@mcp-abap-adt/connection 4.0.0 → 6.0.0

package/README.md

@@ -17,8 +17,8 @@ ABAP connection layer for MCP ABAP ADT server. Provides a unified interface for
   - Session headers management (cookies, CSRF tokens)
   - Session state persistence is handled by `@mcp-abap-adt/auth-broker` package
 - 🏗️ **Clean Architecture**:
-  - Abstract base class for common HTTP/session logic
-  - Auth-type specific implementations (BaseAbapConnection, JwtAbapConnection, SamlAbapConnection)
+  - One connector per SYSTEM (`AdtOnPremConnector`, `AdtCloudConnector`), handed an auth provider
+  - Authentication is a parameter, not a subclass — nothing about the system is inferred from it
   - Proper separation of concerns - no JWT logic in base class
 - 🔌 **Realtime Transport Scaffold**:
   - Generic `GenericWebSocketTransport` with pluggable WS factory
@@ -39,21 +39,41 @@ The package uses a clean separation of concerns:
   - CSRF token fetching with retry
   - Auth-agnostic - knows nothing about Basic or JWT
   
-- **`BaseAbapConnection`** (concrete, exported):
-  - Basic Authentication implementation
-  - `connect()` establishes the session (required before any request)
-  - Suitable for on-premise SAP systems
-  
-- **`JwtAbapConnection`** (concrete, exported):
-  - JWT/OAuth2 Authentication implementation
-  - `connect()` establishes the session with the JWT token (required before any request)
-  - Suitable for SAP BTP ABAP Environment
-  - Token refresh handled by auth-broker package
-
-- **`SamlAbapConnection`** (concrete, exported):
-  - Session-cookie-based authentication (`authType: "saml"`)
-  - Uses existing SSO/SAML session cookies
-  - Fetches CSRF token and executes ADT requests in same HTTP model
+- **`AdtOnPremConnector`** (concrete, exported):
+  - An on-prem system: the session arrives with the establishing call, and the platform's
+    ICF logoff is how it is given back
+  - Takes an auth provider — basic, SAML, certificate, a bearer token, whatever you hold
+
+- **`AdtCloudConnector`** (concrete, exported):
+  - An ABAP Cloud system: a session is a resource, opened at
+    `/sap/bc/adt/core/http/sessions` and given back by `DELETE` on the address it publishes
+  - Takes an auth provider, same as above
+
+  **Which one you take is how you say where you are dialling.** Nothing is probed:
+  the session resource answers on on-prem too, and its `DELETE` there leaves the
+  session open while the logoff removes it — so asking the server would pick the
+  mechanism that releases nothing.
+
+- **Auth providers** (`BasicAuthProvider`, `TokenAuthProvider`, `SamlAuthProvider`,
+  `CertificateAuthProvider`):
+  - What a connection authenticates with, passed in
+  - A token provider renews on its own, and the connector asks it per request — which
+    is how a token that expired between two requests is replaced with nobody
+    deciding to replace it
+  - A `401` **surfaces**. Whether a refusal meant "the token is stale" or "these
+    credentials are refused" is a judgement made with what you know, so the
+    connector does not answer it for you. A credential that can be told to get a
+    new one says so through `IRenewableCredential`, which you narrow to
+
+- **Transports** (`OnPremHttpTransport`, `CloudHttpTransport`, `RfcTransport`):
+  - What a request travels over, and everything that is true of that wire.
+    `HttpTransport` keeps the cookie jar, the CSRF token and the affinity
+    headers; `RfcTransport` translates into `SADT_REST_RFC_ENDPOINT` and keeps a
+    conversation that IS the session
+  - On-prem is where this is a real choice; ABAP Cloud has one wire and its
+    connector takes no such parameter
+  - `rfcConversationFrom(config)` builds what `RfcTransport` needs, deriving
+    `ashost` and `sysnr` and loading the SDK only when a conversation opens
 
 - **`GenericWebSocketTransport`** (concrete, exported):
   - Transport abstraction for realtime WS message flows
@@ -113,6 +133,7 @@ This package interacts with external packages **ONLY through interfaces**:
 
 - 📦 **[Installation Guide](./docs/INSTALLATION.md)** - Setup and installation instructions
 - 📚 **[Usage Guide](./docs/USAGE.md)** - Detailed usage examples and API documentation
+- 🚚 **[Migration to 6.0.0](./docs/MIGRATION-6.0.md)** - the factory and the per-credential classes are removed; RFC is a transport, not a class
 - 🚚 **[Migration to 4.0.0](./docs/MIGRATION-4.0.md)** - a 401 refreshes the token, a 403 reaches you with the server's message; the synthesised "JWT token has expired" is gone
 - 🚚 **[Migration: the explicit session lifecycle](./docs/MIGRATION-2.0.md)** - `connect()` is now required; start here if you are coming from 1.x
 - 💡 **[Examples](./examples/)** - Working code examples
@@ -139,7 +160,13 @@ For detailed installation instructions, see [Installation Guide](./docs/INSTALLA
 ### Basic Usage (On-Premise)
 
 ```typescript
-import { createAbapConnection, SapConfig } from "@mcp-abap-adt/connection";
+import {
+  AdtOnPremConnector,
+  BasicAuthProvider,
+  OnPremHttpTransport,
+  SapConfig,
+  getTimeout,
+} from "@mcp-abap-adt/connection";
 
 const config: SapConfig = {
   url: "https://your-sap-system.com",
@@ -157,21 +184,37 @@ const logger = {
   debug: (msg: string, meta?: any) => console.debug(msg, meta),
 };
 
-// Create connection
-const connection = createAbapConnection(config, logger);
+// Which system you are dialling is the class you take; which credential it
+// authenticates with is the object you hand it. Neither is detected.
+const connection = new AdtOnPremConnector(
+  config,
+  new BasicAuthProvider(config.username!, config.password!),
+  new OnPremHttpTransport(() => ({}), logger, {
+    client: config.client,
+    baseUrl: config.url,
+  }),
+  logger,
+);
 await connection.connect();   // required before any request
 
 // Make ADT request
 const response = await connection.makeAdtRequest({
   method: "GET",
   url: "/sap/bc/adt/programs/programs/your-program",
+  timeout: getTimeout("default"),
 });
 ```
 
 ### Cloud Usage (JWT/OAuth2)
 
 ```typescript
-import { createAbapConnection, SapConfig } from "@mcp-abap-adt/connection";
+import {
+  AdtCloudConnector,
+  CloudHttpTransport,
+  SapConfig,
+  TokenAuthProvider,
+  getTimeout,
+} from "@mcp-abap-adt/connection";
 
 // JWT configuration
 const config: SapConfig = {
@@ -188,21 +231,77 @@ const logger = {
   debug: (msg: string, meta?: any) => console.debug(msg, meta),
 };
 
-// Logger is optional - if not provided, no logging output
-const connection = createAbapConnection(config, logger);
+// Logger is optional - if not provided, no logging output.
+// A bare string is a token with nothing behind it. Hand `TokenAuthProvider` an
+// `ITokenRefresher` instead and it checks expiry and renews on its own, which
+// is what you want in anything long-lived.
+const connection = new AdtCloudConnector(
+  config,
+  new TokenAuthProvider(config.jwtToken!),
+  new CloudHttpTransport(() => ({}), logger, {
+    client: config.client,
+    baseUrl: config.url,
+  }),
+  logger,
+);
 await connection.connect();
 
-// Note: Token refresh is handled by @mcp-abap-adt/auth-broker package
+// Note: obtaining and refreshing tokens is @mcp-abap-adt/auth-broker's job
 const response = await connection.makeAdtRequest({
   method: "GET",
   url: "/sap/bc/adt/programs/programs/your-program",
+  timeout: getTimeout("default"),
 });
 ```
 
+### On-Premise over RFC
+
+The same ADT calls, over `SADT_REST_RFC_ENDPOINT` — the function module Eclipse
+ADT itself uses through JCo — instead of over HTTP. Worth taking on a system
+where stateful HTTP sessions are not usable: an RFC conversation is one ABAP
+session for its whole lifetime, which is the way past `423 invalid lock handle`
+on BASIS < 7.50.
+
+Needs the SAP NW RFC SDK on the machine and `npm install @mcp-abap-adt/sap-rfc-lite`.
+
+```typescript
+import {
+  AdtOnPremConnector,
+  BasicAuthProvider,
+  RfcTransport,
+  rfcConversationFrom,
+} from "@mcp-abap-adt/connection";
+
+const connection = new AdtOnPremConnector(
+  config,
+  new BasicAuthProvider(config.username!, config.password!),
+  new RfcTransport(rfcConversationFrom(config), logger),
+  logger,
+);
+
+await connection.connect();
+// Everything above the wire is the same: makeAdtRequest, setSessionType,
+// disconnect. What differs is where the session lives — see below.
+```
+
+**Where to look for it.** An HTTP session is an ICF session and appears in
+**SM05**. An RFC conversation is a gateway client: it appears in **SMGW → Logged
+on Clients** as `NWRFC`, and never in SM05, because there is no ICM in that
+path. Looking for one in the other monitor and finding nothing is not a fault.
+
+There is no cloud equivalent: ABAP Cloud has one wire, and `AdtCloudConnector`
+takes no transport parameter at all.
+
 ### SSO Usage (SAML Session Cookies)
 
 ```typescript
-import { createAbapConnection, SapConfig } from "@mcp-abap-adt/connection";
+import {
+  AdtOnPremConnector,
+  OnPremHttpTransport,
+  SamlAuthProvider,
+  SapConfig,
+  getTimeout,
+} from "@mcp-abap-adt/connection";
 
 const config: SapConfig = {
   url: "https://your-sap-system.com",
@@ -210,47 +309,79 @@ const config: SapConfig = {
   sessionCookies: "MYSAPSSO2=...; SAP_SESSIONID=...",
 };
 
-const connection = createAbapConnection(config, logger);
+// The cookies ARE the credential here — there is no Authorization header at all.
+const connection = new AdtOnPremConnector(
+  config,
+  new SamlAuthProvider(config.sessionCookies!),
+  new OnPremHttpTransport(() => ({}), logger, {
+    client: config.client,
+    baseUrl: config.url,
+  }),
+  logger,
+);
 await connection.connect();
 
 const response = await connection.makeAdtRequest({
   method: "GET",
   url: "/sap/bc/adt/programs/programs/your-program",
+  timeout: getTimeout("default"),
 });
 ```
 
 ### Cloud Usage with Automatic Token Refresh
 
-For automatic token refresh on **401** errors, inject `ITokenRefresher`:
+Give `TokenAuthProvider` an `ITokenRefresher` and the provider replaces an
+**expired** token on its own — it is asked per request and checks expiry before
+answering, so nobody decides to renew. A token the source still believes in and
+the server refuses is the other half, and that one **surfaces**:
 
 ```typescript
-import { JwtAbapConnection, SapConfig } from "@mcp-abap-adt/connection";
+import {
+  AdtCloudConnector,
+  CloudHttpTransport,
+  SapConfig,
+  TokenAuthProvider,
+  getTimeout,
+} from "@mcp-abap-adt/connection";
 import type { ITokenRefresher } from "@mcp-abap-adt/interfaces";
 
 // Token refresher provides token acquisition and refresh
 // (created by @mcp-abap-adt/auth-broker or custom implementation)
+const currentAccessToken = 'the access token you already hold';
+const exchangeRefreshToken = async () => 'a freshly exchanged access token';
 const tokenRefresher: ITokenRefresher = {
-  getToken: async () => { /* return current token */ },
-  refreshToken: async () => { /* refresh and return new token */ },
+  getToken: async () => currentAccessToken,      // the one you hold
+  refreshToken: async () => exchangeRefreshToken(), // a new one, and cache it
 };
 
-// JWT configuration
 const config: SapConfig = {
   url: "https://your-instance.abap.cloud.sap",
   authType: "jwt",
-  jwtToken: await tokenRefresher.getToken(), // Get initial token
 };
 
-// Create connection with token refresher - 401 handled automatically
-const connection = new JwtAbapConnection(config, logger, undefined, tokenRefresher);
+// The connector says which SYSTEM this is; the provider says how to
+// authenticate. Neither decides the other.
+const connection = new AdtCloudConnector(
+  config,
+  new TokenAuthProvider(tokenRefresher),
+  new CloudHttpTransport(() => ({}), logger, {
+    client: config.client,
+    baseUrl: config.url,
+  }),
+  logger,
+);
 await connection.connect();
 
-// Requests automatically retry with refreshed token on auth errors. A refresh
-// replaces the SAP session, so if a lock window is open the request fails with
-// ADT_SESSION_REPLACED instead of continuing on a session your lock is not in.
+// On a 401 nothing here decides to get a new credential: the refusal reaches
+// you. Whether it meant "stale" is a judgement made with what you know, and
+// `renew()` is the seam you make it with. The session is untouched — a refused
+// reaches you. A refresh replaces the SAP session, so if a lock window is open
+// the request fails with ADT_SESSION_REPLACED rather than continuing on a
+// session your lock is not in.
 const response = await connection.makeAdtRequest({
   method: "GET",
   url: "/sap/bc/adt/programs/programs/your-program",
+  timeout: getTimeout("default"),
 });
 ```
 
@@ -271,9 +402,22 @@ See [MIGRATION-4.0.md](./docs/MIGRATION-4.0.md).
 For operations that require session state (e.g., object modifications), you can enable stateful sessions:
 
 ```typescript
-import { createAbapConnection } from "@mcp-abap-adt/connection";
-
-const connection = createAbapConnection(config, logger);
+import {
+  AdtOnPremConnector,
+  BasicAuthProvider,
+  OnPremHttpTransport,
+  getTimeout,
+} from "@mcp-abap-adt/connection";
+
+const connection = new AdtOnPremConnector(
+  config,
+  new BasicAuthProvider(config.username!, config.password!),
+  new OnPremHttpTransport(() => ({}), logger, {
+    client: config.client,
+    baseUrl: config.url,
+  }),
+  logger,
+);
 await connection.connect();
 
 // Enable stateful session mode (adds x-sap-adt-sessiontype: stateful header)
@@ -284,6 +428,7 @@ await connection.makeAdtRequest({
   method: "POST",
   url: "/sap/bc/adt/objects/domains",
   data: { /* domain data */ },
+  timeout: getTimeout("default"),
 });
 
 // Note: Session state persistence is handled by @mcp-abap-adt/auth-broker package
@@ -292,7 +437,7 @@ await connection.makeAdtRequest({
 ### Custom Logger
 
 ```typescript
-import { ILogger } from "@mcp-abap-adt/connection";
+import { AdtOnPremConnector, BasicAuthProvider, ILogger, OnPremHttpTransport } from "@mcp-abap-adt/connection";
 
 class MyLogger implements ILogger {
   info(message: string, meta?: any): void {
@@ -321,7 +466,15 @@ class MyLogger implements ILogger {
 }
 
 const logger = new MyLogger();
-const connection = createAbapConnection(config, logger);
+const connection = new AdtOnPremConnector(
+  config,
+  new BasicAuthProvider(config.username!, config.password!),
+  new OnPremHttpTransport(() => ({}), logger, {
+    client: config.client,
+    baseUrl: config.url,
+  }),
+  logger,
+);
 ```
 
 ## CLI Tool
@@ -411,6 +564,8 @@ type SapConfig = {
 Main interface for ABAP connections.
 
 ```typescript
+import { AbapRequestOptions } from '@mcp-abap-adt/connection';
+import type { AxiosResponse } from 'axios';
 // The shared contract (IAbapConnection), what every connection provides:
 interface AbapConnection {
   connect(): Promise<void>; // REQUIRED before any request; rejects on failure
@@ -421,10 +576,12 @@ interface AbapConnection {
 }
 ```
 
-The HTTP connection classes carry the rest of the session lifecycle. It is on the
-shared contract as a **capability atom** in `@mcp-abap-adt/interfaces` rather than
-as methods on `IAbapConnection`, which is why `RfcAbapConnection` — a transport
-that owns no HTTP session — is unaffected by its existence:
+The connectors carry the rest of the session lifecycle. It is on the shared
+contract as a **capability atom** in `@mcp-abap-adt/interfaces` rather than as
+methods on `IAbapConnection`, so a consumer that only carries requests is
+unaffected by its existence. Note that a connection over RFC has the whole of it
+— what an RFC conversation has none of is a session RESOURCE to open and close
+by address, which is an empty mechanism, not an absent lifecycle:
 
 ```typescript
 // ISessionLifecycleAware
@@ -466,16 +623,35 @@ interface ILogger {
 
 ### Functions
 
-#### `createAbapConnection(config, logger?, sessionId?)`
+#### `rfcConversationFrom(config)`
+
+What `RfcTransport` is constructed with. Derives `ashost` from the url and
+`sysnr` from the HTTP port by the SAP convention that `80XX` is the ICM port for
+system `XX`, which `SAP_SYSNR` overrides for a port that follows no convention.
 
-Factory function to create an ABAP connection instance.
+The SAP NW RFC SDK is loaded when a conversation opens, not when this is called,
+so a machine without it fails at `connect()` with a message saying what to
+install rather than at construction.
+
+```text
+function rfcConversationFrom(config: SapConfig): () => IRfcConversation;
+function rfcParamsFrom(config: SapConfig): RfcConnectionParams;
+```
 
 ```typescript
-function createAbapConnection(
-  config: SapConfig,
-  logger?: ILogger | null,
-  sessionId?: string
-): AbapConnection;
+import {
+  AdtOnPremConnector,
+  BasicAuthProvider,
+  RfcTransport,
+  rfcConversationFrom,
+} from "@mcp-abap-adt/connection";
+
+const connection = new AdtOnPremConnector(
+  config,
+  new BasicAuthProvider(config.username!, config.password!),
+  new RfcTransport(rfcConversationFrom(config), logger),
+  logger,
+);
 ```
 
 #### `CSRF_CONFIG` and `CSRF_ERROR_MESSAGES`
@@ -502,6 +678,12 @@ import { CSRF_CONFIG, CSRF_ERROR_MESSAGES } from '@mcp-abap-adt/connection';
 ```typescript
 import { CSRF_CONFIG, CSRF_ERROR_MESSAGES } from '@mcp-abap-adt/connection';
 
+// Whatever HTTP client your own connection class is built on.
+const yourHttpClient = {
+  get: async (url: string, config: { headers: Record<string, string> }) =>
+    ({ headers: {} as Record<string, string> }),
+};
+
 async function fetchCsrfToken(baseUrl: string): Promise<string> {
   const csrfUrl = `${baseUrl}${CSRF_CONFIG.ENDPOINT}`;
   
@@ -533,6 +715,10 @@ async function fetchCsrfToken(baseUrl: string): Promise<string> {
       await new Promise(resolve => setTimeout(resolve, CSRF_CONFIG.RETRY_DELAY));
     }
   }
+
+  // Unreachable: the last attempt either returns or throws above. Stated so the
+  // function has a return type the compiler can agree with.
+  throw new Error(CSRF_ERROR_MESSAGES.NOT_IN_HEADERS);
 }
 ```
 

package/dist/auth/providers.d.ts

@@ -0,0 +1,124 @@
+/**
+ * The credentials a connector can be handed.
+ *
+ * Each is the authentication half of one of the connection classes that used to
+ * carry both halves, lifted out unchanged — the header a `BasicAuthProvider`
+ * builds is byte for byte what `BaseAbapConnection` built, and the TLS options a
+ * `CertificateAuthProvider` returns are what `CertificateAbapConnection`
+ * returned. Nothing about how a credential works changed; only who owns it.
+ */
+import type { IAuthProvider, ICertificateMaterial, ICertificateMaterialLoader, IRenewableCredential, ISapConfig, ITokenRefresher } from '@mcp-abap-adt/interfaces';
+/** Username and password, as `Basic base64(user:pass)`. */
+export declare class BasicAuthProvider implements IAuthProvider {
+    private readonly username;
+    private readonly password;
+    readonly kind = "basic";
+    /** Nothing to get ready: this credential is complete as constructed. */
+    prepare(): Promise<void>;
+    /** Not cookies. This one authenticates with a header. */
+    cookies(): string | null;
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial(): ICertificateMaterial;
+    constructor(username: string, password: string);
+    authorizationHeader(): Promise<string | null>;
+}
+/**
+ * A bearer token, kept current by whoever issued it.
+ *
+ * Takes an `ITokenRefresher` — the contract `@mcp-abap-adt/auth-broker` already
+ * produces and `@mcp-abap-adt/auth-providers` already implements twelve ways.
+ * This package depends on neither: it speaks the contract, and the consumer
+ * brings the implementation, exactly as it does for `IAbapConnection`.
+ *
+ * **This carries no session recovery.** What happens to a session when the
+ * credential behind it is renewed mid-flight is the connection's business and
+ * stays there; see `JwtAbapConnection`, which still owns that machinery.
+ */
+export declare class TokenAuthProvider implements IRenewableCredential {
+    private readonly source;
+    readonly kind = "token";
+    /** Nothing to get ready: this credential is complete as constructed. */
+    prepare(): Promise<void>;
+    /** Not cookies. This one authenticates with a header. */
+    cookies(): string | null;
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial(): ICertificateMaterial;
+    /**
+     * A token, or something that can produce one.
+     *
+     * A bare string is a token with no renewal behind it — honest, and fine for a
+     * short task. An `ITokenRefresher` or a function is a provider that checks
+     * expiry and renews on its own, which is where this belongs in a long-lived
+     * process.
+     */
+    constructor(source: string | ITokenRefresher | (() => Promise<string>));
+    /**
+     * Asked every time, and nothing kept.
+     *
+     * The provider behind this already caches the token, knows when it expires,
+     * and renews before handing one back. A second cache here would serve the
+     * stale one and hide exactly the renewal the provider exists to do — which
+     * is what the first version of this class did.
+     */
+    authorizationHeader(): Promise<string | null>;
+    /**
+     * The token was refused, so force a new one.
+     *
+     * Declared through `IRenewableCredential` rather than as an optional member
+     * of every credential, so a consumer narrows to it: a password has nothing
+     * behind it to ask again, and a SAML session was negotiated elsewhere.
+     *
+     * **Nothing in this package calls it.** A token that EXPIRED is replaced
+     * inside `authorizationHeader()` above, which is asked per request — nobody
+     * decides anything. This is the other case, a token the source still believes
+     * in and the server refuses, and whether a refusal meant that is a judgement
+     * made with what the caller knows. So the refusal surfaces, and this is the
+     * seam the caller decides with.
+     *
+     * `getToken()` is documented to return the cached token while it believes it
+     * is still valid — which is exactly the situation after a 401 on a token the
+     * provider has not yet noticed is dead. `refreshToken()` is the contract's
+     * answer for that, and this is the only place it is called.
+     */
+    renew(): Promise<void>;
+}
+/**
+ * A SAML session, already negotiated, presented as cookies.
+ *
+ * No `Authorization` header at all — the cookies are the credential, and they
+ * are added by the connection alongside its own.
+ */
+export declare class SamlAuthProvider implements IAuthProvider {
+    private readonly sessionCookies;
+    readonly kind = "saml";
+    /** Nothing to get ready: this credential is complete as constructed. */
+    prepare(): Promise<void>;
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial(): ICertificateMaterial;
+    constructor(sessionCookies: string);
+    /** Not a header: this credential authenticates with the cookies below. */
+    authorizationHeader(): Promise<string | null>;
+    /** The cookies to present. */
+    cookies(): string;
+}
+/**
+ * Client certificate: the credential lives in the TLS handshake.
+ *
+ * `prepare()` is where the material is read, which is why it exists at all —
+ * building an agent before it is loaded is what used to reject a connect
+ * before a single request went out.
+ */
+export declare class CertificateAuthProvider implements IAuthProvider {
+    private readonly loader;
+    private readonly config;
+    readonly kind = "certificate";
+    /** Not cookies. This one authenticates with a header. */
+    cookies(): string | null;
+    private material;
+    constructor(loader: ICertificateMaterialLoader, config: ISapConfig);
+    prepare(): Promise<void>;
+    /** Not a header: this credential authenticates through TLS. */
+    authorizationHeader(): Promise<string | null>;
+    transportMaterial(): ICertificateMaterial;
+}
+//# sourceMappingURL=providers.d.ts.map

package/dist/auth/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/auth/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,UAAU,EACV,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,2DAA2D;AAC3D,qBAAa,iBAAkB,YAAW,aAAa;IAiBnD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAjB3B,QAAQ,CAAC,IAAI,WAAW;IAExB,wEAAwE;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE9B,yDAAyD;IACzD,OAAO,IAAI,MAAM,GAAG,IAAI;IAIxB,gFAAgF;IAChF,iBAAiB,IAAI,oBAAoB;gBAKtB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;IAG7B,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGpD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAkB,YAAW,oBAAoB;IAyB1D,OAAO,CAAC,QAAQ,CAAC,MAAM;IAxBzB,QAAQ,CAAC,IAAI,WAAW;IAExB,wEAAwE;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE9B,yDAAyD;IACzD,OAAO,IAAI,MAAM,GAAG,IAAI;IAIxB,gFAAgF;IAChF,iBAAiB,IAAI,oBAAoB;IAIzC;;;;;;;OAOG;gBAEgB,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7E;;;;;;;OAOG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUnD;;;;;;;;;;;;;;;;;;OAkBG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ7B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IAWxC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAV3C,QAAQ,CAAC,IAAI,UAAU;IAEvB,wEAAwE;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE9B,gFAAgF;IAChF,iBAAiB,IAAI,oBAAoB;gBAIZ,cAAc,EAAE,MAAM;IAEnD,0EAA0E;IACpE,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAInD,8BAA8B;IAC9B,OAAO,IAAI,MAAM;CAGlB;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,YAAW,aAAa;IAWzD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAXzB,QAAQ,CAAC,IAAI,iBAAiB;IAE9B,yDAAyD;IACzD,OAAO,IAAI,MAAM,GAAG,IAAI;IAIxB,OAAO,CAAC,QAAQ,CAAqC;gBAGlC,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,UAAU;IAG/B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAM9B,+DAA+D;IACzD,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAInD,iBAAiB,IAAI,oBAAoB;CAS1C"}