _thisArgs, args) => onCall(path, args),\n    });\n\n  return createProxy() as unknown as T;\n};\n","import { createDummyClient } from './utils';\n\ntype OnUnavailableFn = (info: {\n  serviceId: string;\n  path: string[];\n  args: unknown[];\n  clientName: string;\n}) => void;\n\n/**\n * A service's base URL, or a resolver for one that is not known yet — the stack index it comes from\n * may still be in flight. Declared here rather than taken from `fetchClient`, so the registry stays\n * independent of the transport its clients happen to use.\n */\nexport type ServiceUrl = string | (() => Promise<string>);\n\ntype ClientConfig<ServiceId extends string, ClientName extends string> = {\n  serviceId: ServiceId;\n  clientName: ClientName;\n  clientFn: (serviceUrl: ServiceUrl) => unknown;\n};\n\ntype ClientMeta<ServiceId extends string> = {\n  clientName: string;\n  serviceId: ServiceId;\n  isAvailable: boolean;\n};\n\ntype Options<ServiceId extends string> = {\n  getServiceBaseUrl: (serviceId: ServiceId) => ServiceUrl | null;\n  onUnavailable?: OnUnavailableFn;\n};\n\ntype BuildResult<\n  ServiceId extends string,\n  ClientName extends string,\n  Configs extends ClientConfig<ServiceId, ClientName>[],\n> = {\n  client: {\n    [Config in Configs[number] as Config['clientName']]: ReturnType<Config['clientFn']>;\n  };\n  meta: ClientMeta<ServiceId>[];\n};\n\ntype Registry<\n  ServiceId extends string,\n  ClientName extends string,\n  Configs extends ClientConfig<ServiceId, ClientName>[],\n> = {\n  add: <const Config extends ClientConfig<ServiceId, ClientName>>(\n    config: Config,\n  ) => Registry<ServiceId, ClientName, [...Configs, Config]>;\n  build: () => BuildResult<ServiceId, ClientName, Configs>;\n};\n\nexport const createServiceClientRegistry =\n  <ServiceId extends string, ClientName extends string = string>() =>\n  ({\n    getServiceBaseUrl,\n    onUnavailable,\n  }: Options<ServiceId>): Registry<ServiceId, ClientName, []> => {\n    const dummy = (serviceId: string, clientName: string) =>\n      createDummyClient({\n        onCall: (path, args) => {\n          onUnavailable?.({\n            serviceId,\n            path,\n            args,\n            clientName,\n          });\n        },\n      });\n\n    const configs: ClientConfig<ServiceId, ClientName>[] = [];\n\n    const resolveClient = ({\n      serviceId,\n      clientFn,\n      clientName,\n    }: ClientConfig<ServiceId, ClientName>) => {\n      const serviceBaseUrl = getServiceBaseUrl(serviceId);\n      return serviceBaseUrl ? clientFn(serviceBaseUrl) : dummy(serviceId, clientName);\n    };\n\n    type AnyConfig = ClientConfig<ServiceId, ClientName>;\n    const registry: Registry<ServiceId, ClientName, AnyConfig[]> = {\n      add: (config) => {\n        configs.push(config);\n        return registry;\n      },\n      build: () => {\n        const clientMap: Record<string, unknown> = {};\n        const clientMeta: ClientMeta<ServiceId>[] = [];\n\n        configs.forEach((config) => {\n          clientMap[config.clientName] = resolveClient(config);\n          clientMeta.push({\n            clientName: config.clientName,\n            serviceId: config.serviceId,\n            isAvailable: !!getServiceBaseUrl(config.serviceId),\n          });\n        });\n\n        // The dynamically-built map can't be statically proven against the\n        // per-config mapped type; the public key safety comes from the fluent\n        // `add` chain asserted at the bottom of this factory.\n        return {\n          client: clientMap,\n          meta: clientMeta,\n        } as BuildResult<ServiceId, ClientName, AnyConfig[]>;\n      },\n    };\n\n    return registry as Registry<ServiceId, ClientName, []>;\n  };\n","import type { createAuthClient } from '../clients/auth/authClient';\nimport type { createManagementClient } from '../clients/management';\nimport { isBuiltInProperty } from '../serviceClientRegistry';\n\nimport type { createProjectClients } from './legacy/createProjectClients';\nimport { assert, KeboolaErrorType } from './errors';\n\ntype AuthClient = ReturnType<typeof createAuthClient>;\ntype ManagementClient = ReturnType<typeof createManagementClient>;\n\n/**\n * Everything on `api` except `auth` and `management` — the project-scoped half of `KeboolaApi`.\n *\n * - Holds no credential; the token and its refresh loop live on the session that built it.\n */\nexport type ProjectClients = Awaited<ReturnType<typeof createProjectClients>>;\n\nexport type KeboolaApi = ProjectClients & {\n  auth: ReturnType<typeof createAuthClient>;\n  management: ReturnType<typeof createManagementClient>;\n};\n\ntype ApiState = {\n  getAuthClient: () => AuthClient | null;\n  getManagementClient: () => ManagementClient | null;\n  getProjectClients: () => ProjectClients | null;\n};\n\nexport const createApi = (state: ApiState) =>\n  new Proxy({} as KeboolaApi, {\n    get(_target, property) {\n      if (isBuiltInProperty(property)) return undefined;\n\n      if (property === 'auth') {\n        const authClient = state.getAuthClient();\n        assert(authClient, KeboolaErrorType.Unconfigured);\n        return authClient;\n      }\n\n      if (property === 'management') {\n        const management = state.getManagementClient();\n        assert(management, KeboolaErrorType.NoManagementToken);\n        return management;\n      }\n\n      const clients = state.getProjectClients();\n      assert(clients, KeboolaErrorType.NotReady);\n\n      return clients[property as keyof ProjectClients];\n    },\n  });\n","import type { MiddlewareFn } from '../fetchClient';\n\n/**\n * Service clients reached through the registry — the key is the `clientName`\n * the user accesses them by (e.g. `api.dataScience`), not the `serviceId`.\n */\nexport type ServiceClientName =\n  | 'vault'\n  | 'dataScience'\n  | 'apps'\n  | 'encryption'\n  | 'editor'\n  | 'syncActions'\n  | 'telemetry'\n  | 'queryService'\n  | 'queue'\n  | 'chat'\n  | 'ai'\n  | 'import'\n  | 'kaiAgent'\n  | 'businessWorkspaceApi'\n  | 'oauth'\n  | 'omnisearch'\n  | 'stream'\n  | 'notifications'\n  | 'scheduler'\n  | 'metastore'\n  | 'billing';\n\n/** Clients instantiated directly (not stack-discovered), keyed by their property name. */\ntype NonServiceClientName = 'storage' | 'management' | 'auth';\n\nexport type MiddlewareTarget = ServiceClientName | NonServiceClientName;\n\nexport type Middlewares =\n  | MiddlewareFn[]\n  | ({ all?: MiddlewareFn[] } & Partial<Record<MiddlewareTarget, MiddlewareFn[]>>);\n\nexport const createMiddlewareFor = (middlewares: Middlewares | undefined) => {\n  return (target: MiddlewareTarget, baseline: MiddlewareFn[] = []): MiddlewareFn[] => {\n    if (Array.isArray(middlewares)) return [...baseline, ...middlewares];\n\n    const all = middlewares?.all ?? [];\n    const targeted = middlewares?.[target] ?? [];\n    return [...baseline, ...all, ...targeted];\n  };\n};\n\nexport type MiddlewareFor = ReturnType<typeof createMiddlewareFor>;\n","import { createStore } from '../../utils';\n\nexport type State = {\n  baseUrl: string | null;\n  sapiToken: string | null;\n  managementToken: string | null;\n};\n\n// The legacy config is a plain observable state store: the host injects the baseUrl and tokens, and\n// consumers derive their clients from `store` (see `keboola.ts`). No lifecycle events — the derived\n// stores react to state changes directly.\nexport const createConfig = () => {\n  const store = createStore<State>({ baseUrl: null, sapiToken: null, managementToken: null });\n\n  const setBaseUrl = (baseUrl: string) => {\n    store.set({ ...store.get(), baseUrl });\n  };\n\n  const authenticate = (tokens: { sapiToken?: string; managementToken?: string }) => {\n    const current = store.get();\n    store.set({\n      ...current,\n      sapiToken: tokens.sapiToken ?? current.sapiToken,\n      managementToken: tokens.managementToken ?? current.managementToken,\n    });\n  };\n\n  // SAPI token accessors over the config store — the single source of truth. The storage build reads\n  // `getStorageToken` on every request; in-band rotations write back via `setStorageToken`, which\n  // surfaces to observers as an ordinary store change.\n  const getStorageToken = () => store.get().sapiToken ?? '';\n  const setStorageToken = (sapiToken: string) => store.set({ ...store.get(), sapiToken });\n\n  /** Current state, for diagnostics. */\n  const debug = (): State => store.get();\n\n  return { store, setBaseUrl, authenticate, getStorageToken, setStorageToken, debug };\n};\n","import type { DevBranch } from '../clients/storage/branches/types';\nimport { assert } from '../utils';\n\ntype BranchType = 'default' | 'dev';\n\ntype Options = {\n  devBranches: DevBranch[];\n};\n\nexport const createDefaultBranch = ({ devBranches }: Options) => {\n  const defaultBranch = devBranches.find((branch) => branch.isDefault);\n  assert(defaultBranch, 'No default branch found for the project.');\n\n  const getType = (branchId?: string | number): BranchType => {\n    if (branchId == null || branchId === 'default') return 'default';\n    return Number(branchId) === defaultBranch.id ? 'default' : 'dev';\n  };\n\n  return {\n    id: defaultBranch.id,\n    name: defaultBranch.name,\n    getType,\n    isDev: (branchId?: string | number) => getType(branchId) === 'dev',\n    isDefault: (branchId?: string | number) => getType(branchId) === 'default',\n  };\n};\n","import type { ServiceId, StackInfo } from '../clients/storage/types';\n\nexport type ServiceUrls = Partial<Record<ServiceId, (url: string) => string | undefined | null>>;\n\nconst SERVICE_URL_OVERRIDES: ServiceUrls = {\n  // The advertised Kai Assistant URL lacks the `/api` suffix.\n  'kai-assistant': (url) => `${url}/api`,\n};\n\ntype Options = {\n  stackInfo: StackInfo;\n  clientServiceUrls?: ServiceUrls;\n};\n\nexport const createStack = ({ stackInfo, clientServiceUrls }: Options) => {\n  const { services, components, features, ...infoRest } = stackInfo;\n\n  const serviceMap = new Map(\n    services.map((service) => {\n      const devOverride = clientServiceUrls?.[service.id]?.(service.url);\n      const prodOverride = SERVICE_URL_OVERRIDES[service.id]?.(service.url);\n      const url = devOverride ?? prodOverride ?? service.url;\n      return [service.id, url];\n    }),\n  );\n\n  const componentMap = new Map(components.map((component) => [component.id, component]));\n  const featureSet = new Set(features);\n\n  const hasFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => featureSet.has(x));\n  };\n\n  const hasComponent = (...componentId: string[]) => {\n    if (componentId.length === 0) return false;\n    return componentId.every((x) => componentMap.has(x));\n  };\n\n  const getComponent = (componentId: string) => componentMap.get(componentId) ?? null;\n\n  const hasService = (serviceId: ServiceId) => serviceMap.has(serviceId);\n\n  const getServiceUrl = (serviceId: ServiceId) => serviceMap.get(serviceId) ?? null;\n\n  return {\n    ...infoRest,\n    services,\n    features,\n    components,\n    hasFeature,\n    getServiceUrl,\n    hasService,\n    getComponent,\n    hasComponent,\n  };\n};\n","import type * as storage from '../../clients/storage';\n\nconst VARIABLES_COMPONENT_ID = 'keboola.variables';\n\n// The storage client takes the branch as the string the spec declares.\ntype BranchId = string;\n\ntype VariableDefinition = { name: string; type?: string };\ntype VariableValue = { name: string; value?: unknown };\n\n/** Reference to a `keboola.variables` config + the values row a config points at. */\ntype VariablesRef = { variablesId: string; variablesValuesId: string };\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n};\n\n/** Union the definitions by name; on a name conflict the target's definition is kept. */\nexport const mergeVariableDefinitions = (\n  target: VariableDefinition[],\n  source: VariableDefinition[],\n): VariableDefinition[] => {\n  const targetNames = new Set(target.map((definition) => definition.name));\n\n  return [...target, ...source.filter((definition) => !targetNames.has(definition.name))];\n};\n\n/** Add values missing in the target; on a name conflict the value is updated to the source's. */\nexport const mergeVariableValues = (\n  target: VariableValue[],\n  source: VariableValue[],\n): VariableValue[] => {\n  const sourceByName = new Map(source.map((value) => [value.name, value.value]));\n  const targetNames = new Set(target.map((value) => value.name));\n\n  return [\n    ...target.map((value) =>\n      sourceByName.has(value.name) ? { ...value, value: sourceByName.get(value.name) } : value,\n    ),\n    ...source.filter((value) => !targetNames.has(value.name)),\n  ];\n};\n\n/**\n * Orchestration for `keboola.variables` configs: copy a config, or merge two configs into a fresh\n * one (union definitions, upsert values — source wins on a name conflict). Each result is a brand\n * new config + values row, so the caller can reference it without sharing lineage with the source.\n */\nexport const createVariablesSdk = ({ storageClient }: Options) => {\n  const configs = storageClient.configurations;\n  const rows = storageClient.configurationRows;\n\n  const readVariables = async (\n    configId: string,\n    valuesRowId: string | undefined,\n    branchId: BranchId,\n  ) => {\n    const config = await configs.getConfiguration({\n      componentId: VARIABLES_COMPONENT_ID,\n      configId,\n      branchId,\n    });\n    // variables configs carry a single values row — read the referenced one, or the only one\n    const row = config.rows.find((candidate) => candidate.id === valuesRowId) ?? config.rows[0];\n\n    const rawDefinitions = config.configuration?.variables;\n    const rawValues = row?.configuration?.values;\n\n    // guard the array shape — a non-array from Storage would throw in the merge helpers' .map()\n    return {\n      definitions: (Array.isArray(rawDefinitions) ? rawDefinitions : []) as VariableDefinition[],\n      values: (Array.isArray(rawValues) ? rawValues : []) as VariableValue[],\n    };\n  };\n\n  const createVariables = async (\n    definitions: VariableDefinition[],\n    values: VariableValue[],\n    branchId: BranchId,\n  ): Promise<VariablesRef> => {\n    const config = await configs.createConfiguration({\n      branchId,\n      componentId: VARIABLES_COMPONENT_ID,\n      name: 'Variables definition',\n      configuration: { variables: definitions },\n    });\n\n    try {\n      const row = await rows.createConfigurationRow({\n        branchId: String(branchId),\n        componentId: VARIABLES_COMPONENT_ID,\n        configurationId: config.id,\n        name: 'Default values',\n        configuration: { values },\n      });\n\n      return { variablesId: config.id, variablesValuesId: row.id };\n    } catch (error) {\n      // the values row failed — best-effort drop the orphaned config, but always surface the original error\n      await configs\n        .deleteConfiguration({\n          branchId,\n          componentId: VARIABLES_COMPONENT_ID,\n          configId: config.id,\n        })\n        .catch((cleanupError: unknown) => {\n          // keep the cleanup failure on the original error rather than letting it mask the real cause\n          if (error instanceof Error && error.cause === undefined) {\n            error.cause = cleanupError;\n          }\n        });\n      throw error;\n    }\n  };\n\n  return {\n    /** Copy a variables config into a fresh, independent config + values row. */\n    copy: async ({\n      variablesId,\n      variablesValuesId,\n      branchId = 'default',\n    }: {\n      variablesId: string;\n      variablesValuesId?: string;\n      branchId?: BranchId;\n    }): Promise<VariablesRef> => {\n      const { definitions, values } = await readVariables(variablesId, variablesValuesId, branchId);\n\n      return createVariables(definitions, values, branchId);\n    },\n\n    /** Merge the source's variables into the target's and create a fresh merged config + values row. */\n    merge: async ({\n      targetVariablesId,\n      targetValuesId,\n      sourceVariablesId,\n      sourceValuesId,\n      branchId = 'default',\n    }: {\n      targetVariablesId: string;\n      targetValuesId?: string;\n      sourceVariablesId: string;\n      sourceValuesId?: string;\n      branchId?: BranchId;\n    }): Promise<VariablesRef> => {\n      const [target, source] = await Promise.all([\n        readVariables(targetVariablesId, targetValuesId, branchId),\n        readVariables(sourceVariablesId, sourceValuesId, branchId),\n      ]);\n\n      return createVariables(\n        mergeVariableDefinitions(target.definitions, source.definitions),\n        mergeVariableValues(target.values, source.values),\n        branchId,\n      );\n    },\n  };\n};\n","import { createAiClient } from '../clients/ai';\nimport { createAppsClient } from '../clients/apps';\nimport type { AuthStrategy } from '../clients/auth';\nimport { createBillingClient } from '../clients/billing';\nimport { createBusinessWorkspaceApiClient } from '../clients/businessWorkspaceApi';\nimport { createChatClient } from '../clients/chat';\nimport { createDataScienceClient } from '../clients/dataScience';\nimport { createEditorClient } from '../clients/editor';\nimport { createEncryptionClient } from '../clients/encryption';\nimport { createImportClient } from '../clients/import';\nimport { createKaiAgentClient } from '../clients/kaiAgent';\nimport { createMetastoreClient } from '../clients/metastore';\nimport { createNotificationsClient } from '../clients/notifications';\nimport { createOauthClient } from '../clients/oauth';\nimport { createOmnisearchClient } from '../clients/omnisearch';\nimport { createQueryServiceClient } from '../clients/queryService';\nimport { createQueueClient } from '../clients/queue';\nimport { createSchedulerClient } from '../clients/scheduler';\nimport type { ServiceId } from '../clients/storage/types';\nimport { createStreamClient } from '../clients/stream';\nimport { createSyncActionsClient } from '../clients/syncActions';\nimport { createTelemetryClient } from '../clients/telemetry';\nimport { createVaultClient } from '../clients/vault';\nimport { ServiceUnavailableError } from '../errors';\nimport type { MiddlewareFn } from '../fetchClient';\nimport { createServiceClientRegistry, type ServiceUrl } from '../serviceClientRegistry';\n\nimport { type MiddlewareFor, type ServiceClientName } from './createMiddlewareFor';\n\ntype Options = {\n  baseUrl: string;\n  auth: AuthStrategy;\n  getServiceBaseUrl: (serviceId: ServiceId) => ServiceUrl | null;\n  middlewareFor: MiddlewareFor;\n  attachTokenMiddleware: MiddlewareFn;\n};\n\n// A service whose URL is still being resolved cannot have a path appended to it as a string.\nconst withPath = (serviceBaseUrl: ServiceUrl, path: string): ServiceUrl =>\n  typeof serviceBaseUrl === 'string'\n    ? `${serviceBaseUrl}${path}`\n    : async () => `${await serviceBaseUrl()}${path}`;\n\nexport const createServiceClients = ({\n  baseUrl,\n  auth,\n  getServiceBaseUrl,\n  middlewareFor,\n  attachTokenMiddleware,\n}: Options) =>\n  createServiceClientRegistry<ServiceId, ServiceClientName>()({\n    getServiceBaseUrl,\n    onUnavailable: ({ serviceId, path, clientName }) => {\n      throw new ServiceUnavailableError(serviceId, path, clientName);\n    },\n  })\n    .add({\n      serviceId: 'vault',\n      clientName: 'vault',\n      clientFn: (serviceBaseUrl) =>\n        createVaultClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('vault', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'data-science',\n      clientName: 'dataScience',\n      clientFn: (serviceBaseUrl) =>\n        createDataScienceClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('dataScience', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      // `/v2` App Deployments live on the sandboxes deployment; the `apps.<stack>` host is absent\n      // from the service index. At a third prefixed client, give `.add()` a `pathPrefix`.\n      serviceId: 'data-science',\n      clientName: 'apps',\n      clientFn: (serviceBaseUrl) =>\n        createAppsClient({\n          baseUrl: withPath(serviceBaseUrl, '/v2'),\n          middlewares: middlewareFor('apps', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'encryption',\n      clientName: 'encryption',\n      clientFn: (serviceBaseUrl) =>\n        createEncryptionClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('encryption'),\n        }),\n    })\n    .add({\n      serviceId: 'editor',\n      clientName: 'editor',\n      clientFn: (serviceBaseUrl) =>\n        createEditorClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('editor', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'sync-actions',\n      clientName: 'syncActions',\n      clientFn: (serviceBaseUrl) =>\n        createSyncActionsClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('syncActions', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'telemetry',\n      clientName: 'telemetry',\n      clientFn: (serviceBaseUrl) =>\n        createTelemetryClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('telemetry', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'query',\n      clientName: 'queryService',\n      clientFn: (serviceBaseUrl) =>\n        createQueryServiceClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('queryService', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'queue',\n      clientName: 'queue',\n      clientFn: (serviceBaseUrl) =>\n        createQueueClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('queue', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'kai-assistant',\n      clientName: 'chat',\n      clientFn: (serviceBaseUrl) =>\n        createChatClient({\n          storageApiUrl: baseUrl,\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('chat', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'ai',\n      clientName: 'ai',\n      clientFn: (serviceBaseUrl) =>\n        createAiClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('ai', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      // The ai-service ingress exposes omnisearch under `/omnisearch`, like the `kai-assistant`\n      // `/api` override in `domain/stack.ts`.\n      serviceId: 'ai',\n      clientName: 'omnisearch',\n      clientFn: (serviceBaseUrl) =>\n        createOmnisearchClient({\n          baseUrl: withPath(serviceBaseUrl, '/omnisearch'),\n          middlewares: middlewareFor('omnisearch', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'import',\n      clientName: 'import',\n      clientFn: (serviceBaseUrl) =>\n        createImportClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('import', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'kai-agent',\n      clientName: 'kaiAgent',\n      clientFn: (serviceBaseUrl) =>\n        createKaiAgentClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('kaiAgent', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'business-workspace',\n      clientName: 'businessWorkspaceApi',\n      clientFn: (serviceBaseUrl) =>\n        createBusinessWorkspaceApiClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('businessWorkspaceApi', [attachTokenMiddleware]),\n          publicMiddlewares: middlewareFor('businessWorkspaceApi'),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'oauth',\n      clientName: 'oauth',\n      clientFn: (serviceBaseUrl) =>\n        createOauthClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('oauth', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'scheduler',\n      clientName: 'scheduler',\n      clientFn: (serviceBaseUrl) =>\n        createSchedulerClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('scheduler', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'stream',\n      clientName: 'stream',\n      clientFn: (serviceBaseUrl) =>\n        createStreamClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('stream', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'notification',\n      clientName: 'notifications',\n      clientFn: (serviceBaseUrl) =>\n        createNotificationsClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('notifications', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'billing',\n      clientName: 'billing',\n      clientFn: (serviceBaseUrl) =>\n        createBillingClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('billing', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .add({\n      serviceId: 'metastore',\n      clientName: 'metastore',\n      clientFn: (serviceBaseUrl) =>\n        createMetastoreClient({\n          baseUrl: serviceBaseUrl,\n          middlewares: middlewareFor('metastore', [attachTokenMiddleware]),\n          auth,\n        }),\n    })\n    .build();\n","import type { AuthStrategy } from '../../clients/auth';\nimport { createStorageClient } from '../../clients/storage';\nimport { ProjectFeature } from '../../constants/projectFeatures';\nimport { createDefaultBranch } from '../../domain/defaultBranch';\nimport { createStack, type ServiceUrls } from '../../domain/stack';\nimport { createStorageTable } from '../../domain/storageTable';\nimport { type MiddlewareFn, normalizeBaseUrl } from '../../fetchClient';\nimport { KeboolaHttpHeader } from '../../internal';\nimport { createConfigurationSdk } from '../../sdks/configurations';\nimport { createKaiMemorySdk } from '../../sdks/kaiMemory';\nimport { createSemanticLayerSdk } from '../../sdks/semanticLayer';\nimport { createStorageSdk } from '../../sdks/storage';\nimport { createTagSdk } from '../../sdks/tag';\nimport { createVariablesSdk } from '../../sdks/variables';\nimport { createVaultSdk } from '../../sdks/vault';\nimport { createDerivedStore } from '../../utils';\nimport { type ClientContext, createLiveProject } from '../createLiveProject';\nimport { type MiddlewareFor } from '../createMiddlewareFor';\nimport { createServiceClients } from '../createServiceClients';\n\nconst createAttachStorageToken =\n  (getToken: () => string): MiddlewareFn =>\n  (next) =>\n  (request) => {\n    request.request.headers.set(KeboolaHttpHeader.STORAGE_API_TOKEN, getToken());\n    return next(request);\n  };\n\ntype Options = {\n  baseUrl: string;\n  getStorageToken: () => string;\n  onStorageTokenRefreshed: (token: string) => void;\n  middlewareFor: MiddlewareFor;\n  clientServiceUrls?: ServiceUrls;\n};\n\nexport const createProjectClients = async ({\n  baseUrl,\n  getStorageToken,\n  onStorageTokenRefreshed,\n  middlewareFor,\n  clientServiceUrls,\n}: Options) => {\n  const auth: AuthStrategy = { type: 'sapi-token', token: getStorageToken() };\n\n  const attach = createAttachStorageToken(getStorageToken);\n  const _storage = createStorageClient({ baseUrl, auth, middlewares: [attach] });\n  const [stackInfo, sapiToken, devBranches] = await Promise.all([\n    _storage.getStackInfo({ exclude: 'componentDetails' }),\n    _storage.tokens.verify(),\n    _storage.branches.getDevBranches(),\n  ]);\n\n  const stack = createStack({ stackInfo, clientServiceUrls });\n  const defaultBranch = createDefaultBranch({ devBranches });\n  const liveProject = createLiveProject({\n    initialToken: sapiToken,\n    verify: () => _storage.tokens.verify(),\n  });\n  const storageTableStore = createDerivedStore({\n    source: liveProject.store,\n    build: createStorageTable,\n    dependsOn: (project) => ({\n      useLegacyBucketPrefix: !project.hasFeature(ProjectFeature.DisableLegacyBucketPrefix),\n      hasProtectedDefaultBranch: project.hasFeature(ProjectFeature.SoxProtectedDefaultBranch),\n      hasStorageBranches: project.hasFeature(ProjectFeature.StorageBranches),\n    }),\n  });\n  const context: ClientContext = {\n    baseUrl: normalizeBaseUrl(baseUrl),\n    stack,\n    defaultBranch,\n    get project() {\n      return liveProject.getProject();\n    },\n    get st() {\n      return storageTableStore.get();\n    },\n  };\n\n  // Static storage-token header + in-band refresh (onRefreshToken rotates the shared liveToken store).\n  const storage = createStorageClient({\n    baseUrl,\n    auth,\n    middlewares: middlewareFor('storage', [liveProject.middleware]),\n    onRefreshToken: onStorageTokenRefreshed,\n  });\n\n  const { client: services, meta: serviceMeta } = createServiceClients({\n    baseUrl,\n    auth,\n    getServiceBaseUrl: context.stack.getServiceUrl,\n    middlewareFor,\n    attachTokenMiddleware: attach,\n  });\n\n  const sdk = {\n    configuration: createConfigurationSdk({\n      storageClient: storage,\n      encryptionClient: services.encryption,\n      context,\n    }),\n    tag: createTagSdk({ metastoreClient: services.metastore }),\n    semanticLayer: createSemanticLayerSdk({ metastoreClient: services.metastore }),\n    kaiMemory: createKaiMemorySdk({ metastoreClient: services.metastore }),\n    storage: createStorageSdk({ storageClient: storage }),\n    vault: createVaultSdk({ vaultClient: services.vault, encryptionClient: services.encryption }),\n    variables: createVariablesSdk({ storageClient: storage }),\n  };\n\n  return { context, serviceMeta, storage, ...services, sdk };\n};\n","import { createAuthClient } from '../../clients/auth/authClient';\nimport { createManagementClient } from '../../clients/management';\nimport { createDerivedAsyncStore, createDerivedStore } from '../../utils';\nimport { createApi } from '../createApi';\nimport { createMiddlewareFor } from '../createMiddlewareFor';\nimport type { LegacyKeboolaOptions } from '../types';\n\nimport { createConfig, type State } from './createConfig';\nimport { createProjectClients } from './createProjectClients';\nimport type { SessionSnapshot } from './types';\n\ntype ProjectClients = Awaited<ReturnType<typeof createProjectClients>>;\n\nexport const createLegacyKeboola = (options: LegacyKeboolaOptions = {}) => {\n  const config = createConfig();\n  const middlewareFor = createMiddlewareFor(options.middlewares);\n\n  // The clients are derived from config state: each rebuilds only when the slice it depends on\n  // changes. auth needs a baseUrl; management builds token-less up front and upgrades once a manage\n  // token lands; storage builds once the SAPI token arrives (a later in-band rotation keeps the same\n  // baseUrl key, so it does not rebuild).\n  const authClient = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => state.baseUrl,\n    build: (baseUrl) =>\n      baseUrl ? createAuthClient({ baseUrl, middlewares: middlewareFor('auth', []) }) : null,\n  });\n\n  const management = createDerivedStore({\n    source: config.store,\n    dependsOn: (state) => ({ baseUrl: state.baseUrl, token: state.managementToken }),\n    build: ({ baseUrl, token }) =>\n      baseUrl\n        ? createManagementClient({\n            baseUrl,\n            auth: token ? { type: 'management-token', token } : { type: 'management-token' },\n            middlewares: middlewareFor('management', []),\n          })\n        : null,\n  });\n\n  const build = createDerivedAsyncStore<State, string, ProjectClients>({\n    source: config.store,\n    dependsOn: (state) => (state.sapiToken && state.baseUrl ? state.baseUrl : null),\n    build: (baseUrl) =>\n      createProjectClients({\n        baseUrl,\n        getStorageToken: config.getStorageToken,\n        onStorageTokenRefreshed: config.setStorageToken,\n        middlewareFor,\n        clientServiceUrls: options.clientServiceUrls,\n      }),\n  });\n\n  if (options.baseUrl) config.setBaseUrl(options.baseUrl);\n\n  const debug = (): SessionSnapshot => {\n    const info = config.debug();\n    return {\n      type: 'Sapi',\n      config: info,\n      authReady: authClient.get() !== null,\n      managementReady: !!info.managementToken,\n      storage: build.store.get().state,\n    };\n  };\n\n  const session = {\n    setBaseUrl: config.setBaseUrl,\n    isStorageReady: () => build.store.get().state === 'ready',\n    authenticateStorage: (sapiToken: string) => config.authenticate({ sapiToken }),\n    authenticateStorageAsync: async (sapiToken: string) => {\n      config.authenticate({ sapiToken });\n      // `authenticate` mutates synchronously, so the build is already pending; `settled` awaits it.\n      await build.settled();\n    },\n    authenticateManagement: (managementToken: string) => config.authenticate({ managementToken }),\n    subscribe: (listener: (snapshot: SessionSnapshot) => void) => {\n      // Fire on both config mutations and storage-build transitions, so `ready` is observable.\n      const unsubscribeConfig = config.store.subscribe(() => listener(debug()));\n      const unsubscribeBuild = build.store.subscribe(() => listener(debug()));\n      return () => {\n        unsubscribeConfig();\n        unsubscribeBuild();\n      };\n    },\n    debug,\n  };\n\n  const api = createApi({\n    getAuthClient: () => authClient.get(),\n    getManagementClient: () => management.get(),\n    getProjectClients: () => {\n      const state = build.store.get();\n      return state.state === 'ready' ? state.value : null;\n    },\n  });\n\n  return { api, session };\n};\n","import type { createAuthClient } from '../../../clients/auth/authClient';\nimport { KeboolaError, KeboolaErrorType } from '../../errors';\nimport type { RotatingCredential, RotatingCredentialInput } from '../state/types';\n\ntype AuthClient = ReturnType<typeof createAuthClient>;\n\nexport type RenewalGrant =\n  | { type: 'token'; refreshToken: string }\n  | { type: 'cookie'; sessionId: string };\n\nexport const renewalGrant = (credential: RotatingCredential): RenewalGrant =>\n  credential.type === 'token'\n    ? { type: 'token', refreshToken: credential.refreshToken }\n    : { type: 'cookie', sessionId: credential.sessionId };\n\nexport const renew = async (\n  client: AuthClient,\n  grant: RenewalGrant,\n): Promise<RotatingCredentialInput> => {\n  if (grant.type === 'cookie') {\n    const { accessToken, expiresIn, sessionId } = await client.token.refreshWithSession({\n      sessionId: grant.sessionId,\n    });\n    return { type: 'cookie', accessToken, expiresIn, sessionId };\n  }\n\n  const { accessToken, expiresIn, refreshToken } = await client.token.refreshWithToken({\n    refreshToken: grant.refreshToken,\n  });\n  if (!refreshToken) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n  return { type: 'token', accessToken, expiresIn, refreshToken };\n};\n","import { createAuthClient } from '../../../clients/auth/authClient';\nimport type { MiddlewareFn } from '../../../fetchClient';\nimport { dedupe, ensure, Result } from '../../../utils';\nimport { KeboolaError, KeboolaErrorType } from '../../errors';\nimport type { createSessionPersistor, PersistedSession } from '../persistor';\nimport type { createState } from '../state';\nimport type { BaseUrl, CredentialMode, ProjectId, RotatingCredentialInput } from '../state/types';\n\nimport { createBearerAuthMiddleware, isUnauthorized } from './middleware';\nimport { renew, type RenewalGrant, renewalGrant } from './renewal';\n\ntype Options = {\n  state: ReturnType<typeof createState>;\n  persistor: ReturnType<typeof createSessionPersistor>;\n  middlewares: MiddlewareFn[];\n  /** The rotating kind this client renews. A persisted or offered credential of the other is refused. */\n  mode?: CredentialMode;\n  refreshThreshold?: number;\n  /** Drops what the sign-in derived; also fires when a refused refresh expires it, not only on `signOut`. */\n  onSignedOut?: (baseUrl: BaseUrl) => void;\n};\n\nconst DEFAULT_REFRESH_THRESHOLD = 0.9;\n\n/**\n * What a boot-time restore found.\n *\n * - `expired`: the server refused the refresh token.\n * - `unreachable`: no answer; the stored token is still good — retry, never log in.\n */\nexport type RestoreStatus = 'restored' | 'expired' | 'unreachable' | 'empty';\n\n/**\n * One stack's outcome; `RestoreStatus` reads the scoped stack's.\n *\n * - `skipped`: the caller signed this stack in or out before the restore reached it.\n */\ntype StackRestore = 'restored' | 'refused' | 'unreachable' | 'skipped';\n\nconst signInEnded = () => new KeboolaError(KeboolaErrorType.SignInEnded);\n\nexport const createCredentials = ({\n  state,\n  persistor,\n  middlewares,\n  mode = 'token',\n  refreshThreshold = DEFAULT_REFRESH_THRESHOLD,\n  onSignedOut,\n}: Options) => {\n  const rotationMap = new Map<BaseUrl, () => Promise<Result<string>>>();\n\n  // `epoch` restarts with the row, so close + reopen + authenticate can repeat it; this counter\n  // outlives the row, so the pair tells sign-ins apart.\n  const generations = new Map<BaseUrl, number>();\n  const generationOf = (baseUrl: BaseUrl) => generations.get(baseUrl) ?? 0;\n\n  // No bearer middleware on this client: the cookie refresh is rejected outright if it carries one.\n  const refresh = async (\n    baseUrl: BaseUrl,\n    grant: RenewalGrant,\n  ): Promise<Result<RotatingCredentialInput>> => {\n    const client = createAuthClient({ baseUrl, middlewares });\n    const epochBefore = Result.unwrap(state.auth.getEpoch(baseUrl));\n    const generationBefore = generationOf(baseUrl);\n    const refreshed = await Result.tryCatchAsync(() => renew(client, grant));\n    const epochAfter = Result.unwrapOr(state.auth.getEpoch(baseUrl), -1);\n    const isCurrentSignIn =\n      epochAfter === epochBefore && generationOf(baseUrl) === generationBefore;\n    return isCurrentSignIn ? refreshed : Result.failure(signInEnded());\n  };\n\n  /**\n   * A stack's teardown, from the credential's side.\n   *\n   * - Bumps the generation, so an in-flight rotation can no longer write.\n   * - Drops the deduped entry, so nothing joins that rotation.\n   */\n  const forget = (baseUrl: BaseUrl) => {\n    generations.set(baseUrl, generationOf(baseUrl) + 1);\n    rotationMap.delete(baseUrl);\n  };\n\n  /**\n   * The rotation, and the one place a credential is declared dead.\n   *\n   * - A refused refresh token or session is unambiguous.\n   * - The triggering 401 is not (an unreachable project answers the same), so never sign out on a replay.\n   */\n  const rotateOnce = async (baseUrl: BaseUrl): Promise<Result<string>> => {\n    const credential = state.auth.requireCredentialOf(baseUrl, mode);\n    if (!credential.success) return credential;\n\n    const refreshed = await refresh(baseUrl, renewalGrant(credential.data));\n    if (!refreshed.success) {\n      if (isUnauthorized(refreshed.error)) expire(baseUrl);\n      return refreshed;\n    }\n\n    return Result.map(\n      state.auth.applyRefresh(baseUrl, refreshed.data),\n      () => refreshed.data.accessToken,\n    );\n  };\n\n  const rotate = (baseUrl: BaseUrl): Promise<Result<string>> =>\n    ensure(rotationMap, baseUrl, () => dedupe(() => rotateOnce(baseUrl)))();\n\n  // Turns a persisted grant back into a credential; anonymous again if it is dead.\n  const restoreStack = async (baseUrl: BaseUrl, grant: RenewalGrant): Promise<StackRestore> => {\n    const restoring = state.auth.startRestore(baseUrl);\n    if (!restoring.success) return 'unreachable';\n\n    const refreshed = await refresh(baseUrl, grant);\n    if (!refreshed.success) {\n      state.auth.cancelRestore(baseUrl);\n      // Only a refusal means dead; offline, a 503 or a proxy leaves the credential good.\n      return isUnauthorized(refreshed.error) ? 'refused' : 'unreachable';\n    }\n\n    state.auth.authenticate(baseUrl, refreshed.data);\n    return 'restored';\n  };\n\n  // Runs after the credential lands: opening a project on an anonymous stack is refused.\n  const restoreProjects = (baseUrl: BaseUrl, projects: { projectId: ProjectId }[]) => {\n    for (const { projectId } of projects) state.projects.open(baseUrl, projectId);\n  };\n\n  /**\n   * Every persisted stack back into the table, with whatever credential it can hand back.\n   *\n   * - Never writes the scope. `lastActive` is what was scoped when the session was stored, for the\n   *   caller to select.\n   * - `status` reports what became of `lastActive`'s credential; the client reads it to decide\n   *   when persistence may start.\n   */\n  const restore = async (): Promise<{\n    lastActive: PersistedSession['current'];\n    status: RestoreStatus;\n  }> => {\n    const hydrated = persistor.hydrate();\n    // The other mode's grant is unusable here — a refresh token cannot renew a cookie session, and\n    // a session id is refused without the cookie — so that stack comes back signed out.\n    const stacks = hydrated.stacks.map((stack) =>\n      stack.credential && stack.credential.type !== 'static' && stack.credential.type !== mode\n        ? { ...stack, credential: null }\n        : stack,\n    );\n    const { current } = hydrated;\n    const scoped = stacks.find(({ baseUrl }) => baseUrl === current?.baseUrl);\n\n    const restored = stacks.map(\n      async ({ baseUrl, credential, projects }): Promise<StackRestore> => {\n        state.stacks.ensure(baseUrl);\n        if (!credential) return 'unreachable';\n        // Every sign-in and sign-out moves the epoch off 0, so a stored credential never lands on a\n        // stack the caller already decided about.\n        if (Result.unwrapOr(state.auth.getEpoch(baseUrl), 0) > 0) return 'skipped';\n\n        // A static token is the credential; a rotating one is a grant to be exchanged.\n        const outcome =\n          credential.type === 'static'\n            ? state.auth.authenticate(baseUrl, credential).success\n              ? ('restored' as const)\n              : ('refused' as const)\n            : await restoreStack(baseUrl, credential);\n\n        if (outcome === 'restored') restoreProjects(baseUrl, projects);\n        return outcome;\n      },\n    );\n\n    const results = await Promise.all(restored);\n    const outcome = scoped?.credential ? results[stacks.indexOf(scoped)] : undefined;\n    const status: RestoreStatus =\n      outcome === undefined || outcome === 'skipped'\n        ? 'empty'\n        : outcome === 'restored'\n          ? 'restored'\n          : outcome === 'unreachable'\n            ? 'unreachable'\n            : 'expired';\n\n    return { lastActive: current, status };\n  };\n\n  const isStale = (baseUrl: BaseUrl): boolean => {\n    const ageing = Result.map(\n      state.auth.requireCredentialOf(baseUrl, mode),\n      ({ issuedAt, expiresIn }) => Date.now() >= issuedAt + expiresIn * 1000 * refreshThreshold,\n    );\n    return Result.unwrapOr(ageing, false);\n  };\n\n  // Drops the slot so the next sign-in's requests don't join the dying rotation.\n  const signOut = (baseUrl: BaseUrl) => {\n    rotationMap.delete(baseUrl);\n    const signedOut = state.auth.signOut(baseUrl);\n    onSignedOut?.(baseUrl);\n\n    return signedOut;\n  };\n\n  // The table's latch re-arms on `authenticate`: one sign-out per sign-in.\n  const expire = (baseUrl: BaseUrl) => {\n    if (state.auth.notifyExpired(baseUrl)) signOut(baseUrl);\n  };\n\n  // A static credential *is* the token, so nothing refreshes it.\n  const canRefresh = (baseUrl: BaseUrl) => state.auth.requireCredentialOf(baseUrl, mode).success;\n\n  const middleware = (baseUrl: BaseUrl): MiddlewareFn =>\n    createBearerAuthMiddleware({\n      getAccessToken: async ({ forceRefresh = false } = {}) => {\n        // `null`, not a rejection: nothing to rotate, so the caller keeps its original 401.\n        if (forceRefresh) return canRefresh(baseUrl) ? Result.unwrap(await rotate(baseUrl)) : null;\n        if (!isStale(baseUrl)) return state.auth.getAccessToken(baseUrl);\n\n        // Best-effort: on failure keep the token in hand; a real 401 drives the mandatory rotation.\n        return Result.unwrapOr(await rotate(baseUrl), state.auth.getAccessToken(baseUrl));\n      },\n    });\n\n  return { middleware, rotate, restore, signOut, forget };\n};\n","import { Result } from '../../../utils';\nimport { KeboolaError, KeboolaErrorType } from '../../errors';\n\nimport type {\n  Auth,\n  BaseUrl,\n  BearerCredential,\n  CredentialInput,\n  Project,\n  ProjectAddress,\n  ProjectEntryId,\n  ProjectId,\n  RotatingCredential,\n  Stack,\n  StackAddress,\n  State,\n} from './types';\n\n/**\n * Everything the table constructs: the entries themselves, and the failures reading them produces.\n *\n * Nothing here touches the store — a factory takes what it is told and returns a value, so the\n * namespaces the tables build on can be read without following a dependency.\n */\n\n// --- entry ids ---\n\nconst projectEntryId = (baseUrl: BaseUrl, projectId: ProjectId): ProjectEntryId =>\n  `${baseUrl}#${projectId}`;\n\n/** What every project entry of one stack shares — the one thing a per-stack teardown matches on. */\nconst projectEntryPrefix = (baseUrl: BaseUrl) => `${baseUrl}#`;\n\nconst isUnderStack = (baseUrl: BaseUrl) => (id: ProjectEntryId) =>\n  id.startsWith(projectEntryPrefix(baseUrl));\n\n// --- auth: the three phases of a credential holder ---\n\nconst anonymousAuth = (): Auth => ({ status: 'anonymous' });\n\nconst restoringAuth = (): Auth => ({ status: 'restoring' });\n\nconst authenticatedAuth = (credential: BearerCredential): Auth => ({\n  status: 'authenticated',\n  credential,\n});\n\n// --- credentials ---\n\n// Stamps the issue time a rotating credential is measured from; a static one has none.\nconst bearerCredential = (input: CredentialInput): BearerCredential =>\n  input.type === 'static' ? input : { ...input, issuedAt: Date.now() };\n\n// Backdates the issue time by a full lifetime, so the credential reads as expired right now.\nconst expiredCredential = (credential: RotatingCredential): RotatingCredential => ({\n  ...credential,\n  issuedAt: Date.now() - credential.expiresIn * 1000,\n});\n\n// --- fresh entries: anonymous, nothing fetched yet ---\n\nconst stack = (baseUrl: BaseUrl): Stack => ({\n  baseUrl,\n  context: 'idle',\n  epoch: 0,\n  auth: anonymousAuth(),\n});\n\nconst project = (baseUrl: BaseUrl, projectId: ProjectId): Project => ({\n  id: projectEntryId(baseUrl, projectId),\n  baseUrl,\n  projectId,\n  context: 'idle',\n});\n\n// --- addresses: references into the table ---\n\nconst stackAddress = (baseUrl: BaseUrl): StackAddress => ({\n  baseUrl,\n  projectId: null,\n});\n\nconst projectAddress = (baseUrl: BaseUrl, projectId: ProjectId): ProjectAddress => ({\n  baseUrl,\n  projectId,\n});\n\n// --- the table: scoped to its default stack from the start, which is its one row ---\n\nconst table = (defaultBaseUrl: BaseUrl): State => ({\n  active: stackAddress(defaultBaseUrl),\n  stacks: { [defaultBaseUrl]: stack(defaultBaseUrl) },\n  projects: {},\n});\n\nexport const Entry = {\n  // ids\n  projectEntryId,\n  isUnderStack,\n\n  // entries\n  stack,\n  project,\n\n  // addresses\n  stackAddress,\n  projectAddress,\n\n  // the table\n  table,\n\n  // auth\n  anonymousAuth,\n  restoringAuth,\n  authenticatedAuth,\n\n  // credentials\n  bearerCredential,\n  expiredCredential,\n};\n\n/**\n * Every failure the table can produce.\n *\n * - The typed ones carry a `KeboolaErrorType` a consumer branches on; the rest are plain `Error`s\n *   whose message names the entry, because nothing branches on them.\n */\nexport const Errors = {\n  // typed: a consumer reads the `type` and decides what to render\n  notAuthenticated: () => new KeboolaError(KeboolaErrorType.NotAuthenticated),\n  stackActive: () => new KeboolaError(KeboolaErrorType.StackActive),\n  /** A stack that was never opened — nothing has been configured for it. */\n  unconfigured: () => new KeboolaError(KeboolaErrorType.Unconfigured),\n  alreadyAuthenticated: () => new KeboolaError(KeboolaErrorType.AlreadyAuthenticated),\n  notReady: () => new KeboolaError(KeboolaErrorType.NotReady),\n\n  // the restore phases\n  alreadyRestoring: (baseUrl: BaseUrl) => new Error(`Stack \"${baseUrl}\" is already being restored`),\n  notRestoring: (baseUrl: BaseUrl) => new Error(`Stack \"${baseUrl}\" is not being restored`),\n\n  // a credential asked to do what its kind cannot\n  unexpectedCredentialKind: (baseUrl: BaseUrl, kind: string) =>\n    new Error(`Stack \"${baseUrl}\" holds a ${kind} credential`),\n  notRotatingCredential: (baseUrl: BaseUrl) =>\n    new Error(`Stack \"${baseUrl}\" holds a static credential`),\n  credentialKindChanged: (from: string, to: string) =>\n    new Error(`A ${from} credential cannot become ${to}`),\n\n  missingProject: (id: ProjectEntryId) => new Error(`No project \"${id}\"`),\n};\n\n// The credential behind an `Auth`, or `NotAuthenticated` for the anonymous and restoring phases.\nexport const authenticated = (auth: Auth): Result<BearerCredential> =>\n  auth.status === 'authenticated'\n    ? Result.success(auth.credential)\n    : Result.failure(Errors.notAuthenticated());\n","import { Result } from '../../../utils';\n\nimport { Entry, Errors } from './factories';\nimport type { Projects } from './projects';\nimport type { Stacks } from './stacks';\nimport type { BaseUrl, CredentialInput, CredentialMode } from './types';\n\n/**\n * Fire-once per sign-in: the first report of a dead credential returns `true`, the rest `false`,\n * and `authenticate` re-arms it. Held beside the table because it is not state anyone restores.\n */\nexport const createExpiryLatch = () => {\n  const notified = new Map<BaseUrl, boolean>();\n\n  return {\n    arm: (baseUrl: BaseUrl) => notified.set(baseUrl, false),\n    forget: (baseUrl: BaseUrl) => notified.delete(baseUrl),\n    report: (baseUrl: BaseUrl): boolean => {\n      if (notified.get(baseUrl)) return false;\n      notified.set(baseUrl, true);\n      return true;\n    },\n  };\n};\n\ntype ExpiryLatch = ReturnType<typeof createExpiryLatch>;\n\ntype Options = {\n  stacks: Stacks;\n  projects: Projects;\n  expiry: ExpiryLatch;\n};\n\n/**\n * The stack's credential and its sign-in pin.\n *\n * - `epoch` moves on `authenticate` and `signOut` and never on a rotation, so it is exactly \"which\n *   sign-in is this\" — what an in-flight exchange compares itself against.\n */\nexport const createAuth = ({ stacks, projects, expiry }: Options) => {\n  // Nothing signed in yet: `anonymous` or `restoring` pass.\n  const requireUnauthenticated = (baseUrl: BaseUrl) =>\n    Result.andThen(stacks.get(baseUrl), (stack) =>\n      stack.auth.status === 'authenticated'\n        ? Result.failure(Errors.alreadyAuthenticated())\n        : Result.success(stack),\n    );\n\n  // Strictly `anonymous`: a restore in flight is refused too, with its own reason.\n  const requireAnonymous = (baseUrl: BaseUrl) =>\n    Result.andThen(requireUnauthenticated(baseUrl), (stack) =>\n      stack.auth.status === 'restoring'\n        ? Result.failure(Errors.alreadyRestoring(baseUrl))\n        : Result.success(stack),\n    );\n\n  const requireRestoring = (baseUrl: BaseUrl) =>\n    Result.andThen(stacks.get(baseUrl), (stack) =>\n      stack.auth.status === 'restoring'\n        ? Result.success(stack)\n        : Result.failure(Errors.notRestoring(baseUrl)),\n    );\n\n  // A credential that rotates: `static` has neither an issue time nor a lifetime to act on.\n  const requireRotatingCredential = (baseUrl: BaseUrl) =>\n    Result.andThen(stacks.requireCredential(baseUrl), (credential) =>\n      credential.type === 'static'\n        ? Result.failure(Errors.notRotatingCredential(baseUrl))\n        : Result.success(credential),\n    );\n\n  // The rotating kind a client's mode renews; the other one it has no grant to renew with.\n  const requireCredentialOf = (baseUrl: BaseUrl, mode: CredentialMode) =>\n    Result.andThen(requireRotatingCredential(baseUrl), (credential) =>\n      credential.type === mode\n        ? Result.success(credential)\n        : Result.failure(Errors.unexpectedCredentialKind(baseUrl, credential.type)),\n    );\n\n  const startRestore = (baseUrl: BaseUrl) =>\n    Result.map(requireAnonymous(baseUrl), (stack) =>\n      stacks.set({ ...stack, auth: Entry.restoringAuth() }),\n    );\n\n  // A restore that failed or was abandoned: back to anonymous, no sign-in ended.\n  const cancelRestore = (baseUrl: BaseUrl) =>\n    Result.map(requireRestoring(baseUrl), (stack) =>\n      stacks.set({ ...stack, auth: Entry.anonymousAuth() }),\n    );\n\n  // Completes a restore too: `restoring` is the one non-anonymous phase this accepts.\n  const authenticate = (baseUrl: BaseUrl, input: CredentialInput) =>\n    Result.map(requireUnauthenticated(baseUrl), (stack) => {\n      expiry.arm(baseUrl);\n\n      return stacks.set({\n        ...stack,\n        epoch: stack.epoch + 1,\n        auth: Entry.authenticatedAuth(Entry.bearerCredential(input)),\n      });\n    });\n\n  const applyRefresh = (baseUrl: BaseUrl, input: CredentialInput) =>\n    Result.andThen(requireRotatingCredential(baseUrl), (credential) =>\n      credential.type !== input.type\n        ? Result.failure(Errors.credentialKindChanged(credential.type, input.type))\n        : Result.map(stacks.get(baseUrl), (stack) =>\n            stacks.set({ ...stack, auth: Entry.authenticatedAuth(Entry.bearerCredential(input)) }),\n          ),\n    );\n\n  const forceExpire = (baseUrl: BaseUrl) =>\n    Result.andThen(requireRotatingCredential(baseUrl), (credential) =>\n      Result.map(stacks.get(baseUrl), (stack) =>\n        stacks.set({\n          ...stack,\n          auth: Entry.authenticatedAuth(Entry.expiredCredential(credential)),\n        }),\n      ),\n    );\n\n  // Drops the credential and every project under it; the stack stays, anonymous, as the scope.\n  const signOut = (baseUrl: BaseUrl) =>\n    Result.map(stacks.get(baseUrl), (stack) => {\n      projects.closeAll(baseUrl);\n\n      return stacks.set({ ...stack, epoch: stack.epoch + 1, auth: Entry.anonymousAuth() });\n    });\n\n  const getEpoch = (baseUrl: BaseUrl) => Result.map(stacks.get(baseUrl), (stack) => stack.epoch);\n\n  // `null` rather than a failure: an anonymous request goes out without an `Authorization` header.\n  const getAccessToken = (baseUrl: BaseUrl): string | null =>\n    Result.unwrapOr(\n      Result.map(stacks.requireCredential(baseUrl), ({ accessToken }) => accessToken),\n      null,\n    );\n\n  return {\n    startRestore,\n    cancelRestore,\n    authenticate,\n    applyRefresh,\n    forceExpire,\n    signOut,\n    notifyExpired: expiry.report,\n    requireCredential: stacks.requireCredential,\n    requireRotatingCredential,\n    requireCredentialOf,\n    getEpoch,\n    getAccessToken,\n  };\n};\n","import { Result } from '../../../utils';\n\nimport { Entry, Errors } from './factories';\nimport type { Stacks } from './stacks';\nimport type {\n  Address,\n  BaseUrl,\n  FetchStatus,\n  Project,\n  ProjectEntryId,\n  ProjectId,\n  Store,\n} from './types';\n\ntype Options = {\n  store: Store;\n  stacks: Stacks;\n};\n\n/** The projects open under a stack, and what authorizes a request to one. */\nexport const createProjects = ({ store, stacks }: Options) => {\n  const has = (id: ProjectEntryId): boolean => id in store.get().projects;\n\n  const get = (id: ProjectEntryId): Result<Project> => {\n    const project = store.get().projects[id];\n    return project ? Result.success(project) : Result.failure(Errors.missingProject(id));\n  };\n\n  const list = (baseUrl: BaseUrl): Project[] =>\n    Object.values(store.get().projects).filter((project) => project.baseUrl === baseUrl);\n\n  /** Every open project with this id, whatever stack it sits on — a project number is not unique. */\n  const findAll = (projectId: ProjectId): Project[] =>\n    Object.values(store.get().projects).filter((project) => project.projectId === projectId);\n\n  const set = (project: Project): Project => {\n    const state = store.get();\n    store.set({ ...state, projects: { ...state.projects, [project.id]: project } });\n    return project;\n  };\n\n  const update = (id: ProjectEntryId, updater: (project: Project) => Project): Result<Project> =>\n    Result.map(get(id), (project) => set(updater(project)));\n\n  const removeMany = (ids: ProjectEntryId[], nextActive: Address) => {\n    const state = store.get();\n    const projects = { ...state.projects };\n    for (const id of ids) delete projects[id];\n    store.set({ ...state, active: nextActive, projects });\n  };\n\n  // What authorizes a request to this project: the credential of the stack it sits under.\n  const requireCredential = (id: ProjectEntryId) =>\n    Result.andThen(get(id), (project) => stacks.requireCredential(project.baseUrl));\n\n  // --- verbs ---\n\n  // A project borrows its stack's credential, and so needs one to exist.\n  const open = (baseUrl: BaseUrl, projectId: ProjectId): Result<Project> => {\n    const id = Entry.projectEntryId(baseUrl, projectId);\n    if (has(id)) return get(id);\n\n    return Result.map(stacks.requireCredential(baseUrl), () =>\n      set(Entry.project(baseUrl, projectId)),\n    );\n  };\n\n  // Resolves to the closed project, so the caller can tear down what it built for it.\n  const close = (id: ProjectEntryId): Result<Project> =>\n    Result.tap(get(id), ({ baseUrl, projectId }) => {\n      const { active } = store.get();\n      const isScoped = active.baseUrl === baseUrl && active.projectId === projectId;\n      removeMany([id], isScoped ? Entry.stackAddress(baseUrl) : active);\n    });\n\n  /** Every project under a stack, with the scope falling back to the stack itself. */\n  const closeAll = (baseUrl: BaseUrl) => {\n    const ids = list(baseUrl).map((project) => project.id);\n    const { active } = store.get();\n\n    removeMany(ids, active.baseUrl === baseUrl ? Entry.stackAddress(baseUrl) : active);\n  };\n\n  const updateContext = (id: ProjectEntryId, context: FetchStatus): Result<Project> =>\n    update(id, (project) => ({ ...project, context }));\n\n  return {\n    has,\n    get,\n    list,\n    findAll,\n    set,\n    update,\n    open,\n    close,\n    closeAll,\n    updateContext,\n    requireCredential,\n  };\n};\n\nexport type Projects = ReturnType<typeof createProjects>;\n","import { Result } from '../../../utils';\n\nimport { Entry, Errors } from './factories';\nimport type { Projects } from './projects';\nimport type { Stacks } from './stacks';\nimport type {\n  Address,\n  BaseUrl,\n  Location,\n  Project,\n  ProjectAddress,\n  ProjectId,\n  Stack,\n  StackAddress,\n  Store,\n} from './types';\n\ntype Options = {\n  store: Store;\n  stacks: Stacks;\n  projects: Projects;\n};\n\n/**\n * What `api.*` addresses: the `active` slot, and the address in it resolved against the tables it\n * points into.\n *\n * The tables never write here — they read `active` through the pure helpers in `address.ts`, so\n * that this can depend on them rather than the other way round.\n */\nexport const createScope = ({ store, stacks, projects }: Options) => {\n  const get = (): Address => store.get().active;\n\n  const isSame = (a: Address, b: Address) =>\n    a === b || (a.baseUrl === b.baseUrl && a.projectId === b.projectId);\n\n  // Re-activating what is already active is not a change. Without this a component that scopes on\n  // every render — the backend flow, handed its stack and project by the server — is notified back\n  // into another render, forever.\n  const set = (active: Address) => {\n    if (isSame(store.get().active, active)) return;\n    store.set({ ...store.get(), active });\n  };\n\n  const locate = (active: Address): Location | null => {\n    const stack = stacks.get(active.baseUrl);\n    if (!stack.success) return null;\n    if (active.projectId === null) return { stack: stack.data, project: null };\n\n    const project = projects.get(Entry.projectEntryId(active.baseUrl, active.projectId));\n    if (!project.success) return null;\n\n    return { stack: stack.data, project: project.data };\n  };\n\n  // The scope always names a row: the table starts on one, and the active stack cannot close.\n  const getActive = (): Location => {\n    const location = locate(get());\n    if (!location) throw new Error(`The scope names no row: ${JSON.stringify(get())}`);\n    return location;\n  };\n\n  const getActiveStack = (): Stack => getActive().stack;\n\n  const activateStack = (baseUrl: BaseUrl): Result<StackAddress> =>\n    Result.map(stacks.get(baseUrl), (stack) => {\n      const next = Entry.stackAddress(stack.baseUrl);\n      set(next);\n      return next;\n    });\n\n  // A project can only be addressed once something authorizes a request to it — which is also what\n  // proves both its own row and its stack's exist.\n  const activateProject = (baseUrl: BaseUrl, projectId: ProjectId): Result<ProjectAddress> =>\n    Result.map(projects.requireCredential(Entry.projectEntryId(baseUrl, projectId)), () => {\n      const next = Entry.projectAddress(baseUrl, projectId);\n      set(next);\n      return next;\n    });\n\n  // `select` creates the row it activates; the `activate*` pair above requires one that exists.\n  const selectStack = (baseUrl: BaseUrl): Result<Stack> => {\n    const stack = stacks.ensure(baseUrl);\n    return Result.map(activateStack(stack.baseUrl), () => stack);\n  };\n\n  const selectProject = (projectId: ProjectId): Result<Project> => {\n    const { baseUrl } = getActiveStack();\n\n    const project = projects.open(baseUrl, projectId);\n    if (!project.success) return project;\n\n    return Result.map(activateProject(baseUrl, projectId), () => project.data);\n  };\n\n  // Leaves the project but stays on its stack; a stack-level scope is left as it is.\n  const deactivate = () => {\n    const active = get();\n    if (active.projectId === null) return;\n    set(Entry.stackAddress(active.baseUrl));\n  };\n\n  // A stack-level scope is real state, not a broken one: there is no project to hand back yet.\n  const requireActiveProject = (): Result<Project> => {\n    const { project } = getActive();\n    return project ? Result.success(project) : Result.failure(Errors.notReady());\n  };\n\n  return {\n    get,\n    getActive,\n    activateStack,\n    activateProject,\n    selectStack,\n    selectProject,\n    deactivate,\n    getActiveStack,\n    requireActiveProject,\n  };\n};\n","import { Result } from '../../../utils';\n\nimport { authenticated, Entry, Errors } from './factories';\nimport type { BaseUrl, FetchStatus, Stack, Store } from './types';\n\ntype Options = {\n  store: Store;\n  /** Cleared with the stack, so a reopened stack starts with its expiry report re-armed. */\n  forgetExpiry: (baseUrl: BaseUrl) => void;\n};\n\n/** One entry per stack: the entries, and the verbs that open and close them. */\nexport const createStacks = ({ store, forgetExpiry }: Options) => {\n  const has = (baseUrl: BaseUrl) => baseUrl in store.get().stacks;\n  const get = (baseUrl: BaseUrl) => {\n    const stack = store.get().stacks[baseUrl];\n    return stack ? Result.success(stack) : Result.failure(Errors.unconfigured());\n  };\n  const list = () => Object.values(store.get().stacks);\n  const set = (stack: Stack): Stack => {\n    const state = store.get();\n    store.set({ ...state, stacks: { ...state.stacks, [stack.baseUrl]: stack } });\n    return stack;\n  };\n  const update = (baseUrl: BaseUrl, updater: (stack: Stack) => Stack) =>\n    Result.map(get(baseUrl), (stack) => set(updater(stack)));\n\n  // What authorizes a request to this stack; every project under it borrows the same one.\n  const requireCredential = (baseUrl: BaseUrl) =>\n    Result.andThen(get(baseUrl), (stack) => authenticated(stack.auth));\n\n  // --- verbs ---\n\n  const ensure = (baseUrl: BaseUrl) => {\n    const existing = get(baseUrl);\n    if (existing.success) return existing.data;\n    return set(Entry.stack(baseUrl));\n  };\n\n  // Drops the stack and every project under it in one write. The active stack is refused: the scope\n  // always names a stack.\n  const close = (baseUrl: BaseUrl) => {\n    const stack = get(baseUrl);\n    if (!stack.success) return stack;\n\n    const state = store.get();\n    if (state.active.baseUrl === baseUrl) return Result.failure(Errors.stackActive());\n\n    const stacks = { ...state.stacks };\n    delete stacks[baseUrl];\n\n    const projects = Object.fromEntries(\n      Object.entries(state.projects).filter(([, project]) => project.baseUrl !== baseUrl),\n    );\n    store.set({ active: state.active, stacks, projects });\n    forgetExpiry(baseUrl);\n    return stack;\n  };\n\n  const updateContext = (baseUrl: BaseUrl, context: FetchStatus) =>\n    update(baseUrl, (stack) => ({ ...stack, context }));\n\n  return {\n    has,\n    get,\n    list,\n    set,\n    update,\n    ensure,\n    close,\n    updateContext,\n    requireCredential,\n  };\n};\n\nexport type Stacks = ReturnType<typeof createStacks>;\n","import { createStore } from '../../../utils';\n\nimport { createAuth, createExpiryLatch } from './auth';\nimport { Entry } from './factories';\nimport { createProjects } from './projects';\nimport { createScope } from './scope';\nimport { createStacks } from './stacks';\nimport type { BaseUrl, State } from './types';\n\n/**\n * The stack table and the rules over it, one namespace per concern.\n *\n * - Built in dependency order: a project reads its stack's credential, and the scope resolves\n *   the active address against both tables.\n */\nexport const createState = (defaultBaseUrl: BaseUrl) => {\n  const store = createStore<State>(Entry.table(defaultBaseUrl));\n  const expiry = createExpiryLatch();\n\n  const stacks = createStacks({ store, forgetExpiry: expiry.forget });\n  const projects = createProjects({ store, stacks });\n  const scope = createScope({ store, stacks, projects });\n  const auth = createAuth({ stacks, projects, expiry });\n\n  return { store: store.asReadable(), stacks, projects, auth, scope };\n};\n\nexport type StateApi = ReturnType<typeof createState>;\n","import { createEmitter, type Emitter } from '../../../utils';\n\ntype Settled<Value> = { status: 'ready'; value: Value } | { status: 'errored'; error: unknown };\ntype Entry<Input, Value> = { input: Input } & (\n  | { status: 'pending'; settled: Promise<Settled<Value>> }\n  | Settled<Value>\n);\ntype Options<Input, Key extends string, Value> = {\n  key: (input: Input) => Key;\n  fetch: (input: Input) => Promise<Value>;\n};\ntype StatusChange<Key extends string> = { key: Key; status: Entry<unknown, unknown>['status'] };\n\ntype ResourceApi<Input, Key extends string, Value> = {\n  /** The value, if it has landed. Never fetches. `null` until it does, and after a failure. */\n  get: (id: Key) => Value | null;\n\n  /** The value, awaited. Fetches unless one is landed or in flight; retries a failed key. */\n  getAsync: (input: Input) => Promise<Value>;\n\n  /** Fetches in the background, once per key. Leaves a failed key failed — use `retry`. */\n  prefetch: (input: Input) => void;\n\n  /** Fetches the key again, whatever it holds. A key that never ran has nothing to refetch. */\n  retry: (id: Key) => void;\n\n  /**\n   * Drops every key the predicate names, silently. What comes back is fetched, not remembered.\n   *\n   * Drop the state row first — a row outliving its entry keeps a `ready` this never corrects.\n   */\n  forget: (matches: (id: Key) => boolean) => void;\n\n  /** Every status change, in order. Returns its unsubscribe. `forget` is silent. */\n  subscribe: Emitter<StatusChange<Key>>['subscribe'];\n};\n\n/**\n * Owns fetching one async value per key — a caller names what it needs and never orchestrates the\n * request. Backs the stack and project contexts.\n *\n * - One fetch per key: concurrent askers share it, a landed value is never refetched.\n * - A failure is held, not thrown away — nothing here needs a rejection handler.\n * - Status lives here and nowhere else; a consumer that has to mirror it subscribes.\n */\nexport const createResource = <Input, Key extends string, Value>({\n  key,\n  fetch,\n}: Options<Input, Key, Value>): ResourceApi<Input, Key, Value> => {\n  const entries = new Map<Key, Entry<Input, Value>>();\n  const changes = createEmitter<StatusChange<Key>>();\n\n  const set = (id: Key, entry: Entry<Input, Value>): void => {\n    entries.set(id, entry);\n    changes.emit({ key: id, status: entry.status });\n  };\n\n  // The input is kept on the entry so `retry` needs only the key — the caller holding one would\n  // otherwise have to read the fetch's arguments back out of wherever they live.\n  const run = (id: Key, input: Input): Entry<Input, Value> => {\n    const settle = (next: Settled<Value>): Settled<Value> => {\n      // Only the newest run may write: a retry mid-flight starts another, and the run it\n      // replaced must not land on top of it.\n      if (entries.get(id) === entry) set(id, { input, ...next });\n      return next;\n    };\n\n    // Async wrapper, so a synchronous throw from `fetch` rejects rather than escaping `run` —\n    // which would leave the key holding whatever it held and throw at `prefetch`'s caller.\n    const attempt = async (): Promise<Value> => await fetch(input);\n\n    const entry: Entry<Input, Value> = {\n      input,\n      status: 'pending',\n      settled: attempt().then(\n        (value) => settle({ status: 'ready', value }),\n        (error: unknown) => settle({ status: 'errored', error }),\n      ),\n    };\n\n    set(id, entry);\n    return entry;\n  };\n\n  const get = (id: Key): Value | null => {\n    const entry = entries.get(id);\n    return entry?.status === 'ready' ? entry.value : null;\n  };\n\n  const getAsync = async (input: Input): Promise<Value> => {\n    const id = key(input);\n    const cached = entries.get(id);\n    const entry = cached === undefined || cached.status === 'errored' ? run(id, input) : cached;\n    const settled = entry.status === 'pending' ? await entry.settled : entry;\n\n    if (settled.status === 'errored') throw settled.error;\n    return settled.value;\n  };\n\n  const forget = (matches: (id: Key) => boolean): void => {\n    for (const id of entries.keys()) if (matches(id)) entries.delete(id);\n  };\n\n  const prefetch = (input: Input): void => {\n    const id = key(input);\n    if (!entries.has(id)) run(id, input);\n  };\n\n  const retry = (id: Key): void => {\n    const entry = entries.get(id);\n    if (entry !== undefined) run(id, entry.input);\n  };\n\n  return { get, getAsync, prefetch, retry, forget, subscribe: changes.subscribe };\n};\n","import { createStorageClient } from '../../../clients/storage';\nimport { createDefaultBranch } from '../../../domain/defaultBranch';\nimport type { MiddlewareFn } from '../../../fetchClient';\nimport { KeboolaHttpHeader } from '../../../internal';\nimport type { createCredentials } from '../credentials';\nimport { Entry, type StateApi } from '../state';\nimport type { BaseUrl, Project, ProjectEntryId, State } from '../state/types';\n\nimport { createResource } from './resource';\n\ntype Options = {\n  state: StateApi;\n  credentials: ReturnType<typeof createCredentials>;\n  /** Only the awaited read — this needs the stack's index to have landed, not to read it. */\n  stackContext: { getAsync: (baseUrl: BaseUrl) => Promise<unknown> };\n};\n\n/** What a project is, once its stack has answered for it. */\ntype ProjectContext = {\n  token: Awaited<ReturnType<ReturnType<typeof createStorageClient>['tokens']['verify']>>;\n  defaultBranch: ReturnType<typeof createDefaultBranch>;\n};\n\nexport const createProjectContext = ({ state, credentials, stackContext }: Options) => {\n  const resource = createResource({\n    key: (project: Project) => project.id,\n    fetch: async ({ baseUrl, projectId }): Promise<ProjectContext> => {\n      // Outside the auth middleware, so the header is already set when it clones the request for\n      // its 401 replay.\n      const withProjectId: MiddlewareFn = (next) => (request) => {\n        request.request.headers.set(KeboolaHttpHeader.PROJECT_ID, String(projectId));\n        return next(request);\n      };\n\n      const client = createStorageClient({\n        baseUrl,\n        auth: { type: 'bearer', token: '', projectId },\n        middlewares: [(next) => withProjectId(credentials.middleware(baseUrl)(next))],\n      });\n\n      // The stack index too, though nothing here reads it. Every consumer gates on *this* status —\n      // `BearerFrontendRoot`, `getApi` — while the service URLs a handle resolves come from the\n      // index, so a project reporting ready before it lands mounts an app whose first `api.context`\n      // read throws `NotReady`.\n      const [token, devBranches] = await Promise.all([\n        client.tokens.verify(),\n        client.branches.getDevBranches(),\n        stackContext.getAsync(baseUrl),\n      ]);\n\n      return { token, defaultBranch: createDefaultBranch({ devBranches }) };\n    },\n  });\n\n  // The resource owns the status; the entry carries a copy, for the consumers that render it.\n  resource.subscribe(({ key, status }) => {\n    state.projects.updateContext(key, status);\n  });\n\n  const subscriber = ({ projects }: State) => {\n    for (const project of Object.values(projects)) resource.prefetch(project);\n  };\n\n  /**\n   * Dropped with the sign-in that fetched them: a verified token is what a credential answered\n   * for, so it belongs to that credential and not to the project id it was keyed by.\n   */\n  const forgetUnder = (baseUrl: BaseUrl) => resource.forget(Entry.isUnderStack(baseUrl));\n\n  /** One project, closed on purpose. */\n  const forget = (id: ProjectEntryId) => resource.forget((key) => key === id);\n\n  return {\n    subscriber,\n    get: resource.get,\n    getAsync: resource.getAsync,\n    retry: resource.retry,\n    forget,\n    forgetUnder,\n  };\n};\n","import { createStorageClient } from '../../../clients/storage';\nimport type { StateApi } from '../state';\nimport type { BaseUrl, State } from '../state/types';\n\nimport { createResource } from './resource';\n\nexport const createStackContext = (state: StateApi) => {\n  const resource = createResource({\n    key: (baseUrl: BaseUrl) => baseUrl,\n    fetch: (baseUrl) =>\n      createStorageClient({ baseUrl, auth: { type: 'sapi-token', token: '' } }).getStackInfo({\n        exclude: 'componentDetails',\n      }),\n  });\n\n  // The resource owns the status; the entry carries a copy, for the consumers that render it.\n  resource.subscribe(({ key, status }) => {\n    state.stacks.updateContext(key, status);\n  });\n\n  const subscriber = ({ stacks }: State) => {\n    for (const { baseUrl } of Object.values(stacks)) resource.prefetch(baseUrl);\n  };\n\n  /** Dropped with the stack itself — a stack that comes back re-reads its index. */\n  const forget = (baseUrl: BaseUrl) => resource.forget((key) => key === baseUrl);\n\n  return {\n    subscriber,\n    get: resource.get,\n    getAsync: resource.getAsync,\n    retry: resource.retry,\n    forget,\n  };\n};\n","import type { AuthStrategy } from '../../clients/auth';\nimport { createStorageClient } from '../../clients/storage';\nimport type { ServiceId } from '../../clients/storage/types';\nimport { ProjectFeature } from '../../constants/projectFeatures';\nimport { createStack } from '../../domain/stack';\nimport { createStorageTable } from '../../domain/storageTable';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { KeboolaHttpHeader } from '../../internal';\nimport { createDerivedStore, ensure } from '../../utils';\nimport type { KeboolaApi } from '../createApi';\nimport { createLiveProject } from '../createLiveProject';\nimport type { createMiddlewareFor } from '../createMiddlewareFor';\nimport { createServiceClients } from '../createServiceClients';\nimport { assert, KeboolaErrorType } from '../errors';\nimport type { KeboolaOptions } from '../types';\n\nimport type { BaseUrl, Project, ProjectEntryId } from './state/types';\nimport { createProjectContext } from './context';\nimport type { createCredentials } from './credentials';\nimport type { PerStack } from './perStack';\nimport { Entry, type StateApi } from './state';\n\ntype Options = {\n  state: StateApi;\n  credentials: ReturnType<typeof createCredentials>;\n  middlewareFor: ReturnType<typeof createMiddlewareFor>;\n  stack: PerStack;\n  clientServiceUrls: KeboolaOptions['clientServiceUrls'];\n  /** What a handle for this project is. Injected, because the surface spans both lifetimes. */\n  buildApi: (project: Project) => KeboolaApi;\n};\n\n// `ensure` for a record's field. A build that throws leaves the field unbuilt, so the next read\n// attempts it again — which is what keeps a namespace gated on `NotReady` until its fetch lands.\nconst once = <V extends NonNullable<unknown>>(build: () => V): (() => V) => {\n  let value: V | null = null;\n  return () => (value ??= build());\n};\n\n/**\n * Everything one project derives, and the one call that drops it.\n *\n * Every field belongs to the credential that built it — a client set carries its middleware chain,\n * the storage client holds a `liveProject` seeded with its token, a fetched context *is* what it\n * answered for `tokens.verify` — so the record dies with the sign-in, and `forgetUnder` is the\n * only thing that ends one.\n */\nexport const createPerProject = ({\n  state,\n  credentials,\n  middlewareFor,\n  stack,\n  clientServiceUrls,\n  buildApi,\n}: Options) => {\n  const context = createProjectContext({ state, credentials, stackContext: stack.context });\n\n  // The project-id header outside the auth middleware, so it is set before the 401 replay clones\n  // the request.\n  const attachFor = ({ baseUrl, projectId }: Project): MiddlewareFn => {\n    const withProjectId: MiddlewareFn = (next) => (request) => {\n      request.request.headers.set(KeboolaHttpHeader.PROJECT_ID, String(projectId));\n      return next(request);\n    };\n\n    return (next) => withProjectId(credentials.middleware(baseUrl)(next));\n  };\n\n  const buildClients = ({ baseUrl, projectId }: Project, attach: MiddlewareFn) =>\n    createServiceClients({\n      baseUrl,\n      // No static header: the auth middleware stamps the live token, so this never reaches the wire.\n      auth: { type: 'bearer', token: '', projectId },\n      // A resolver rather than a URL: the first request awaits the stack index if it is still in\n      // flight. `createStack` applies the dev and production overrides.\n      getServiceBaseUrl: (serviceId: ServiceId) => async () => {\n        const stackInfo = await stack.context.getAsync(baseUrl);\n        const serviceUrl = createStack({ stackInfo, clientServiceUrls }).getServiceUrl(serviceId);\n\n        assert(serviceUrl, KeboolaErrorType.NotReady);\n        return serviceUrl;\n      },\n      middlewareFor,\n      attachTokenMiddleware: attach,\n    });\n\n  /**\n   * `api.storage` and `api.context`, built together: both read one live token — the storage client\n   * carries its re-verify middleware, the context reports the project it re-verifies.\n   *\n   * - Both fetches it reads are already running. `NotReady` covers the window before they land,\n   *   which the table reports as `project.context`.\n   * - `storage` is gated on the stack index too, though it addresses the project's own `baseUrl`\n   *   and does not need it — that is the gate as it stands, not a requirement.\n   */\n  const buildLive = (project: Project, attach: MiddlewareFn) => {\n    const stackInfo = stack.context.get(project.baseUrl);\n    assert(stackInfo, KeboolaErrorType.NotReady);\n\n    const fetched = context.get(project.id);\n    assert(fetched, KeboolaErrorType.NotReady);\n\n    const { baseUrl, projectId } = project;\n    const auth: AuthStrategy = { type: 'bearer', token: '', projectId };\n\n    // Carries no refresh middleware of its own: it is what that middleware calls, so routing it\n    // through would re-enter the re-verification it performs.\n    const reader = createStorageClient({ baseUrl, auth, middlewares: [attach] });\n    const liveProject = createLiveProject({\n      initialToken: fetched.token,\n      verify: () => reader.tokens.verify(),\n    });\n\n    const storageTableStore = createDerivedStore({\n      source: liveProject.store,\n      build: createStorageTable,\n      dependsOn: (live) => ({\n        useLegacyBucketPrefix: !live.hasFeature(ProjectFeature.DisableLegacyBucketPrefix),\n        hasProtectedDefaultBranch: live.hasFeature(ProjectFeature.SoxProtectedDefaultBranch),\n        hasStorageBranches: live.hasFeature(ProjectFeature.StorageBranches),\n      }),\n    });\n\n    return {\n      storage: createStorageClient({\n        baseUrl,\n        auth,\n        middlewares: middlewareFor('storage', [attach, liveProject.middleware]),\n      }),\n      context: {\n        baseUrl,\n        stack: createStack({ stackInfo, clientServiceUrls }),\n        defaultBranch: fetched.defaultBranch,\n        // Getters: the token is re-verified in place after a mutating request, so a snapshot of\n        // either would go stale.\n        get project() {\n          return liveProject.getProject();\n        },\n        get st() {\n          return storageTableStore.get();\n        },\n      },\n    };\n  };\n\n  // Getters, so `api.*` reads a field. Lazy per field: a `context` read must build neither the\n  // service clients nor a storage client whose fetch has not landed.\n  const build = (project: Project) => {\n    const attach = attachFor(project);\n    const live = once(() => buildLive(project, attach));\n    const clients = once(() => buildClients(project, attach));\n\n    return {\n      api: buildApi(project),\n      get clients() {\n        return clients();\n      },\n      get storage() {\n        return live().storage;\n      },\n      get context() {\n        return live().context;\n      },\n    };\n  };\n\n  const derived = new Map<ProjectEntryId, ReturnType<typeof build>>();\n\n  const get = (project: Project) => ensure(derived, project.id, () => build(project));\n\n  /** One project, closed on purpose — a handle for it stops answering from the next read. */\n  const forget = (id: ProjectEntryId) => {\n    derived.delete(id);\n    context.forget(id);\n  };\n\n  const forgetUnder = (baseUrl: BaseUrl) => {\n    const isUnder = Entry.isUnderStack(baseUrl);\n    for (const id of derived.keys()) if (isUnder(id)) derived.delete(id);\n\n    context.forgetUnder(baseUrl);\n  };\n\n  return { context, get, forget, forgetUnder };\n};\n","import * as z from 'zod';\n\nimport { createPersistor } from '../../utils/persistor';\nimport type { StorageAdapter } from '../types';\n\nimport type { Stack, State } from './state/types';\n\n/**\n * Where a bearer session is persisted, under whichever adapter the client was given.\n *\n * Exported because a consumer sometimes has to drop a session a client cannot reach: the adapter is\n * chosen at construction, so a client built without one holds no handle to the storage its own\n * session is sitting in. `AppAuthStrategy` in kbc-ui is that case.\n */\nexport const SESSION_STORAGE_KEY = 'keboola:session';\n\n/**\n * What survives a reload, per credential kind.\n *\n * - `token`: the refresh token. It rotates, is single-use and is server-revocable, so a leaked\n *   snapshot has limited and revocable value. The access token is never written.\n * - `static`: the token itself — a long-lived PAT the user pasted, which nothing can re-mint.\n * - `cookie`: the session id. The session cookie is the durable half and the browser keeps it;\n *   the id alone renews nothing.\n */\nconst persistedCredentialSchema = z.discriminatedUnion('type', [\n  z.object({ type: z.literal('token'), refreshToken: z.string() }),\n  z.object({ type: z.literal('cookie'), sessionId: z.string() }),\n  z.object({ type: z.literal('static'), accessToken: z.string() }),\n]);\n\n/** A record per project rather than a bare id, so a project can grow a field without a migration. */\nconst persistedProjectSchema = z.object({ projectId: z.number() });\n\nconst persistedSessionSchema = z.object({\n  current: z.object({ baseUrl: z.string(), projectId: z.number().nullable() }).nullable(),\n  stacks: z.array(\n    z.object({\n      baseUrl: z.string(),\n      credential: persistedCredentialSchema.nullable(),\n      projects: z.array(persistedProjectSchema),\n    }),\n  ),\n});\n\nexport type PersistedCredential = z.infer<typeof persistedCredentialSchema>;\nexport type PersistedSession = z.infer<typeof persistedSessionSchema>;\n\nconst EMPTY_PERSISTED_SESSION: PersistedSession = { current: null, stacks: [] };\n\nconst durableCredential = (stack: Stack): PersistedCredential | null => {\n  if (stack.auth.status !== 'authenticated') return null;\n\n  const { credential } = stack.auth;\n  if (credential.type === 'token') return { type: 'token', refreshToken: credential.refreshToken };\n  if (credential.type === 'cookie') return { type: 'cookie', sessionId: credential.sessionId };\n  return { type: 'static', accessToken: credential.accessToken };\n};\n\nexport const createSessionPersistor = (storage?: StorageAdapter) => {\n  const persistor = createPersistor<PersistedSession>({\n    storage,\n    key: SESSION_STORAGE_KEY,\n    schema: persistedSessionSchema,\n    defaultValue: EMPTY_PERSISTED_SESSION,\n  });\n\n  const persist = ({ active, stacks, projects }: State) =>\n    persistor.persist({\n      current: { baseUrl: active.baseUrl, projectId: active.projectId },\n      stacks: Object.values(stacks).map((stack) => ({\n        baseUrl: stack.baseUrl,\n        credential: durableCredential(stack),\n        projects: Object.values(projects)\n          .filter((project) => project.baseUrl === stack.baseUrl)\n          .map(({ projectId }) => ({ projectId })),\n      })),\n    });\n\n  return { ...persistor, persist };\n};\n","import { createAuthClient } from '../../clients/auth/authClient';\nimport { createManagementClient } from '../../clients/management';\nimport { ensure } from '../../utils';\nimport type { createMiddlewareFor } from '../createMiddlewareFor';\n\nimport type { BaseUrl } from './state/types';\nimport { createStackContext } from './context';\nimport type { createCredentials } from './credentials';\nimport type { StateApi } from './state';\n\ntype Options = {\n  state: StateApi;\n  credentials: ReturnType<typeof createCredentials>;\n  middlewareFor: ReturnType<typeof createMiddlewareFor>;\n};\n\ntype StackDerived = {\n  auth: ReturnType<typeof createAuthClient>;\n  management: ReturnType<typeof createManagementClient>;\n};\n\n/**\n * Everything one stack derives, and the one call that drops it.\n *\n * Outlives a sign-out, unlike anything in `perProject`: both clients read the credential live per\n * request, so neither belongs to one sign-in, and the stack index is public.\n */\nexport const createPerStack = ({ state, credentials, middlewareFor }: Options) => {\n  const context = createStackContext(state);\n  const derived = new Map<BaseUrl, StackDerived>();\n\n  const get = (baseUrl: BaseUrl): StackDerived =>\n    ensure(derived, baseUrl, () => ({\n      auth: createAuthClient({\n        baseUrl,\n        middlewares: middlewareFor('auth', [credentials.middleware(baseUrl)]),\n      }),\n      management: createManagementClient({\n        baseUrl,\n        auth: { type: 'bearer', token: '' },\n        middlewares: middlewareFor('management', [credentials.middleware(baseUrl)]),\n      }),\n    }));\n\n  const forget = (baseUrl: BaseUrl) => {\n    derived.delete(baseUrl);\n    context.forget(baseUrl);\n  };\n\n  return { context, get, forget };\n};\n\nexport type PerStack = ReturnType<typeof createPerStack>;\n","import { HttpHeader, normalizeBaseUrl } from '../../fetchClient';\nimport { KeboolaHttpHeader } from '../../internal';\nimport { isBuiltInProperty } from '../../serviceClientRegistry';\nimport { lazy, Result } from '../../utils';\nimport type { KeboolaApi } from '../createApi';\nimport { createMiddlewareFor } from '../createMiddlewareFor';\nimport type { createServiceClients } from '../createServiceClients';\nimport { KeboolaError, KeboolaErrorType } from '../errors';\nimport type { KeboolaOptions } from '../types';\n\nimport type {\n  BaseUrl,\n  CredentialInput,\n  Project,\n  ProjectEntryId,\n  ProjectId,\n  Stack,\n  TokenCredentialInput,\n} from './state/types';\nimport { createCredentials, type RestoreStatus } from './credentials';\nimport { createPerProject } from './perProject';\nimport { createSessionPersistor } from './persistor';\nimport { createPerStack } from './perStack';\nimport { createState, Entry } from './state';\n\ntype ServiceClients = ReturnType<typeof createServiceClients>['client'];\n\n/**\n * The bearer client: the session table, its two scopes, and the surface they back.\n *\n * - Credential-derived state is owned by the scope whose end ends it (`perStack`, `perProject`).\n */\nexport const createKeboola = ({\n  defaultBaseUrl,\n  storage,\n  middlewares,\n  clientServiceUrls,\n  credentials: mode = 'token',\n}: KeboolaOptions) => {\n  const state = createState(normalizeBaseUrl(defaultBaseUrl));\n  const persistor = createSessionPersistor(storage);\n  const middlewareFor = createMiddlewareFor(middlewares);\n  const credentials = createCredentials({\n    state,\n    persistor,\n    middlewares: middlewareFor('auth'),\n    mode,\n    // Read at call time, so it reaches the `perProject` built below.\n    onSignedOut: (baseUrl) => perProject.forgetUnder(baseUrl),\n  });\n\n  const perStack = createPerStack({ state, credentials, middlewareFor });\n  const perProject = createPerProject({\n    state,\n    credentials,\n    middlewareFor,\n    stack: perStack,\n    clientServiceUrls,\n    // Pinned: throws once its project closes rather than following a replacement.\n    buildApi: (project) =>\n      createApiFor({\n        stackUrl: () => project.baseUrl,\n        project: () => Result.unwrap(state.projects.get(project.id)),\n        pinned: true,\n      }),\n  });\n\n  state.store.subscribe(perStack.context.subscriber);\n  // The default stack is in the table from the start, so no change announces it.\n  perStack.context.subscriber(state.store.get());\n  state.store.subscribe(perProject.context.subscriber);\n\n  const selectStack = (baseUrl: string): Stack =>\n    Result.unwrap(state.scope.selectStack(normalizeBaseUrl(baseUrl)));\n\n  const selectProject = (projectId: ProjectId): Project =>\n    Result.unwrap(state.scope.selectProject(projectId));\n\n  /** The scoped stack, or a named one — normalised to key like `select`. */\n  const requireStackUrl = (baseUrl?: string): BaseUrl =>\n    baseUrl === undefined ? state.scope.getActiveStack().baseUrl : normalizeBaseUrl(baseUrl);\n\n  /** The scoped project, or the row a table id names — on whichever stack that is. */\n  const requireProjectEntry = (id?: ProjectEntryId): Project =>\n    id === undefined\n      ? Result.unwrap(state.scope.requireActiveProject())\n      : Result.unwrap(state.projects.get(id));\n\n  /**\n   * The scoped project, or a named open one.\n   *\n   * - An id is ambiguous across stacks: the active stack decides, else the single one open elsewhere.\n   */\n  const requireProject = (projectId?: ProjectId): Project => {\n    if (projectId === undefined) return Result.unwrap(state.scope.requireActiveProject());\n\n    const scoped = state.projects.get(Entry.projectEntryId(requireStackUrl(), projectId));\n    if (scoped.success) return scoped.data;\n\n    const [only, ...rest] = state.projects.findAll(projectId);\n    return only !== undefined && rest.length === 0 ? only : Result.unwrap(scoped);\n  };\n\n  /**\n   * Auth headers for a non-fetch transport (the chat stream).\n   *\n   * - A read, not a rotation: no middleware recovers a 401 there; the fetch clients keep it fresh.\n   */\n  const getAuthHeaders = (projectId?: ProjectId): Record<string, string> => {\n    const project = requireProject(projectId);\n    const credential = Result.unwrap(state.auth.requireCredential(project.baseUrl));\n    return {\n      [HttpHeader.AUTHORIZATION]: `Bearer ${credential.accessToken}`,\n      [KeboolaHttpHeader.PROJECT_ID]: String(project.projectId),\n    };\n  };\n\n  /**\n   * A login or MFA-verify response, taken as the credential it carries.\n   *\n   * - `refreshToken` is optional: cookie mode omits it, and MFA verify can't tell the mode.\n   * - A `token` credential without one is refused here — it would die at its first refresh.\n   * - So is a rotating kind other than the client's `credentials` mode.\n   */\n  type AuthenticateInput =\n    | (Omit<TokenCredentialInput, 'refreshToken'> & { refreshToken?: string | null })\n    | Exclude<CredentialInput, { type: 'token' }>;\n\n  const authenticate = (input: AuthenticateInput): Stack => {\n    const stack = state.scope.getActiveStack();\n    if (input.type !== 'static' && input.type !== mode) {\n      throw new KeboolaError(KeboolaErrorType.CredentialKindMismatch);\n    }\n    if (input.type !== 'token') return Result.unwrap(state.auth.authenticate(stack.baseUrl, input));\n\n    const { refreshToken } = input;\n    if (!refreshToken) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);\n    return Result.unwrap(state.auth.authenticate(stack.baseUrl, { ...input, refreshToken }));\n  };\n\n  /**\n   * The flat product surface: `auth` and `management` per stack, the rest per project.\n   *\n   * - Both resolvers run per property read: that re-points the active handle and makes a pinned\n   *   one throw once its project is gone.\n   */\n  const createApiFor = (resolve: {\n    stackUrl: () => BaseUrl;\n    project: () => Project;\n    /** One project's handle: its `auth` / `management` throw once that project closes. */\n    pinned?: boolean;\n  }): KeboolaApi =>\n    new Proxy({} as KeboolaApi, {\n      get: (_target, property) => {\n        if (isBuiltInProperty(property)) return undefined;\n\n        if (property === 'auth' || property === 'management') {\n          if (resolve.pinned) resolve.project();\n          return perStack.get(resolve.stackUrl())[property];\n        }\n\n        const derived = perProject.get(resolve.project());\n        if (property === 'context') return derived.context;\n        if (property === 'storage') return derived.storage;\n\n        const { client, meta } = derived.clients;\n        if (property === 'serviceMeta') return meta;\n\n        return client[property as keyof ServiceClients];\n      },\n    });\n\n  // Outside `perProject`: it names no project, so no project's teardown reaches it.\n  const activeApi = createApiFor({\n    stackUrl: () => state.scope.getActiveStack().baseUrl,\n    project: () => Result.unwrap(state.scope.requireActiveProject()),\n  });\n\n  /** The scoped project's surface. Re-points when the scope moves. */\n  const getActiveApi = (): KeboolaApi => activeApi;\n\n  /**\n   * One project's surface, on the active stack — one credential serves all of them.\n   *\n   * - Pinned: never re-points; stops once the project closes (`session.project.close`, sign-out).\n   * - Memoised per project: a React `key` or a hook dep compares handles by identity.\n   */\n  const getApi = (projectId: ProjectId): KeboolaApi => {\n    const { baseUrl } = state.scope.getActiveStack();\n    const project = Entry.project(baseUrl, projectId);\n\n    // Attempted, not required: must not throw mid-restore. The row appears when the sign-in\n    // lands; until then reads throw, as for a closed project.\n    Result.unwrapOr(state.projects.open(baseUrl, projectId), null);\n\n    return perProject.get(project).api;\n  };\n\n  /** The scope's sign-in, or a named stack's — and everything that sign-in derived. */\n  const signOut = (baseUrl?: string): Stack => {\n    const target = requireStackUrl(baseUrl);\n\n    // Teardown rides `credentials.signOut`: an expiry skips this path.\n    return Result.unwrap(credentials.signOut(target));\n  };\n\n  /**\n   * `input` replaces the active stack's sign-in, whatever it holds.\n   *\n   * - Signs out first, always: a sign-out moves the epoch even on an anonymous stack, so a stored\n   *   session still being restored cannot land on top of this one.\n   */\n  const replace = (input: AuthenticateInput): Stack => {\n    signOut();\n    return authenticate(input);\n  };\n\n  /**\n   * A server-injected `token` credential, adopted whatever this client's mode.\n   *\n   * @deprecated Temporary, for the agent-project claim page only: Connection injects an API-mode\n   * session through `UiConfig.programmaticAuth`. Remove together with that injection.\n   *\n   * - Replaces the active stack's sign-in, like `replace`.\n   * - A cookie-mode client never rotates it, so it lasts as long as its access token.\n   */\n  const adoptInjected = (input: TokenCredentialInput): Stack => {\n    signOut();\n    return Result.unwrap(state.auth.authenticate(getActiveStack().baseUrl, input));\n  };\n\n  /**\n   * Leave one project: its row and everything built for it; its handles stop answering.\n   *\n   * - Counterpart of `getApi(projectId)`; without it the project is held and persisted until sign-out.\n   */\n  const closeProject = (projectId: ProjectId): Project | null => {\n    const id = Entry.projectEntryId(requireStackUrl(), projectId);\n    const closed = Result.unwrapOr(state.projects.close(id), null);\n    if (closed === null) return null;\n\n    perProject.forget(id);\n    return closed;\n  };\n\n  // A stack is always active, so the active one cannot be closed — select another first.\n  const closeStack = (baseUrl: string): Stack | null => {\n    const target = normalizeBaseUrl(baseUrl);\n    if (state.scope.get().baseUrl === target) throw new KeboolaError(KeboolaErrorType.StackActive);\n\n    const closed = Result.unwrapOr(state.stacks.close(target), null);\n    if (closed === null) return null;\n\n    // `state.stacks.close` has already dropped the project rows.\n    perProject.forgetUnder(target);\n    perStack.forget(target);\n    // Before a reopen: an in-flight rotation must not write into the next sign-in here.\n    credentials.forget(target);\n\n    return closed;\n  };\n\n  let persisting = false;\n  /**\n   * Persistence starts only once the restore has settled.\n   *\n   * - Mid-hydration an unexchanged stack is `anonymous`; `durableCredential` would erase the\n   *   refresh token the exchange is about to spend.\n   * - Writes the settled table once: the subscription fires only on the next change.\n   */\n  const enablePersistence = () => {\n    // A failed resume is retried, and each attempt lands here again.\n    if (persisting) return;\n    persisting = true;\n\n    persistor.persist(state.store.get());\n    state.store.subscribe(persistor.persist);\n  };\n\n  /**\n   * The same, deferred until a sign-in.\n   *\n   * - After an unreachable restore the table is anonymous but the stored token is still good;\n   *   writing earlier would drop it.\n   */\n  const enablePersistenceOnSignIn = () => {\n    const stop = state.store.subscribe((next) => {\n      if (!Object.values(next.stacks).some(({ auth }) => auth.status === 'authenticated')) return;\n\n      stop();\n      enablePersistence();\n    });\n  };\n\n  // Rebuilds the stored stacks, credentials and open projects; `lastActive` is the scope they were\n  // stored under, `null` only when nothing was.\n  const restore = lazy(() =>\n    credentials.restore().then(\n      (restored) => {\n        if (restored.status === 'unreachable') enablePersistenceOnSignIn();\n        else enablePersistence();\n\n        return restored;\n      },\n      (error: unknown) => {\n        // Not `enablePersistence`: writing the half-restored table now would erase the very session\n        // the retry `lazy` allows is meant to read.\n        enablePersistenceOnSignIn();\n        throw error;\n      },\n    ),\n  );\n\n  const getActiveStack = state.scope.getActiveStack;\n\n  const isAuthenticated = () => getActiveStack().auth.status === 'authenticated';\n\n  /**\n   * Picks up where the stored session left off, once.\n   *\n   * 1. A stored stack becomes active again, with its project if its credential came back.\n   * 2. Nothing stored, or the restore failed: `defaultBaseUrl` stays active; a failure rethrows.\n   * 3. The caller got there first (a select, sign-in or sign-out): its scope and sign-ins stand.\n   *\n   * - Resolves with the stored credential's fate — only this tells `expired` from `empty`.\n   * - Other stacks still come back, persistence still starts; repeat calls share one promise.\n   */\n  const resume = lazy(() =>\n    restore().then(({ lastActive, status }): RestoreStatus => {\n      if (!lastActive || callerScoped) return status;\n\n      const stack = selectStack(lastActive.baseUrl);\n      if (lastActive.projectId !== null && stack.auth.status === 'authenticated')\n        selectProject(lastActive.projectId);\n\n      return status;\n    }),\n  );\n\n  // Set by the public verbs that pick a scope or change a sign-in — the default the table starts on,\n  // the resume's own re-scope and the restore's sign-ins are not a caller's choice.\n  let callerScoped = false;\n  const byCaller =\n    <A extends unknown[], R>(verb: (...args: A) => R) =>\n    (...args: A): R => {\n      callerScoped = true;\n      return verb(...args);\n    };\n\n  return {\n    getActiveApi,\n    getApi,\n    session: {\n      getState: state.store.get,\n      subscribe: state.store.subscribe,\n      resume,\n\n      stack: {\n        getActive: getActiveStack,\n        select: byCaller(selectStack),\n        close: closeStack,\n        retryContext: perStack.context.retry,\n        getContext: (baseUrl?: string) => perStack.context.get(requireStackUrl(baseUrl)),\n        getContextAsync: (baseUrl?: string) => perStack.context.getAsync(requireStackUrl(baseUrl)),\n      },\n\n      project: {\n        select: byCaller(selectProject),\n        close: closeProject,\n        // Still signed in — the scope falls back to the project's stack.\n        deactivate: state.scope.deactivate,\n        // Keyed by table id: reads a row on any stack, unlike `getApi` and `auth.getHeaders`.\n        retryContext: perProject.context.retry,\n        getContext: (id?: ProjectEntryId) => perProject.context.get(id ?? requireProjectEntry().id),\n        // Starts a fetch, so `errored` goes back to `pending`. A stale id throws here, while\n        // `getContext` answers `null`.\n        getContextAsync: (id?: ProjectEntryId) =>\n          perProject.context.getAsync(requireProjectEntry(id)),\n      },\n\n      auth: {\n        authenticate: byCaller(authenticate),\n        replace: byCaller(replace),\n        adoptInjected: byCaller(adoptInjected),\n        signOut: byCaller(signOut),\n        /** Whether the active stack holds a credential — `restoring` is not one yet. */\n        isAuthenticated,\n        isAuthenticatedAsync: () => resume().then(isAuthenticated),\n        rotate: (baseUrl: string) => credentials.rotate(baseUrl).then(Result.unwrap),\n        getHeaders: getAuthHeaders,\n      },\n    },\n  };\n};\n","import { ApiError } from '../errors';\nimport { type HttpMethod, isApiError, type MiddlewareFn } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\nimport { generateUUID } from '../utils';\n\nconst CORRELATION_ID_HEADER = 'X-Correlation-ID';\n\nconst ALWAYS_REDACTED_HEADERS = [\n  KeboolaHttpHeader.MANAGEMENT_API_TOKEN,\n  KeboolaHttpHeader.STORAGE_API_TOKEN,\n  'authorization',\n  'cookie',\n  'set-cookie',\n];\n\nconst ALWAYS_REDACTED_QUERY_PARAMS = new Set([\n  'token',\n  'apikey',\n  'api_key',\n  'access_token',\n  'refresh_token',\n  'code',\n  'state',\n  'signature',\n  'sig',\n  'x-amz-signature',\n  'x-amz-credential',\n  'x-amz-security-token',\n  'password',\n  'secret',\n]);\n\nconst REDACTED = '[REDACTED]';\n\nconst getRedactedUrl = (rawUrl: string): string => {\n  const url = new URL(rawUrl);\n  if (url.username) url.username = REDACTED;\n  if (url.password) url.password = REDACTED;\n\n  url.searchParams.forEach((_value, key) => {\n    if (ALWAYS_REDACTED_QUERY_PARAMS.has(key.toLowerCase())) {\n      url.searchParams.set(key, REDACTED);\n    }\n  });\n  return url.toString();\n};\n\n// Returns the request's correlation ID, generating and attaching one if missing.\n//\n// Forwarded via the X-Correlation-ID header so downstream services log the same ID,\n// letting all log lines for a single user action be stitched together across service\n// boundaries. Reuse when the caller already set one (preserves the chain inside a\n// larger trace); otherwise mint a fresh UUID to start a new trace.\nconst ensureCorrelationId = (request: Request): string => {\n  const correlationId = request.headers.get(CORRELATION_ID_HEADER) ?? generateUUID();\n  request.headers.set(CORRELATION_ID_HEADER, correlationId);\n  return correlationId;\n};\n\nconst getRedactedHeaders = (headers: Headers, redacted: string[]): Record<string, string> => {\n  const redactedSet = new Set(\n    [...ALWAYS_REDACTED_HEADERS, ...redacted].map((h) => h.toLowerCase()),\n  );\n\n  const result: Record<string, string> = {};\n  headers.forEach((value, name) => {\n    result[name] = redactedSet.has(name.toLowerCase()) ? REDACTED : value;\n  });\n  return result;\n};\n\nexport type RequestLog = {\n  url: string;\n  headers: Record<string, string>;\n};\n\nexport type ResponseLog = {\n  status: number;\n  statusText: string;\n  headers: Record<string, string>;\n};\n\ntype BaseLog = {\n  correlationId: string;\n  method: HttpMethod;\n  durationMs: number;\n  request: RequestLog;\n};\n\ntype SuccessLog = BaseLog & {\n  response: ResponseLog;\n};\n\ntype ErrorLog = BaseLog & {\n  error: Error;\n};\n\nexport type Log = SuccessLog | ErrorLog;\n\nexport type Logger = {\n  info?: (log: SuccessLog) => void;\n  error?: (log: ErrorLog) => void;\n};\n\nexport type LogLevel = 'error-only' | 'all';\n\nexport type LoggingOptions = {\n  logger?: Logger;\n  level?: LogLevel;\n  redactHeaders?: string[];\n};\n\nconst getRequestLog = (request: Request, redactedHeaders: string[]): RequestLog => ({\n  url: getRedactedUrl(request.url),\n  headers: getRedactedHeaders(request.headers, redactedHeaders),\n});\n\nconst getResponseLog = (response: Response, redactedHeaders: string[]): ResponseLog => ({\n  status: response.status,\n  statusText: response.statusText,\n  headers: getRedactedHeaders(response.headers, redactedHeaders),\n});\n\n// On failure the logger receives the thrown error itself, but an ApiError carries the raw\n// fetch Request/Response whose headers were never redacted (only the middleware's own log\n// payload is). Hand the logger a copy with the same redaction applied to its headers and URL;\n// the original error is still thrown untouched so error handlers keep full fidelity.\nconst redactApiError = (error: ApiError, redactedHeaders: string[]): ApiError =>\n  new ApiError({\n    request: new Request(getRedactedUrl(error.request.url), {\n      method: error.request.method,\n      headers: getRedactedHeaders(error.request.headers, redactedHeaders),\n    }),\n    response: new Response(null, {\n      status: error.response.status,\n      statusText: error.response.statusText,\n      headers: getRedactedHeaders(error.response.headers, redactedHeaders),\n    }),\n    data: error.data,\n  });\n\nconst formatLog = (level: 'info' | 'error', log: Log): string => {\n  const parts = [`[${level.toUpperCase()}]`, `${Math.round(log.durationMs)}ms`, log.method];\n  parts.push(log.request.url);\n  if ('response' in log) parts.push(String(log.response.status));\n  return parts.join(' ');\n};\n\nconst createSafeLogger = (logger?: Logger, level: LogLevel = 'error-only'): Required<Logger> => {\n  return {\n    info: (log) => {\n      if (level !== 'all') return;\n      try {\n        if (logger?.info) {\n          logger.info(log);\n          return;\n        }\n\n        console.info(formatLog('info', log));\n      } catch {\n        /* never let logging break the request */\n      }\n    },\n    error: (log) => {\n      try {\n        if (logger?.error) {\n          logger.error(log);\n          return;\n        }\n\n        console.error(formatLog('error', log));\n      } catch {\n        /* never let logging break the request */\n      }\n    },\n  };\n};\n\nexport const createLoggingMiddleware = (options: LoggingOptions = {}): MiddlewareFn => {\n  const safeLogger = createSafeLogger(options.logger, options.level);\n  const redactHeaders = options.redactHeaders ?? [];\n\n  return (next) => async (fetchRequest) => {\n    const correlationId = ensureCorrelationId(fetchRequest.request);\n    const start = performance.now();\n    const method = fetchRequest.request.method.toLowerCase() as HttpMethod;\n    const requestLog = getRequestLog(fetchRequest.request, redactHeaders);\n\n    try {\n      const result = await next(fetchRequest);\n      safeLogger.info({\n        correlationId,\n        method,\n        durationMs: performance.now() - start,\n        request: requestLog,\n        response: getResponseLog(result.response, redactHeaders),\n      });\n      return result;\n    } catch (error) {\n      if (error instanceof Error)\n        safeLogger.error({\n          correlationId,\n          method,\n          durationMs: performance.now() - start,\n          request: requestLog,\n          error: isApiError(error) ? redactApiError(error, redactHeaders) : error,\n        });\n\n      throw error;\n    }\n  };\n};\n","import { ApiError } from '../errors';\nimport type { MiddlewareFn } from '../fetchClient';\nimport { HttpStatus } from '../internal';\nimport { delay } from '../utils';\n\nconst DEFAULT_MAX_RETRIES = 5;\nconst DEFAULT_RETRYABLE_STATUSES: number[] = [\n  HttpStatus.INTERNAL_SERVER_ERROR,\n  HttpStatus.BAD_GATEWAY,\n  HttpStatus.SERVICE_UNAVAILABLE,\n  HttpStatus.GATEWAY_TIMEOUT,\n];\nconst DEFAULT_BACKOFF_FACTOR = 0.3;\n\nexport type RetryOptions = {\n  maxRetries?: number;\n  backoffFactor?: number;\n  shouldRetry?: (error: unknown, attempt: number) => boolean;\n};\n\nconst defaultShouldRetry = (error: unknown): boolean =>\n  error instanceof ApiError && DEFAULT_RETRYABLE_STATUSES.includes(error.response.status);\n\nexport const createRetryMiddleware = (options?: RetryOptions): MiddlewareFn => {\n  const {\n    maxRetries = DEFAULT_MAX_RETRIES,\n    backoffFactor = DEFAULT_BACKOFF_FACTOR,\n    shouldRetry = defaultShouldRetry,\n  } = options ?? {};\n\n  if (!Number.isInteger(maxRetries) || maxRetries < 0) {\n    throw new RangeError('maxRetries must be a non-negative integer');\n  }\n  if (!Number.isFinite(backoffFactor) || backoffFactor < 0) {\n    throw new RangeError('backoffFactor must be a finite non-negative number');\n  }\n\n  return (next) => async (request) => {\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      try {\n        return await next({ ...request, request: request.request.clone() });\n      } catch (error) {\n        if (attempt === maxRetries || !shouldRetry(error, attempt)) {\n          throw error;\n        }\n\n        const delayMs = backoffFactor * 1000 * Math.pow(2, attempt);\n        await delay(delayMs, request.request.signal ?? undefined);\n      }\n    }\n\n    throw new Error('unreachable');\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAgB,OAAU,OAA6B,SAAqC;CAC1F,IAAI,SAAS,MACX,MAAM,IAAI,MAAM,OAAO;AAE3B;;;;;;;;;;ACGA,MAAa,UACX,KACA,KACA,UACM;CACN,MAAM,WAAW,IAAI,IAAI,GAAG;CAC5B,IAAI,aAAa,KAAA,GAAW,OAAO;CAEnC,MAAM,UAAU,MAAM;CACtB,IAAI,IAAI,KAAK,OAAO;CAEpB,OAAO;AACT;;;;;;;;;;ACVA,MAAa,YAAe,SAAiD;CAC3E,IAAI,UAAU;CACd,MAAM,UAA8C,CAAC;CAErD,MAAM,QAAQ,YAAY;EACxB,UAAU;EACV,MAAM,QAAQ,QAAQ,OAAO,CAAC;EAE9B,IAAI;GACF,MAAM,SAAS,MAAM,KAAK;GAC1B,MAAM,SAAS,WAAW,OAAO,QAAQ,MAAM,CAAC;EAClD,SAAS,OAAO;GACd,MAAM,SAAS,WAAW,OAAO,OAAO,KAAK,CAAC;EAChD;EAEA,IAAI,QAAQ,SAAS,GAAG,OAAO,MAAM;EACrC,UAAU;CACZ;CAEA,aAAa;EACX,MAAM,SAAS,QAAQ,cAA0B;EACjD,QAAQ,KAAK,MAAM;EACnB,IAAI,CAAC,SAAS,MAAW;EACzB,OAAO,OAAO;CAChB;AACF;;;AChCA,MAAM,wBAAwB,UAA2B;CACvD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO;CACjC,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,MAAa,gBAAmB,GAAM,MAAkB;CACtD,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,OAAO;CAC5B,IAAI,OAAO,MAAM,YAAY,MAAM,QAAQ,OAAO,MAAM,YAAY,MAAM,MAAM,OAAO;CACvF,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,OAAO;CACjE,MAAM,QAAQ,OAAO,KAAK,CAAC;CAC3B,MAAM,QAAQ,OAAO,KAAK,CAAC;CAC3B,OAAO,MAAM,WAAW,MAAM,UAAU,MAAM,OAAO,QAAQ,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC;AACxF;AASA,MAAa,sBAA+B,EAC1C,QACA,WACA,OACA,YAAY,mBACwC;CACpD,IAAI,MAAM,UAAU,OAAO,IAAI,CAAC;CAChC,MAAM,QAAQA,cAAAA,YAAY,MAAM,GAAG,CAAC;CAKpC,MAAM,cAAc,OAAO,WAAW,UAAU;EAC9C,MAAM,OAAO,UAAU,KAAK;EAC5B,IAAI,UAAU,KAAK,IAAI,GAAG;EAC1B,MAAM;EACN,MAAM,IAAI,MAAM,IAAI,CAAC;CACvB,CAAC;CAED,MAAM,MAAM,MAAM;CAElB,MAAM,YAAY,MAAM;CAExB,MAAM,gBAAgB;EACpB,YAAY;EACZ,MAAM,QAAQ;CAChB;CAEA,OAAO;EAAE;EAAK;EAAW;CAAQ;AACnC;;;AC7BA,MAAa,2BAAoC,EAC/C,QACA,WACA,OACA,YAAY,mBAIT;CACH,MAAM,QAAQC,cAAAA,YAA2B,EAAE,OAAO,OAAO,CAAC;CAC1D,IAAI,aAAuB;CAC3B,IAAI,aAAa;CACjB,IAAI,aAAqC;CAEzC,MAAM,OAAO,QAAW;EACtB,YAAY,MAAM;EAClB,aAAa,IAAI,gBAAgB;EACjC,MAAM,gBAAgB,EAAE;EACxB,MAAM,IAAI,EAAE,OAAO,UAAU,CAAC;EAE9B,MAAM,KAAK,WAAW,MAAM,CAAC,CAAC,MAC3B,UAAU;GACT,IAAI,kBAAkB,YAAY,MAAM,IAAI;IAAE,OAAO;IAAS;GAAM,CAAC;EACvE,IACC,UAAU;GACT,IAAI,kBAAkB,YAAY,MAAM,IAAI;IAAE,OAAO;IAAW;GAAM,CAAC;EACzE,CACF;CACF;CAEA,MAAM,QAAQ,UAAa;EACzB,MAAM,OAAO,UAAU,KAAK;EAC5B,IAAI,SAAS,MAAM;GACjB,IAAI,eAAe,MAAM;GACzB,YAAY,MAAM;GAClB,aAAa;GACb,cAAc;GACd,aAAa;GACb,MAAM,IAAI,EAAE,OAAO,OAAO,CAAC;GAC3B;EACF;EACA,IAAI,eAAe,QAAQ,UAAU,YAAY,IAAI,GAAG;EACxD,aAAa;EACb,IAAI,IAAI;CACV;CACA,KAAK,OAAO,IAAI,CAAC;CAEjB,MAAM,cAAc,OAAO,UAAU,IAAI;CAEzC,MAAM,MAAM,MAAM;CAElB,MAAM,YAAY,MAAM;CAExB,MAAM,gBAAgB;EACpB,YAAY,MAAM;EAClB,YAAY;EACZ,MAAM,QAAQ;CAChB;CAEA,MAAM,WAAyC;EAAE;EAAK;EAAW;CAAQ;CAEzE,MAAM,gBACJ,IAAI,SAA0B,YAAY;EACxC,IAAI,2BAA2B,CAAC;EAChC,MAAM,SAAS,UAAyB;GACtC,IAAI,MAAM,UAAU,WAAW,MAAM,UAAU,WAAW;IACxD,mBAAmB;IACnB,QAAQ,KAAK;GACf;EACF;EACA,qBAAqB,MAAM,UAAU,KAAK;EAC1C,MAAM,MAAM,IAAI,CAAC;CACnB,CAAC;CAEH,OAAO;EAAE,OAAO;EAAU;CAAQ;AACpC;;;ACxFA,MAAM,gBAAgB;AAmBtB,MAAM,cAAc,EAAE,eACpB,SAAS,UAAU,UAAU,SAAS,UAAU;AAElD,MAAa,sBAAsB,EAAE,QAAQ,kBAAkB,CAAC,MAAoB;CAClF,MAAM,UAAUC,cAAAA,YAAyB,CAAC,CAAC;CAC3C,MAAM,+BAAe,IAAI,IAAwB;CAEjD,MAAM,aAAaC,kBAAAA,MAAMC,kBAAAA,SAAS,OAAO,aAAa,GAAG,CAAC;CAC1D,IAAI,UAAU;CAEd,MAAM,UAAU,QAAgB;EAC9B,aAAa,IAAI,GAAG,CAAC,GAAG;EACxB,aAAa,OAAO,GAAG;CACzB;CAEA,MAAM,QAAQ,SAAsB;EAClC,IAAI,OAAO;EAEX,OAAO,KAAK,SAAS,YAAY;GAC/B,MAAM,UAAU,KAAK,SAAS,UAAU,KAAK,KAAK,GAAG,EAAE;GAEvD,IAAI,CAAC,SAAS;GAEd,OAAO,QAAQ,GAAG;GAClB,OAAO,KAAK,QAAQ,UAAU,UAAU,OAAO;EACjD;EAEA,OAAO;CACT;CAEA,MAAM,WAAW,KAAa,aAC5B,QAAQ,IAAI,QAAQ,IAAI,CAAC,CAAC,KAAK,UAAW,MAAM,QAAQ,MAAM;EAAE,GAAG;EAAO;CAAS,IAAI,KAAM,CAAC;CAEhG,MAAM,YAAY,WAA2B;EAC3C,MAAM,MAAM;EACZ,MAAM,QAAmB;GACvB;GACA,WAAW,KAAK,IAAI;GACpB,UAAU,OAAO,MAAM;GACvB,MAAM,OAAO;GACb,OAAO,OAAO;EAChB;EAEA,aAAa,IACX,KACA,OAAO,WAAW,aAAa,QAAQ,KAAK,QAAQ,CAAC,CACvD;EACA,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC;CAC7C;CAEA,MAAM,gBAAgB;EACpB,kBAAA,QAAQ,UAAU,QAAQ;CAC5B;CAEA,OAAO;EACL,MAAM,QAAQ;EACd;EACA,YAAY,aAAa,QAAQ,gBAAgB,SAAS,CAAC;EAC3D,aAAa;GACX,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,OAAO,GAAG,CAAC;GAC9C,QAAQ,IAAI,CAAC,CAAC;EAChB;EACA,UAAU,WAAW,QAAQ,IAAI,CAAC,CAAC,SAAS,UAAU,MAAM,KAAK,MAAM,CAAC;CAC1E;AACF;;;;;;;;;ACtFA,MAAa,aACX,MACA,UACM;CACN,MAAM,MAA+B,EAAE,GAAG,KAAK;CAE/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,UAAU,IAAI;EACpB,IAAI,OAAOC,sBAAAA,cAAc,OAAO,KAAKA,sBAAAA,cAAc,KAAK,IAAI,UAAU,SAAS,KAAK,IAAI;CAC1F;CAEA,OAAO;AACT;;;ACXA,MAAa,2BAA2C;CACtD,eAAe;CACf,eAAe,CAAC;CAChB,kBAAkB,CAAC;AACrB;AAIA,MAAa,4BAA4C;CACvD,MAAM,wBAAQ,IAAI,IAAoB;CACtC,OAAO;EACL,UAAU,QAAQ,MAAM,IAAI,GAAG,KAAK;EACpC,UAAU,KAAK,UAAU;GACvB,MAAM,IAAI,KAAK,KAAK;EACtB;EACA,aAAa,QAAQ;GACnB,MAAM,OAAO,GAAG;EAClB;CACF;AACF;AAOA,MAAM,oBAAoB,SAA+C;CACvE,IAAI,MAAsB;CAC1B,IAAI;EACF,MAAM,KAAK;EACX,IAAI,KAAK;GACP,MAAM,QAAQ;GACd,IAAI,QAAQ,OAAO,KAAK;GACxB,IAAI,WAAW,KAAK;EACtB;CACF,SAAS,KAAK;EACZ,QAAQ,KAAK,qEAAqE,GAAG;EACrF,MAAM;CACR;CACA,IAAI,CAAC,KAAK,OAAO,oBAAoB;CAErC,MAAM,UAAU;CAChB,OAAO;EACL,UAAU,QAAQ,QAAQ,QAAQ,GAAG;EACrC,UAAU,KAAK,UAAU;GACvB,QAAQ,QAAQ,KAAK,KAAK;EAC5B;EACA,aAAa,QAAQ;GACnB,QAAQ,WAAW,GAAG;EACxB;CACF;AACF;AAEA,MAAa,2BACX,uBAAwB,kBAAkB,aAAa,WAAW,eAAe,IAAK;AAExF,MAAa,6BACX,uBAAwB,oBAAoB,aAAa,WAAW,iBAAiB,IAAK;;;ACvC5F,MAAa,mBAAsB,EACjC,UAAU,kBAAkB,GAC5B,KACA,QACA,cACA,SAAS,KAAK,WACd,SAAS,KAAK,YACyB;CAEvC,MAAM,cAAoB;EACxB,IAAI;GACF,QAAQ,WAAW,GAAG;EACxB,SAAS,KAAK;GACZ,QAAQ,KAAK,qCAAqC,IAAI,IAAI,GAAG;EAC/D;CACF;CAGA,MAAM,0BAAmC;EACvC,IAAI;GACF,OAAO,CAAC,CAAC,QAAQ,QAAQ,GAAG;EAC9B,SAAS,KAAK;GACZ,QAAQ,KAAK,oCAAoC,IAAI,oBAAoB,GAAG;GAC5E,OAAO;EACT;CACF;CAEA,MAAM,gBAAmB;EACvB,IAAI;EACJ,IAAI;GACF,MAAM,QAAQ,QAAQ,GAAG;EAC3B,SAAS,KAAK;GACZ,QAAQ,KAAK,oCAAoC,IAAI,mBAAmB,GAAG;GAC3E,OAAO;EACT;EACA,IAAI,QAAQ,MAAM,OAAO;EAEzB,IAAI;EACJ,IAAI;GACF,UAAU,OAAO,GAAG;EACtB,SAAS,KAAK;GACZ,QAAQ,KAAK,sCAAsC,IAAI,eAAe,GAAG;GACzE,MAAM;GACN,OAAO;EACT;EAEA,MAAM,SAAS,OAAO,UAAU,OAAO;EACvC,IAAI,OAAO,SAAS,OAAO,OAAO;EAClC,MAAM;EACN,OAAO;CACT;CAEA,MAAM,WAAW,UAAmB;EAClC,IAAI;EACJ,IAAI;GACF,MAAM,OAAO,KAAK;EACpB,SAAS,KAAK;GACZ,QAAQ,KAAK,sCAAsC,IAAI,oBAAoB,GAAG;GAC9E;EACF;EACA,IAAI;GACF,QAAQ,QAAQ,KAAK,GAAG;EAC1B,SAAS,KAAK;GACZ,QAAQ,KAAK,qCAAqC,IAAI,IAAI,GAAG;EAC/D;CACF;CAEA,OAAO;EAAE;EAAS;EAAS;EAAO;CAAkB;AACtD;;;ACvFA,MAAM,kCAAkC,CAEtC,wBAEA,wCACF;AAEA,MAAa,iCAAiC,YAA8B;CAC1E,IAAI,QAAQ,WAAW,OAAO,OAAO;CACrC,MAAM,EAAE,aAAa,IAAI,IAAI,QAAQ,GAAG;CACxC,OAAO,gCAAgC,MAAM,YAAY,QAAQ,KAAK,QAAQ,CAAC;AACjF;AAEA,MAAM,kCAEF,eACA,oBAED,SACD,OAAO,YAAY;CACjB,MAAM,WAAW,MAAM,KAAK,OAAO;CAEnC,IAAI,cAAc,QAAQ,OAAO,GAAG,MAAM,eAAe;CACzD,OAAO;AACT;;;;AAKF,MAAa,qBAAqB,EAChC,cACA,aAII;CACJ,MAAM,QAAQC,cAAAA,YAAYC,gBAAAA,cAAc,EAAE,WAAW,aAAa,CAAC,CAAC;CACpE,MAAM,UAAU,SAAS,YAAY,MAAM,IAAIA,gBAAAA,cAAc,EAAE,WAAW,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC;CAC5F,MAAM,aAAa,+BAA+B,+BAA+B,OAAO;CACxF,OAAO;EAAE;EAAO,kBAAkB,MAAM,IAAI;EAAG,WAAW,MAAM;EAAW;EAAY;CAAQ;AACjG;;;;;;;AC7CA,MAAa,mBAAmB;CAC9B,cAAc;CACd,kBAAkB;CAClB,aAAa;CACb,sBAAsB;CACtB,gBAAgB;CAChB,mBAAmB;CACnB,gBAAgB;CAChB,WAAW;CACX,UAAU;CACV,wBAAwB;CACxB,aAAa;CACb,wBAAwB;AAC1B;AAIA,MAAM,WAA6C;EAChD,iBAAiB,eAAe;EAChC,iBAAiB,mBAAmB;EACpC,iBAAiB,cAChB;EACD,iBAAiB,uBAChB;EACD,iBAAiB,iBAAiB;EAClC,iBAAiB,oBAChB;EACD,iBAAiB,iBAChB;EACD,iBAAiB,YAAY;EAC7B,iBAAiB,WAAW;EAC5B,iBAAiB,yBAChB;EACD,iBAAiB,cAAc;EAC/B,iBAAiB,yBAChB;AACJ;AAEA,IAAa,eAAb,MAAa,qBAAqB,MAAM;CACtC;CAEA,YAAY,MAAwB;EAClC,MAAM,SAAS,KAAK;EACpB,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,OAAO,eAAe,MAAM,aAAa,SAAS;CACpD;AACF;AAEA,MAAa,kBAAkB,UAC7B,iBAAiB;;AAGnB,SAAgBC,SAAU,OAA6B,MAA4C;CACjG,IAAI,SAAS,MAAM,MAAM,IAAI,aAAa,IAAI;AAChD;;;AC3DA,MAAa,qBAAqB,aAChC,OAAO,aAAa,YACpB,aAAa,UACb,aAAa,iBACb,aAAa,cACb,aAAa;;;;AAKf,MAAa,qBAAwD,EACnE,aAGO;CACP,MAAM,eAAe,OAAiB,CAAC,MACrC,IAAI,YAAY,CAAC,GAAG;EAElB,MAAM,SAAS,SAAS;GAEtB,IAAI,kBAAkB,IAAI,GAAG,OAAO,KAAA;GACpC,OAAO,YAAY,CAAC,GAAG,MAAM,IAAI,CAAC;EACpC;EAEA,QAAQ,SAAS,WAAW,SAAS,OAAO,MAAM,IAAI;CACxD,CAAC;CAEH,OAAO,YAAY;AACrB;;;AC2BA,MAAa,qCAEV,EACC,mBACA,oBAC6D;CAC7D,MAAM,SAAS,WAAmB,eAChC,kBAAkB,EAChB,SAAS,MAAM,SAAS;EACtB,gBAAgB;GACd;GACA;GACA;GACA;EACF,CAAC;CACH,EACF,CAAC;CAEH,MAAM,UAAiD,CAAC;CAExD,MAAM,iBAAiB,EACrB,WACA,UACA,iBACyC;EACzC,MAAM,iBAAiB,kBAAkB,SAAS;EAClD,OAAO,iBAAiB,SAAS,cAAc,IAAI,MAAM,WAAW,UAAU;CAChF;CAGA,MAAM,WAAyD;EAC7D,MAAM,WAAW;GACf,QAAQ,KAAK,MAAM;GACnB,OAAO;EACT;EACA,aAAa;GACX,MAAM,YAAqC,CAAC;GAC5C,MAAM,aAAsC,CAAC;GAE7C,QAAQ,SAAS,WAAW;IAC1B,UAAU,OAAO,cAAc,cAAc,MAAM;IACnD,WAAW,KAAK;KACd,YAAY,OAAO;KACnB,WAAW,OAAO;KAClB,aAAa,CAAC,CAAC,kBAAkB,OAAO,SAAS;IACnD,CAAC;GACH,CAAC;GAKD,OAAO;IACL,QAAQ;IACR,MAAM;GACR;EACF;CACF;CAEA,OAAO;AACT;;;ACtFF,MAAa,aAAa,UACxB,IAAI,MAAM,CAAC,GAAiB,EAC1B,IAAI,SAAS,UAAU;CACrB,IAAI,kBAAkB,QAAQ,GAAG,OAAO,KAAA;CAExC,IAAI,aAAa,QAAQ;EACvB,MAAM,aAAa,MAAM,cAAc;EACvC,SAAO,YAAY,iBAAiB,YAAY;EAChD,OAAO;CACT;CAEA,IAAI,aAAa,cAAc;EAC7B,MAAM,aAAa,MAAM,oBAAoB;EAC7C,SAAO,YAAY,iBAAiB,iBAAiB;EACrD,OAAO;CACT;CAEA,MAAM,UAAU,MAAM,kBAAkB;CACxC,SAAO,SAAS,iBAAiB,QAAQ;CAEzC,OAAO,QAAQ;AACjB,EACF,CAAC;;;ACZH,MAAa,uBAAuB,gBAAyC;CAC3E,QAAQ,QAA0B,WAA2B,CAAC,MAAsB;EAClF,IAAI,MAAM,QAAQ,WAAW,GAAG,OAAO,CAAC,GAAG,UAAU,GAAG,WAAW;EAEnE,MAAM,MAAM,aAAa,OAAO,CAAC;EACjC,MAAM,WAAW,cAAc,WAAW,CAAC;EAC3C,OAAO;GAAC,GAAG;GAAU,GAAG;GAAK,GAAG;EAAQ;CAC1C;AACF;;;ACnCA,MAAa,qBAAqB;CAChC,MAAM,QAAQC,cAAAA,YAAmB;EAAE,SAAS;EAAM,WAAW;EAAM,iBAAiB;CAAK,CAAC;CAE1F,MAAM,cAAc,YAAoB;EACtC,MAAM,IAAI;GAAE,GAAG,MAAM,IAAI;GAAG;EAAQ,CAAC;CACvC;CAEA,MAAM,gBAAgB,WAA6D;EACjF,MAAM,UAAU,MAAM,IAAI;EAC1B,MAAM,IAAI;GACR,GAAG;GACH,WAAW,OAAO,aAAa,QAAQ;GACvC,iBAAiB,OAAO,mBAAmB,QAAQ;EACrD,CAAC;CACH;CAKA,MAAM,wBAAwB,MAAM,IAAI,CAAC,CAAC,aAAa;CACvD,MAAM,mBAAmB,cAAsB,MAAM,IAAI;EAAE,GAAG,MAAM,IAAI;EAAG;CAAU,CAAC;;CAGtF,MAAM,cAAqB,MAAM,IAAI;CAErC,OAAO;EAAE;EAAO;EAAY;EAAc;EAAiB;EAAiB;CAAM;AACpF;;;AC5BA,MAAa,uBAAuB,EAAE,kBAA2B;CAC/D,MAAM,gBAAgB,YAAY,MAAM,WAAW,OAAO,SAAS;CACnE,OAAO,eAAe,0CAA0C;CAEhE,MAAM,WAAW,aAA2C;EAC1D,IAAI,YAAY,QAAQ,aAAa,WAAW,OAAO;EACvD,OAAO,OAAO,QAAQ,MAAM,cAAc,KAAK,YAAY;CAC7D;CAEA,OAAO;EACL,IAAI,cAAc;EAClB,MAAM,cAAc;EACpB;EACA,QAAQ,aAA+B,QAAQ,QAAQ,MAAM;EAC7D,YAAY,aAA+B,QAAQ,QAAQ,MAAM;CACnE;AACF;;;ACrBA,MAAM,wBAAqC,EAEzC,kBAAkB,QAAQ,GAAG,IAAI,MACnC;AAOA,MAAa,eAAe,EAAE,WAAW,wBAAiC;CACxE,MAAM,EAAE,UAAU,YAAY,UAAU,GAAG,aAAa;CAExD,MAAM,aAAa,IAAI,IACrB,SAAS,KAAK,YAAY;EACxB,MAAM,cAAc,oBAAoB,QAAQ,GAAG,GAAG,QAAQ,GAAG;EACjE,MAAM,eAAe,sBAAsB,QAAQ,GAAG,GAAG,QAAQ,GAAG;EACpE,MAAM,MAAM,eAAe,gBAAgB,QAAQ;EACnD,OAAO,CAAC,QAAQ,IAAI,GAAG;CACzB,CAAC,CACH;CAEA,MAAM,eAAe,IAAI,IAAI,WAAW,KAAK,cAAc,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC;CACrF,MAAM,aAAa,IAAI,IAAI,QAAQ;CAEnC,MAAM,cAAc,GAAG,YAAsB;EAC3C,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,WAAW,IAAI,CAAC,CAAC;CAC/C;CAEA,MAAM,gBAAgB,GAAG,gBAA0B;EACjD,IAAI,YAAY,WAAW,GAAG,OAAO;EACrC,OAAO,YAAY,OAAO,MAAM,aAAa,IAAI,CAAC,CAAC;CACrD;CAEA,MAAM,gBAAgB,gBAAwB,aAAa,IAAI,WAAW,KAAK;CAE/E,MAAM,cAAc,cAAyB,WAAW,IAAI,SAAS;CAErE,MAAM,iBAAiB,cAAyB,WAAW,IAAI,SAAS,KAAK;CAE7E,OAAO;EACL,GAAG;EACH;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACtDA,MAAM,yBAAyB;;AAgB/B,MAAa,4BACX,QACA,WACyB;CACzB,MAAM,cAAc,IAAI,IAAI,OAAO,KAAK,eAAe,WAAW,IAAI,CAAC;CAEvE,OAAO,CAAC,GAAG,QAAQ,GAAG,OAAO,QAAQ,eAAe,CAAC,YAAY,IAAI,WAAW,IAAI,CAAC,CAAC;AACxF;;AAGA,MAAa,uBACX,QACA,WACoB;CACpB,MAAM,eAAe,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,MAAM,MAAM,MAAM,KAAK,CAAC,CAAC;CAC7E,MAAM,cAAc,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC;CAE7D,OAAO,CACL,GAAG,OAAO,KAAK,UACb,aAAa,IAAI,MAAM,IAAI,IAAI;EAAE,GAAG;EAAO,OAAO,aAAa,IAAI,MAAM,IAAI;CAAE,IAAI,KACrF,GACA,GAAG,OAAO,QAAQ,UAAU,CAAC,YAAY,IAAI,MAAM,IAAI,CAAC,CAC1D;AACF;;;;;;AAOA,MAAa,sBAAsB,EAAE,oBAA6B;CAChE,MAAM,UAAU,cAAc;CAC9B,MAAM,OAAO,cAAc;CAE3B,MAAM,gBAAgB,OACpB,UACA,aACA,aACG;EACH,MAAM,SAAS,MAAM,QAAQ,iBAAiB;GAC5C,aAAa;GACb;GACA;EACF,CAAC;EAED,MAAM,MAAM,OAAO,KAAK,MAAM,cAAc,UAAU,OAAO,WAAW,KAAK,OAAO,KAAK;EAEzF,MAAM,iBAAiB,OAAO,eAAe;EAC7C,MAAM,YAAY,KAAK,eAAe;EAGtC,OAAO;GACL,aAAc,MAAM,QAAQ,cAAc,IAAI,iBAAiB,CAAC;GAChE,QAAS,MAAM,QAAQ,SAAS,IAAI,YAAY,CAAC;EACnD;CACF;CAEA,MAAM,kBAAkB,OACtB,aACA,QACA,aAC0B;EAC1B,MAAM,SAAS,MAAM,QAAQ,oBAAoB;GAC/C;GACA,aAAa;GACb,MAAM;GACN,eAAe,EAAE,WAAW,YAAY;EAC1C,CAAC;EAED,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,uBAAuB;IAC5C,UAAU,OAAO,QAAQ;IACzB,aAAa;IACb,iBAAiB,OAAO;IACxB,MAAM;IACN,eAAe,EAAE,OAAO;GAC1B,CAAC;GAED,OAAO;IAAE,aAAa,OAAO;IAAI,mBAAmB,IAAI;GAAG;EAC7D,SAAS,OAAO;GAEd,MAAM,QACH,oBAAoB;IACnB;IACA,aAAa;IACb,UAAU,OAAO;GACnB,CAAC,CAAC,CACD,OAAO,iBAA0B;IAEhC,IAAI,iBAAiB,SAAS,MAAM,UAAU,KAAA,GAC5C,MAAM,QAAQ;GAElB,CAAC;GACH,MAAM;EACR;CACF;CAEA,OAAO;;EAEL,MAAM,OAAO,EACX,aACA,mBACA,WAAW,gBAKgB;GAC3B,MAAM,EAAE,aAAa,WAAW,MAAM,cAAc,aAAa,mBAAmB,QAAQ;GAE5F,OAAO,gBAAgB,aAAa,QAAQ,QAAQ;EACtD;;EAGA,OAAO,OAAO,EACZ,mBACA,gBACA,mBACA,gBACA,WAAW,gBAOgB;GAC3B,MAAM,CAAC,QAAQ,UAAU,MAAM,QAAQ,IAAI,CACzC,cAAc,mBAAmB,gBAAgB,QAAQ,GACzD,cAAc,mBAAmB,gBAAgB,QAAQ,CAC3D,CAAC;GAED,OAAO,gBACL,yBAAyB,OAAO,aAAa,OAAO,WAAW,GAC/D,oBAAoB,OAAO,QAAQ,OAAO,MAAM,GAChD,QACF;EACF;CACF;AACF;;;ACvHA,MAAM,YAAY,gBAA4B,SAC5C,OAAO,mBAAmB,WACtB,GAAG,iBAAiB,SACpB,YAAY,GAAG,MAAM,eAAe,IAAI;AAE9C,MAAa,wBAAwB,EACnC,SACA,MACA,mBACA,eACA,4BAEA,4BAA0D,CAAC,CAAC;CAC1D;CACA,gBAAgB,EAAE,WAAW,MAAM,iBAAiB;EAClD,MAAM,IAAIC,gBAAAA,wBAAwB,WAAW,MAAM,UAAU;CAC/D;AACF,CAAC,CAAC,CACC,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,oBAAAA,kBAAkB;EAChB,SAAS;EACT,aAAa,cAAc,SAAS,CAAC,qBAAqB,CAAC;EAC3D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,oBAAAA,wBAAwB;EACtB,SAAS;EACT,aAAa,cAAc,eAAe,CAAC,qBAAqB,CAAC;EACjE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CAGH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,mBAAAA,iBAAiB;EACf,SAAS,SAAS,gBAAgB,KAAK;EACvC,aAAa,cAAc,QAAQ,CAAC,qBAAqB,CAAC;EAC1D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,yBAAAA,uBAAuB;EACrB,SAAS;EACT,aAAa,cAAc,YAAY;CACzC,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,qBAAAA,mBAAmB;EACjB,SAAS;EACT,aAAa,cAAc,UAAU,CAAC,qBAAqB,CAAC;EAC5D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,oBAAAA,wBAAwB;EACtB,SAAS;EACT,aAAa,cAAc,eAAe,CAAC,qBAAqB,CAAC;EACjE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,wBAAAA,sBAAsB;EACpB,SAAS;EACT,aAAa,cAAc,aAAa,CAAC,qBAAqB,CAAC;EAC/D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,qBAAAA,yBAAyB;EACvB,SAAS;EACT,aAAa,cAAc,gBAAgB,CAAC,qBAAqB,CAAC;EAClE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,cAAAA,kBAAkB;EAChB,SAAS;EACT,aAAa,cAAc,SAAS,CAAC,qBAAqB,CAAC;EAC3D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,mBAAAA,iBAAiB;EACf,eAAe;EACf,SAAS;EACT,aAAa,cAAc,QAAQ,CAAC,qBAAqB,CAAC;EAC1D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,iBAAAA,eAAe;EACb,SAAS;EACT,aAAa,cAAc,MAAM,CAAC,qBAAqB,CAAC;EACxD;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CAGH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,yBAAAA,uBAAuB;EACrB,SAAS,SAAS,gBAAgB,aAAa;EAC/C,aAAa,cAAc,cAAc,CAAC,qBAAqB,CAAC;EAChE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,eAAAA,mBAAmB;EACjB,SAAS;EACT,aAAa,cAAc,UAAU,CAAC,qBAAqB,CAAC;EAC5D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,iBAAAA,qBAAqB;EACnB,SAAS;EACT,aAAa,cAAc,YAAY,CAAC,qBAAqB,CAAC;EAC9D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,6BAAAA,iCAAiC;EAC/B,SAAS;EACT,aAAa,cAAc,wBAAwB,CAAC,qBAAqB,CAAC;EAC1E,mBAAmB,cAAc,sBAAsB;EACvD;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,cAAAA,kBAAkB;EAChB,SAAS;EACT,aAAa,cAAc,SAAS,CAAC,qBAAqB,CAAC;EAC3D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,wBAAAA,sBAAsB;EACpB,SAAS;EACT,aAAa,cAAc,aAAa,CAAC,qBAAqB,CAAC;EAC/D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,qBAAAA,mBAAmB;EACjB,SAAS;EACT,aAAa,cAAc,UAAU,CAAC,qBAAqB,CAAC;EAC5D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,4BAAAA,0BAA0B;EACxB,SAAS;EACT,aAAa,cAAc,iBAAiB,CAAC,qBAAqB,CAAC;EACnE;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,sBAAAA,oBAAoB;EAClB,SAAS;EACT,aAAa,cAAc,WAAW,CAAC,qBAAqB,CAAC;EAC7D;CACF,CAAC;AACL,CAAC,CAAC,CACD,IAAI;CACH,WAAW;CACX,YAAY;CACZ,WAAW,mBACTC,kBAAAA,sBAAsB;EACpB,SAAS;EACT,aAAa,cAAc,aAAa,CAAC,qBAAqB,CAAC;EAC/D;CACF,CAAC;AACL,CAAC,CAAC,CACD,MAAM;;;AC3PX,MAAM,4BACH,cACA,UACA,YAAY;CACX,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,kBAAkB,mBAAmB,SAAS,CAAC;CAC3E,OAAO,KAAK,OAAO;AACrB;AAUF,MAAa,uBAAuB,OAAO,EACzC,SACA,iBACA,yBACA,eACA,wBACa;CACb,MAAM,OAAqB;EAAE,MAAM;EAAc,OAAO,gBAAgB;CAAE;CAE1E,MAAM,SAAS,yBAAyB,eAAe;CACvD,MAAM,WAAWC,gBAAAA,oBAAoB;EAAE;EAAS;EAAM,aAAa,CAAC,MAAM;CAAE,CAAC;CAC7E,MAAM,CAAC,WAAW,WAAW,eAAe,MAAM,QAAQ,IAAI;EAC5D,SAAS,aAAa,EAAE,SAAS,mBAAmB,CAAC;EACrD,SAAS,OAAO,OAAO;EACvB,SAAS,SAAS,eAAe;CACnC,CAAC;CAED,MAAM,QAAQ,YAAY;EAAE;EAAW;CAAkB,CAAC;CAC1D,MAAM,gBAAgB,oBAAoB,EAAE,YAAY,CAAC;CACzD,MAAM,cAAc,kBAAkB;EACpC,cAAc;EACd,cAAc,SAAS,OAAO,OAAO;CACvC,CAAC;CACD,MAAM,oBAAoB,mBAAmB;EAC3C,QAAQ,YAAY;EACpB,OAAOC,qBAAAA;EACP,YAAY,aAAa;GACvB,uBAAuB,CAAC,QAAQ,WAAWC,kBAAAA,eAAe,yBAAyB;GACnF,2BAA2B,QAAQ,WAAWA,kBAAAA,eAAe,yBAAyB;GACtF,oBAAoB,QAAQ,WAAWA,kBAAAA,eAAe,eAAe;EACvE;CACF,CAAC;CACD,MAAM,UAAyB;EAC7B,SAASC,0BAAAA,iBAAiB,OAAO;EACjC;EACA;EACA,IAAI,UAAU;GACZ,OAAO,YAAY,WAAW;EAChC;EACA,IAAI,KAAK;GACP,OAAO,kBAAkB,IAAI;EAC/B;CACF;CAGA,MAAM,UAAUH,gBAAAA,oBAAoB;EAClC;EACA;EACA,aAAa,cAAc,WAAW,CAAC,YAAY,UAAU,CAAC;EAC9D,gBAAgB;CAClB,CAAC;CAED,MAAM,EAAE,QAAQ,UAAU,MAAM,gBAAgB,qBAAqB;EACnE;EACA;EACA,mBAAmB,QAAQ,MAAM;EACjC;EACA,uBAAuB;CACzB,CAAC;CAED,MAAM,MAAM;EACV,eAAeI,uBAAAA,uBAAuB;GACpC,eAAe;GACf,kBAAkB,SAAS;GAC3B;EACF,CAAC;EACD,KAAKC,YAAAA,aAAa,EAAE,iBAAiB,SAAS,UAAU,CAAC;EACzD,eAAeC,sBAAAA,uBAAuB,EAAE,iBAAiB,SAAS,UAAU,CAAC;EAC7E,WAAWC,kBAAAA,mBAAmB,EAAE,iBAAiB,SAAS,UAAU,CAAC;EACrE,SAASC,0BAAAA,iBAAiB,EAAE,eAAe,QAAQ,CAAC;EACpD,OAAOC,wBAAAA,eAAe;GAAE,aAAa,SAAS;GAAO,kBAAkB,SAAS;EAAW,CAAC;EAC5F,WAAW,mBAAmB,EAAE,eAAe,QAAQ,CAAC;CAC1D;CAEA,OAAO;EAAE;EAAS;EAAa;EAAS,GAAG;EAAU;CAAI;AAC3D;;;AClGA,MAAa,uBAAuB,UAAgC,CAAC,MAAM;CACzE,MAAM,SAAS,aAAa;CAC5B,MAAM,gBAAgB,oBAAoB,QAAQ,WAAW;CAM7D,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,UAAU,MAAM;EAC5B,QAAQ,YACN,UAAUC,mBAAAA,iBAAiB;GAAE;GAAS,aAAa,cAAc,QAAQ,CAAC,CAAC;EAAE,CAAC,IAAI;CACtF,CAAC;CAED,MAAM,aAAa,mBAAmB;EACpC,QAAQ,OAAO;EACf,YAAY,WAAW;GAAE,SAAS,MAAM;GAAS,OAAO,MAAM;EAAgB;EAC9E,QAAQ,EAAE,SAAS,YACjB,UACIC,mBAAAA,uBAAuB;GACrB;GACA,MAAM,QAAQ;IAAE,MAAM;IAAoB;GAAM,IAAI,EAAE,MAAM,mBAAmB;GAC/E,aAAa,cAAc,cAAc,CAAC,CAAC;EAC7C,CAAC,IACD;CACR,CAAC;CAED,MAAM,QAAQ,wBAAuD;EACnE,QAAQ,OAAO;EACf,YAAY,UAAW,MAAM,aAAa,MAAM,UAAU,MAAM,UAAU;EAC1E,QAAQ,YACN,qBAAqB;GACnB;GACA,iBAAiB,OAAO;GACxB,yBAAyB,OAAO;GAChC;GACA,mBAAmB,QAAQ;EAC7B,CAAC;CACL,CAAC;CAED,IAAI,QAAQ,SAAS,OAAO,WAAW,QAAQ,OAAO;CAEtD,MAAM,cAA+B;EACnC,MAAM,OAAO,OAAO,MAAM;EAC1B,OAAO;GACL,MAAM;GACN,QAAQ;GACR,WAAW,WAAW,IAAI,MAAM;GAChC,iBAAiB,CAAC,CAAC,KAAK;GACxB,SAAS,MAAM,MAAM,IAAI,CAAC,CAAC;EAC7B;CACF;CAEA,MAAM,UAAU;EACd,YAAY,OAAO;EACnB,sBAAsB,MAAM,MAAM,IAAI,CAAC,CAAC,UAAU;EAClD,sBAAsB,cAAsB,OAAO,aAAa,EAAE,UAAU,CAAC;EAC7E,0BAA0B,OAAO,cAAsB;GACrD,OAAO,aAAa,EAAE,UAAU,CAAC;GAEjC,MAAM,MAAM,QAAQ;EACtB;EACA,yBAAyB,oBAA4B,OAAO,aAAa,EAAE,gBAAgB,CAAC;EAC5F,YAAY,aAAkD;GAE5D,MAAM,oBAAoB,OAAO,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACxE,MAAM,mBAAmB,MAAM,MAAM,gBAAgB,SAAS,MAAM,CAAC,CAAC;GACtE,aAAa;IACX,kBAAkB;IAClB,iBAAiB;GACnB;EACF;EACA;CACF;CAWA,OAAO;EAAE,KATG,UAAU;GACpB,qBAAqB,WAAW,IAAI;GACpC,2BAA2B,WAAW,IAAI;GAC1C,yBAAyB;IACvB,MAAM,QAAQ,MAAM,MAAM,IAAI;IAC9B,OAAO,MAAM,UAAU,UAAU,MAAM,QAAQ;GACjD;EACF,CAEW;EAAG;CAAQ;AACxB;;;ACzFA,MAAa,gBAAgB,eAC3B,WAAW,SAAS,UAChB;CAAE,MAAM;CAAS,cAAc,WAAW;AAAa,IACvD;CAAE,MAAM;CAAU,WAAW,WAAW;AAAU;AAExD,MAAa,QAAQ,OACnB,QACA,UACqC;CACrC,IAAI,MAAM,SAAS,UAAU;EAC3B,MAAM,EAAE,aAAa,WAAW,cAAc,MAAM,OAAO,MAAM,mBAAmB,EAClF,WAAW,MAAM,UACnB,CAAC;EACD,OAAO;GAAE,MAAM;GAAU;GAAa;GAAW;EAAU;CAC7D;CAEA,MAAM,EAAE,aAAa,WAAW,iBAAiB,MAAM,OAAO,MAAM,iBAAiB,EACnF,cAAc,MAAM,aACtB,CAAC;CACD,IAAI,CAAC,cAAc,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;CAC3E,OAAO;EAAE,MAAM;EAAS;EAAa;EAAW;CAAa;AAC/D;;;ACTA,MAAM,4BAA4B;AAiBlC,MAAM,oBAAoB,IAAI,aAAa,iBAAiB,WAAW;AAEvE,MAAa,qBAAqB,EAChC,OACA,WACA,aACA,OAAO,SACP,mBAAmB,2BACnB,kBACa;CACb,MAAM,8BAAc,IAAI,IAA4C;CAIpE,MAAM,8BAAc,IAAI,IAAqB;CAC7C,MAAM,gBAAgB,YAAqB,YAAY,IAAI,OAAO,KAAK;CAGvE,MAAM,UAAU,OACd,SACA,UAC6C;EAC7C,MAAM,SAASC,mBAAAA,iBAAiB;GAAE;GAAS;EAAY,CAAC;EACxD,MAAM,cAAcC,kBAAAA,OAAO,OAAO,MAAM,KAAK,SAAS,OAAO,CAAC;EAC9D,MAAM,mBAAmB,aAAa,OAAO;EAC7C,MAAM,YAAY,MAAMA,kBAAAA,OAAO,oBAAoB,MAAM,QAAQ,KAAK,CAAC;EAIvE,OAHmBA,kBAAAA,OAAO,SAAS,MAAM,KAAK,SAAS,OAAO,GAAG,EAEtD,MAAM,eAAe,aAAa,OAAO,MAAM,mBACjC,YAAYA,kBAAAA,OAAO,QAAQ,YAAY,CAAC;CACnE;;;;;;;CAQA,MAAM,UAAU,YAAqB;EACnC,YAAY,IAAI,SAAS,aAAa,OAAO,IAAI,CAAC;EAClD,YAAY,OAAO,OAAO;CAC5B;;;;;;;CAQA,MAAM,aAAa,OAAO,YAA8C;EACtE,MAAM,aAAa,MAAM,KAAK,oBAAoB,SAAS,IAAI;EAC/D,IAAI,CAAC,WAAW,SAAS,OAAO;EAEhC,MAAM,YAAY,MAAM,QAAQ,SAAS,aAAa,WAAW,IAAI,CAAC;EACtE,IAAI,CAAC,UAAU,SAAS;GACtB,IAAIC,mBAAAA,eAAe,UAAU,KAAK,GAAG,OAAO,OAAO;GACnD,OAAO;EACT;EAEA,OAAOD,kBAAAA,OAAO,IACZ,MAAM,KAAK,aAAa,SAAS,UAAU,IAAI,SACzC,UAAU,KAAK,WACvB;CACF;CAEA,MAAM,UAAU,YACd,OAAO,aAAa,eAAeE,eAAAA,aAAa,WAAW,OAAO,CAAC,CAAC,CAAC,CAAC;CAGxE,MAAM,eAAe,OAAO,SAAkB,UAA+C;EAE3F,IAAI,CADc,MAAM,KAAK,aAAa,OAC7B,CAAC,CAAC,SAAS,OAAO;EAE/B,MAAM,YAAY,MAAM,QAAQ,SAAS,KAAK;EAC9C,IAAI,CAAC,UAAU,SAAS;GACtB,MAAM,KAAK,cAAc,OAAO;GAEhC,OAAOD,mBAAAA,eAAe,UAAU,KAAK,IAAI,YAAY;EACvD;EAEA,MAAM,KAAK,aAAa,SAAS,UAAU,IAAI;EAC/C,OAAO;CACT;CAGA,MAAM,mBAAmB,SAAkB,aAAyC;EAClF,KAAK,MAAM,EAAE,eAAe,UAAU,MAAM,SAAS,KAAK,SAAS,SAAS;CAC9E;;;;;;;;;CAUA,MAAM,UAAU,YAGV;EACJ,MAAM,WAAW,UAAU,QAAQ;EAGnC,MAAM,SAAS,SAAS,OAAO,KAAK,UAClC,MAAM,cAAc,MAAM,WAAW,SAAS,YAAY,MAAM,WAAW,SAAS,OAChF;GAAE,GAAG;GAAO,YAAY;EAAK,IAC7B,KACN;EACA,MAAM,EAAE,YAAY;EACpB,MAAM,SAAS,OAAO,MAAM,EAAE,cAAc,YAAY,SAAS,OAAO;EAExE,MAAM,WAAW,OAAO,IACtB,OAAO,EAAE,SAAS,YAAY,eAAsC;GAClE,MAAM,OAAO,OAAO,OAAO;GAC3B,IAAI,CAAC,YAAY,OAAO;GAGxB,IAAID,kBAAAA,OAAO,SAAS,MAAM,KAAK,SAAS,OAAO,GAAG,CAAC,IAAI,GAAG,OAAO;GAGjE,MAAM,UACJ,WAAW,SAAS,WAChB,MAAM,KAAK,aAAa,SAAS,UAAU,CAAC,CAAC,UAC1C,aACA,YACH,MAAM,aAAa,SAAS,UAAU;GAE5C,IAAI,YAAY,YAAY,gBAAgB,SAAS,QAAQ;GAC7D,OAAO;EACT,CACF;EAEA,MAAM,UAAU,MAAM,QAAQ,IAAI,QAAQ;EAC1C,MAAM,UAAU,QAAQ,aAAa,QAAQ,OAAO,QAAQ,MAAM,KAAK,KAAA;EAUvE,OAAO;GAAE,YAAY;GAAS,QAR5B,YAAY,KAAA,KAAa,YAAY,YACjC,UACA,YAAY,aACV,aACA,YAAY,gBACV,gBACA;EAE2B;CACvC;CAEA,MAAM,WAAW,YAA8B;EAC7C,MAAM,SAASA,kBAAAA,OAAO,IACpB,MAAM,KAAK,oBAAoB,SAAS,IAAI,IAC3C,EAAE,UAAU,gBAAgB,KAAK,IAAI,KAAK,WAAW,YAAY,MAAO,gBAC3E;EACA,OAAOA,kBAAAA,OAAO,SAAS,QAAQ,KAAK;CACtC;CAGA,MAAM,WAAW,YAAqB;EACpC,YAAY,OAAO,OAAO;EAC1B,MAAM,YAAY,MAAM,KAAK,QAAQ,OAAO;EAC5C,cAAc,OAAO;EAErB,OAAO;CACT;CAGA,MAAM,UAAU,YAAqB;EACnC,IAAI,MAAM,KAAK,cAAc,OAAO,GAAG,QAAQ,OAAO;CACxD;CAGA,MAAM,cAAc,YAAqB,MAAM,KAAK,oBAAoB,SAAS,IAAI,CAAC,CAAC;CAEvF,MAAM,cAAc,YAClBG,mBAAAA,2BAA2B,EACzB,gBAAgB,OAAO,EAAE,eAAe,UAAU,CAAC,MAAM;EAEvD,IAAI,cAAc,OAAO,WAAW,OAAO,IAAIH,kBAAAA,OAAO,OAAO,MAAM,OAAO,OAAO,CAAC,IAAI;EACtF,IAAI,CAAC,QAAQ,OAAO,GAAG,OAAO,MAAM,KAAK,eAAe,OAAO;EAG/D,OAAOA,kBAAAA,OAAO,SAAS,MAAM,OAAO,OAAO,GAAG,MAAM,KAAK,eAAe,OAAO,CAAC;CAClF,EACF,CAAC;CAEH,OAAO;EAAE;EAAY;EAAQ;EAAS;EAAS;CAAO;AACxD;;;;;;;;;ACrMA,MAAM,kBAAkB,SAAkB,cACxC,GAAG,QAAQ,GAAG;;AAGhB,MAAM,sBAAsB,YAAqB,GAAG,QAAQ;AAE5D,MAAM,gBAAgB,aAAsB,OAC1C,GAAG,WAAW,mBAAmB,OAAO,CAAC;AAI3C,MAAM,uBAA6B,EAAE,QAAQ,YAAY;AAEzD,MAAM,uBAA6B,EAAE,QAAQ,YAAY;AAEzD,MAAM,qBAAqB,gBAAwC;CACjE,QAAQ;CACR;AACF;AAKA,MAAM,oBAAoB,UACxB,MAAM,SAAS,WAAW,QAAQ;CAAE,GAAG;CAAO,UAAU,KAAK,IAAI;AAAE;AAGrE,MAAM,qBAAqB,gBAAwD;CACjF,GAAG;CACH,UAAU,KAAK,IAAI,IAAI,WAAW,YAAY;AAChD;AAIA,MAAM,SAAS,aAA6B;CAC1C;CACA,SAAS;CACT,OAAO;CACP,MAAM,cAAc;AACtB;AAEA,MAAM,WAAW,SAAkB,eAAmC;CACpE,IAAI,eAAe,SAAS,SAAS;CACrC;CACA;CACA,SAAS;AACX;AAIA,MAAM,gBAAgB,aAAoC;CACxD;CACA,WAAW;AACb;AAEA,MAAM,kBAAkB,SAAkB,eAA0C;CAClF;CACA;AACF;AAIA,MAAM,SAAS,oBAAoC;CACjD,QAAQ,aAAa,cAAc;CACnC,QAAQ,GAAG,iBAAiB,MAAM,cAAc,EAAE;CAClD,UAAU,CAAC;AACb;AAEA,MAAa,QAAQ;CAEnB;CACA;CAGA;CACA;CAGA;CACA;CAGA;CAGA;CACA;CACA;CAGA;CACA;AACF;;;;;;;AAQA,MAAa,SAAS;CAEpB,wBAAwB,IAAI,aAAa,iBAAiB,gBAAgB;CAC1E,mBAAmB,IAAI,aAAa,iBAAiB,WAAW;;CAEhE,oBAAoB,IAAI,aAAa,iBAAiB,YAAY;CAClE,4BAA4B,IAAI,aAAa,iBAAiB,oBAAoB;CAClF,gBAAgB,IAAI,aAAa,iBAAiB,QAAQ;CAG1D,mBAAmB,4BAAqB,IAAI,MAAM,UAAU,QAAQ,4BAA4B;CAChG,eAAe,4BAAqB,IAAI,MAAM,UAAU,QAAQ,wBAAwB;CAGxF,2BAA2B,SAAkB,yBAC3C,IAAI,MAAM,UAAU,QAAQ,YAAY,KAAK,YAAY;CAC3D,wBAAwB,4BACtB,IAAI,MAAM,UAAU,QAAQ,4BAA4B;CAC1D,wBAAwB,MAAc,uBACpC,IAAI,MAAM,KAAK,KAAK,4BAA4B,IAAI;CAEtD,iBAAiB,uBAAuB,IAAI,MAAM,eAAe,GAAG,EAAE;AACxE;AAGA,MAAa,iBAAiB,SAC5B,KAAK,WAAW,kBACZI,kBAAAA,OAAO,QAAQ,KAAK,UAAU,IAC9BA,kBAAAA,OAAO,QAAQ,OAAO,iBAAiB,CAAC;;;;;;;AChJ9C,MAAa,0BAA0B;CACrC,MAAM,2BAAW,IAAI,IAAsB;CAE3C,OAAO;EACL,MAAM,YAAqB,SAAS,IAAI,SAAS,KAAK;EACtD,SAAS,YAAqB,SAAS,OAAO,OAAO;EACrD,SAAS,YAA8B;GACrC,IAAI,SAAS,IAAI,OAAO,GAAG,OAAO;GAClC,SAAS,IAAI,SAAS,IAAI;GAC1B,OAAO;EACT;CACF;AACF;;;;;;;AAgBA,MAAa,cAAc,EAAE,QAAQ,UAAU,aAAsB;CAEnE,MAAM,0BAA0B,YAC9BC,kBAAAA,OAAO,QAAQ,OAAO,IAAI,OAAO,IAAI,UACnC,MAAM,KAAK,WAAW,kBAClBA,kBAAAA,OAAO,QAAQ,OAAO,qBAAqB,CAAC,IAC5CA,kBAAAA,OAAO,QAAQ,KAAK,CAC1B;CAGF,MAAM,oBAAoB,YACxBA,kBAAAA,OAAO,QAAQ,uBAAuB,OAAO,IAAI,UAC/C,MAAM,KAAK,WAAW,cAClBA,kBAAAA,OAAO,QAAQ,OAAO,iBAAiB,OAAO,CAAC,IAC/CA,kBAAAA,OAAO,QAAQ,KAAK,CAC1B;CAEF,MAAM,oBAAoB,YACxBA,kBAAAA,OAAO,QAAQ,OAAO,IAAI,OAAO,IAAI,UACnC,MAAM,KAAK,WAAW,cAClBA,kBAAAA,OAAO,QAAQ,KAAK,IACpBA,kBAAAA,OAAO,QAAQ,OAAO,aAAa,OAAO,CAAC,CACjD;CAGF,MAAM,6BAA6B,YACjCA,kBAAAA,OAAO,QAAQ,OAAO,kBAAkB,OAAO,IAAI,eACjD,WAAW,SAAS,WAChBA,kBAAAA,OAAO,QAAQ,OAAO,sBAAsB,OAAO,CAAC,IACpDA,kBAAAA,OAAO,QAAQ,UAAU,CAC/B;CAGF,MAAM,uBAAuB,SAAkB,SAC7CA,kBAAAA,OAAO,QAAQ,0BAA0B,OAAO,IAAI,eAClD,WAAW,SAAS,OAChBA,kBAAAA,OAAO,QAAQ,UAAU,IACzBA,kBAAAA,OAAO,QAAQ,OAAO,yBAAyB,SAAS,WAAW,IAAI,CAAC,CAC9E;CAEF,MAAM,gBAAgB,YACpBA,kBAAAA,OAAO,IAAI,iBAAiB,OAAO,IAAI,UACrC,OAAO,IAAI;EAAE,GAAG;EAAO,MAAM,MAAM,cAAc;CAAE,CAAC,CACtD;CAGF,MAAM,iBAAiB,YACrBA,kBAAAA,OAAO,IAAI,iBAAiB,OAAO,IAAI,UACrC,OAAO,IAAI;EAAE,GAAG;EAAO,MAAM,MAAM,cAAc;CAAE,CAAC,CACtD;CAGF,MAAM,gBAAgB,SAAkB,UACtCA,kBAAAA,OAAO,IAAI,uBAAuB,OAAO,IAAI,UAAU;EACrD,OAAO,IAAI,OAAO;EAElB,OAAO,OAAO,IAAI;GAChB,GAAG;GACH,OAAO,MAAM,QAAQ;GACrB,MAAM,MAAM,kBAAkB,MAAM,iBAAiB,KAAK,CAAC;EAC7D,CAAC;CACH,CAAC;CAEH,MAAM,gBAAgB,SAAkB,UACtCA,kBAAAA,OAAO,QAAQ,0BAA0B,OAAO,IAAI,eAClD,WAAW,SAAS,MAAM,OACtBA,kBAAAA,OAAO,QAAQ,OAAO,sBAAsB,WAAW,MAAM,MAAM,IAAI,CAAC,IACxEA,kBAAAA,OAAO,IAAI,OAAO,IAAI,OAAO,IAAI,UAC/B,OAAO,IAAI;EAAE,GAAG;EAAO,MAAM,MAAM,kBAAkB,MAAM,iBAAiB,KAAK,CAAC;CAAE,CAAC,CACvF,CACN;CAEF,MAAM,eAAe,YACnBA,kBAAAA,OAAO,QAAQ,0BAA0B,OAAO,IAAI,eAClDA,kBAAAA,OAAO,IAAI,OAAO,IAAI,OAAO,IAAI,UAC/B,OAAO,IAAI;EACT,GAAG;EACH,MAAM,MAAM,kBAAkB,MAAM,kBAAkB,UAAU,CAAC;CACnE,CAAC,CACH,CACF;CAGF,MAAM,WAAW,YACfA,kBAAAA,OAAO,IAAI,OAAO,IAAI,OAAO,IAAI,UAAU;EACzC,SAAS,SAAS,OAAO;EAEzB,OAAO,OAAO,IAAI;GAAE,GAAG;GAAO,OAAO,MAAM,QAAQ;GAAG,MAAM,MAAM,cAAc;EAAE,CAAC;CACrF,CAAC;CAEH,MAAM,YAAY,YAAqBA,kBAAAA,OAAO,IAAI,OAAO,IAAI,OAAO,IAAI,UAAU,MAAM,KAAK;CAG7F,MAAM,kBAAkB,YACtBA,kBAAAA,OAAO,SACLA,kBAAAA,OAAO,IAAI,OAAO,kBAAkB,OAAO,IAAI,EAAE,kBAAkB,WAAW,GAC9E,IACF;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA,eAAe,OAAO;EACtB,mBAAmB,OAAO;EAC1B;EACA;EACA;EACA;CACF;AACF;;;;ACpIA,MAAa,kBAAkB,EAAE,OAAO,aAAsB;CAC5D,MAAM,OAAO,OAAgC,MAAM,MAAM,IAAI,CAAC,CAAC;CAE/D,MAAM,OAAO,OAAwC;EACnD,MAAM,UAAU,MAAM,IAAI,CAAC,CAAC,SAAS;EACrC,OAAO,UAAUC,kBAAAA,OAAO,QAAQ,OAAO,IAAIA,kBAAAA,OAAO,QAAQ,OAAO,eAAe,EAAE,CAAC;CACrF;CAEA,MAAM,QAAQ,YACZ,OAAO,OAAO,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,YAAY,QAAQ,YAAY,OAAO;;CAGrF,MAAM,WAAW,cACf,OAAO,OAAO,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,YAAY,QAAQ,cAAc,SAAS;CAEzF,MAAM,OAAO,YAA8B;EACzC,MAAM,QAAQ,MAAM,IAAI;EACxB,MAAM,IAAI;GAAE,GAAG;GAAO,UAAU;IAAE,GAAG,MAAM;KAAW,QAAQ,KAAK;GAAQ;EAAE,CAAC;EAC9E,OAAO;CACT;CAEA,MAAM,UAAU,IAAoB,YAClCA,kBAAAA,OAAO,IAAI,IAAI,EAAE,IAAI,YAAY,IAAI,QAAQ,OAAO,CAAC,CAAC;CAExD,MAAM,cAAc,KAAuB,eAAwB;EACjE,MAAM,QAAQ,MAAM,IAAI;EACxB,MAAM,WAAW,EAAE,GAAG,MAAM,SAAS;EACrC,KAAK,MAAM,MAAM,KAAK,OAAO,SAAS;EACtC,MAAM,IAAI;GAAE,GAAG;GAAO,QAAQ;GAAY;EAAS,CAAC;CACtD;CAGA,MAAM,qBAAqB,OACzBA,kBAAAA,OAAO,QAAQ,IAAI,EAAE,IAAI,YAAY,OAAO,kBAAkB,QAAQ,OAAO,CAAC;CAKhF,MAAM,QAAQ,SAAkB,cAA0C;EACxE,MAAM,KAAK,MAAM,eAAe,SAAS,SAAS;EAClD,IAAI,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE;EAE1B,OAAOA,kBAAAA,OAAO,IAAI,OAAO,kBAAkB,OAAO,SAChD,IAAI,MAAM,QAAQ,SAAS,SAAS,CAAC,CACvC;CACF;CAGA,MAAM,SAAS,OACbA,kBAAAA,OAAO,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,gBAAgB;EAC9C,MAAM,EAAE,WAAW,MAAM,IAAI;EAC7B,MAAM,WAAW,OAAO,YAAY,WAAW,OAAO,cAAc;EACpE,WAAW,CAAC,EAAE,GAAG,WAAW,MAAM,aAAa,OAAO,IAAI,MAAM;CAClE,CAAC;;CAGH,MAAM,YAAY,YAAqB;EACrC,MAAM,MAAM,KAAK,OAAO,CAAC,CAAC,KAAK,YAAY,QAAQ,EAAE;EACrD,MAAM,EAAE,WAAW,MAAM,IAAI;EAE7B,WAAW,KAAK,OAAO,YAAY,UAAU,MAAM,aAAa,OAAO,IAAI,MAAM;CACnF;CAEA,MAAM,iBAAiB,IAAoB,YACzC,OAAO,KAAK,aAAa;EAAE,GAAG;EAAS;CAAQ,EAAE;CAEnD,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;;;;ACrEA,MAAa,eAAe,EAAE,OAAO,QAAQ,eAAwB;CACnE,MAAM,YAAqB,MAAM,IAAI,CAAC,CAAC;CAEvC,MAAM,UAAU,GAAY,MAC1B,MAAM,KAAM,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE;CAK3D,MAAM,OAAO,WAAoB;EAC/B,IAAI,OAAO,MAAM,IAAI,CAAC,CAAC,QAAQ,MAAM,GAAG;EACxC,MAAM,IAAI;GAAE,GAAG,MAAM,IAAI;GAAG;EAAO,CAAC;CACtC;CAEA,MAAM,UAAU,WAAqC;EACnD,MAAM,QAAQ,OAAO,IAAI,OAAO,OAAO;EACvC,IAAI,CAAC,MAAM,SAAS,OAAO;EAC3B,IAAI,OAAO,cAAc,MAAM,OAAO;GAAE,OAAO,MAAM;GAAM,SAAS;EAAK;EAEzE,MAAM,UAAU,SAAS,IAAI,MAAM,eAAe,OAAO,SAAS,OAAO,SAAS,CAAC;EACnF,IAAI,CAAC,QAAQ,SAAS,OAAO;EAE7B,OAAO;GAAE,OAAO,MAAM;GAAM,SAAS,QAAQ;EAAK;CACpD;CAGA,MAAM,kBAA4B;EAChC,MAAM,WAAW,OAAO,IAAI,CAAC;EAC7B,IAAI,CAAC,UAAU,MAAM,IAAI,MAAM,2BAA2B,KAAK,UAAU,IAAI,CAAC,GAAG;EACjF,OAAO;CACT;CAEA,MAAM,uBAA8B,UAAU,CAAC,CAAC;CAEhD,MAAM,iBAAiB,YACrBC,kBAAAA,OAAO,IAAI,OAAO,IAAI,OAAO,IAAI,UAAU;EACzC,MAAM,OAAO,MAAM,aAAa,MAAM,OAAO;EAC7C,IAAI,IAAI;EACR,OAAO;CACT,CAAC;CAIH,MAAM,mBAAmB,SAAkB,cACzCA,kBAAAA,OAAO,IAAI,SAAS,kBAAkB,MAAM,eAAe,SAAS,SAAS,CAAC,SAAS;EACrF,MAAM,OAAO,MAAM,eAAe,SAAS,SAAS;EACpD,IAAI,IAAI;EACR,OAAO;CACT,CAAC;CAGH,MAAM,eAAe,YAAoC;EACvD,MAAM,QAAQ,OAAO,OAAO,OAAO;EACnC,OAAOA,kBAAAA,OAAO,IAAI,cAAc,MAAM,OAAO,SAAS,KAAK;CAC7D;CAEA,MAAM,iBAAiB,cAA0C;EAC/D,MAAM,EAAE,YAAY,eAAe;EAEnC,MAAM,UAAU,SAAS,KAAK,SAAS,SAAS;EAChD,IAAI,CAAC,QAAQ,SAAS,OAAO;EAE7B,OAAOA,kBAAAA,OAAO,IAAI,gBAAgB,SAAS,SAAS,SAAS,QAAQ,IAAI;CAC3E;CAGA,MAAM,mBAAmB;EACvB,MAAM,SAAS,IAAI;EACnB,IAAI,OAAO,cAAc,MAAM;EAC/B,IAAI,MAAM,aAAa,OAAO,OAAO,CAAC;CACxC;CAGA,MAAM,6BAA8C;EAClD,MAAM,EAAE,YAAY,UAAU;EAC9B,OAAO,UAAUA,kBAAAA,OAAO,QAAQ,OAAO,IAAIA,kBAAAA,OAAO,QAAQ,OAAO,SAAS,CAAC;CAC7E;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;AC3GA,MAAa,gBAAgB,EAAE,OAAO,mBAA4B;CAChE,MAAM,OAAO,YAAqB,WAAW,MAAM,IAAI,CAAC,CAAC;CACzD,MAAM,OAAO,YAAqB;EAChC,MAAM,QAAQ,MAAM,IAAI,CAAC,CAAC,OAAO;EACjC,OAAO,QAAQC,kBAAAA,OAAO,QAAQ,KAAK,IAAIA,kBAAAA,OAAO,QAAQ,OAAO,aAAa,CAAC;CAC7E;CACA,MAAM,aAAa,OAAO,OAAO,MAAM,IAAI,CAAC,CAAC,MAAM;CACnD,MAAM,OAAO,UAAwB;EACnC,MAAM,QAAQ,MAAM,IAAI;EACxB,MAAM,IAAI;GAAE,GAAG;GAAO,QAAQ;IAAE,GAAG,MAAM;KAAS,MAAM,UAAU;GAAM;EAAE,CAAC;EAC3E,OAAO;CACT;CACA,MAAM,UAAU,SAAkB,YAChCA,kBAAAA,OAAO,IAAI,IAAI,OAAO,IAAI,UAAU,IAAI,QAAQ,KAAK,CAAC,CAAC;CAGzD,MAAM,qBAAqB,YACzBA,kBAAAA,OAAO,QAAQ,IAAI,OAAO,IAAI,UAAU,cAAc,MAAM,IAAI,CAAC;CAInE,MAAM,UAAU,YAAqB;EACnC,MAAM,WAAW,IAAI,OAAO;EAC5B,IAAI,SAAS,SAAS,OAAO,SAAS;EACtC,OAAO,IAAI,MAAM,MAAM,OAAO,CAAC;CACjC;CAIA,MAAM,SAAS,YAAqB;EAClC,MAAM,QAAQ,IAAI,OAAO;EACzB,IAAI,CAAC,MAAM,SAAS,OAAO;EAE3B,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,MAAM,OAAO,YAAY,SAAS,OAAOA,kBAAAA,OAAO,QAAQ,OAAO,YAAY,CAAC;EAEhF,MAAM,SAAS,EAAE,GAAG,MAAM,OAAO;EACjC,OAAO,OAAO;EAEd,MAAM,WAAW,OAAO,YACtB,OAAO,QAAQ,MAAM,QAAQ,CAAC,CAAC,QAAQ,GAAG,aAAa,QAAQ,YAAY,OAAO,CACpF;EACA,MAAM,IAAI;GAAE,QAAQ,MAAM;GAAQ;GAAQ;EAAS,CAAC;EACpD,aAAa,OAAO;EACpB,OAAO;CACT;CAEA,MAAM,iBAAiB,SAAkB,YACvC,OAAO,UAAU,WAAW;EAAE,GAAG;EAAO;CAAQ,EAAE;CAEpD,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;;;AC1DA,MAAa,eAAe,mBAA4B;CACtD,MAAM,QAAQC,cAAAA,YAAmB,MAAM,MAAM,cAAc,CAAC;CAC5D,MAAM,SAAS,kBAAkB;CAEjC,MAAM,SAAS,aAAa;EAAE;EAAO,cAAc,OAAO;CAAO,CAAC;CAClE,MAAM,WAAW,eAAe;EAAE;EAAO;CAAO,CAAC;CACjD,MAAM,QAAQ,YAAY;EAAE;EAAO;EAAQ;CAAS,CAAC;CACrD,MAAM,OAAO,WAAW;EAAE;EAAQ;EAAU;CAAO,CAAC;CAEpD,OAAO;EAAE,OAAO,MAAM,WAAW;EAAG;EAAQ;EAAU;EAAM;CAAM;AACpE;;;;;;;;;;;ACoBA,MAAa,kBAAoD,EAC/D,KACA,YACgE;CAChE,MAAM,0BAAU,IAAI,IAA8B;CAClD,MAAM,UAAUC,cAAAA,cAAiC;CAEjD,MAAM,OAAO,IAAS,UAAqC;EACzD,QAAQ,IAAI,IAAI,KAAK;EACrB,QAAQ,KAAK;GAAE,KAAK;GAAI,QAAQ,MAAM;EAAO,CAAC;CAChD;CAIA,MAAM,OAAO,IAAS,UAAsC;EAC1D,MAAM,UAAU,SAAyC;GAGvD,IAAI,QAAQ,IAAI,EAAE,MAAM,OAAO,IAAI,IAAI;IAAE;IAAO,GAAG;GAAK,CAAC;GACzD,OAAO;EACT;EAIA,MAAM,UAAU,YAA4B,MAAM,MAAM,KAAK;EAE7D,MAAM,QAA6B;GACjC;GACA,QAAQ;GACR,SAAS,QAAQ,CAAC,CAAC,MAChB,UAAU,OAAO;IAAE,QAAQ;IAAS;GAAM,CAAC,IAC3C,UAAmB,OAAO;IAAE,QAAQ;IAAW;GAAM,CAAC,CACzD;EACF;EAEA,IAAI,IAAI,KAAK;EACb,OAAO;CACT;CAEA,MAAM,OAAO,OAA0B;EACrC,MAAM,QAAQ,QAAQ,IAAI,EAAE;EAC5B,OAAO,OAAO,WAAW,UAAU,MAAM,QAAQ;CACnD;CAEA,MAAM,WAAW,OAAO,UAAiC;EACvD,MAAM,KAAK,IAAI,KAAK;EACpB,MAAM,SAAS,QAAQ,IAAI,EAAE;EAC7B,MAAM,QAAQ,WAAW,KAAA,KAAa,OAAO,WAAW,YAAY,IAAI,IAAI,KAAK,IAAI;EACrF,MAAM,UAAU,MAAM,WAAW,YAAY,MAAM,MAAM,UAAU;EAEnE,IAAI,QAAQ,WAAW,WAAW,MAAM,QAAQ;EAChD,OAAO,QAAQ;CACjB;CAEA,MAAM,UAAU,YAAwC;EACtD,KAAK,MAAM,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,EAAE,GAAG,QAAQ,OAAO,EAAE;CACrE;CAEA,MAAM,YAAY,UAAuB;EACvC,MAAM,KAAK,IAAI,KAAK;EACpB,IAAI,CAAC,QAAQ,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK;CACrC;CAEA,MAAM,SAAS,OAAkB;EAC/B,MAAM,QAAQ,QAAQ,IAAI,EAAE;EAC5B,IAAI,UAAU,KAAA,GAAW,IAAI,IAAI,MAAM,KAAK;CAC9C;CAEA,OAAO;EAAE;EAAK;EAAU;EAAU;EAAO;EAAQ,WAAW,QAAQ;CAAU;AAChF;;;AC3FA,MAAa,wBAAwB,EAAE,OAAO,aAAa,mBAA4B;CACrF,MAAM,WAAW,eAAe;EAC9B,MAAM,YAAqB,QAAQ;EACnC,OAAO,OAAO,EAAE,SAAS,gBAAyC;GAGhE,MAAM,iBAA+B,UAAU,YAAY;IACzD,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,kBAAkB,YAAY,OAAO,SAAS,CAAC;IAC3E,OAAO,KAAK,OAAO;GACrB;GAEA,MAAM,SAASC,gBAAAA,oBAAoB;IACjC;IACA,MAAM;KAAE,MAAM;KAAU,OAAO;KAAI;IAAU;IAC7C,aAAa,EAAE,SAAS,cAAc,YAAY,WAAW,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;GAC9E,CAAC;GAMD,MAAM,CAAC,OAAO,eAAe,MAAM,QAAQ,IAAI;IAC7C,OAAO,OAAO,OAAO;IACrB,OAAO,SAAS,eAAe;IAC/B,aAAa,SAAS,OAAO;GAC/B,CAAC;GAED,OAAO;IAAE;IAAO,eAAe,oBAAoB,EAAE,YAAY,CAAC;GAAE;EACtE;CACF,CAAC;CAGD,SAAS,WAAW,EAAE,KAAK,aAAa;EACtC,MAAM,SAAS,cAAc,KAAK,MAAM;CAC1C,CAAC;CAED,MAAM,cAAc,EAAE,eAAsB;EAC1C,KAAK,MAAM,WAAW,OAAO,OAAO,QAAQ,GAAG,SAAS,SAAS,OAAO;CAC1E;;;;;CAMA,MAAM,eAAe,YAAqB,SAAS,OAAO,MAAM,aAAa,OAAO,CAAC;;CAGrF,MAAM,UAAU,OAAuB,SAAS,QAAQ,QAAQ,QAAQ,EAAE;CAE1E,OAAO;EACL;EACA,KAAK,SAAS;EACd,UAAU,SAAS;EACnB,OAAO,SAAS;EAChB;EACA;CACF;AACF;;;AC1EA,MAAa,sBAAsB,UAAoB;CACrD,MAAM,WAAW,eAAe;EAC9B,MAAM,YAAqB;EAC3B,QAAQ,YACNC,gBAAAA,oBAAoB;GAAE;GAAS,MAAM;IAAE,MAAM;IAAc,OAAO;GAAG;EAAE,CAAC,CAAC,CAAC,aAAa,EACrF,SAAS,mBACX,CAAC;CACL,CAAC;CAGD,SAAS,WAAW,EAAE,KAAK,aAAa;EACtC,MAAM,OAAO,cAAc,KAAK,MAAM;CACxC,CAAC;CAED,MAAM,cAAc,EAAE,aAAoB;EACxC,KAAK,MAAM,EAAE,aAAa,OAAO,OAAO,MAAM,GAAG,SAAS,SAAS,OAAO;CAC5E;;CAGA,MAAM,UAAU,YAAqB,SAAS,QAAQ,QAAQ,QAAQ,OAAO;CAE7E,OAAO;EACL;EACA,KAAK,SAAS;EACd,UAAU,SAAS;EACnB,OAAO,SAAS;EAChB;CACF;AACF;;;ACAA,MAAM,QAAwC,UAA8B;CAC1E,IAAI,QAAkB;CACtB,aAAc,UAAU,MAAM;AAChC;;;;;;;;;AAUA,MAAa,oBAAoB,EAC/B,OACA,aACA,eACA,OACA,mBACA,eACa;CACb,MAAM,UAAU,qBAAqB;EAAE;EAAO;EAAa,cAAc,MAAM;CAAQ,CAAC;CAIxF,MAAM,aAAa,EAAE,SAAS,gBAAuC;EACnE,MAAM,iBAA+B,UAAU,YAAY;GACzD,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,kBAAkB,YAAY,OAAO,SAAS,CAAC;GAC3E,OAAO,KAAK,OAAO;EACrB;EAEA,QAAQ,SAAS,cAAc,YAAY,WAAW,OAAO,CAAC,CAAC,IAAI,CAAC;CACtE;CAEA,MAAM,gBAAgB,EAAE,SAAS,aAAsB,WACrD,qBAAqB;EACnB;EAEA,MAAM;GAAE,MAAM;GAAU,OAAO;GAAI;EAAU;EAG7C,oBAAoB,cAAyB,YAAY;GACvD,MAAM,YAAY,MAAM,MAAM,QAAQ,SAAS,OAAO;GACtD,MAAM,aAAa,YAAY;IAAE;IAAW;GAAkB,CAAC,CAAC,CAAC,cAAc,SAAS;GAExF,SAAO,YAAY,iBAAiB,QAAQ;GAC5C,OAAO;EACT;EACA;EACA,uBAAuB;CACzB,CAAC;;;;;;;;;;CAWH,MAAM,aAAa,SAAkB,WAAyB;EAC5D,MAAM,YAAY,MAAM,QAAQ,IAAI,QAAQ,OAAO;EACnD,SAAO,WAAW,iBAAiB,QAAQ;EAE3C,MAAM,UAAU,QAAQ,IAAI,QAAQ,EAAE;EACtC,SAAO,SAAS,iBAAiB,QAAQ;EAEzC,MAAM,EAAE,SAAS,cAAc;EAC/B,MAAM,OAAqB;GAAE,MAAM;GAAU,OAAO;GAAI;EAAU;EAIlE,MAAM,SAASC,gBAAAA,oBAAoB;GAAE;GAAS;GAAM,aAAa,CAAC,MAAM;EAAE,CAAC;EAC3E,MAAM,cAAc,kBAAkB;GACpC,cAAc,QAAQ;GACtB,cAAc,OAAO,OAAO,OAAO;EACrC,CAAC;EAED,MAAM,oBAAoB,mBAAmB;GAC3C,QAAQ,YAAY;GACpB,OAAOC,qBAAAA;GACP,YAAY,UAAU;IACpB,uBAAuB,CAAC,KAAK,WAAWC,kBAAAA,eAAe,yBAAyB;IAChF,2BAA2B,KAAK,WAAWA,kBAAAA,eAAe,yBAAyB;IACnF,oBAAoB,KAAK,WAAWA,kBAAAA,eAAe,eAAe;GACpE;EACF,CAAC;EAED,OAAO;GACL,SAASF,gBAAAA,oBAAoB;IAC3B;IACA;IACA,aAAa,cAAc,WAAW,CAAC,QAAQ,YAAY,UAAU,CAAC;GACxE,CAAC;GACD,SAAS;IACP;IACA,OAAO,YAAY;KAAE;KAAW;IAAkB,CAAC;IACnD,eAAe,QAAQ;IAGvB,IAAI,UAAU;KACZ,OAAO,YAAY,WAAW;IAChC;IACA,IAAI,KAAK;KACP,OAAO,kBAAkB,IAAI;IAC/B;GACF;EACF;CACF;CAIA,MAAM,SAAS,YAAqB;EAClC,MAAM,SAAS,UAAU,OAAO;EAChC,MAAM,OAAO,WAAW,UAAU,SAAS,MAAM,CAAC;EAClD,MAAM,UAAU,WAAW,aAAa,SAAS,MAAM,CAAC;EAExD,OAAO;GACL,KAAK,SAAS,OAAO;GACrB,IAAI,UAAU;IACZ,OAAO,QAAQ;GACjB;GACA,IAAI,UAAU;IACZ,OAAO,KAAK,CAAC,CAAC;GAChB;GACA,IAAI,UAAU;IACZ,OAAO,KAAK,CAAC,CAAC;GAChB;EACF;CACF;CAEA,MAAM,0BAAU,IAAI,IAA8C;CAElE,MAAM,OAAO,YAAqB,OAAO,SAAS,QAAQ,UAAU,MAAM,OAAO,CAAC;;CAGlF,MAAM,UAAU,OAAuB;EACrC,QAAQ,OAAO,EAAE;EACjB,QAAQ,OAAO,EAAE;CACnB;CAEA,MAAM,eAAe,YAAqB;EACxC,MAAM,UAAU,MAAM,aAAa,OAAO;EAC1C,KAAK,MAAM,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,EAAE,GAAG,QAAQ,OAAO,EAAE;EAEnE,QAAQ,YAAY,OAAO;CAC7B;CAEA,OAAO;EAAE;EAAS;EAAK;EAAQ;CAAY;AAC7C;;;;;;;;;;AC1KA,MAAa,sBAAsB;;;;;;;;;;AAWnC,MAAM,4BAA4BG,IAAE,mBAAmB,QAAQ;CAC7DA,IAAE,OAAO;EAAE,MAAMA,IAAE,QAAQ,OAAO;EAAG,cAAcA,IAAE,OAAO;CAAE,CAAC;CAC/DA,IAAE,OAAO;EAAE,MAAMA,IAAE,QAAQ,QAAQ;EAAG,WAAWA,IAAE,OAAO;CAAE,CAAC;CAC7DA,IAAE,OAAO;EAAE,MAAMA,IAAE,QAAQ,QAAQ;EAAG,aAAaA,IAAE,OAAO;CAAE,CAAC;AACjE,CAAC;;AAGD,MAAM,yBAAyBA,IAAE,OAAO,EAAE,WAAWA,IAAE,OAAO,EAAE,CAAC;AAEjE,MAAM,yBAAyBA,IAAE,OAAO;CACtC,SAASA,IAAE,OAAO;EAAE,SAASA,IAAE,OAAO;EAAG,WAAWA,IAAE,OAAO,CAAC,CAAC,SAAS;CAAE,CAAC,CAAC,CAAC,SAAS;CACtF,QAAQA,IAAE,MACRA,IAAE,OAAO;EACP,SAASA,IAAE,OAAO;EAClB,YAAY,0BAA0B,SAAS;EAC/C,UAAUA,IAAE,MAAM,sBAAsB;CAC1C,CAAC,CACH;AACF,CAAC;AAKD,MAAM,0BAA4C;CAAE,SAAS;CAAM,QAAQ,CAAC;AAAE;AAE9E,MAAM,qBAAqB,UAA6C;CACtE,IAAI,MAAM,KAAK,WAAW,iBAAiB,OAAO;CAElD,MAAM,EAAE,eAAe,MAAM;CAC7B,IAAI,WAAW,SAAS,SAAS,OAAO;EAAE,MAAM;EAAS,cAAc,WAAW;CAAa;CAC/F,IAAI,WAAW,SAAS,UAAU,OAAO;EAAE,MAAM;EAAU,WAAW,WAAW;CAAU;CAC3F,OAAO;EAAE,MAAM;EAAU,aAAa,WAAW;CAAY;AAC/D;AAEA,MAAa,0BAA0B,YAA6B;CAClE,MAAM,YAAY,gBAAkC;EAClD;EACA,KAAK;EACL,QAAQ;EACR,cAAc;CAChB,CAAC;CAED,MAAM,WAAW,EAAE,QAAQ,QAAQ,eACjC,UAAU,QAAQ;EAChB,SAAS;GAAE,SAAS,OAAO;GAAS,WAAW,OAAO;EAAU;EAChE,QAAQ,OAAO,OAAO,MAAM,CAAC,CAAC,KAAK,WAAW;GAC5C,SAAS,MAAM;GACf,YAAY,kBAAkB,KAAK;GACnC,UAAU,OAAO,OAAO,QAAQ,CAAC,CAC9B,QAAQ,YAAY,QAAQ,YAAY,MAAM,OAAO,CAAC,CACtD,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE;EAC3C,EAAE;CACJ,CAAC;CAEH,OAAO;EAAE,GAAG;EAAW;CAAQ;AACjC;;;;;;;;;ACrDA,MAAa,kBAAkB,EAAE,OAAO,aAAa,oBAA6B;CAChF,MAAM,UAAU,mBAAmB,KAAK;CACxC,MAAM,0BAAU,IAAI,IAA2B;CAE/C,MAAM,OAAO,YACX,OAAO,SAAS,gBAAgB;EAC9B,MAAMC,mBAAAA,iBAAiB;GACrB;GACA,aAAa,cAAc,QAAQ,CAAC,YAAY,WAAW,OAAO,CAAC,CAAC;EACtE,CAAC;EACD,YAAYC,mBAAAA,uBAAuB;GACjC;GACA,MAAM;IAAE,MAAM;IAAU,OAAO;GAAG;GAClC,aAAa,cAAc,cAAc,CAAC,YAAY,WAAW,OAAO,CAAC,CAAC;EAC5E,CAAC;CACH,EAAE;CAEJ,MAAM,UAAU,YAAqB;EACnC,QAAQ,OAAO,OAAO;EACtB,QAAQ,OAAO,OAAO;CACxB;CAEA,OAAO;EAAE;EAAS;EAAK;CAAO;AAChC;;;;;;;;AClBA,MAAa,iBAAiB,EAC5B,gBACA,SACA,aACA,mBACA,aAAa,OAAO,cACA;CACpB,MAAM,QAAQ,YAAYC,0BAAAA,iBAAiB,cAAc,CAAC;CAC1D,MAAM,YAAY,uBAAuB,OAAO;CAChD,MAAM,gBAAgB,oBAAoB,WAAW;CACrD,MAAM,cAAc,kBAAkB;EACpC;EACA;EACA,aAAa,cAAc,MAAM;EACjC;EAEA,cAAc,YAAY,WAAW,YAAY,OAAO;CAC1D,CAAC;CAED,MAAM,WAAW,eAAe;EAAE;EAAO;EAAa;CAAc,CAAC;CACrE,MAAM,aAAa,iBAAiB;EAClC;EACA;EACA;EACA,OAAO;EACP;EAEA,WAAW,YACT,aAAa;GACX,gBAAgB,QAAQ;GACxB,eAAeC,kBAAAA,OAAO,OAAO,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;GAC3D,QAAQ;EACV,CAAC;CACL,CAAC;CAED,MAAM,MAAM,UAAU,SAAS,QAAQ,UAAU;CAEjD,SAAS,QAAQ,WAAW,MAAM,MAAM,IAAI,CAAC;CAC7C,MAAM,MAAM,UAAU,WAAW,QAAQ,UAAU;CAEnD,MAAM,eAAe,YACnBA,kBAAAA,OAAO,OAAO,MAAM,MAAM,YAAYD,0BAAAA,iBAAiB,OAAO,CAAC,CAAC;CAElE,MAAM,iBAAiB,cACrBC,kBAAAA,OAAO,OAAO,MAAM,MAAM,cAAc,SAAS,CAAC;;CAGpD,MAAM,mBAAmB,YACvB,YAAY,KAAA,IAAY,MAAM,MAAM,eAAe,CAAC,CAAC,UAAUD,0BAAAA,iBAAiB,OAAO;;CAGzF,MAAM,uBAAuB,OAC3B,OAAO,KAAA,IACHC,kBAAAA,OAAO,OAAO,MAAM,MAAM,qBAAqB,CAAC,IAChDA,kBAAAA,OAAO,OAAO,MAAM,SAAS,IAAI,EAAE,CAAC;;;;;;CAO1C,MAAM,kBAAkB,cAAmC;EACzD,IAAI,cAAc,KAAA,GAAW,OAAOA,kBAAAA,OAAO,OAAO,MAAM,MAAM,qBAAqB,CAAC;EAEpF,MAAM,SAAS,MAAM,SAAS,IAAI,MAAM,eAAe,gBAAgB,GAAG,SAAS,CAAC;EACpF,IAAI,OAAO,SAAS,OAAO,OAAO;EAElC,MAAM,CAAC,MAAM,GAAG,QAAQ,MAAM,SAAS,QAAQ,SAAS;EACxD,OAAO,SAAS,KAAA,KAAa,KAAK,WAAW,IAAI,OAAOA,kBAAAA,OAAO,OAAO,MAAM;CAC9E;;;;;;CAOA,MAAM,kBAAkB,cAAkD;EACxE,MAAM,UAAU,eAAe,SAAS;EACxC,MAAM,aAAaA,kBAAAA,OAAO,OAAO,MAAM,KAAK,kBAAkB,QAAQ,OAAO,CAAC;EAC9E,OAAO;IACJC,0BAAAA,WAAW,gBAAgB,UAAU,WAAW;IAChDC,0BAAAA,kBAAkB,aAAa,OAAO,QAAQ,SAAS;EAC1D;CACF;CAaA,MAAM,gBAAgB,UAAoC;EACxD,MAAM,QAAQ,MAAM,MAAM,eAAe;EACzC,IAAI,MAAM,SAAS,YAAY,MAAM,SAAS,MAC5C,MAAM,IAAI,aAAa,iBAAiB,sBAAsB;EAEhE,IAAI,MAAM,SAAS,SAAS,OAAOF,kBAAAA,OAAO,OAAO,MAAM,KAAK,aAAa,MAAM,SAAS,KAAK,CAAC;EAE9F,MAAM,EAAE,iBAAiB;EACzB,IAAI,CAAC,cAAc,MAAM,IAAI,aAAa,iBAAiB,gBAAgB;EAC3E,OAAOA,kBAAAA,OAAO,OAAO,MAAM,KAAK,aAAa,MAAM,SAAS;GAAE,GAAG;GAAO;EAAa,CAAC,CAAC;CACzF;;;;;;;CAQA,MAAM,gBAAgB,YAMpB,IAAI,MAAM,CAAC,GAAiB,EAC1B,MAAM,SAAS,aAAa;EAC1B,IAAI,kBAAkB,QAAQ,GAAG,OAAO,KAAA;EAExC,IAAI,aAAa,UAAU,aAAa,cAAc;GACpD,IAAI,QAAQ,QAAQ,QAAQ,QAAQ;GACpC,OAAO,SAAS,IAAI,QAAQ,SAAS,CAAC,CAAC,CAAC;EAC1C;EAEA,MAAM,UAAU,WAAW,IAAI,QAAQ,QAAQ,CAAC;EAChD,IAAI,aAAa,WAAW,OAAO,QAAQ;EAC3C,IAAI,aAAa,WAAW,OAAO,QAAQ;EAE3C,MAAM,EAAE,QAAQ,SAAS,QAAQ;EACjC,IAAI,aAAa,eAAe,OAAO;EAEvC,OAAO,OAAO;CAChB,EACF,CAAC;CAGH,MAAM,YAAY,aAAa;EAC7B,gBAAgB,MAAM,MAAM,eAAe,CAAC,CAAC;EAC7C,eAAeA,kBAAAA,OAAO,OAAO,MAAM,MAAM,qBAAqB,CAAC;CACjE,CAAC;;CAGD,MAAM,qBAAiC;;;;;;;CAQvC,MAAM,UAAU,cAAqC;EACnD,MAAM,EAAE,YAAY,MAAM,MAAM,eAAe;EAC/C,MAAM,UAAU,MAAM,QAAQ,SAAS,SAAS;EAIhD,kBAAA,OAAO,SAAS,MAAM,SAAS,KAAK,SAAS,SAAS,GAAG,IAAI;EAE7D,OAAO,WAAW,IAAI,OAAO,CAAC,CAAC;CACjC;;CAGA,MAAM,WAAW,YAA4B;EAC3C,MAAM,SAAS,gBAAgB,OAAO;EAGtC,OAAOA,kBAAAA,OAAO,OAAO,YAAY,QAAQ,MAAM,CAAC;CAClD;;;;;;;CAQA,MAAM,WAAW,UAAoC;EACnD,QAAQ;EACR,OAAO,aAAa,KAAK;CAC3B;;;;;;;;;;CAWA,MAAM,iBAAiB,UAAuC;EAC5D,QAAQ;EACR,OAAOA,kBAAAA,OAAO,OAAO,MAAM,KAAK,aAAa,eAAe,CAAC,CAAC,SAAS,KAAK,CAAC;CAC/E;;;;;;CAOA,MAAM,gBAAgB,cAAyC;EAC7D,MAAM,KAAK,MAAM,eAAe,gBAAgB,GAAG,SAAS;EAC5D,MAAM,SAASA,kBAAAA,OAAO,SAAS,MAAM,SAAS,MAAM,EAAE,GAAG,IAAI;EAC7D,IAAI,WAAW,MAAM,OAAO;EAE5B,WAAW,OAAO,EAAE;EACpB,OAAO;CACT;CAGA,MAAM,cAAc,YAAkC;EACpD,MAAM,SAASD,0BAAAA,iBAAiB,OAAO;EACvC,IAAI,MAAM,MAAM,IAAI,CAAC,CAAC,YAAY,QAAQ,MAAM,IAAI,aAAa,iBAAiB,WAAW;EAE7F,MAAM,SAASC,kBAAAA,OAAO,SAAS,MAAM,OAAO,MAAM,MAAM,GAAG,IAAI;EAC/D,IAAI,WAAW,MAAM,OAAO;EAG5B,WAAW,YAAY,MAAM;EAC7B,SAAS,OAAO,MAAM;EAEtB,YAAY,OAAO,MAAM;EAEzB,OAAO;CACT;CAEA,IAAI,aAAa;;;;;;;;CAQjB,MAAM,0BAA0B;EAE9B,IAAI,YAAY;EAChB,aAAa;EAEb,UAAU,QAAQ,MAAM,MAAM,IAAI,CAAC;EACnC,MAAM,MAAM,UAAU,UAAU,OAAO;CACzC;;;;;;;CAQA,MAAM,kCAAkC;EACtC,MAAM,OAAO,MAAM,MAAM,WAAW,SAAS;GAC3C,IAAI,CAAC,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,WAAW,KAAK,WAAW,eAAe,GAAG;GAErF,KAAK;GACL,kBAAkB;EACpB,CAAC;CACH;CAIA,MAAM,UAAUG,kBAAAA,WACd,YAAY,QAAQ,CAAC,CAAC,MACnB,aAAa;EACZ,IAAI,SAAS,WAAW,eAAe,0BAA0B;OAC5D,kBAAkB;EAEvB,OAAO;CACT,IACC,UAAmB;EAGlB,0BAA0B;EAC1B,MAAM;CACR,CACF,CACF;CAEA,MAAM,iBAAiB,MAAM,MAAM;CAEnC,MAAM,wBAAwB,eAAe,CAAC,CAAC,KAAK,WAAW;;;;;;;;;;;CAY/D,MAAM,SAASA,kBAAAA,WACb,QAAQ,CAAC,CAAC,MAAM,EAAE,YAAY,aAA4B;EACxD,IAAI,CAAC,cAAc,cAAc,OAAO;EAExC,MAAM,QAAQ,YAAY,WAAW,OAAO;EAC5C,IAAI,WAAW,cAAc,QAAQ,MAAM,KAAK,WAAW,iBACzD,cAAc,WAAW,SAAS;EAEpC,OAAO;CACT,CAAC,CACH;CAIA,IAAI,eAAe;CACnB,MAAM,YACqB,UACxB,GAAG,SAAe;EACjB,eAAe;EACf,OAAO,KAAK,GAAG,IAAI;CACrB;CAEF,OAAO;EACL;EACA;EACA,SAAS;GACP,UAAU,MAAM,MAAM;GACtB,WAAW,MAAM,MAAM;GACvB;GAEA,OAAO;IACL,WAAW;IACX,QAAQ,SAAS,WAAW;IAC5B,OAAO;IACP,cAAc,SAAS,QAAQ;IAC/B,aAAa,YAAqB,SAAS,QAAQ,IAAI,gBAAgB,OAAO,CAAC;IAC/E,kBAAkB,YAAqB,SAAS,QAAQ,SAAS,gBAAgB,OAAO,CAAC;GAC3F;GAEA,SAAS;IACP,QAAQ,SAAS,aAAa;IAC9B,OAAO;IAEP,YAAY,MAAM,MAAM;IAExB,cAAc,WAAW,QAAQ;IACjC,aAAa,OAAwB,WAAW,QAAQ,IAAI,MAAM,oBAAoB,CAAC,CAAC,EAAE;IAG1F,kBAAkB,OAChB,WAAW,QAAQ,SAAS,oBAAoB,EAAE,CAAC;GACvD;GAEA,MAAM;IACJ,cAAc,SAAS,YAAY;IACnC,SAAS,SAAS,OAAO;IACzB,eAAe,SAAS,aAAa;IACrC,SAAS,SAAS,OAAO;;IAEzB;IACA,4BAA4B,OAAO,CAAC,CAAC,KAAK,eAAe;IACzD,SAAS,YAAoB,YAAY,OAAO,OAAO,CAAC,CAAC,KAAKH,kBAAAA,OAAO,MAAM;IAC3E,YAAY;GACd;EACF;CACF;AACF;;;ACpYA,MAAM,wBAAwB;AAE9B,MAAM,0BAA0B;CAC9BI,0BAAAA,kBAAkB;CAClBA,0BAAAA,kBAAkB;CAClB;CACA;CACA;AACF;AAEA,MAAM,+CAA+B,IAAI,IAAI;CAC3C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,WAAW;AAEjB,MAAM,kBAAkB,WAA2B;CACjD,MAAM,MAAM,IAAI,IAAI,MAAM;CAC1B,IAAI,IAAI,UAAU,IAAI,WAAW;CACjC,IAAI,IAAI,UAAU,IAAI,WAAW;CAEjC,IAAI,aAAa,SAAS,QAAQ,QAAQ;EACxC,IAAI,6BAA6B,IAAI,IAAI,YAAY,CAAC,GACpD,IAAI,aAAa,IAAI,KAAK,QAAQ;CAEtC,CAAC;CACD,OAAO,IAAI,SAAS;AACtB;AAQA,MAAM,uBAAuB,YAA6B;CACxD,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,qBAAqB,KAAKC,qBAAAA,aAAa;CACjF,QAAQ,QAAQ,IAAI,uBAAuB,aAAa;CACxD,OAAO;AACT;AAEA,MAAM,sBAAsB,SAAkB,aAA+C;CAC3F,MAAM,cAAc,IAAI,IACtB,CAAC,GAAG,yBAAyB,GAAG,QAAQ,CAAC,CAAC,KAAK,MAAM,EAAE,YAAY,CAAC,CACtE;CAEA,MAAM,SAAiC,CAAC;CACxC,QAAQ,SAAS,OAAO,SAAS;EAC/B,OAAO,QAAQ,YAAY,IAAI,KAAK,YAAY,CAAC,IAAI,WAAW;CAClE,CAAC;CACD,OAAO;AACT;AA2CA,MAAM,iBAAiB,SAAkB,qBAA2C;CAClF,KAAK,eAAe,QAAQ,GAAG;CAC/B,SAAS,mBAAmB,QAAQ,SAAS,eAAe;AAC9D;AAEA,MAAM,kBAAkB,UAAoB,qBAA4C;CACtF,QAAQ,SAAS;CACjB,YAAY,SAAS;CACrB,SAAS,mBAAmB,SAAS,SAAS,eAAe;AAC/D;AAMA,MAAM,kBAAkB,OAAiB,oBACvC,IAAIC,0BAAAA,SAAS;CACX,SAAS,IAAI,QAAQ,eAAe,MAAM,QAAQ,GAAG,GAAG;EACtD,QAAQ,MAAM,QAAQ;EACtB,SAAS,mBAAmB,MAAM,QAAQ,SAAS,eAAe;CACpE,CAAC;CACD,UAAU,IAAI,SAAS,MAAM;EAC3B,QAAQ,MAAM,SAAS;EACvB,YAAY,MAAM,SAAS;EAC3B,SAAS,mBAAmB,MAAM,SAAS,SAAS,eAAe;CACrE,CAAC;CACD,MAAM,MAAM;AACd,CAAC;AAEH,MAAM,aAAa,OAAyB,QAAqB;CAC/D,MAAM,QAAQ;EAAC,IAAI,MAAM,YAAY,EAAE;EAAI,GAAG,KAAK,MAAM,IAAI,UAAU,EAAE;EAAK,IAAI;CAAM;CACxF,MAAM,KAAK,IAAI,QAAQ,GAAG;CAC1B,IAAI,cAAc,KAAK,MAAM,KAAK,OAAO,IAAI,SAAS,MAAM,CAAC;CAC7D,OAAO,MAAM,KAAK,GAAG;AACvB;AAEA,MAAM,oBAAoB,QAAiB,QAAkB,iBAAmC;CAC9F,OAAO;EACL,OAAO,QAAQ;GACb,IAAI,UAAU,OAAO;GACrB,IAAI;IACF,IAAI,QAAQ,MAAM;KAChB,OAAO,KAAK,GAAG;KACf;IACF;IAEA,QAAQ,KAAK,UAAU,QAAQ,GAAG,CAAC;GACrC,QAAQ,CAER;EACF;EACA,QAAQ,QAAQ;GACd,IAAI;IACF,IAAI,QAAQ,OAAO;KACjB,OAAO,MAAM,GAAG;KAChB;IACF;IAEA,QAAQ,MAAM,UAAU,SAAS,GAAG,CAAC;GACvC,QAAQ,CAER;EACF;CACF;AACF;AAEA,MAAa,2BAA2B,UAA0B,CAAC,MAAoB;CACrF,MAAM,aAAa,iBAAiB,QAAQ,QAAQ,QAAQ,KAAK;CACjE,MAAM,gBAAgB,QAAQ,iBAAiB,CAAC;CAEhD,QAAQ,SAAS,OAAO,iBAAiB;EACvC,MAAM,gBAAgB,oBAAoB,aAAa,OAAO;EAC9D,MAAM,QAAQ,YAAY,IAAI;EAC9B,MAAM,SAAS,aAAa,QAAQ,OAAO,YAAY;EACvD,MAAM,aAAa,cAAc,aAAa,SAAS,aAAa;EAEpE,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,YAAY;GACtC,WAAW,KAAK;IACd;IACA;IACA,YAAY,YAAY,IAAI,IAAI;IAChC,SAAS;IACT,UAAU,eAAe,OAAO,UAAU,aAAa;GACzD,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,IAAI,iBAAiB,OACnB,WAAW,MAAM;IACf;IACA;IACA,YAAY,YAAY,IAAI,IAAI;IAChC,SAAS;IACT,OAAOC,0BAAAA,WAAW,KAAK,IAAI,eAAe,OAAO,aAAa,IAAI;GACpE,CAAC;GAEH,MAAM;EACR;CACF;AACF;;;AC9MA,MAAM,sBAAsB;AAC5B,MAAM,6BAAuC;CAC3CC,0BAAAA,WAAW;CACXA,0BAAAA,WAAW;CACXA,0BAAAA,WAAW;CACXA,0BAAAA,WAAW;AACb;AACA,MAAM,yBAAyB;AAQ/B,MAAM,sBAAsB,UAC1B,iBAAiBC,0BAAAA,YAAY,2BAA2B,SAAS,MAAM,SAAS,MAAM;AAExF,MAAa,yBAAyB,YAAyC;CAC7E,MAAM,EACJ,aAAa,qBACb,gBAAgB,wBAChB,cAAc,uBACZ,WAAW,CAAC;CAEhB,IAAI,CAAC,OAAO,UAAU,UAAU,KAAK,aAAa,GAChD,MAAM,IAAI,WAAW,2CAA2C;CAElE,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,gBAAgB,GACrD,MAAM,IAAI,WAAW,oDAAoD;CAG3E,QAAQ,SAAS,OAAO,YAAY;EAClC,KAAK,IAAI,UAAU,GAAG,WAAW,YAAY,WAC3C,IAAI;GACF,OAAO,MAAM,KAAK;IAAE,GAAG;IAAS,SAAS,QAAQ,QAAQ,MAAM;GAAE,CAAC;EACpE,SAAS,OAAO;GACd,IAAI,YAAY,cAAc,CAAC,YAAY,OAAO,OAAO,GACvD,MAAM;GAGR,MAAM,UAAU,gBAAgB,MAAO,KAAK,IAAI,GAAG,OAAO;GAC1D,MAAMC,kBAAAA,MAAM,SAAS,QAAQ,QAAQ,UAAU,KAAA,CAAS;EAC1D;EAGF,MAAM,IAAI,MAAM,aAAa;CAC/B;AACF"}