@milaboratories/pl-client 3.14.5 → 3.14.6

package/dist/core/ll_client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ll_client.cjs","names":["plAddressToConfig","inferAuthRefreshTime","interceptors","GrpcPlApiClient","createClient","SUPPORTED_WIRE_PROTOCOLS","compressionAlgorithms","ChannelCredentials","GrpcTransport","parsePlJwt","isUnauthenticated","parseResponseError","InterceptingCall","GrpcStatus","Timestamp","hasCapability","isAbortedError","LLPlTransaction","WebSocketBiDiStream","TxAPI_ClientMessage","TxAPI_ServerMessage"],"sources":["../../src/core/ll_client.ts"],"sourcesContent":["import { PlatformClient as GrpcPlApiClient } from \"../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api.client\";\nimport type { ClientOptions, Interceptor } from \"@grpc/grpc-js\";\nimport {\n  ChannelCredentials,\n  InterceptingCall,\n  status as GrpcStatus,\n  compressionAlgorithms,\n} from \"@grpc/grpc-js\";\nimport type {\n  AuthInformation,\n  AuthOps,\n  PlClientConfig,\n  PlConnectionStatus,\n  PlConnectionStatusListener,\n} from \"./config\";\nimport { plAddressToConfig, type wireProtocol, SUPPORTED_WIRE_PROTOCOLS } from \"./config\";\nimport type { GrpcOptions } from \"@protobuf-ts/grpc-transport\";\nimport { GrpcTransport } from \"@protobuf-ts/grpc-transport\";\nimport { LLPlTransaction } from \"./ll_transaction\";\nimport { setResourceSignaturesRequired } from \"./types\";\nimport { parsePlJwt } from \"../util/pl\";\nimport { type Dispatcher, interceptors } from \"undici\";\nimport type { Middleware } from \"openapi-fetch\";\nimport { inferAuthRefreshTime } from \"./auth\";\nimport { hasCapability, type BackendCapability } from \"./capabilities\";\nimport { defaultHttpDispatcher } from \"@milaboratories/pl-http\";\nimport type { WireClientProvider, WireClientProviderFactory, WireConnection } from \"./wire\";\nimport { parseHttpAuth } from \"@milaboratories/pl-model-common\";\nimport type * as grpcTypes from \"../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api\";\nimport {\n  type PlApiPaths,\n  type PlRestClientType,\n  createClient,\n  parseResponseError,\n} from \"../proto-rest\";\nimport { notEmpty, retry, withTimeout, type RetryOptions } from \"@milaboratories/ts-helpers\";\nimport { Code } from \"../proto-grpc/google/rpc/code\";\nimport { WebSocketBiDiStream } from \"./websocket_stream\";\nimport {\n  AuthAPI_Role,\n  TxAPI_ClientMessage,\n  TxAPI_ServerMessage,\n} from \"../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api\";\nimport type { MiLogger } from \"@milaboratories/ts-helpers\";\nimport { isAbortedError, isUnauthenticated } from \"./errors\";\nimport { Timestamp } from \"../proto-grpc/google/protobuf/timestamp\";\n\nexport interface PlCallOps {\n  timeout?: number;\n  abortSignal?: AbortSignal;\n}\n\n// Parses leading \"<major>.<minor>.<patch>\" from a version string like\n// \"3.1.1\" or \"3.1.1-rc1\" and returns true if the parsed version is >= target.\n// Returns false for unparseable versions (safer to assume an old backend).\nfunction isVersionAtLeast(version: string, target: [number, number, number]): boolean {\n  const match = /^v?(\\d+)\\.(\\d+)\\.(\\d+)/.exec(version);\n  if (!match) return false;\n  const parsed: [number, number, number] = [Number(match[1]), Number(match[2]), Number(match[3])];\n  for (let i = 0; i < 3; i++) {\n    if (parsed[i] !== target[i]) return parsed[i] > target[i];\n  }\n  return true;\n}\n\n// Returns true iff `version` is strictly after the release tag `target`. Dev\n// builds (`git describe`-style, e.g. \"3.5.0-224-g0ca182\") are considered\n// AFTER the matching release tag — they include commits past the tag and so\n// have any change merged after it. Released versions with the same triplet\n// return false (we want the tag itself to be excluded).\n//\n// Examples for target [3,5,0]:\n//   \"3.5.0\"              → false (the tagged release)\n//   \"3.5.0-224-g0ca182\"  → true  (dev build past the tag)\n//   \"3.5.1\"              → true\n//   \"3.4.9\"              → false\n// Returns false for unparseable versions.\nfunction isAfterVersion(version: string, target: [number, number, number]): boolean {\n  const match = /^v?(\\d+)\\.(\\d+)\\.(\\d+)(.*)$/.exec(version);\n  if (!match) return false;\n  const parsed: [number, number, number] = [Number(match[1]), Number(match[2]), Number(match[3])];\n  const suffix = match[4];\n  for (let i = 0; i < 3; i++) {\n    if (parsed[i] !== target[i]) return parsed[i] > target[i];\n  }\n  return suffix !== \"\";\n}\n\nclass WireClientProviderImpl<Client> implements WireClientProvider<Client> {\n  private client: Client | undefined = undefined;\n\n  constructor(\n    private readonly wireOpts: () => WireConnection,\n    private readonly clientConstructor: (wireOpts: WireConnection) => Client,\n  ) {}\n\n  public reset(): void {\n    this.client = undefined;\n  }\n\n  public get(): Client {\n    if (this.client === undefined) this.client = this.clientConstructor(this.wireOpts());\n    return this.client;\n  }\n}\n\n/** Abstract out low level networking and authorization details */\nexport class LLPlClient implements WireClientProviderFactory {\n  /** Initial authorization information */\n  private authInformation?: AuthInformation;\n  /** Will be executed by the client when it is required */\n  private readonly onAuthUpdate?: (newInfo: AuthInformation) => void;\n  /** Will be executed if auth-related error happens during normal client operation */\n  private readonly onAuthError?: () => void;\n  /** Will be executed by the client when it is required */\n  private readonly onAuthRefreshProblem?: (error: unknown) => void;\n  /** Threshold after which auth info refresh is required */\n  private refreshTimestamp?: number;\n\n  /** Cached Ping response. Populated by build() before it returns; refreshed by every later ping(). */\n  private _serverInfo?: grpcTypes.MaintenanceAPI_Ping_Response;\n  private _authMethodsSync?: grpcTypes.AuthAPI_ListMethods_Response;\n\n  private _status: PlConnectionStatus = \"OK\";\n  private authProbeInFlight = false;\n  private readonly statusListener?: PlConnectionStatusListener;\n\n  private _wireProto: wireProtocol = \"grpc\";\n  private _wireConn!: WireConnection;\n\n  private readonly _restInterceptors: Dispatcher.DispatcherComposeInterceptor[];\n  private readonly _restMiddlewares: Middleware[];\n  private readonly _grpcInterceptors: Interceptor[];\n  private readonly providers: WeakRef<WireClientProviderImpl<any>>[] = [];\n\n  public readonly clientProvider: WireClientProvider<PlRestClientType | GrpcPlApiClient>;\n\n  public readonly httpDispatcher: Dispatcher;\n\n  public static async build(\n    configOrAddress: PlClientConfig | string,\n    ops: {\n      auth?: AuthOps;\n      statusListener?: PlConnectionStatusListener;\n      shouldUseGzip?: boolean;\n      logger?: MiLogger;\n      useAutoDetectWireProtocol?: boolean;\n    } = {},\n  ) {\n    const conf =\n      typeof configOrAddress === \"string\" ? plAddressToConfig(configOrAddress) : configOrAddress;\n\n    const pl = new LLPlClient(conf, ops);\n\n    // FIXME(rfiskov)[MILAB-5275]: Investigate why autodetect randomly fails; temporary turn it off.\n    if (ops.useAutoDetectWireProtocol) {\n      await pl.detectOptimalWireProtocol();\n    }\n\n    // Guarantee a ping happened so capability-gated paths (login, refresh) can branch synchronously.\n    // In the autodetect path the loop's last successful ping already populated _serverInfo via the\n    // side-effect in ping(); this fallback covers the path where autodetect is disabled.\n    if (!pl._serverInfo) await pl.ping();\n\n    // Install the process-global signature-strictness flag based on backend version.\n    setResourceSignaturesRequired(pl.supportsResourceSignatures);\n\n    // Guarantee authMethods happened so client can make weighted decision on which auth method to use.\n    if (!pl._authMethodsSync) await pl.authMethods();\n\n    return pl;\n  }\n\n  private constructor(\n    public readonly conf: PlClientConfig,\n    private readonly ops: {\n      auth?: AuthOps;\n      statusListener?: PlConnectionStatusListener;\n      shouldUseGzip?: boolean;\n      logger?: MiLogger;\n    } = {},\n  ) {\n    const { auth, statusListener } = ops;\n\n    if (auth !== undefined) {\n      this.refreshTimestamp = inferAuthRefreshTime(\n        auth.authInformation,\n        this.conf.authMaxRefreshSeconds,\n      );\n      this.authInformation = auth.authInformation;\n      this.onAuthUpdate = auth.onUpdate;\n      this.onAuthRefreshProblem = auth.onUpdateError;\n      this.onAuthError = auth.onAuthError;\n    }\n\n    this._restInterceptors = [];\n    this._restMiddlewares = [];\n    this._grpcInterceptors = [];\n\n    if (auth !== undefined) {\n      this._restInterceptors.push(this.createRestAuthInterceptor());\n      this._grpcInterceptors.push(this.createGrpcAuthInterceptor());\n    }\n    this._restInterceptors.push(interceptors.retry({ statusCodes: [] })); // Handle errors with openapi-fetch middleware.\n    this._restMiddlewares.push(this.createRestErrorMiddleware());\n    this._grpcInterceptors.push(this.createGrpcErrorInterceptor());\n\n    this.httpDispatcher = defaultHttpDispatcher(this.conf.httpProxy);\n    if (this.conf.wireProtocol) {\n      this._wireProto = this.conf.wireProtocol;\n    }\n\n    this.initWireConnection(this._wireProto);\n\n    if (statusListener !== undefined) {\n      this.statusListener = statusListener;\n      statusListener(this._status);\n    }\n\n    this.clientProvider = this.createWireClientProvider((wireConn) => {\n      if (wireConn.type === \"grpc\") {\n        return new GrpcPlApiClient(wireConn.Transport);\n      } else {\n        return createClient<PlApiPaths>({\n          hostAndPort: wireConn.Config.hostAndPort,\n          ssl: wireConn.Config.ssl,\n          dispatcher: wireConn.Dispatcher,\n          middlewares: wireConn.Middlewares,\n        });\n      }\n    });\n  }\n\n  private initWireConnection(protocol: wireProtocol) {\n    switch (protocol) {\n      case \"rest\":\n        this.initRestConnection();\n        return;\n      case \"grpc\":\n        this.initGrpcConnection(this.ops.shouldUseGzip ?? false);\n        return;\n      default:\n        ((v: never) => {\n          throw new Error(\n            `Unsupported wire protocol '${v as string}'. Use one of: ${SUPPORTED_WIRE_PROTOCOLS.join(\", \")}`,\n          );\n        })(protocol);\n    }\n  }\n\n  private initRestConnection(): void {\n    const dispatcher = defaultHttpDispatcher(this.conf.grpcProxy, this._restInterceptors);\n    this._replaceWireConnection({\n      type: \"rest\",\n      Config: this.conf,\n      Dispatcher: dispatcher,\n      Middlewares: this._restMiddlewares,\n    });\n  }\n\n  /**\n   * Initializes (or reinitializes) _grpcTransport\n   * @param gzip - whether to enable gzip compression\n   */\n  private initGrpcConnection(gzip: boolean) {\n    const clientOptions: ClientOptions = {\n      \"grpc.keepalive_time_ms\": 30_000, // 30 seconds\n      \"grpc.service_config_disable_resolution\": 1, // Disable DNS TXT lookups for service config\n      // Raises the per-stream and connection-level HTTP/2 windows. Node's 64 KB default\n      // caps a big single-stream read (project open) at window/RTT rather than link speed,\n      // and a lost WINDOW_UPDATE can deadlock it under packet loss.\n      \"grpc-node.flow_control_window\": 16 * 1024 * 1024, // 16 MiB\n      interceptors: this._grpcInterceptors,\n    };\n\n    if (gzip) clientOptions[\"grpc.default_compression_algorithm\"] = compressionAlgorithms.gzip;\n\n    //\n    // Leaving it here for now\n    // https://github.com/grpc/grpc-node/issues/2788\n    //\n    // We should implement message pooling algorithm to overcome hardcoded NO_DELAY behaviour\n    // of HTTP/2 and allow our small messages to batch together.\n    //\n    const grpcOptions: GrpcOptions = {\n      host: this.conf.hostAndPort,\n      timeout: this.conf.defaultRequestTimeout,\n      channelCredentials: this.conf.ssl\n        ? ChannelCredentials.createSsl()\n        : ChannelCredentials.createInsecure(),\n      clientOptions,\n    };\n\n    const grpcProxy =\n      typeof this.conf.grpcProxy === \"string\" ? { url: this.conf.grpcProxy } : this.conf.grpcProxy;\n\n    if (grpcProxy?.url) {\n      const url = new URL(grpcProxy.url);\n      if (grpcProxy.auth) {\n        const parsed = parseHttpAuth(grpcProxy.auth);\n        if (parsed.scheme !== \"Basic\") {\n          throw new Error(`Unsupported auth scheme: ${parsed.scheme as string}.`);\n        }\n        url.username = parsed.username;\n        url.password = parsed.password;\n      }\n      process.env.grpc_proxy = url.toString();\n    } else {\n      delete process.env.grpc_proxy;\n    }\n\n    this._replaceWireConnection({ type: \"grpc\", Transport: new GrpcTransport(grpcOptions) });\n  }\n\n  private _replaceWireConnection(newConn: WireConnection): void {\n    const oldConn = this._wireConn;\n    this._wireConn = newConn;\n    this._wireProto = newConn.type;\n\n    // Reset all providers to let them reinitialize their clients\n    for (let i = 0; i < this.providers.length; i++) {\n      const provider = this.providers[i].deref();\n      if (provider === undefined) {\n        // at the same time we need to remove providers that are no longer valid\n        this.providers.splice(i, 1);\n        i--;\n      } else {\n        provider.reset();\n      }\n    }\n\n    if (oldConn !== undefined && oldConn.type === \"grpc\") oldConn.Transport.close();\n  }\n\n  private providerCleanupCounter = 0;\n\n  /**\n   * Creates a provider for a grpc client. Returned provider will create fresh client whenever the underlying transport is reset.\n   *\n   * @param clientConstructor - a factory function that creates a grpc client\n   */\n  public createWireClientProvider<Client>(\n    clientConstructor: (transport: WireConnection) => Client,\n  ): WireClientProvider<Client> {\n    // We need to cleanup providers periodically to avoid memory leaks.\n    // This is a simple heuristic to avoid memory leaks.\n    // We could use a more sophisticated algorithm, but this is good enough for now.\n    this.providerCleanupCounter++;\n    if (this.providerCleanupCounter >= 16) {\n      for (let i = 0; i < this.providers.length; i++) {\n        const provider = this.providers[i].deref();\n        if (provider === undefined) {\n          this.providers.splice(i, 1);\n          i--;\n        }\n      }\n      this.providerCleanupCounter = 0;\n    }\n\n    const provider = new WireClientProviderImpl<Client>(() => this._wireConn, clientConstructor);\n    this.providers.push(new WeakRef(provider));\n    return provider;\n  }\n\n  public get wireConnection(): WireConnection {\n    return this._wireConn;\n  }\n\n  public get wireProtocol(): wireProtocol | undefined {\n    return this._wireProto;\n  }\n\n  /** Returns true if client is authenticated. Even with anonymous auth information\n   * connection is considered authenticated. Unauthenticated clients are used for\n   * login and similar tasks, see {@link UnauthenticatedPlClient}. */\n  public get authenticated(): boolean {\n    return this.authInformation !== undefined;\n  }\n\n  /** null means anonymous connection */\n  public get authUser(): string | null {\n    if (!this.authenticated) throw new Error(\"Client is not authenticated\");\n    if (this.authInformation?.jwtToken) {\n      if (this.hasCapability(\"auth:v2\")) {\n        return parsePlJwt(this.authInformation?.jwtToken).sub;\n      }\n      return parsePlJwt(this.authInformation?.jwtToken).user.login;\n    } else return null;\n  }\n\n  private updateStatus(newStatus: PlConnectionStatus) {\n    process.nextTick(() => {\n      if (this._status !== newStatus) {\n        this._status = newStatus;\n        if (this.statusListener !== undefined) this.statusListener(this._status);\n        if (newStatus === \"Unauthenticated\" && this.onAuthError !== undefined) this.onAuthError();\n      }\n    });\n  }\n\n  /**\n   * UNAUTHENTICATED covers both a dead session (must reset) and a per-request authorization failure\n   * such as a revoked resource signature (must not). Disambiguate by probing getSessionInfo — an\n   * authenticated call with no resource signature: success means the session is alive and the failure\n   * was resource-level; a probe that is itself Unauthenticated means real auth loss. Coalesced via\n   * authProbeInFlight so a burst of failures costs one probe.\n   */\n  private async verifyThenMaybeEscalateUnauthenticated(): Promise<void> {\n    if (this._status !== \"OK\" || this.authProbeInFlight) return;\n    this.authProbeInFlight = true;\n    try {\n      await this.getSessionInfo();\n    } catch (e) {\n      if (isUnauthenticated(e)) this.updateStatus(\"Unauthenticated\");\n    } finally {\n      this.authProbeInFlight = false;\n    }\n  }\n\n  public get status(): PlConnectionStatus {\n    return this._status;\n  }\n\n  private authRefreshInProgress: boolean = false;\n\n  private refreshAuthInformationIfNeeded(): void {\n    if (\n      this.refreshTimestamp === undefined ||\n      Date.now() < this.refreshTimestamp ||\n      this.authRefreshInProgress ||\n      this._status === \"Unauthenticated\"\n    )\n      return;\n\n    // Running refresh in background`\n    this.authRefreshInProgress = true;\n    void (async () => {\n      try {\n        const ttl = BigInt(this.conf.authTTLSeconds);\n        const token = this.hasCapability(\"auth:v2\")\n          ? await this.refreshToken({ ttlSeconds: ttl })\n          : await this.getJwtToken(ttl);\n        this.authInformation = { jwtToken: token };\n        this.refreshTimestamp = inferAuthRefreshTime(\n          this.authInformation,\n          this.conf.authMaxRefreshSeconds,\n        );\n        if (this.onAuthUpdate) this.onAuthUpdate(this.authInformation);\n      } catch (e: unknown) {\n        if (this.onAuthRefreshProblem) this.onAuthRefreshProblem(e);\n      } finally {\n        this.authRefreshInProgress = false;\n      }\n    })();\n  }\n\n  /**\n   * Creates middleware that parses error responses and handles them centrally.\n   * This middleware runs before openapi-fetch parses the response, so we need to\n   * manually parse the response body for error responses.\n   */\n  private createRestErrorMiddleware(): Middleware {\n    return {\n      onResponse: async ({ request: _request, response, options: _options }) => {\n        const { body, ...resOptions } = response;\n\n        if ([502, 503, 504].includes(response.status)) {\n          // Service unavailable, bad gateway, gateway timeout\n          this.updateStatus(\"Disconnected\");\n          return new Response(body, { ...resOptions, status: response.status });\n        }\n\n        const respErr = await parseResponseError(response);\n        if (!respErr.error) {\n          // No error: nice!\n          return new Response(respErr.origBody ?? body, { ...resOptions, status: response.status });\n        }\n\n        if (typeof respErr.error === \"string\") {\n          // Non-standard error or normal response: let later middleware to deal wit it.\n          return new Response(respErr.error, { ...resOptions, status: response.status });\n        }\n\n        if (respErr.error.code === Code.UNAUTHENTICATED) {\n          void this.verifyThenMaybeEscalateUnauthenticated();\n        }\n\n        // Let later middleware to deal with standard gRPC error.\n        return new Response(respErr.origBody, { ...resOptions, status: response.status });\n      },\n    };\n  }\n\n  /** Detects certain errors and update client status accordingly when using GRPC wire connection */\n  private createGrpcErrorInterceptor(): Interceptor {\n    return (options, nextCall) => {\n      return new InterceptingCall(nextCall(options), {\n        start: (metadata, listener, next) => {\n          next(metadata, {\n            onReceiveStatus: (status, next) => {\n              if (status.code == GrpcStatus.UNAUTHENTICATED)\n                // (!!!) don't change to \"===\"\n                void this.verifyThenMaybeEscalateUnauthenticated();\n              if (status.code == GrpcStatus.UNAVAILABLE)\n                // (!!!) don't change to \"===\"\n                this.updateStatus(\"Disconnected\");\n              next(status);\n            },\n          });\n        },\n      });\n    };\n  }\n\n  private createRestAuthInterceptor(): Dispatcher.DispatcherComposeInterceptor {\n    return (dispatch) => {\n      return (options, handler) => {\n        if (this.authInformation?.jwtToken !== undefined) {\n          // TODO: check this magic really works and gets called\n          options.headers = {\n            ...options.headers,\n            authorization: \"Bearer \" + this.authInformation.jwtToken,\n          };\n          this.refreshAuthInformationIfNeeded();\n        }\n\n        return dispatch(options, handler);\n      };\n    };\n  }\n\n  /** Injects authentication information if needed */\n  private createGrpcAuthInterceptor(): Interceptor {\n    return (options, nextCall) => {\n      return new InterceptingCall(nextCall(options), {\n        start: (metadata, listener, next) => {\n          if (this.authInformation?.jwtToken !== undefined) {\n            metadata.set(\"authorization\", \"Bearer \" + this.authInformation.jwtToken);\n            this.refreshAuthInformationIfNeeded();\n            next(metadata, listener);\n          } else {\n            next(metadata, listener);\n          }\n        },\n      });\n    };\n  }\n\n  public async getJwtToken(\n    ttlSeconds: bigint,\n    options?: { authorization?: string; role?: AuthAPI_Role },\n  ): Promise<string> {\n    const cl = this.clientProvider.get();\n    const role = options?.role ?? AuthAPI_Role.UNSPECIFIED;\n\n    if (cl instanceof GrpcPlApiClient) {\n      const meta: Record<string, string> = {};\n      if (options?.authorization) meta.authorization = options.authorization;\n      return (\n        await cl.getJWTToken(\n          {\n            expiration: { seconds: ttlSeconds, nanos: 0 },\n            requestedRole: role,\n          },\n          { meta },\n        ).response\n      ).token;\n    } else {\n      const headers: Record<string, string> = {};\n      if (options?.authorization) headers.authorization = options.authorization;\n      const resp = cl.POST(\"/v1/auth/jwt-token\", {\n        body: { expiration: `${ttlSeconds}s`, requestedRole: role },\n        headers,\n      });\n      return notEmpty((await resp).data, \"REST: empty response for JWT token request\").token;\n    }\n  }\n\n  /** Login via username/password. Returns a fresh JWT. Backend creates a new session per call. */\n  public async loginBasic(\n    user: string,\n    password: string,\n    opts: { ttlSeconds?: bigint; role?: AuthAPI_Role } = {},\n  ): Promise<string> {\n    const cl = this.clientProvider.get();\n    const ttl = opts.ttlSeconds ?? BigInt(this.conf.authTTLSeconds);\n    const role = opts.role ?? AuthAPI_Role.UNSPECIFIED;\n\n    if (cl instanceof GrpcPlApiClient) {\n      return (\n        await cl.login({\n          credentials: {\n            oneofKind: \"basic\",\n            basic: { login: user, password },\n          },\n          expiration: { seconds: ttl, nanos: 0 },\n          requestedRole: role,\n        }).response\n      ).token;\n    } else {\n      const resp = cl.POST(\"/v1/auth/login\", {\n        // openapi-typescript generated all body fields as required, but Login.Request\n        // has a credentials oneof — only one of `basic`/`token` is sent. Cast around it.\n        body: {\n          basic: { login: user, password },\n          expiration: `${ttl}s`,\n          requestedRole: role,\n        } as any,\n      });\n      return notEmpty((await resp).data, \"REST: empty response for login request\").token;\n    }\n  }\n\n  /** Login via opaque bearer token (controller pre-shared secret, OIDC id-token, etc.).\n   * String input is UTF-8 encoded. Returns a fresh Platforma JWT. */\n  public async loginWithToken(\n    token: Uint8Array | string,\n    opts: { ttlSeconds?: bigint; role?: AuthAPI_Role } = {},\n  ): Promise<string> {\n    const cl = this.clientProvider.get();\n    const ttl = opts.ttlSeconds ?? BigInt(this.conf.authTTLSeconds);\n    const role = opts.role ?? AuthAPI_Role.UNSPECIFIED;\n    const bytes = typeof token === \"string\" ? Buffer.from(token, \"utf8\") : token;\n\n    if (cl instanceof GrpcPlApiClient) {\n      return (\n        await cl.login({\n          credentials: {\n            oneofKind: \"token\",\n            token: { token: bytes },\n          },\n          expiration: { seconds: ttl, nanos: 0 },\n          requestedRole: role,\n        }).response\n      ).token;\n    } else {\n      const resp = cl.POST(\"/v1/auth/login\", {\n        // openapi-typescript marks all body fields as required, but Login.Request has a oneof.\n        // REST encodes `bytes` as a base64 string.\n        body: {\n          token: { token: Buffer.from(bytes).toString(\"base64\") },\n          expiration: `${ttl}s`,\n          requestedRole: role,\n        } as any,\n      });\n      return notEmpty((await resp).data, \"REST: empty response for login request\").token;\n    }\n  }\n\n  /** Login via SSO: forwards the raw IdP /token JSON body to the backend.\n   * Backend validates signature + nonce + audience and mints a Platforma JWT. */\n  public async loginSSO(tokenResponse: Uint8Array): Promise<string> {\n    const cl = this.clientProvider.get();\n    if (cl instanceof GrpcPlApiClient) {\n      return (\n        await cl.login({\n          credentials: {\n            oneofKind: \"sso\",\n            sso: { tokenResponse },\n          },\n        }).response\n      ).token;\n    } else {\n      const resp = cl.POST(\"/v1/auth/login\", {\n        body: {\n          sso: { tokenResponse: Buffer.from(tokenResponse).toString(\"base64\") },\n        } as any,\n      });\n      return notEmpty((await resp).data, \"REST: empty response for SSO login request\").token;\n    }\n  }\n\n  /** Request a one-time PKCE nonce + its expiry from the backend. The desktop is\n   * expected to place the nonce verbatim into the OIDC auth-request before\n   * redirecting to the IdP; the backend enforces the expiry on {@link loginSSO}. */\n  public async beginSSOLogin(): Promise<{ nonce: string; expiresAt: Date; clientSecret?: string }> {\n    const cl = this.clientProvider.get();\n    if (cl instanceof GrpcPlApiClient) {\n      const resp = (await cl.beginSSOLogin({}).response).flow;\n      if (resp.oneofKind !== \"publicPkce\") {\n        throw new Error(`beginSSOLogin: unsupported flow ${resp.oneofKind}`);\n      }\n      const exp = notEmpty(resp.publicPkce.expiresAt, \"beginSSOLogin: missing expiresAt\");\n      return {\n        nonce: resp.publicPkce.nonce,\n        expiresAt: Timestamp.toDate(exp),\n        clientSecret: resp.publicPkce.clientSecret,\n      };\n    } else {\n      const wsResponse = notEmpty(\n        (await cl.POST(\"/v1/auth/sso/begin-login\", { body: {} })).data,\n        \"REST: empty response for beginSSOLogin request\",\n      );\n      const pkce = notEmpty(wsResponse.publicPkce, \"REST: missing publicPkce in beginSSOLogin\");\n      return {\n        nonce: pkce.nonce,\n        expiresAt: new Date(pkce.expiresAt),\n        clientSecret: pkce.clientSecret,\n      };\n    }\n  }\n\n  /** Refresh the current JWT, preserving session id and role. */\n  public async refreshToken(opts: { ttlSeconds?: bigint } = {}): Promise<string> {\n    const cl = this.clientProvider.get();\n    const ttl = opts.ttlSeconds ?? BigInt(this.conf.authTTLSeconds);\n    const currentToken = notEmpty(\n      this.authInformation?.jwtToken,\n      \"refreshToken called without a current JWT\",\n    );\n\n    if (cl instanceof GrpcPlApiClient) {\n      return (\n        await cl.refreshToken({\n          token: currentToken,\n          expiration: { seconds: ttl, nanos: 0 },\n        }).response\n      ).token;\n    } else {\n      const resp = cl.POST(\"/v1/auth/refresh\", {\n        body: { token: currentToken, expiration: `${ttl}s` },\n      });\n      return notEmpty((await resp).data, \"REST: empty response for refresh request\").token;\n    }\n  }\n\n  public async ping(): Promise<grpcTypes.MaintenanceAPI_Ping_Response> {\n    const cl = this.clientProvider.get();\n    let resp: grpcTypes.MaintenanceAPI_Ping_Response;\n    if (cl instanceof GrpcPlApiClient) {\n      resp = (await cl.ping({})).response;\n    } else {\n      // The REST ping response predates the `capabilities` field (proto field 9).\n      // Old servers omit it; treat absence as empty capability list.\n      const pingData = notEmpty(\n        (await cl.GET(\"/v1/ping\")).data,\n        \"REST: empty response for ping request\",\n      );\n      resp = {\n        ...(pingData as unknown as grpcTypes.MaintenanceAPI_Ping_Response),\n        capabilities: (pingData as any).capabilities ?? [],\n      };\n    }\n    this._serverInfo = resp;\n    return resp;\n  }\n\n  /** Cached Ping response. Always populated post-build(); throws if accessed earlier. */\n  public get serverInfo(): grpcTypes.MaintenanceAPI_Ping_Response {\n    if (!this._serverInfo) {\n      throw new Error(\"LLPlClient.serverInfo accessed before build() completed\");\n    }\n    return this._serverInfo;\n  }\n\n  /** Synchronous capability check against the cached Ping response. */\n  public hasCapability(capability: BackendCapability): boolean {\n    return hasCapability(this.serverInfo.capabilities, capability);\n  }\n\n  /** True if the backend produces signed resource ids (and accepts the\n   * setDefaultColor TX request). Tagged at 3.3.0 — backends older than this\n   * return resources without signatures and reject color-proof requests. */\n  public get supportsResourceSignatures(): boolean {\n    return isVersionAtLeast(this.serverInfo.coreVersion, [3, 3, 0]);\n  }\n\n  /**\n   * True if the backend honors per-file `permissions` on workdir fill rules, so\n   * `exec.builder().writeFile/addFile({ writable: true })` takes effect. When false\n   * the requested mode is ignored and files land at the canonical archive perm.\n   *\n   * [3, 5, 0] excludes the tagged 3.5.0 release but includes dev builds past the\n   * tag (e.g. \"3.5.0-224-g0ca182\"), which is where the support lands.\n   */\n  public get supportsWritableWorkdirFiles(): boolean {\n    return isAfterVersion(this.serverInfo.coreVersion, [3, 5, 0]);\n  }\n\n  /**\n   * Detects the best available wire protocol.\n   * If wireProtocol is explicitly configured, does nothing.\n   * Otherwise probes the current protocol via ping; if it fails, switches to the alternative.\n   */\n  private async detectOptimalWireProtocol() {\n    if (this.conf.wireProtocol) {\n      return;\n    }\n\n    // Each retry is:\n    //  - ping request timeout (100 to 3_000ms)\n    //  - backoff delay (30 to 500ms)\n    //\n    // 30 attempts are ~43 seconds of overall waiting time.\n    // Think twice on overall time this thing takes to complete when changing these parameters.\n    // It may block UI when connecting to the server and loading projects list.\n    const pingTimeoutFactor = 1.3;\n    const maxPingTimeoutMs = 3_000;\n    const retryOptions: RetryOptions = {\n      type: \"exponentialBackoff\",\n      maxAttempts: 30,\n      initialDelay: 30,\n      backoffMultiplier: 1.3,\n      jitter: 0.2,\n      maxDelay: 500,\n    };\n\n    let attempt = 1;\n    let pingTimeoutMs = 100;\n    await retry(\n      () => withTimeout(this.ping(), pingTimeoutMs),\n      retryOptions,\n      (e: unknown) => {\n        if (isAbortedError(e)) {\n          this.ops.logger?.info(\n            `Wire proto autodetect: ping timed out after ${pingTimeoutMs}ms: attempt=${attempt}, wire=${this._wireProto}`,\n          );\n\n          if (attempt % 2 === 0) {\n            // We have 2 wire protocols to check. Increase timeout each 2 attempts.\n            pingTimeoutMs = Math.min(\n              Math.round(pingTimeoutMs * pingTimeoutFactor),\n              maxPingTimeoutMs,\n            );\n          }\n        } else {\n          this.ops.logger?.info(\n            `Wire proto autodetect: ping failed: attempt=${attempt}, wire=${this._wireProto}, err=${String(e)}`,\n          );\n        }\n\n        attempt++;\n        const protocol = this._wireProto === \"grpc\" ? \"rest\" : \"grpc\";\n        this.ops.logger?.info(\n          `Wire protocol autodetect next attempt: will try wire '${protocol}' with timeout ${pingTimeoutMs}ms`,\n        );\n        this.initWireConnection(protocol);\n        return true;\n      },\n    );\n  }\n\n  public async license(): Promise<grpcTypes.MaintenanceAPI_License_Response> {\n    const cl = this.clientProvider.get();\n    if (cl instanceof GrpcPlApiClient) {\n      return (await cl.license({})).response;\n    } else {\n      const resp = notEmpty(\n        (await cl.GET(\"/v1/license\")).data,\n        \"REST: empty response for license request\",\n      );\n      return {\n        status: resp.status,\n        isOk: resp.isOk,\n        responseBody: Uint8Array.from(Buffer.from(resp.responseBody)),\n      };\n    }\n  }\n\n  public async authMethods(): Promise<grpcTypes.AuthAPI_ListMethods_Response> {\n    const cl = this.clientProvider.get();\n    let resp: grpcTypes.AuthAPI_ListMethods_Response;\n    if (cl instanceof GrpcPlApiClient) {\n      resp = (await cl.authMethods({})).response;\n    } else {\n      const wsResponse = notEmpty(\n        (await cl.GET(\"/v1/auth/methods\")).data,\n        \"REST: empty response for auth methods request\",\n      );\n      // OpenAPI schema flattens the protobuf oneof into `{ basic?, token? }`,\n      // while protobuf-ts models it as a discriminated union. Reshape per item.\n      resp = {\n        methods: (wsResponse.methods ?? []).map((m): grpcTypes.AuthAPI_ListMethods_MethodInfo => {\n          const base = { id: m.id, description: m.description };\n          if (m.basic !== undefined) {\n            return { ...base, method: { oneofKind: \"basic\", basic: m.basic } };\n          }\n          if (m.token !== undefined) {\n            return { ...base, method: { oneofKind: \"token\", token: m.token } };\n          }\n          if (m.sso !== undefined) {\n            return { ...base, method: { oneofKind: \"sso\", sso: m.sso } };\n          }\n          return { ...base, method: { oneofKind: undefined } };\n        }),\n      };\n    }\n\n    this._authMethodsSync = resp;\n    return resp;\n  }\n\n  public get authMethodsSync(): grpcTypes.AuthAPI_ListMethods_Response {\n    if (!this._authMethodsSync) {\n      throw new Error(\"LLPlClient.authMethodsSync accessed before build() completed\");\n    }\n    return this._authMethodsSync;\n  }\n\n  public async getUserRoot(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<grpcTypes.AuthAPI_GetUserRoot_Response> {\n    const cl = this.clientProvider.get();\n    if (cl instanceof GrpcPlApiClient) {\n      return (\n        await cl.getUserRoot({\n          login: opts.login ?? \"\",\n          createIfNotExists: opts.createIfNotExists ?? false,\n        })\n      ).response;\n    } else {\n      const resp = notEmpty(\n        (\n          await cl.POST(\"/v1/auth/user-root\", {\n            body: {\n              login: opts.login ?? \"\",\n              createIfNotExists: opts.createIfNotExists ?? false,\n            },\n          })\n        ).data,\n        \"REST: empty response for getUserRoot request\",\n      );\n      return {\n        userRoot: resp.userRoot\n          ? {\n              resourceId: BigInt(resp.userRoot.resourceId),\n              resourceSignature: Uint8Array.from(\n                Buffer.from(resp.userRoot.resourceSignature, \"base64\"),\n              ),\n            }\n          : undefined,\n      };\n    }\n  }\n\n  public async listUserResources(\n    opts: { login?: string; startFrom?: bigint; limit?: number } = {},\n  ): Promise<grpcTypes.AuthAPI_ListUserResources_Response[]> {\n    const cl = this.clientProvider.get();\n\n    if (!(cl instanceof GrpcPlApiClient)) {\n      throw new Error(\"ListUserResources requires gRPC wire protocol; REST is not supported\");\n    }\n\n    const call = cl.listUserResources({\n      login: opts.login ?? \"\",\n      startFrom: opts.startFrom ?? 0n,\n      limit: opts.limit ?? 0,\n    });\n    const responses: grpcTypes.AuthAPI_ListUserResources_Response[] = [];\n    for await (const msg of call.responses) {\n      responses.push(msg);\n    }\n    return responses;\n  }\n\n  /** Returns the authenticated caller's session id and effective role.\n   *  Models the {@link getUserRoot} wrapper: gRPC unary with a REST fallback. */\n  public async getSessionInfo(): Promise<grpcTypes.AuthAPI_GetSessionInfo_Response> {\n    const cl = this.clientProvider.get();\n    if (cl instanceof GrpcPlApiClient) {\n      return (await cl.getSessionInfo({})).response;\n    } else {\n      const resp = notEmpty(\n        (await cl.POST(\"/v1/auth/session-info\", { body: {} })).data,\n        \"REST: empty response for getSessionInfo request\",\n      );\n      return {\n        sessionId: Uint8Array.from(Buffer.from(resp.sessionId, \"base64\")),\n        role: resp.role as AuthAPI_Role,\n      };\n    }\n  }\n\n  /** Lists the users known to the server — the recipient picker's source. A user\n   *  becomes known on first login; provisioned users who have never logged in do not\n   *  appear. gRPC-only (unary, no REST binding). */\n  public async listUsers(): Promise<grpcTypes.AuthAPI_User[]> {\n    const cl = this.clientProvider.get();\n\n    if (!(cl instanceof GrpcPlApiClient)) {\n      throw new Error(\"ListUsers requires gRPC wire protocol; REST is not supported\");\n    }\n\n    return (await cl.listUsers({})).response.users;\n  }\n\n  public async txSync(txId: bigint): Promise<void> {\n    const cl = this.clientProvider.get();\n    if (cl instanceof GrpcPlApiClient) {\n      await cl.txSync({ txId: BigInt(txId) });\n    } else {\n      await cl.POST(\"/v1/tx-sync\", { body: { txId: txId.toString() } });\n    }\n  }\n\n  createTx(rw: boolean, ops: PlCallOps = {}): LLPlTransaction {\n    return new LLPlTransaction((abortSignal) => {\n      let totalAbortSignal = abortSignal;\n      if (ops.abortSignal) totalAbortSignal = AbortSignal.any([totalAbortSignal, ops.abortSignal]);\n\n      const timeout =\n        ops.timeout ??\n        (rw ? this.conf.defaultRWTransactionTimeout : this.conf.defaultROTransactionTimeout);\n\n      const cl = this.clientProvider.get();\n      if (cl instanceof GrpcPlApiClient) {\n        return cl.tx({\n          abort: totalAbortSignal,\n          timeout,\n        });\n      }\n\n      const wireConn = this.wireConnection;\n      if (wireConn.type === \"rest\") {\n        // For REST/WebSocket protocol, timeout needs to be converted to AbortSignal\n        if (timeout !== undefined) {\n          totalAbortSignal = AbortSignal.any([totalAbortSignal, AbortSignal.timeout(timeout)]);\n        }\n\n        // The gRPC transport has the auth interceptor that already handles it, but here we need to refresh the auth information to be safe.\n        this.refreshAuthInformationIfNeeded();\n\n        const wsUrl = this.conf.ssl\n          ? `wss://${this.conf.hostAndPort}/v1/ws/tx`\n          : `ws://${this.conf.hostAndPort}/v1/ws/tx`;\n\n        return new WebSocketBiDiStream(\n          wsUrl,\n          (msg) => TxAPI_ClientMessage.toBinary(msg),\n          (data) => TxAPI_ServerMessage.fromBinary(new Uint8Array(data)),\n          {\n            abortSignal: totalAbortSignal,\n            jwtToken: this.authInformation?.jwtToken,\n            dispatcher: wireConn.Dispatcher,\n\n            onComplete: async (stream) =>\n              stream.requests.send({\n                // Ask server to gracefully close the stream on its side, if not done yet.\n                requestId: 0,\n                request: { oneofKind: \"streamClose\", streamClose: {} },\n              }),\n          },\n        );\n      }\n\n      throw new Error(`transactions are not supported for wire protocol ${this._wireProto}`);\n    });\n  }\n\n  /** Closes underlying transport */\n  public async close() {\n    if (this.wireConnection.type === \"grpc\") {\n      this.wireConnection.Transport.close();\n    } else {\n      // TODO: close all WS connections\n    }\n    await this.httpDispatcher.destroy();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAuDA,SAAS,iBAAiB,SAAiB,QAA2C;CACpF,MAAM,QAAQ,yBAAyB,KAAK,OAAO;CACnD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,SAAmC;EAAC,OAAO,MAAM,EAAE;EAAG,OAAO,MAAM,EAAE;EAAG,OAAO,MAAM,EAAE;CAAC;CAC9F,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KACrB,IAAI,OAAO,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,OAAO;CAEzD,OAAO;AACT;AAcA,SAAS,eAAe,SAAiB,QAA2C;CAClF,MAAM,QAAQ,8BAA8B,KAAK,OAAO;CACxD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,SAAmC;EAAC,OAAO,MAAM,EAAE;EAAG,OAAO,MAAM,EAAE;EAAG,OAAO,MAAM,EAAE;CAAC;CAC9F,MAAM,SAAS,MAAM;CACrB,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KACrB,IAAI,OAAO,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,OAAO;CAEzD,OAAO,WAAW;AACpB;AAEA,IAAM,yBAAN,MAA2E;CAItD;CACA;CAJnB,SAAqC,KAAA;CAErC,YACE,UACA,mBACA;EAFiB,KAAA,WAAA;EACA,KAAA,oBAAA;CAChB;CAEH,QAAqB;EACnB,KAAK,SAAS,KAAA;CAChB;CAEA,MAAqB;EACnB,IAAI,KAAK,WAAW,KAAA,GAAW,KAAK,SAAS,KAAK,kBAAkB,KAAK,SAAS,CAAC;EACnF,OAAO,KAAK;CACd;AACF;;AAGA,IAAa,aAAb,MAAa,WAAgD;CAmEzC;CACC;;CAlEnB;;CAEA;;CAEA;;CAEA;;CAEA;;CAGA;CACA;CAEA,UAAsC;CACtC,oBAA4B;CAC5B;CAEA,aAAmC;CACnC;CAEA;CACA;CACA;CACA,YAAqE,CAAC;CAEtE;CAEA;CAEA,aAAoB,MAClB,iBACA,MAMI,CAAC,GACL;EAIA,MAAM,KAAK,IAAI,WAFb,OAAO,oBAAoB,WAAWA,eAAAA,kBAAkB,eAAe,IAAI,iBAE7C,GAAG;EAGnC,IAAI,IAAI,2BACN,MAAM,GAAG,0BAA0B;EAMrC,IAAI,CAAC,GAAG,aAAa,MAAM,GAAG,KAAK;EAGnC,cAAA,8BAA8B,GAAG,0BAA0B;EAG3D,IAAI,CAAC,GAAG,kBAAkB,MAAM,GAAG,YAAY;EAE/C,OAAO;CACT;CAEA,YACE,MACA,MAKI,CAAC,GACL;EAPgB,KAAA,OAAA;EACC,KAAA,MAAA;EAOjB,MAAM,EAAE,MAAM,mBAAmB;EAEjC,IAAI,SAAS,KAAA,GAAW;GACtB,KAAK,mBAAmBC,aAAAA,qBACtB,KAAK,iBACL,KAAK,KAAK,qBACZ;GACA,KAAK,kBAAkB,KAAK;GAC5B,KAAK,eAAe,KAAK;GACzB,KAAK,uBAAuB,KAAK;GACjC,KAAK,cAAc,KAAK;EAC1B;EAEA,KAAK,oBAAoB,CAAC;EAC1B,KAAK,mBAAmB,CAAC;EACzB,KAAK,oBAAoB,CAAC;EAE1B,IAAI,SAAS,KAAA,GAAW;GACtB,KAAK,kBAAkB,KAAK,KAAK,0BAA0B,CAAC;GAC5D,KAAK,kBAAkB,KAAK,KAAK,0BAA0B,CAAC;EAC9D;EACA,KAAK,kBAAkB,KAAKC,OAAAA,aAAa,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;EACnE,KAAK,iBAAiB,KAAK,KAAK,0BAA0B,CAAC;EAC3D,KAAK,kBAAkB,KAAK,KAAK,2BAA2B,CAAC;EAE7D,KAAK,kBAAA,GAAA,wBAAA,sBAAA,CAAuC,KAAK,KAAK,SAAS;EAC/D,IAAI,KAAK,KAAK,cACZ,KAAK,aAAa,KAAK,KAAK;EAG9B,KAAK,mBAAmB,KAAK,UAAU;EAEvC,IAAI,mBAAmB,KAAA,GAAW;GAChC,KAAK,iBAAiB;GACtB,eAAe,KAAK,OAAO;EAC7B;EAEA,KAAK,iBAAiB,KAAK,0BAA0B,aAAa;GAChE,IAAI,SAAS,SAAS,QACpB,OAAO,IAAIC,mBAAAA,eAAgB,SAAS,SAAS;QAE7C,OAAOC,cAAAA,aAAyB;IAC9B,aAAa,SAAS,OAAO;IAC7B,KAAK,SAAS,OAAO;IACrB,YAAY,SAAS;IACrB,aAAa,SAAS;GACxB,CAAC;EAEL,CAAC;CACH;CAEA,mBAA2B,UAAwB;EACjD,QAAQ,UAAR;GACE,KAAK;IACH,KAAK,mBAAmB;IACxB;GACF,KAAK;IACH,KAAK,mBAAmB,KAAK,IAAI,iBAAiB,KAAK;IACvD;GACF,SACE,EAAE,MAAa;IACb,MAAM,IAAI,MACR,8BAA8B,EAAY,iBAAiBC,eAAAA,yBAAyB,KAAK,IAAI,GAC/F;GACF,EAAA,CAAG,QAAQ;EACf;CACF;CAEA,qBAAmC;EACjC,MAAM,cAAA,GAAA,wBAAA,sBAAA,CAAmC,KAAK,KAAK,WAAW,KAAK,iBAAiB;EACpF,KAAK,uBAAuB;GAC1B,MAAM;GACN,QAAQ,KAAK;GACb,YAAY;GACZ,aAAa,KAAK;EACpB,CAAC;CACH;;;;;CAMA,mBAA2B,MAAe;EACxC,MAAM,gBAA+B;GACnC,0BAA0B;GAC1B,0CAA0C;GAI1C,iCAAiC,KAAK,OAAO;GAC7C,cAAc,KAAK;EACrB;EAEA,IAAI,MAAM,cAAc,wCAAwCC,cAAAA,sBAAsB;EAStF,MAAM,cAA2B;GAC/B,MAAM,KAAK,KAAK;GAChB,SAAS,KAAK,KAAK;GACnB,oBAAoB,KAAK,KAAK,MAC1BC,cAAAA,mBAAmB,UAAU,IAC7BA,cAAAA,mBAAmB,eAAe;GACtC;EACF;EAEA,MAAM,YACJ,OAAO,KAAK,KAAK,cAAc,WAAW,EAAE,KAAK,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK;EAErF,IAAI,WAAW,KAAK;GAClB,MAAM,MAAM,IAAI,IAAI,UAAU,GAAG;GACjC,IAAI,UAAU,MAAM;IAClB,MAAM,UAAA,GAAA,gCAAA,cAAA,CAAuB,UAAU,IAAI;IAC3C,IAAI,OAAO,WAAW,SACpB,MAAM,IAAI,MAAM,4BAA4B,OAAO,OAAiB,EAAE;IAExE,IAAI,WAAW,OAAO;IACtB,IAAI,WAAW,OAAO;GACxB;GACA,QAAQ,IAAI,aAAa,IAAI,SAAS;EACxC,OACE,OAAO,QAAQ,IAAI;EAGrB,KAAK,uBAAuB;GAAE,MAAM;GAAQ,WAAW,IAAIC,4BAAAA,cAAc,WAAW;EAAE,CAAC;CACzF;CAEA,uBAA+B,SAA+B;EAC5D,MAAM,UAAU,KAAK;EACrB,KAAK,YAAY;EACjB,KAAK,aAAa,QAAQ;EAG1B,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,UAAU,QAAQ,KAAK;GAC9C,MAAM,WAAW,KAAK,UAAU,EAAE,CAAC,MAAM;GACzC,IAAI,aAAa,KAAA,GAAW;IAE1B,KAAK,UAAU,OAAO,GAAG,CAAC;IAC1B;GACF,OACE,SAAS,MAAM;EAEnB;EAEA,IAAI,YAAY,KAAA,KAAa,QAAQ,SAAS,QAAQ,QAAQ,UAAU,MAAM;CAChF;CAEA,yBAAiC;;;;;;CAOjC,yBACE,mBAC4B;EAI5B,KAAK;EACL,IAAI,KAAK,0BAA0B,IAAI;GACrC,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,UAAU,QAAQ,KAEzC,IADiB,KAAK,UAAU,EAAE,CAAC,MACxB,MAAM,KAAA,GAAW;IAC1B,KAAK,UAAU,OAAO,GAAG,CAAC;IAC1B;GACF;GAEF,KAAK,yBAAyB;EAChC;EAEA,MAAM,WAAW,IAAI,6BAAqC,KAAK,WAAW,iBAAiB;EAC3F,KAAK,UAAU,KAAK,IAAI,QAAQ,QAAQ,CAAC;EACzC,OAAO;CACT;CAEA,IAAW,iBAAiC;EAC1C,OAAO,KAAK;CACd;CAEA,IAAW,eAAyC;EAClD,OAAO,KAAK;CACd;;;;CAKA,IAAW,gBAAyB;EAClC,OAAO,KAAK,oBAAoB,KAAA;CAClC;;CAGA,IAAW,WAA0B;EACnC,IAAI,CAAC,KAAK,eAAe,MAAM,IAAI,MAAM,6BAA6B;EACtE,IAAI,KAAK,iBAAiB,UAAU;GAClC,IAAI,KAAK,cAAc,SAAS,GAC9B,OAAOC,WAAAA,WAAW,KAAK,iBAAiB,QAAQ,CAAC,CAAC;GAEpD,OAAOA,WAAAA,WAAW,KAAK,iBAAiB,QAAQ,CAAC,CAAC,KAAK;EACzD,OAAO,OAAO;CAChB;CAEA,aAAqB,WAA+B;EAClD,QAAQ,eAAe;GACrB,IAAI,KAAK,YAAY,WAAW;IAC9B,KAAK,UAAU;IACf,IAAI,KAAK,mBAAmB,KAAA,GAAW,KAAK,eAAe,KAAK,OAAO;IACvE,IAAI,cAAc,qBAAqB,KAAK,gBAAgB,KAAA,GAAW,KAAK,YAAY;GAC1F;EACF,CAAC;CACH;;;;;;;;CASA,MAAc,yCAAwD;EACpE,IAAI,KAAK,YAAY,QAAQ,KAAK,mBAAmB;EACrD,KAAK,oBAAoB;EACzB,IAAI;GACF,MAAM,KAAK,eAAe;EAC5B,SAAS,GAAG;GACV,IAAIC,eAAAA,kBAAkB,CAAC,GAAG,KAAK,aAAa,iBAAiB;EAC/D,UAAU;GACR,KAAK,oBAAoB;EAC3B;CACF;CAEA,IAAW,SAA6B;EACtC,OAAO,KAAK;CACd;CAEA,wBAAyC;CAEzC,iCAA+C;EAC7C,IACE,KAAK,qBAAqB,KAAA,KAC1B,KAAK,IAAI,IAAI,KAAK,oBAClB,KAAK,yBACL,KAAK,YAAY,mBAEjB;EAGF,KAAK,wBAAwB;EAC7B,CAAM,YAAY;GAChB,IAAI;IACF,MAAM,MAAM,OAAO,KAAK,KAAK,cAAc;IAC3C,MAAM,QAAQ,KAAK,cAAc,SAAS,IACtC,MAAM,KAAK,aAAa,EAAE,YAAY,IAAI,CAAC,IAC3C,MAAM,KAAK,YAAY,GAAG;IAC9B,KAAK,kBAAkB,EAAE,UAAU,MAAM;IACzC,KAAK,mBAAmBT,aAAAA,qBACtB,KAAK,iBACL,KAAK,KAAK,qBACZ;IACA,IAAI,KAAK,cAAc,KAAK,aAAa,KAAK,eAAe;GAC/D,SAAS,GAAY;IACnB,IAAI,KAAK,sBAAsB,KAAK,qBAAqB,CAAC;GAC5D,UAAU;IACR,KAAK,wBAAwB;GAC/B;EACF,EAAA,CAAG;CACL;;;;;;CAOA,4BAAgD;EAC9C,OAAO,EACL,YAAY,OAAO,EAAE,SAAS,UAAU,UAAU,SAAS,eAAe;GACxE,MAAM,EAAE,MAAM,GAAG,eAAe;GAEhC,IAAI;IAAC;IAAK;IAAK;GAAG,CAAC,CAAC,SAAS,SAAS,MAAM,GAAG;IAE7C,KAAK,aAAa,cAAc;IAChC,OAAO,IAAI,SAAS,MAAM;KAAE,GAAG;KAAY,QAAQ,SAAS;IAAO,CAAC;GACtE;GAEA,MAAM,UAAU,MAAMU,cAAAA,mBAAmB,QAAQ;GACjD,IAAI,CAAC,QAAQ,OAEX,OAAO,IAAI,SAAS,QAAQ,YAAY,MAAM;IAAE,GAAG;IAAY,QAAQ,SAAS;GAAO,CAAC;GAG1F,IAAI,OAAO,QAAQ,UAAU,UAE3B,OAAO,IAAI,SAAS,QAAQ,OAAO;IAAE,GAAG;IAAY,QAAQ,SAAS;GAAO,CAAC;GAG/E,IAAI,QAAQ,MAAM,SAAA,IAChB,KAAU,uCAAuC;GAInD,OAAO,IAAI,SAAS,QAAQ,UAAU;IAAE,GAAG;IAAY,QAAQ,SAAS;GAAO,CAAC;EAClF,EACF;CACF;;CAGA,6BAAkD;EAChD,QAAQ,SAAS,aAAa;GAC5B,OAAO,IAAIC,cAAAA,iBAAiB,SAAS,OAAO,GAAG,EAC7C,QAAQ,UAAU,UAAU,SAAS;IACnC,KAAK,UAAU,EACb,kBAAkB,QAAQ,SAAS;KACjC,IAAI,OAAO,QAAQC,cAAAA,OAAW,iBAE5B,KAAU,uCAAuC;KACnD,IAAI,OAAO,QAAQA,cAAAA,OAAW,aAE5B,KAAK,aAAa,cAAc;KAClC,KAAK,MAAM;IACb,EACF,CAAC;GACH,EACF,CAAC;EACH;CACF;CAEA,4BAA6E;EAC3E,QAAQ,aAAa;GACnB,QAAQ,SAAS,YAAY;IAC3B,IAAI,KAAK,iBAAiB,aAAa,KAAA,GAAW;KAEhD,QAAQ,UAAU;MAChB,GAAG,QAAQ;MACX,eAAe,YAAY,KAAK,gBAAgB;KAClD;KACA,KAAK,+BAA+B;IACtC;IAEA,OAAO,SAAS,SAAS,OAAO;GAClC;EACF;CACF;;CAGA,4BAAiD;EAC/C,QAAQ,SAAS,aAAa;GAC5B,OAAO,IAAID,cAAAA,iBAAiB,SAAS,OAAO,GAAG,EAC7C,QAAQ,UAAU,UAAU,SAAS;IACnC,IAAI,KAAK,iBAAiB,aAAa,KAAA,GAAW;KAChD,SAAS,IAAI,iBAAiB,YAAY,KAAK,gBAAgB,QAAQ;KACvE,KAAK,+BAA+B;KACpC,KAAK,UAAU,QAAQ;IACzB,OACE,KAAK,UAAU,QAAQ;GAE3B,EACF,CAAC;EACH;CACF;CAEA,MAAa,YACX,YACA,SACiB;EACjB,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,MAAM,OAAO,SAAS,QAAA;EAEtB,IAAI,cAAcT,mBAAAA,gBAAiB;GACjC,MAAM,OAA+B,CAAC;GACtC,IAAI,SAAS,eAAe,KAAK,gBAAgB,QAAQ;GACzD,QACE,MAAM,GAAG,YACP;IACE,YAAY;KAAE,SAAS;KAAY,OAAO;IAAE;IAC5C,eAAe;GACjB,GACA,EAAE,KAAK,CACT,CAAC,CAAC,SAAA,CACF;EACJ,OAAO;GACL,MAAM,UAAkC,CAAC;GACzC,IAAI,SAAS,eAAe,QAAQ,gBAAgB,QAAQ;GAK5D,QAAA,GAAA,2BAAA,SAAA,EAAiB,MAJJ,GAAG,KAAK,sBAAsB;IACzC,MAAM;KAAE,YAAY,GAAG,WAAW;KAAI,eAAe;IAAK;IAC1D;GACF,CAC0B,EAAA,CAAG,MAAM,4CAA4C,CAAC,CAAC;EACnF;CACF;;CAGA,MAAa,WACX,MACA,UACA,OAAqD,CAAC,GACrC;EACjB,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,MAAM,MAAM,KAAK,cAAc,OAAO,KAAK,KAAK,cAAc;EAC9D,MAAM,OAAO,KAAK,QAAA;EAElB,IAAI,cAAcA,mBAAAA,gBAChB,QACE,MAAM,GAAG,MAAM;GACb,aAAa;IACX,WAAW;IACX,OAAO;KAAE,OAAO;KAAM;IAAS;GACjC;GACA,YAAY;IAAE,SAAS;IAAK,OAAO;GAAE;GACrC,eAAe;EACjB,CAAC,CAAC,CAAC,SAAA,CACH;OAWF,QAAA,GAAA,2BAAA,SAAA,EAAiB,MATJ,GAAG,KAAK,kBAAkB,EAGrC,MAAM;GACJ,OAAO;IAAE,OAAO;IAAM;GAAS;GAC/B,YAAY,GAAG,IAAI;GACnB,eAAe;EACjB,EACF,CAC0B,EAAA,CAAG,MAAM,wCAAwC,CAAC,CAAC;CAEjF;;;CAIA,MAAa,eACX,OACA,OAAqD,CAAC,GACrC;EACjB,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,MAAM,MAAM,KAAK,cAAc,OAAO,KAAK,KAAK,cAAc;EAC9D,MAAM,OAAO,KAAK,QAAA;EAClB,MAAM,QAAQ,OAAO,UAAU,WAAW,OAAO,KAAK,OAAO,MAAM,IAAI;EAEvE,IAAI,cAAcA,mBAAAA,gBAChB,QACE,MAAM,GAAG,MAAM;GACb,aAAa;IACX,WAAW;IACX,OAAO,EAAE,OAAO,MAAM;GACxB;GACA,YAAY;IAAE,SAAS;IAAK,OAAO;GAAE;GACrC,eAAe;EACjB,CAAC,CAAC,CAAC,SAAA,CACH;OAWF,QAAA,GAAA,2BAAA,SAAA,EAAiB,MATJ,GAAG,KAAK,kBAAkB,EAGrC,MAAM;GACJ,OAAO,EAAE,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ,EAAE;GACtD,YAAY,GAAG,IAAI;GACnB,eAAe;EACjB,EACF,CAC0B,EAAA,CAAG,MAAM,wCAAwC,CAAC,CAAC;CAEjF;;;CAIA,MAAa,SAAS,eAA4C;EAChE,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI,cAAcA,mBAAAA,gBAChB,QACE,MAAM,GAAG,MAAM,EACb,aAAa;GACX,WAAW;GACX,KAAK,EAAE,cAAc;EACvB,EACF,CAAC,CAAC,CAAC,SAAA,CACH;OAOF,QAAA,GAAA,2BAAA,SAAA,EAAiB,MALJ,GAAG,KAAK,kBAAkB,EACrC,MAAM,EACJ,KAAK,EAAE,eAAe,OAAO,KAAK,aAAa,CAAC,CAAC,SAAS,QAAQ,EAAE,EACtE,EACF,CAC0B,EAAA,CAAG,MAAM,4CAA4C,CAAC,CAAC;CAErF;;;;CAKA,MAAa,gBAAoF;EAC/F,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI,cAAcA,mBAAAA,gBAAiB;GACjC,MAAM,QAAQ,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,SAAA,CAAU;GACnD,IAAI,KAAK,cAAc,cACrB,MAAM,IAAI,MAAM,mCAAmC,KAAK,WAAW;GAErE,MAAM,OAAA,GAAA,2BAAA,SAAA,CAAe,KAAK,WAAW,WAAW,kCAAkC;GAClF,OAAO;IACL,OAAO,KAAK,WAAW;IACvB,WAAWW,kBAAAA,UAAU,OAAO,GAAG;IAC/B,cAAc,KAAK,WAAW;GAChC;EACF,OAAO;GAKL,MAAM,QAAA,GAAA,2BAAA,SAAA,EAAA,GAAA,2BAAA,SAAA,EAHH,MAAM,GAAG,KAAK,4BAA4B,EAAE,MAAM,CAAC,EAAE,CAAC,EAAA,CAAG,MAC1D,gDAE6B,CAAC,CAAC,YAAY,2CAA2C;GACxF,OAAO;IACL,OAAO,KAAK;IACZ,WAAW,IAAI,KAAK,KAAK,SAAS;IAClC,cAAc,KAAK;GACrB;EACF;CACF;;CAGA,MAAa,aAAa,OAAgC,CAAC,GAAoB;EAC7E,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,MAAM,MAAM,KAAK,cAAc,OAAO,KAAK,KAAK,cAAc;EAC9D,MAAM,gBAAA,GAAA,2BAAA,SAAA,CACJ,KAAK,iBAAiB,UACtB,2CACF;EAEA,IAAI,cAAcX,mBAAAA,gBAChB,QACE,MAAM,GAAG,aAAa;GACpB,OAAO;GACP,YAAY;IAAE,SAAS;IAAK,OAAO;GAAE;EACvC,CAAC,CAAC,CAAC,SAAA,CACH;OAKF,QAAA,GAAA,2BAAA,SAAA,EAAiB,MAHJ,GAAG,KAAK,oBAAoB,EACvC,MAAM;GAAE,OAAO;GAAc,YAAY,GAAG,IAAI;EAAG,EACrD,CAC0B,EAAA,CAAG,MAAM,0CAA0C,CAAC,CAAC;CAEnF;CAEA,MAAa,OAAwD;EACnE,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI;EACJ,IAAI,cAAcA,mBAAAA,gBAChB,QAAQ,MAAM,GAAG,KAAK,CAAC,CAAC,EAAA,CAAG;OACtB;GAGL,MAAM,YAAA,GAAA,2BAAA,SAAA,EACH,MAAM,GAAG,IAAI,UAAU,EAAA,CAAG,MAC3B,uCACF;GACA,OAAO;IACL,GAAI;IACJ,cAAe,SAAiB,gBAAgB,CAAC;GACnD;EACF;EACA,KAAK,cAAc;EACnB,OAAO;CACT;;CAGA,IAAW,aAAqD;EAC9D,IAAI,CAAC,KAAK,aACR,MAAM,IAAI,MAAM,yDAAyD;EAE3E,OAAO,KAAK;CACd;;CAGA,cAAqB,YAAwC;EAC3D,OAAOY,qBAAAA,cAAc,KAAK,WAAW,cAAc,UAAU;CAC/D;;;;CAKA,IAAW,6BAAsC;EAC/C,OAAO,iBAAiB,KAAK,WAAW,aAAa;GAAC;GAAG;GAAG;EAAC,CAAC;CAChE;;;;;;;;;CAUA,IAAW,+BAAwC;EACjD,OAAO,eAAe,KAAK,WAAW,aAAa;GAAC;GAAG;GAAG;EAAC,CAAC;CAC9D;;;;;;CAOA,MAAc,4BAA4B;EACxC,IAAI,KAAK,KAAK,cACZ;EAUF,MAAM,oBAAoB;EAC1B,MAAM,mBAAmB;EACzB,MAAM,eAA6B;GACjC,MAAM;GACN,aAAa;GACb,cAAc;GACd,mBAAmB;GACnB,QAAQ;GACR,UAAU;EACZ;EAEA,IAAI,UAAU;EACd,IAAI,gBAAgB;EACpB,OAAA,GAAA,2BAAA,MAAA,QAAA,GAAA,2BAAA,YAAA,CACoB,KAAK,KAAK,GAAG,aAAa,GAC5C,eACC,MAAe;GACd,IAAIC,eAAAA,eAAe,CAAC,GAAG;IACrB,KAAK,IAAI,QAAQ,KACf,+CAA+C,cAAc,cAAc,QAAQ,SAAS,KAAK,YACnG;IAEA,IAAI,UAAU,MAAM,GAElB,gBAAgB,KAAK,IACnB,KAAK,MAAM,gBAAgB,iBAAiB,GAC5C,gBACF;GAEJ,OACE,KAAK,IAAI,QAAQ,KACf,+CAA+C,QAAQ,SAAS,KAAK,WAAW,QAAQ,OAAO,CAAC,GAClG;GAGF;GACA,MAAM,WAAW,KAAK,eAAe,SAAS,SAAS;GACvD,KAAK,IAAI,QAAQ,KACf,yDAAyD,SAAS,iBAAiB,cAAc,GACnG;GACA,KAAK,mBAAmB,QAAQ;GAChC,OAAO;EACT,CACF;CACF;CAEA,MAAa,UAA8D;EACzE,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI,cAAcb,mBAAAA,gBAChB,QAAQ,MAAM,GAAG,QAAQ,CAAC,CAAC,EAAA,CAAG;OACzB;GACL,MAAM,QAAA,GAAA,2BAAA,SAAA,EACH,MAAM,GAAG,IAAI,aAAa,EAAA,CAAG,MAC9B,0CACF;GACA,OAAO;IACL,QAAQ,KAAK;IACb,MAAM,KAAK;IACX,cAAc,WAAW,KAAK,OAAO,KAAK,KAAK,YAAY,CAAC;GAC9D;EACF;CACF;CAEA,MAAa,cAA+D;EAC1E,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI;EACJ,IAAI,cAAcA,mBAAAA,gBAChB,QAAQ,MAAM,GAAG,YAAY,CAAC,CAAC,EAAA,CAAG;OAQlC,OAAO,EACL,WAAA,GAAA,2BAAA,SAAA,EANC,MAAM,GAAG,IAAI,kBAAkB,EAAA,CAAG,MACnC,+CAKmB,CAAC,CAAC,WAAW,CAAC,EAAA,CAAG,KAAK,MAAgD;GACvF,MAAM,OAAO;IAAE,IAAI,EAAE;IAAI,aAAa,EAAE;GAAY;GACpD,IAAI,EAAE,UAAU,KAAA,GACd,OAAO;IAAE,GAAG;IAAM,QAAQ;KAAE,WAAW;KAAS,OAAO,EAAE;IAAM;GAAE;GAEnE,IAAI,EAAE,UAAU,KAAA,GACd,OAAO;IAAE,GAAG;IAAM,QAAQ;KAAE,WAAW;KAAS,OAAO,EAAE;IAAM;GAAE;GAEnE,IAAI,EAAE,QAAQ,KAAA,GACZ,OAAO;IAAE,GAAG;IAAM,QAAQ;KAAE,WAAW;KAAO,KAAK,EAAE;IAAI;GAAE;GAE7D,OAAO;IAAE,GAAG;IAAM,QAAQ,EAAE,WAAW,KAAA,EAAU;GAAE;EACrD,CAAC,EACH;EAGF,KAAK,mBAAmB;EACxB,OAAO;CACT;CAEA,IAAW,kBAA0D;EACnE,IAAI,CAAC,KAAK,kBACR,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO,KAAK;CACd;CAEA,MAAa,YACX,OAAwD,CAAC,GACR;EACjD,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI,cAAcA,mBAAAA,gBAChB,QACE,MAAM,GAAG,YAAY;GACnB,OAAO,KAAK,SAAS;GACrB,mBAAmB,KAAK,qBAAqB;EAC/C,CAAC,EAAA,CACD;OACG;GACL,MAAM,QAAA,GAAA,2BAAA,SAAA,EAEF,MAAM,GAAG,KAAK,sBAAsB,EAClC,MAAM;IACJ,OAAO,KAAK,SAAS;IACrB,mBAAmB,KAAK,qBAAqB;GAC/C,EACF,CAAC,EAAA,CACD,MACF,8CACF;GACA,OAAO,EACL,UAAU,KAAK,WACX;IACE,YAAY,OAAO,KAAK,SAAS,UAAU;IAC3C,mBAAmB,WAAW,KAC5B,OAAO,KAAK,KAAK,SAAS,mBAAmB,QAAQ,CACvD;GACF,IACA,KAAA,EACN;EACF;CACF;CAEA,MAAa,kBACX,OAA+D,CAAC,GACP;EACzD,MAAM,KAAK,KAAK,eAAe,IAAI;EAEnC,IAAI,EAAE,cAAcA,mBAAAA,iBAClB,MAAM,IAAI,MAAM,sEAAsE;EAGxF,MAAM,OAAO,GAAG,kBAAkB;GAChC,OAAO,KAAK,SAAS;GACrB,WAAW,KAAK,aAAa;GAC7B,OAAO,KAAK,SAAS;EACvB,CAAC;EACD,MAAM,YAA4D,CAAC;EACnE,WAAW,MAAM,OAAO,KAAK,WAC3B,UAAU,KAAK,GAAG;EAEpB,OAAO;CACT;;;CAIA,MAAa,iBAAqE;EAChF,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI,cAAcA,mBAAAA,gBAChB,QAAQ,MAAM,GAAG,eAAe,CAAC,CAAC,EAAA,CAAG;OAChC;GACL,MAAM,QAAA,GAAA,2BAAA,SAAA,EACH,MAAM,GAAG,KAAK,yBAAyB,EAAE,MAAM,CAAC,EAAE,CAAC,EAAA,CAAG,MACvD,iDACF;GACA,OAAO;IACL,WAAW,WAAW,KAAK,OAAO,KAAK,KAAK,WAAW,QAAQ,CAAC;IAChE,MAAM,KAAK;GACb;EACF;CACF;;;;CAKA,MAAa,YAA+C;EAC1D,MAAM,KAAK,KAAK,eAAe,IAAI;EAEnC,IAAI,EAAE,cAAcA,mBAAAA,iBAClB,MAAM,IAAI,MAAM,8DAA8D;EAGhF,QAAQ,MAAM,GAAG,UAAU,CAAC,CAAC,EAAA,CAAG,SAAS;CAC3C;CAEA,MAAa,OAAO,MAA6B;EAC/C,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI,cAAcA,mBAAAA,gBAChB,MAAM,GAAG,OAAO,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;OAEtC,MAAM,GAAG,KAAK,eAAe,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,EAAE,CAAC;CAEpE;CAEA,SAAS,IAAa,MAAiB,CAAC,GAAoB;EAC1D,OAAO,IAAIc,uBAAAA,iBAAiB,gBAAgB;GAC1C,IAAI,mBAAmB;GACvB,IAAI,IAAI,aAAa,mBAAmB,YAAY,IAAI,CAAC,kBAAkB,IAAI,WAAW,CAAC;GAE3F,MAAM,UACJ,IAAI,YACH,KAAK,KAAK,KAAK,8BAA8B,KAAK,KAAK;GAE1D,MAAM,KAAK,KAAK,eAAe,IAAI;GACnC,IAAI,cAAcd,mBAAAA,gBAChB,OAAO,GAAG,GAAG;IACX,OAAO;IACP;GACF,CAAC;GAGH,MAAM,WAAW,KAAK;GACtB,IAAI,SAAS,SAAS,QAAQ;IAE5B,IAAI,YAAY,KAAA,GACd,mBAAmB,YAAY,IAAI,CAAC,kBAAkB,YAAY,QAAQ,OAAO,CAAC,CAAC;IAIrF,KAAK,+BAA+B;IAMpC,OAAO,IAAIe,yBAAAA,oBAJG,KAAK,KAAK,MACpB,SAAS,KAAK,KAAK,YAAY,aAC/B,QAAQ,KAAK,KAAK,YAAY,aAI/B,QAAQC,YAAAA,oBAAoB,SAAS,GAAG,IACxC,SAASC,YAAAA,oBAAoB,WAAW,IAAI,WAAW,IAAI,CAAC,GAC7D;KACE,aAAa;KACb,UAAU,KAAK,iBAAiB;KAChC,YAAY,SAAS;KAErB,YAAY,OAAO,WACjB,OAAO,SAAS,KAAK;MAEnB,WAAW;MACX,SAAS;OAAE,WAAW;OAAe,aAAa,CAAC;MAAE;KACvD,CAAC;IACL,CACF;GACF;GAEA,MAAM,IAAI,MAAM,oDAAoD,KAAK,YAAY;EACvF,CAAC;CACH;;CAGA,MAAa,QAAQ;EACnB,IAAI,KAAK,eAAe,SAAS,QAC/B,KAAK,eAAe,UAAU,MAAM;EAItC,MAAM,KAAK,eAAe,QAAQ;CACpC;AACF"}
+{"version":3,"file":"ll_client.cjs","names":["plAddressToConfig","inferAuthRefreshTime","interceptors","GrpcPlApiClient","createClient","SUPPORTED_WIRE_PROTOCOLS","compressionAlgorithms","ChannelCredentials","GrpcTransport","deriveUnaryDeadline","smoothRtt","isTransientCallFailure","parsePlJwt","isUnauthenticated","parseResponseError","InterceptingCall","GrpcStatus","DEFAULT_LOGIN_TIMEOUT","Timestamp","hasCapability","isAbortedError","LLPlTransaction","WebSocketBiDiStream","TxAPI_ClientMessage","TxAPI_ServerMessage"],"sources":["../../src/core/ll_client.ts"],"sourcesContent":["import { PlatformClient as GrpcPlApiClient } from \"../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api.client\";\nimport type { ClientOptions, Interceptor } from \"@grpc/grpc-js\";\nimport {\n  ChannelCredentials,\n  InterceptingCall,\n  status as GrpcStatus,\n  compressionAlgorithms,\n} from \"@grpc/grpc-js\";\nimport type {\n  AuthInformation,\n  AuthOps,\n  PlClientConfig,\n  PlConnectionStatus,\n  PlConnectionStatusListener,\n} from \"./config\";\nimport {\n  plAddressToConfig,\n  type wireProtocol,\n  SUPPORTED_WIRE_PROTOCOLS,\n  DEFAULT_LOGIN_TIMEOUT,\n  deriveUnaryDeadline,\n  smoothRtt,\n} from \"./config\";\nimport type { GrpcOptions } from \"@protobuf-ts/grpc-transport\";\nimport { GrpcTransport } from \"@protobuf-ts/grpc-transport\";\nimport { LLPlTransaction } from \"./ll_transaction\";\nimport { setResourceSignaturesRequired } from \"./types\";\nimport { parsePlJwt } from \"../util/pl\";\nimport { type Dispatcher, interceptors } from \"undici\";\nimport type { Middleware } from \"openapi-fetch\";\nimport { inferAuthRefreshTime } from \"./auth\";\nimport { hasCapability, type BackendCapability } from \"./capabilities\";\nimport { defaultHttpDispatcher } from \"@milaboratories/pl-http\";\nimport type { WireClientProvider, WireClientProviderFactory, WireConnection } from \"./wire\";\nimport { parseHttpAuth } from \"@milaboratories/pl-model-common\";\nimport type * as grpcTypes from \"../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api\";\nimport {\n  type PlApiPaths,\n  type PlRestClientType,\n  createClient,\n  parseResponseError,\n} from \"../proto-rest\";\nimport { notEmpty, retry, withTimeout, type RetryOptions } from \"@milaboratories/ts-helpers\";\nimport { Code } from \"../proto-grpc/google/rpc/code\";\nimport { WebSocketBiDiStream } from \"./websocket_stream\";\nimport {\n  AuthAPI_Role,\n  TxAPI_ClientMessage,\n  TxAPI_ServerMessage,\n} from \"../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api\";\nimport type { MiLogger } from \"@milaboratories/ts-helpers\";\nimport { isAbortedError, isTransientCallFailure, isUnauthenticated } from \"./errors\";\nimport { Timestamp } from \"../proto-grpc/google/protobuf/timestamp\";\n\nexport interface PlCallOps {\n  timeout?: number;\n  abortSignal?: AbortSignal;\n}\n\n/** Bounded retry for idempotent unary calls. Deliberately short: these calls sit on the\n * connect path and gate the UI, so a few quick attempts beat a long grind. */\nconst IDEMPOTENT_RETRY_OPTIONS: RetryOptions = {\n  type: \"exponentialBackoff\",\n  maxAttempts: 4,\n  initialDelay: 200,\n  backoffMultiplier: 2,\n  jitter: 0.3,\n  maxDelay: 2_000,\n};\n\n// Parses leading \"<major>.<minor>.<patch>\" from a version string like\n// \"3.1.1\" or \"3.1.1-rc1\" and returns true if the parsed version is >= target.\n// Returns false for unparseable versions (safer to assume an old backend).\nfunction isVersionAtLeast(version: string, target: [number, number, number]): boolean {\n  const match = /^v?(\\d+)\\.(\\d+)\\.(\\d+)/.exec(version);\n  if (!match) return false;\n  const parsed: [number, number, number] = [Number(match[1]), Number(match[2]), Number(match[3])];\n  for (let i = 0; i < 3; i++) {\n    if (parsed[i] !== target[i]) return parsed[i] > target[i];\n  }\n  return true;\n}\n\n// Returns true iff `version` is strictly after the release tag `target`. Dev\n// builds (`git describe`-style, e.g. \"3.5.0-224-g0ca182\") are considered\n// AFTER the matching release tag — they include commits past the tag and so\n// have any change merged after it. Released versions with the same triplet\n// return false (we want the tag itself to be excluded).\n//\n// Examples for target [3,5,0]:\n//   \"3.5.0\"              → false (the tagged release)\n//   \"3.5.0-224-g0ca182\"  → true  (dev build past the tag)\n//   \"3.5.1\"              → true\n//   \"3.4.9\"              → false\n// Returns false for unparseable versions.\nfunction isAfterVersion(version: string, target: [number, number, number]): boolean {\n  const match = /^v?(\\d+)\\.(\\d+)\\.(\\d+)(.*)$/.exec(version);\n  if (!match) return false;\n  const parsed: [number, number, number] = [Number(match[1]), Number(match[2]), Number(match[3])];\n  const suffix = match[4];\n  for (let i = 0; i < 3; i++) {\n    if (parsed[i] !== target[i]) return parsed[i] > target[i];\n  }\n  return suffix !== \"\";\n}\n\nclass WireClientProviderImpl<Client> implements WireClientProvider<Client> {\n  private client: Client | undefined = undefined;\n\n  constructor(\n    private readonly wireOpts: () => WireConnection,\n    private readonly clientConstructor: (wireOpts: WireConnection) => Client,\n  ) {}\n\n  public reset(): void {\n    this.client = undefined;\n  }\n\n  public get(): Client {\n    if (this.client === undefined) this.client = this.clientConstructor(this.wireOpts());\n    return this.client;\n  }\n}\n\n/** Abstract out low level networking and authorization details */\nexport class LLPlClient implements WireClientProviderFactory {\n  /** Initial authorization information */\n  private authInformation?: AuthInformation;\n  /** Will be executed by the client when it is required */\n  private readonly onAuthUpdate?: (newInfo: AuthInformation) => void;\n  /** Will be executed if auth-related error happens during normal client operation */\n  private readonly onAuthError?: () => void;\n  /** Will be executed by the client when it is required */\n  private readonly onAuthRefreshProblem?: (error: unknown) => void;\n  /** Threshold after which auth info refresh is required */\n  private refreshTimestamp?: number;\n\n  /** Cached Ping response. Populated by build() before it returns; refreshed by every later ping(). */\n  private _serverInfo?: grpcTypes.MaintenanceAPI_Ping_Response;\n  private _authMethodsSync?: grpcTypes.AuthAPI_ListMethods_Response;\n\n  private _status: PlConnectionStatus = \"OK\";\n  private authProbeInFlight = false;\n  private readonly statusListener?: PlConnectionStatusListener;\n\n  private _wireProto: wireProtocol = \"grpc\";\n  private _wireConn!: WireConnection;\n\n  /** The live GrpcOptions object handed to GrpcTransport. The transport keeps it by\n   * reference and re-reads it on every call, so mutating `timeout` here retunes\n   * subsequent deadlines without tearing down the connection. */\n  private _grpcOptions?: GrpcOptions;\n\n  /** Smoothed round-trip estimate in ms, from ping timings. Undefined until the first\n   * successful ping, in which case the configured deadline is used as-is. */\n  private _rttMs?: number;\n\n  private readonly _restInterceptors: Dispatcher.DispatcherComposeInterceptor[];\n  private readonly _restMiddlewares: Middleware[];\n  private readonly _grpcInterceptors: Interceptor[];\n  private readonly providers: WeakRef<WireClientProviderImpl<any>>[] = [];\n\n  public readonly clientProvider: WireClientProvider<PlRestClientType | GrpcPlApiClient>;\n\n  public readonly httpDispatcher: Dispatcher;\n\n  public static async build(\n    configOrAddress: PlClientConfig | string,\n    ops: {\n      auth?: AuthOps;\n      statusListener?: PlConnectionStatusListener;\n      shouldUseGzip?: boolean;\n      logger?: MiLogger;\n      useAutoDetectWireProtocol?: boolean;\n    } = {},\n  ) {\n    const conf =\n      typeof configOrAddress === \"string\" ? plAddressToConfig(configOrAddress) : configOrAddress;\n\n    const pl = new LLPlClient(conf, ops);\n\n    // FIXME(rfiskov)[MILAB-5275]: Investigate why autodetect randomly fails; temporary turn it off.\n    if (ops.useAutoDetectWireProtocol) {\n      await pl.detectOptimalWireProtocol();\n    }\n\n    // Guarantee a ping happened so capability-gated paths (login, refresh) can branch synchronously.\n    // In the autodetect path the loop's last successful ping already populated _serverInfo via the\n    // side-effect in ping(); this fallback covers the path where autodetect is disabled.\n    // Retried, not bare: this ping is the first contact with the server, so DNS and LB\n    // warm-up land here. A single transient failure must not fail the whole connect.\n    // (Not inside ping() itself: the autodetect path already wraps it in its own retry.)\n    if (!pl._serverInfo) await pl.withIdempotentRetry(\"ping\", () => pl.ping());\n\n    // Install the process-global signature-strictness flag based on backend version.\n    setResourceSignaturesRequired(pl.supportsResourceSignatures);\n\n    // Guarantee authMethods happened so client can make weighted decision on which auth method to use.\n    if (!pl._authMethodsSync) await pl.authMethods();\n\n    return pl;\n  }\n\n  private constructor(\n    public readonly conf: PlClientConfig,\n    private readonly ops: {\n      auth?: AuthOps;\n      statusListener?: PlConnectionStatusListener;\n      shouldUseGzip?: boolean;\n      logger?: MiLogger;\n    } = {},\n  ) {\n    const { auth, statusListener } = ops;\n\n    if (auth !== undefined) {\n      this.refreshTimestamp = inferAuthRefreshTime(\n        auth.authInformation,\n        this.conf.authMaxRefreshSeconds,\n      );\n      this.authInformation = auth.authInformation;\n      this.onAuthUpdate = auth.onUpdate;\n      this.onAuthRefreshProblem = auth.onUpdateError;\n      this.onAuthError = auth.onAuthError;\n    }\n\n    this._restInterceptors = [];\n    this._restMiddlewares = [];\n    this._grpcInterceptors = [];\n\n    if (auth !== undefined) {\n      this._restInterceptors.push(this.createRestAuthInterceptor());\n      this._grpcInterceptors.push(this.createGrpcAuthInterceptor());\n    }\n    this._restInterceptors.push(interceptors.retry({ statusCodes: [] })); // Handle errors with openapi-fetch middleware.\n    this._restMiddlewares.push(this.createRestErrorMiddleware());\n    this._grpcInterceptors.push(this.createGrpcErrorInterceptor());\n\n    this.httpDispatcher = defaultHttpDispatcher(this.conf.httpProxy);\n    if (this.conf.wireProtocol) {\n      this._wireProto = this.conf.wireProtocol;\n    }\n\n    this.initWireConnection(this._wireProto);\n\n    if (statusListener !== undefined) {\n      this.statusListener = statusListener;\n      statusListener(this._status);\n    }\n\n    this.clientProvider = this.createWireClientProvider((wireConn) => {\n      if (wireConn.type === \"grpc\") {\n        return new GrpcPlApiClient(wireConn.Transport);\n      } else {\n        return createClient<PlApiPaths>({\n          hostAndPort: wireConn.Config.hostAndPort,\n          ssl: wireConn.Config.ssl,\n          dispatcher: wireConn.Dispatcher,\n          middlewares: wireConn.Middlewares,\n        });\n      }\n    });\n  }\n\n  private initWireConnection(protocol: wireProtocol) {\n    switch (protocol) {\n      case \"rest\":\n        this.initRestConnection();\n        return;\n      case \"grpc\":\n        this.initGrpcConnection(this.ops.shouldUseGzip ?? false);\n        return;\n      default:\n        ((v: never) => {\n          throw new Error(\n            `Unsupported wire protocol '${v as string}'. Use one of: ${SUPPORTED_WIRE_PROTOCOLS.join(\", \")}`,\n          );\n        })(protocol);\n    }\n  }\n\n  private initRestConnection(): void {\n    const dispatcher = defaultHttpDispatcher(this.conf.grpcProxy, this._restInterceptors);\n    this._replaceWireConnection({\n      type: \"rest\",\n      Config: this.conf,\n      Dispatcher: dispatcher,\n      Middlewares: this._restMiddlewares,\n    });\n  }\n\n  /**\n   * Initializes (or reinitializes) _grpcTransport\n   * @param gzip - whether to enable gzip compression\n   */\n  private initGrpcConnection(gzip: boolean) {\n    const clientOptions: ClientOptions = {\n      \"grpc.keepalive_time_ms\": 30_000, // 30 seconds\n      \"grpc.service_config_disable_resolution\": 1, // Disable DNS TXT lookups for service config\n      // Raises the per-stream and connection-level HTTP/2 windows. Node's 64 KB default\n      // caps a big single-stream read (project open) at window/RTT rather than link speed,\n      // and a lost WINDOW_UPDATE can deadlock it under packet loss.\n      \"grpc-node.flow_control_window\": 16 * 1024 * 1024, // 16 MiB\n      interceptors: this._grpcInterceptors,\n    };\n\n    if (gzip) clientOptions[\"grpc.default_compression_algorithm\"] = compressionAlgorithms.gzip;\n\n    //\n    // Leaving it here for now\n    // https://github.com/grpc/grpc-node/issues/2788\n    //\n    // We should implement message pooling algorithm to overcome hardcoded NO_DELAY behaviour\n    // of HTTP/2 and allow our small messages to batch together.\n    //\n    const grpcOptions: GrpcOptions = {\n      host: this.conf.hostAndPort,\n      timeout: this.unaryDeadline(),\n      channelCredentials: this.conf.ssl\n        ? ChannelCredentials.createSsl()\n        : ChannelCredentials.createInsecure(),\n      clientOptions,\n    };\n\n    const grpcProxy =\n      typeof this.conf.grpcProxy === \"string\" ? { url: this.conf.grpcProxy } : this.conf.grpcProxy;\n\n    if (grpcProxy?.url) {\n      const url = new URL(grpcProxy.url);\n      if (grpcProxy.auth) {\n        const parsed = parseHttpAuth(grpcProxy.auth);\n        if (parsed.scheme !== \"Basic\") {\n          throw new Error(`Unsupported auth scheme: ${parsed.scheme as string}.`);\n        }\n        url.username = parsed.username;\n        url.password = parsed.password;\n      }\n      process.env.grpc_proxy = url.toString();\n    } else {\n      delete process.env.grpc_proxy;\n    }\n\n    this._grpcOptions = grpcOptions;\n    this._replaceWireConnection({ type: \"grpc\", Transport: new GrpcTransport(grpcOptions) });\n  }\n\n  /** Unary deadline derived from the observed RTT, floored by the configured value so\n   * a fast link behaves exactly as before, and capped by\n   * {@link MAX_ADAPTIVE_REQUEST_TIMEOUT}. */\n  private unaryDeadline(): number {\n    return deriveUnaryDeadline(this.conf.defaultRequestTimeout, this._rttMs);\n  }\n\n  /** Folds a fresh round-trip sample into the estimate and retunes the live unary\n   * deadline. Called after every successful ping. */\n  private recordRtt(sampleMs: number): void {\n    this._rttMs = smoothRtt(this._rttMs, sampleMs);\n\n    if (this._grpcOptions) {\n      const next = this.unaryDeadline();\n      if (next !== this._grpcOptions.timeout) {\n        this.ops.logger?.info(\n          `Unary deadline retuned to ${next}ms (rtt estimate ${Math.round(this._rttMs)}ms)`,\n        );\n        this._grpcOptions.timeout = next;\n      }\n    }\n  }\n\n  /** Smoothed round-trip estimate in ms, or undefined before the first ping. */\n  public get rttEstimateMs(): number | undefined {\n    return this._rttMs;\n  }\n\n  /** Runs an idempotent unary call with a bounded retry on transient transport failures.\n   * Safe only for calls with no side effects, since a retry may duplicate the request. */\n  private async withIdempotentRetry<T>(name: string, cb: () => Promise<T>): Promise<T> {\n    return await retry(cb, IDEMPOTENT_RETRY_OPTIONS, (e: unknown) => {\n      if (!isTransientCallFailure(e)) return false;\n      this.ops.logger?.info(`${name}: transient failure, retrying. err=${String(e)}`);\n      return true;\n    });\n  }\n\n  private _replaceWireConnection(newConn: WireConnection): void {\n    const oldConn = this._wireConn;\n    this._wireConn = newConn;\n    this._wireProto = newConn.type;\n\n    // Reset all providers to let them reinitialize their clients\n    for (let i = 0; i < this.providers.length; i++) {\n      const provider = this.providers[i].deref();\n      if (provider === undefined) {\n        // at the same time we need to remove providers that are no longer valid\n        this.providers.splice(i, 1);\n        i--;\n      } else {\n        provider.reset();\n      }\n    }\n\n    if (oldConn !== undefined && oldConn.type === \"grpc\") oldConn.Transport.close();\n  }\n\n  private providerCleanupCounter = 0;\n\n  /**\n   * Creates a provider for a grpc client. Returned provider will create fresh client whenever the underlying transport is reset.\n   *\n   * @param clientConstructor - a factory function that creates a grpc client\n   */\n  public createWireClientProvider<Client>(\n    clientConstructor: (transport: WireConnection) => Client,\n  ): WireClientProvider<Client> {\n    // We need to cleanup providers periodically to avoid memory leaks.\n    // This is a simple heuristic to avoid memory leaks.\n    // We could use a more sophisticated algorithm, but this is good enough for now.\n    this.providerCleanupCounter++;\n    if (this.providerCleanupCounter >= 16) {\n      for (let i = 0; i < this.providers.length; i++) {\n        const provider = this.providers[i].deref();\n        if (provider === undefined) {\n          this.providers.splice(i, 1);\n          i--;\n        }\n      }\n      this.providerCleanupCounter = 0;\n    }\n\n    const provider = new WireClientProviderImpl<Client>(() => this._wireConn, clientConstructor);\n    this.providers.push(new WeakRef(provider));\n    return provider;\n  }\n\n  public get wireConnection(): WireConnection {\n    return this._wireConn;\n  }\n\n  public get wireProtocol(): wireProtocol | undefined {\n    return this._wireProto;\n  }\n\n  /** Returns true if client is authenticated. Even with anonymous auth information\n   * connection is considered authenticated. Unauthenticated clients are used for\n   * login and similar tasks, see {@link UnauthenticatedPlClient}. */\n  public get authenticated(): boolean {\n    return this.authInformation !== undefined;\n  }\n\n  /** null means anonymous connection */\n  public get authUser(): string | null {\n    if (!this.authenticated) throw new Error(\"Client is not authenticated\");\n    if (this.authInformation?.jwtToken) {\n      if (this.hasCapability(\"auth:v2\")) {\n        return parsePlJwt(this.authInformation?.jwtToken).sub;\n      }\n      return parsePlJwt(this.authInformation?.jwtToken).user.login;\n    } else return null;\n  }\n\n  private updateStatus(newStatus: PlConnectionStatus) {\n    process.nextTick(() => {\n      if (this._status !== newStatus) {\n        this._status = newStatus;\n        if (this.statusListener !== undefined) this.statusListener(this._status);\n        if (newStatus === \"Unauthenticated\" && this.onAuthError !== undefined) this.onAuthError();\n      }\n    });\n  }\n\n  /**\n   * UNAUTHENTICATED covers both a dead session (must reset) and a per-request authorization failure\n   * such as a revoked resource signature (must not). Disambiguate by probing getSessionInfo — an\n   * authenticated call with no resource signature: success means the session is alive and the failure\n   * was resource-level; a probe that is itself Unauthenticated means real auth loss. Coalesced via\n   * authProbeInFlight so a burst of failures costs one probe.\n   */\n  private async verifyThenMaybeEscalateUnauthenticated(): Promise<void> {\n    if (this._status !== \"OK\" || this.authProbeInFlight) return;\n    this.authProbeInFlight = true;\n    try {\n      await this.getSessionInfo();\n    } catch (e) {\n      if (isUnauthenticated(e)) this.updateStatus(\"Unauthenticated\");\n    } finally {\n      this.authProbeInFlight = false;\n    }\n  }\n\n  public get status(): PlConnectionStatus {\n    return this._status;\n  }\n\n  private authRefreshInProgress: boolean = false;\n\n  private refreshAuthInformationIfNeeded(): void {\n    if (\n      this.refreshTimestamp === undefined ||\n      Date.now() < this.refreshTimestamp ||\n      this.authRefreshInProgress ||\n      this._status === \"Unauthenticated\"\n    )\n      return;\n\n    // Running refresh in background`\n    this.authRefreshInProgress = true;\n    void (async () => {\n      try {\n        const ttl = BigInt(this.conf.authTTLSeconds);\n        const token = this.hasCapability(\"auth:v2\")\n          ? await this.refreshToken({ ttlSeconds: ttl })\n          : await this.getJwtToken(ttl);\n        this.authInformation = { jwtToken: token };\n        this.refreshTimestamp = inferAuthRefreshTime(\n          this.authInformation,\n          this.conf.authMaxRefreshSeconds,\n        );\n        if (this.onAuthUpdate) this.onAuthUpdate(this.authInformation);\n      } catch (e: unknown) {\n        if (this.onAuthRefreshProblem) this.onAuthRefreshProblem(e);\n      } finally {\n        this.authRefreshInProgress = false;\n      }\n    })();\n  }\n\n  /**\n   * Creates middleware that parses error responses and handles them centrally.\n   * This middleware runs before openapi-fetch parses the response, so we need to\n   * manually parse the response body for error responses.\n   */\n  private createRestErrorMiddleware(): Middleware {\n    return {\n      onResponse: async ({ request: _request, response, options: _options }) => {\n        const { body, ...resOptions } = response;\n\n        if ([502, 503, 504].includes(response.status)) {\n          // Service unavailable, bad gateway, gateway timeout\n          this.updateStatus(\"Disconnected\");\n          return new Response(body, { ...resOptions, status: response.status });\n        }\n\n        const respErr = await parseResponseError(response);\n        if (!respErr.error) {\n          // No error: nice!\n          return new Response(respErr.origBody ?? body, { ...resOptions, status: response.status });\n        }\n\n        if (typeof respErr.error === \"string\") {\n          // Non-standard error or normal response: let later middleware to deal wit it.\n          return new Response(respErr.error, { ...resOptions, status: response.status });\n        }\n\n        if (respErr.error.code === Code.UNAUTHENTICATED) {\n          void this.verifyThenMaybeEscalateUnauthenticated();\n        }\n\n        // Let later middleware to deal with standard gRPC error.\n        return new Response(respErr.origBody, { ...resOptions, status: response.status });\n      },\n    };\n  }\n\n  /** Detects certain errors and update client status accordingly when using GRPC wire connection */\n  private createGrpcErrorInterceptor(): Interceptor {\n    return (options, nextCall) => {\n      return new InterceptingCall(nextCall(options), {\n        start: (metadata, listener, next) => {\n          next(metadata, {\n            onReceiveStatus: (status, next) => {\n              if (status.code == GrpcStatus.UNAUTHENTICATED)\n                // (!!!) don't change to \"===\"\n                void this.verifyThenMaybeEscalateUnauthenticated();\n              if (status.code == GrpcStatus.UNAVAILABLE)\n                // (!!!) don't change to \"===\"\n                this.updateStatus(\"Disconnected\");\n              next(status);\n            },\n          });\n        },\n      });\n    };\n  }\n\n  private createRestAuthInterceptor(): Dispatcher.DispatcherComposeInterceptor {\n    return (dispatch) => {\n      return (options, handler) => {\n        if (this.authInformation?.jwtToken !== undefined) {\n          // TODO: check this magic really works and gets called\n          options.headers = {\n            ...options.headers,\n            authorization: \"Bearer \" + this.authInformation.jwtToken,\n          };\n          this.refreshAuthInformationIfNeeded();\n        }\n\n        return dispatch(options, handler);\n      };\n    };\n  }\n\n  /** Injects authentication information if needed */\n  private createGrpcAuthInterceptor(): Interceptor {\n    return (options, nextCall) => {\n      return new InterceptingCall(nextCall(options), {\n        start: (metadata, listener, next) => {\n          if (this.authInformation?.jwtToken !== undefined) {\n            metadata.set(\"authorization\", \"Bearer \" + this.authInformation.jwtToken);\n            this.refreshAuthInformationIfNeeded();\n            next(metadata, listener);\n          } else {\n            next(metadata, listener);\n          }\n        },\n      });\n    };\n  }\n\n  public async getJwtToken(\n    ttlSeconds: bigint,\n    options?: { authorization?: string; role?: AuthAPI_Role },\n  ): Promise<string> {\n    const cl = this.clientProvider.get();\n    const role = options?.role ?? AuthAPI_Role.UNSPECIFIED;\n\n    if (cl instanceof GrpcPlApiClient) {\n      const meta: Record<string, string> = {};\n      if (options?.authorization) meta.authorization = options.authorization;\n      return (\n        await cl.getJWTToken(\n          {\n            expiration: { seconds: ttlSeconds, nanos: 0 },\n            requestedRole: role,\n          },\n          { meta, timeout: DEFAULT_LOGIN_TIMEOUT },\n        ).response\n      ).token;\n    } else {\n      const headers: Record<string, string> = {};\n      if (options?.authorization) headers.authorization = options.authorization;\n      const resp = cl.POST(\"/v1/auth/jwt-token\", {\n        body: { expiration: `${ttlSeconds}s`, requestedRole: role },\n        headers,\n      });\n      return notEmpty((await resp).data, \"REST: empty response for JWT token request\").token;\n    }\n  }\n\n  /** Login via username/password. Returns a fresh JWT. Backend creates a new session per call. */\n  public async loginBasic(\n    user: string,\n    password: string,\n    opts: { ttlSeconds?: bigint; role?: AuthAPI_Role } = {},\n  ): Promise<string> {\n    const cl = this.clientProvider.get();\n    const ttl = opts.ttlSeconds ?? BigInt(this.conf.authTTLSeconds);\n    const role = opts.role ?? AuthAPI_Role.UNSPECIFIED;\n\n    if (cl instanceof GrpcPlApiClient) {\n      return (\n        await cl.login(\n          {\n            credentials: {\n              oneofKind: \"basic\",\n              basic: { login: user, password },\n            },\n            expiration: { seconds: ttl, nanos: 0 },\n            requestedRole: role,\n          },\n          { timeout: DEFAULT_LOGIN_TIMEOUT },\n        ).response\n      ).token;\n    } else {\n      const resp = cl.POST(\"/v1/auth/login\", {\n        // openapi-typescript generated all body fields as required, but Login.Request\n        // has a credentials oneof — only one of `basic`/`token` is sent. Cast around it.\n        body: {\n          basic: { login: user, password },\n          expiration: `${ttl}s`,\n          requestedRole: role,\n        } as any,\n      });\n      return notEmpty((await resp).data, \"REST: empty response for login request\").token;\n    }\n  }\n\n  /** Login via opaque bearer token (controller pre-shared secret, OIDC id-token, etc.).\n   * String input is UTF-8 encoded. Returns a fresh Platforma JWT. */\n  public async loginWithToken(\n    token: Uint8Array | string,\n    opts: { ttlSeconds?: bigint; role?: AuthAPI_Role } = {},\n  ): Promise<string> {\n    const cl = this.clientProvider.get();\n    const ttl = opts.ttlSeconds ?? BigInt(this.conf.authTTLSeconds);\n    const role = opts.role ?? AuthAPI_Role.UNSPECIFIED;\n    const bytes = typeof token === \"string\" ? Buffer.from(token, \"utf8\") : token;\n\n    if (cl instanceof GrpcPlApiClient) {\n      return (\n        await cl.login(\n          {\n            credentials: {\n              oneofKind: \"token\",\n              token: { token: bytes },\n            },\n            expiration: { seconds: ttl, nanos: 0 },\n            requestedRole: role,\n          },\n          { timeout: DEFAULT_LOGIN_TIMEOUT },\n        ).response\n      ).token;\n    } else {\n      const resp = cl.POST(\"/v1/auth/login\", {\n        // openapi-typescript marks all body fields as required, but Login.Request has a oneof.\n        // REST encodes `bytes` as a base64 string.\n        body: {\n          token: { token: Buffer.from(bytes).toString(\"base64\") },\n          expiration: `${ttl}s`,\n          requestedRole: role,\n        } as any,\n      });\n      return notEmpty((await resp).data, \"REST: empty response for login request\").token;\n    }\n  }\n\n  /** Login via SSO: forwards the raw IdP /token JSON body to the backend.\n   * Backend validates signature + nonce + audience and mints a Platforma JWT. */\n  public async loginSSO(tokenResponse: Uint8Array): Promise<string> {\n    const cl = this.clientProvider.get();\n    if (cl instanceof GrpcPlApiClient) {\n      return (\n        await cl.login(\n          {\n            credentials: {\n              oneofKind: \"sso\",\n              sso: { tokenResponse },\n            },\n          },\n          { timeout: DEFAULT_LOGIN_TIMEOUT },\n        ).response\n      ).token;\n    } else {\n      const resp = cl.POST(\"/v1/auth/login\", {\n        body: {\n          sso: { tokenResponse: Buffer.from(tokenResponse).toString(\"base64\") },\n        } as any,\n      });\n      return notEmpty((await resp).data, \"REST: empty response for SSO login request\").token;\n    }\n  }\n\n  /** Request a one-time PKCE nonce + its expiry from the backend. The desktop is\n   * expected to place the nonce verbatim into the OIDC auth-request before\n   * redirecting to the IdP; the backend enforces the expiry on {@link loginSSO}. */\n  public async beginSSOLogin(): Promise<{ nonce: string; expiresAt: Date; clientSecret?: string }> {\n    const cl = this.clientProvider.get();\n    if (cl instanceof GrpcPlApiClient) {\n      const resp = (await cl.beginSSOLogin({}).response).flow;\n      if (resp.oneofKind !== \"publicPkce\") {\n        throw new Error(`beginSSOLogin: unsupported flow ${resp.oneofKind}`);\n      }\n      const exp = notEmpty(resp.publicPkce.expiresAt, \"beginSSOLogin: missing expiresAt\");\n      return {\n        nonce: resp.publicPkce.nonce,\n        expiresAt: Timestamp.toDate(exp),\n        clientSecret: resp.publicPkce.clientSecret,\n      };\n    } else {\n      const wsResponse = notEmpty(\n        (await cl.POST(\"/v1/auth/sso/begin-login\", { body: {} })).data,\n        \"REST: empty response for beginSSOLogin request\",\n      );\n      const pkce = notEmpty(wsResponse.publicPkce, \"REST: missing publicPkce in beginSSOLogin\");\n      return {\n        nonce: pkce.nonce,\n        expiresAt: new Date(pkce.expiresAt),\n        clientSecret: pkce.clientSecret,\n      };\n    }\n  }\n\n  /** Refresh the current JWT, preserving session id and role. */\n  public async refreshToken(opts: { ttlSeconds?: bigint } = {}): Promise<string> {\n    const cl = this.clientProvider.get();\n    const ttl = opts.ttlSeconds ?? BigInt(this.conf.authTTLSeconds);\n    const currentToken = notEmpty(\n      this.authInformation?.jwtToken,\n      \"refreshToken called without a current JWT\",\n    );\n\n    if (cl instanceof GrpcPlApiClient) {\n      return (\n        await cl.refreshToken(\n          {\n            token: currentToken,\n            expiration: { seconds: ttl, nanos: 0 },\n          },\n          { timeout: DEFAULT_LOGIN_TIMEOUT },\n        ).response\n      ).token;\n    } else {\n      const resp = cl.POST(\"/v1/auth/refresh\", {\n        body: { token: currentToken, expiration: `${ttl}s` },\n      });\n      return notEmpty((await resp).data, \"REST: empty response for refresh request\").token;\n    }\n  }\n\n  public async ping(): Promise<grpcTypes.MaintenanceAPI_Ping_Response> {\n    const cl = this.clientProvider.get();\n    let resp: grpcTypes.MaintenanceAPI_Ping_Response;\n    // Ping is the cheapest call we make, so its duration is our best RTT proxy.\n    const startedAt = performance.now();\n    if (cl instanceof GrpcPlApiClient) {\n      resp = (await cl.ping({})).response;\n    } else {\n      // The REST ping response predates the `capabilities` field (proto field 9).\n      // Old servers omit it; treat absence as empty capability list.\n      const pingData = notEmpty(\n        (await cl.GET(\"/v1/ping\")).data,\n        \"REST: empty response for ping request\",\n      );\n      resp = {\n        ...(pingData as unknown as grpcTypes.MaintenanceAPI_Ping_Response),\n        capabilities: (pingData as any).capabilities ?? [],\n      };\n    }\n    this.recordRtt(performance.now() - startedAt);\n    this._serverInfo = resp;\n    return resp;\n  }\n\n  /** Cached Ping response. Always populated post-build(); throws if accessed earlier. */\n  public get serverInfo(): grpcTypes.MaintenanceAPI_Ping_Response {\n    if (!this._serverInfo) {\n      throw new Error(\"LLPlClient.serverInfo accessed before build() completed\");\n    }\n    return this._serverInfo;\n  }\n\n  /** Synchronous capability check against the cached Ping response. */\n  public hasCapability(capability: BackendCapability): boolean {\n    return hasCapability(this.serverInfo.capabilities, capability);\n  }\n\n  /** True if the backend produces signed resource ids (and accepts the\n   * setDefaultColor TX request). Tagged at 3.3.0 — backends older than this\n   * return resources without signatures and reject color-proof requests. */\n  public get supportsResourceSignatures(): boolean {\n    return isVersionAtLeast(this.serverInfo.coreVersion, [3, 3, 0]);\n  }\n\n  /**\n   * True if the backend honors per-file `permissions` on workdir fill rules, so\n   * `exec.builder().writeFile/addFile({ writable: true })` takes effect. When false\n   * the requested mode is ignored and files land at the canonical archive perm.\n   *\n   * [3, 5, 0] excludes the tagged 3.5.0 release but includes dev builds past the\n   * tag (e.g. \"3.5.0-224-g0ca182\"), which is where the support lands.\n   */\n  public get supportsWritableWorkdirFiles(): boolean {\n    return isAfterVersion(this.serverInfo.coreVersion, [3, 5, 0]);\n  }\n\n  /**\n   * Detects the best available wire protocol.\n   * If wireProtocol is explicitly configured, does nothing.\n   * Otherwise probes the current protocol via ping; if it fails, switches to the alternative.\n   */\n  private async detectOptimalWireProtocol() {\n    if (this.conf.wireProtocol) {\n      return;\n    }\n\n    // Each retry is:\n    //  - ping request timeout (100 to 3_000ms)\n    //  - backoff delay (30 to 500ms)\n    //\n    // 30 attempts are ~43 seconds of overall waiting time.\n    // Think twice on overall time this thing takes to complete when changing these parameters.\n    // It may block UI when connecting to the server and loading projects list.\n    const pingTimeoutFactor = 1.3;\n    const maxPingTimeoutMs = 3_000;\n    const retryOptions: RetryOptions = {\n      type: \"exponentialBackoff\",\n      maxAttempts: 30,\n      initialDelay: 30,\n      backoffMultiplier: 1.3,\n      jitter: 0.2,\n      maxDelay: 500,\n    };\n\n    let attempt = 1;\n    let pingTimeoutMs = 100;\n    await retry(\n      () => withTimeout(this.ping(), pingTimeoutMs),\n      retryOptions,\n      (e: unknown) => {\n        if (isAbortedError(e)) {\n          this.ops.logger?.info(\n            `Wire proto autodetect: ping timed out after ${pingTimeoutMs}ms: attempt=${attempt}, wire=${this._wireProto}`,\n          );\n\n          if (attempt % 2 === 0) {\n            // We have 2 wire protocols to check. Increase timeout each 2 attempts.\n            pingTimeoutMs = Math.min(\n              Math.round(pingTimeoutMs * pingTimeoutFactor),\n              maxPingTimeoutMs,\n            );\n          }\n        } else {\n          this.ops.logger?.info(\n            `Wire proto autodetect: ping failed: attempt=${attempt}, wire=${this._wireProto}, err=${String(e)}`,\n          );\n        }\n\n        attempt++;\n        const protocol = this._wireProto === \"grpc\" ? \"rest\" : \"grpc\";\n        this.ops.logger?.info(\n          `Wire protocol autodetect next attempt: will try wire '${protocol}' with timeout ${pingTimeoutMs}ms`,\n        );\n        this.initWireConnection(protocol);\n        return true;\n      },\n    );\n  }\n\n  public async license(): Promise<grpcTypes.MaintenanceAPI_License_Response> {\n    const cl = this.clientProvider.get();\n    if (cl instanceof GrpcPlApiClient) {\n      return (await cl.license({})).response;\n    } else {\n      const resp = notEmpty(\n        (await cl.GET(\"/v1/license\")).data,\n        \"REST: empty response for license request\",\n      );\n      return {\n        status: resp.status,\n        isOk: resp.isOk,\n        responseBody: Uint8Array.from(Buffer.from(resp.responseBody)),\n      };\n    }\n  }\n\n  public async authMethods(): Promise<grpcTypes.AuthAPI_ListMethods_Response> {\n    const cl = this.clientProvider.get();\n    let resp: grpcTypes.AuthAPI_ListMethods_Response;\n    if (cl instanceof GrpcPlApiClient) {\n      resp = (await cl.authMethods({})).response;\n    } else {\n      const wsResponse = notEmpty(\n        (await cl.GET(\"/v1/auth/methods\")).data,\n        \"REST: empty response for auth methods request\",\n      );\n      // OpenAPI schema flattens the protobuf oneof into `{ basic?, token? }`,\n      // while protobuf-ts models it as a discriminated union. Reshape per item.\n      resp = {\n        methods: (wsResponse.methods ?? []).map((m): grpcTypes.AuthAPI_ListMethods_MethodInfo => {\n          const base = { id: m.id, description: m.description };\n          if (m.basic !== undefined) {\n            return { ...base, method: { oneofKind: \"basic\", basic: m.basic } };\n          }\n          if (m.token !== undefined) {\n            return { ...base, method: { oneofKind: \"token\", token: m.token } };\n          }\n          if (m.sso !== undefined) {\n            return { ...base, method: { oneofKind: \"sso\", sso: m.sso } };\n          }\n          return { ...base, method: { oneofKind: undefined } };\n        }),\n      };\n    }\n\n    this._authMethodsSync = resp;\n    return resp;\n  }\n\n  public get authMethodsSync(): grpcTypes.AuthAPI_ListMethods_Response {\n    if (!this._authMethodsSync) {\n      throw new Error(\"LLPlClient.authMethodsSync accessed before build() completed\");\n    }\n    return this._authMethodsSync;\n  }\n\n  public async getUserRoot(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<grpcTypes.AuthAPI_GetUserRoot_Response> {\n    // Retryable even with createIfNotExists: the call is get-or-create keyed on login, so a\n    // second attempt returns the existing root rather than making another one.\n    return await this.withIdempotentRetry(\"getUserRoot\", () => this.getUserRootOnce(opts));\n  }\n\n  private async getUserRootOnce(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<grpcTypes.AuthAPI_GetUserRoot_Response> {\n    const cl = this.clientProvider.get();\n    if (cl instanceof GrpcPlApiClient) {\n      return (\n        await cl.getUserRoot({\n          login: opts.login ?? \"\",\n          createIfNotExists: opts.createIfNotExists ?? false,\n        })\n      ).response;\n    } else {\n      const resp = notEmpty(\n        (\n          await cl.POST(\"/v1/auth/user-root\", {\n            body: {\n              login: opts.login ?? \"\",\n              createIfNotExists: opts.createIfNotExists ?? false,\n            },\n          })\n        ).data,\n        \"REST: empty response for getUserRoot request\",\n      );\n      return {\n        userRoot: resp.userRoot\n          ? {\n              resourceId: BigInt(resp.userRoot.resourceId),\n              resourceSignature: Uint8Array.from(\n                Buffer.from(resp.userRoot.resourceSignature, \"base64\"),\n              ),\n            }\n          : undefined,\n      };\n    }\n  }\n\n  public async listUserResources(\n    opts: { login?: string; startFrom?: bigint; limit?: number } = {},\n  ): Promise<grpcTypes.AuthAPI_ListUserResources_Response[]> {\n    const cl = this.clientProvider.get();\n\n    if (!(cl instanceof GrpcPlApiClient)) {\n      throw new Error(\"ListUserResources requires gRPC wire protocol; REST is not supported\");\n    }\n\n    const call = cl.listUserResources({\n      login: opts.login ?? \"\",\n      startFrom: opts.startFrom ?? 0n,\n      limit: opts.limit ?? 0,\n    });\n    const responses: grpcTypes.AuthAPI_ListUserResources_Response[] = [];\n    for await (const msg of call.responses) {\n      responses.push(msg);\n    }\n    return responses;\n  }\n\n  /** Returns the authenticated caller's session id and effective role.\n   *  Models the {@link getUserRoot} wrapper: gRPC unary with a REST fallback. */\n  public async getSessionInfo(): Promise<grpcTypes.AuthAPI_GetSessionInfo_Response> {\n    const cl = this.clientProvider.get();\n    if (cl instanceof GrpcPlApiClient) {\n      return (await cl.getSessionInfo({})).response;\n    } else {\n      const resp = notEmpty(\n        (await cl.POST(\"/v1/auth/session-info\", { body: {} })).data,\n        \"REST: empty response for getSessionInfo request\",\n      );\n      return {\n        sessionId: Uint8Array.from(Buffer.from(resp.sessionId, \"base64\")),\n        role: resp.role as AuthAPI_Role,\n      };\n    }\n  }\n\n  /** Lists the users known to the server — the recipient picker's source. A user\n   *  becomes known on first login; provisioned users who have never logged in do not\n   *  appear. gRPC-only (unary, no REST binding). */\n  public async listUsers(): Promise<grpcTypes.AuthAPI_User[]> {\n    const cl = this.clientProvider.get();\n\n    if (!(cl instanceof GrpcPlApiClient)) {\n      throw new Error(\"ListUsers requires gRPC wire protocol; REST is not supported\");\n    }\n\n    return (await cl.listUsers({})).response.users;\n  }\n\n  public async txSync(txId: bigint): Promise<void> {\n    const cl = this.clientProvider.get();\n    if (cl instanceof GrpcPlApiClient) {\n      await cl.txSync({ txId: BigInt(txId) });\n    } else {\n      await cl.POST(\"/v1/tx-sync\", { body: { txId: txId.toString() } });\n    }\n  }\n\n  createTx(rw: boolean, ops: PlCallOps = {}): LLPlTransaction {\n    return new LLPlTransaction((abortSignal) => {\n      let totalAbortSignal = abortSignal;\n      if (ops.abortSignal) totalAbortSignal = AbortSignal.any([totalAbortSignal, ops.abortSignal]);\n\n      const timeout =\n        ops.timeout ??\n        (rw ? this.conf.defaultRWTransactionTimeout : this.conf.defaultROTransactionTimeout);\n\n      const cl = this.clientProvider.get();\n      if (cl instanceof GrpcPlApiClient) {\n        return cl.tx({\n          abort: totalAbortSignal,\n          timeout,\n        });\n      }\n\n      const wireConn = this.wireConnection;\n      if (wireConn.type === \"rest\") {\n        // For REST/WebSocket protocol, timeout needs to be converted to AbortSignal\n        if (timeout !== undefined) {\n          totalAbortSignal = AbortSignal.any([totalAbortSignal, AbortSignal.timeout(timeout)]);\n        }\n\n        // The gRPC transport has the auth interceptor that already handles it, but here we need to refresh the auth information to be safe.\n        this.refreshAuthInformationIfNeeded();\n\n        const wsUrl = this.conf.ssl\n          ? `wss://${this.conf.hostAndPort}/v1/ws/tx`\n          : `ws://${this.conf.hostAndPort}/v1/ws/tx`;\n\n        return new WebSocketBiDiStream(\n          wsUrl,\n          (msg) => TxAPI_ClientMessage.toBinary(msg),\n          (data) => TxAPI_ServerMessage.fromBinary(new Uint8Array(data)),\n          {\n            abortSignal: totalAbortSignal,\n            jwtToken: this.authInformation?.jwtToken,\n            dispatcher: wireConn.Dispatcher,\n\n            onComplete: async (stream) =>\n              stream.requests.send({\n                // Ask server to gracefully close the stream on its side, if not done yet.\n                requestId: 0,\n                request: { oneofKind: \"streamClose\", streamClose: {} },\n              }),\n          },\n        );\n      }\n\n      throw new Error(`transactions are not supported for wire protocol ${this._wireProto}`);\n    });\n  }\n\n  /** Closes underlying transport */\n  public async close() {\n    if (this.wireConnection.type === \"grpc\") {\n      this.wireConnection.Transport.close();\n    } else {\n      // TODO: close all WS connections\n    }\n    await this.httpDispatcher.destroy();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA6DA,MAAM,2BAAyC;CAC7C,MAAM;CACN,aAAa;CACb,cAAc;CACd,mBAAmB;CACnB,QAAQ;CACR,UAAU;AACZ;AAKA,SAAS,iBAAiB,SAAiB,QAA2C;CACpF,MAAM,QAAQ,yBAAyB,KAAK,OAAO;CACnD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,SAAmC;EAAC,OAAO,MAAM,EAAE;EAAG,OAAO,MAAM,EAAE;EAAG,OAAO,MAAM,EAAE;CAAC;CAC9F,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KACrB,IAAI,OAAO,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,OAAO;CAEzD,OAAO;AACT;AAcA,SAAS,eAAe,SAAiB,QAA2C;CAClF,MAAM,QAAQ,8BAA8B,KAAK,OAAO;CACxD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,SAAmC;EAAC,OAAO,MAAM,EAAE;EAAG,OAAO,MAAM,EAAE;EAAG,OAAO,MAAM,EAAE;CAAC;CAC9F,MAAM,SAAS,MAAM;CACrB,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KACrB,IAAI,OAAO,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,OAAO;CAEzD,OAAO,WAAW;AACpB;AAEA,IAAM,yBAAN,MAA2E;CAItD;CACA;CAJnB,SAAqC,KAAA;CAErC,YACE,UACA,mBACA;EAFiB,KAAA,WAAA;EACA,KAAA,oBAAA;CAChB;CAEH,QAAqB;EACnB,KAAK,SAAS,KAAA;CAChB;CAEA,MAAqB;EACnB,IAAI,KAAK,WAAW,KAAA,GAAW,KAAK,SAAS,KAAK,kBAAkB,KAAK,SAAS,CAAC;EACnF,OAAO,KAAK;CACd;AACF;;AAGA,IAAa,aAAb,MAAa,WAAgD;CA+EzC;CACC;;CA9EnB;;CAEA;;CAEA;;CAEA;;CAEA;;CAGA;CACA;CAEA,UAAsC;CACtC,oBAA4B;CAC5B;CAEA,aAAmC;CACnC;;;;CAKA;;;CAIA;CAEA;CACA;CACA;CACA,YAAqE,CAAC;CAEtE;CAEA;CAEA,aAAoB,MAClB,iBACA,MAMI,CAAC,GACL;EAIA,MAAM,KAAK,IAAI,WAFb,OAAO,oBAAoB,WAAWA,eAAAA,kBAAkB,eAAe,IAAI,iBAE7C,GAAG;EAGnC,IAAI,IAAI,2BACN,MAAM,GAAG,0BAA0B;EASrC,IAAI,CAAC,GAAG,aAAa,MAAM,GAAG,oBAAoB,cAAc,GAAG,KAAK,CAAC;EAGzE,cAAA,8BAA8B,GAAG,0BAA0B;EAG3D,IAAI,CAAC,GAAG,kBAAkB,MAAM,GAAG,YAAY;EAE/C,OAAO;CACT;CAEA,YACE,MACA,MAKI,CAAC,GACL;EAPgB,KAAA,OAAA;EACC,KAAA,MAAA;EAOjB,MAAM,EAAE,MAAM,mBAAmB;EAEjC,IAAI,SAAS,KAAA,GAAW;GACtB,KAAK,mBAAmBC,aAAAA,qBACtB,KAAK,iBACL,KAAK,KAAK,qBACZ;GACA,KAAK,kBAAkB,KAAK;GAC5B,KAAK,eAAe,KAAK;GACzB,KAAK,uBAAuB,KAAK;GACjC,KAAK,cAAc,KAAK;EAC1B;EAEA,KAAK,oBAAoB,CAAC;EAC1B,KAAK,mBAAmB,CAAC;EACzB,KAAK,oBAAoB,CAAC;EAE1B,IAAI,SAAS,KAAA,GAAW;GACtB,KAAK,kBAAkB,KAAK,KAAK,0BAA0B,CAAC;GAC5D,KAAK,kBAAkB,KAAK,KAAK,0BAA0B,CAAC;EAC9D;EACA,KAAK,kBAAkB,KAAKC,OAAAA,aAAa,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;EACnE,KAAK,iBAAiB,KAAK,KAAK,0BAA0B,CAAC;EAC3D,KAAK,kBAAkB,KAAK,KAAK,2BAA2B,CAAC;EAE7D,KAAK,kBAAA,GAAA,wBAAA,sBAAA,CAAuC,KAAK,KAAK,SAAS;EAC/D,IAAI,KAAK,KAAK,cACZ,KAAK,aAAa,KAAK,KAAK;EAG9B,KAAK,mBAAmB,KAAK,UAAU;EAEvC,IAAI,mBAAmB,KAAA,GAAW;GAChC,KAAK,iBAAiB;GACtB,eAAe,KAAK,OAAO;EAC7B;EAEA,KAAK,iBAAiB,KAAK,0BAA0B,aAAa;GAChE,IAAI,SAAS,SAAS,QACpB,OAAO,IAAIC,mBAAAA,eAAgB,SAAS,SAAS;QAE7C,OAAOC,cAAAA,aAAyB;IAC9B,aAAa,SAAS,OAAO;IAC7B,KAAK,SAAS,OAAO;IACrB,YAAY,SAAS;IACrB,aAAa,SAAS;GACxB,CAAC;EAEL,CAAC;CACH;CAEA,mBAA2B,UAAwB;EACjD,QAAQ,UAAR;GACE,KAAK;IACH,KAAK,mBAAmB;IACxB;GACF,KAAK;IACH,KAAK,mBAAmB,KAAK,IAAI,iBAAiB,KAAK;IACvD;GACF,SACE,EAAE,MAAa;IACb,MAAM,IAAI,MACR,8BAA8B,EAAY,iBAAiBC,eAAAA,yBAAyB,KAAK,IAAI,GAC/F;GACF,EAAA,CAAG,QAAQ;EACf;CACF;CAEA,qBAAmC;EACjC,MAAM,cAAA,GAAA,wBAAA,sBAAA,CAAmC,KAAK,KAAK,WAAW,KAAK,iBAAiB;EACpF,KAAK,uBAAuB;GAC1B,MAAM;GACN,QAAQ,KAAK;GACb,YAAY;GACZ,aAAa,KAAK;EACpB,CAAC;CACH;;;;;CAMA,mBAA2B,MAAe;EACxC,MAAM,gBAA+B;GACnC,0BAA0B;GAC1B,0CAA0C;GAI1C,iCAAiC,KAAK,OAAO;GAC7C,cAAc,KAAK;EACrB;EAEA,IAAI,MAAM,cAAc,wCAAwCC,cAAAA,sBAAsB;EAStF,MAAM,cAA2B;GAC/B,MAAM,KAAK,KAAK;GAChB,SAAS,KAAK,cAAc;GAC5B,oBAAoB,KAAK,KAAK,MAC1BC,cAAAA,mBAAmB,UAAU,IAC7BA,cAAAA,mBAAmB,eAAe;GACtC;EACF;EAEA,MAAM,YACJ,OAAO,KAAK,KAAK,cAAc,WAAW,EAAE,KAAK,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK;EAErF,IAAI,WAAW,KAAK;GAClB,MAAM,MAAM,IAAI,IAAI,UAAU,GAAG;GACjC,IAAI,UAAU,MAAM;IAClB,MAAM,UAAA,GAAA,gCAAA,cAAA,CAAuB,UAAU,IAAI;IAC3C,IAAI,OAAO,WAAW,SACpB,MAAM,IAAI,MAAM,4BAA4B,OAAO,OAAiB,EAAE;IAExE,IAAI,WAAW,OAAO;IACtB,IAAI,WAAW,OAAO;GACxB;GACA,QAAQ,IAAI,aAAa,IAAI,SAAS;EACxC,OACE,OAAO,QAAQ,IAAI;EAGrB,KAAK,eAAe;EACpB,KAAK,uBAAuB;GAAE,MAAM;GAAQ,WAAW,IAAIC,4BAAAA,cAAc,WAAW;EAAE,CAAC;CACzF;;;;CAKA,gBAAgC;EAC9B,OAAOC,eAAAA,oBAAoB,KAAK,KAAK,uBAAuB,KAAK,MAAM;CACzE;;;CAIA,UAAkB,UAAwB;EACxC,KAAK,SAASC,eAAAA,UAAU,KAAK,QAAQ,QAAQ;EAE7C,IAAI,KAAK,cAAc;GACrB,MAAM,OAAO,KAAK,cAAc;GAChC,IAAI,SAAS,KAAK,aAAa,SAAS;IACtC,KAAK,IAAI,QAAQ,KACf,6BAA6B,KAAK,mBAAmB,KAAK,MAAM,KAAK,MAAM,EAAE,IAC/E;IACA,KAAK,aAAa,UAAU;GAC9B;EACF;CACF;;CAGA,IAAW,gBAAoC;EAC7C,OAAO,KAAK;CACd;;;CAIA,MAAc,oBAAuB,MAAc,IAAkC;EACnF,OAAO,OAAA,GAAA,2BAAA,MAAA,CAAY,IAAI,2BAA2B,MAAe;GAC/D,IAAI,CAACC,eAAAA,uBAAuB,CAAC,GAAG,OAAO;GACvC,KAAK,IAAI,QAAQ,KAAK,GAAG,KAAK,qCAAqC,OAAO,CAAC,GAAG;GAC9E,OAAO;EACT,CAAC;CACH;CAEA,uBAA+B,SAA+B;EAC5D,MAAM,UAAU,KAAK;EACrB,KAAK,YAAY;EACjB,KAAK,aAAa,QAAQ;EAG1B,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,UAAU,QAAQ,KAAK;GAC9C,MAAM,WAAW,KAAK,UAAU,EAAE,CAAC,MAAM;GACzC,IAAI,aAAa,KAAA,GAAW;IAE1B,KAAK,UAAU,OAAO,GAAG,CAAC;IAC1B;GACF,OACE,SAAS,MAAM;EAEnB;EAEA,IAAI,YAAY,KAAA,KAAa,QAAQ,SAAS,QAAQ,QAAQ,UAAU,MAAM;CAChF;CAEA,yBAAiC;;;;;;CAOjC,yBACE,mBAC4B;EAI5B,KAAK;EACL,IAAI,KAAK,0BAA0B,IAAI;GACrC,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,UAAU,QAAQ,KAEzC,IADiB,KAAK,UAAU,EAAE,CAAC,MACxB,MAAM,KAAA,GAAW;IAC1B,KAAK,UAAU,OAAO,GAAG,CAAC;IAC1B;GACF;GAEF,KAAK,yBAAyB;EAChC;EAEA,MAAM,WAAW,IAAI,6BAAqC,KAAK,WAAW,iBAAiB;EAC3F,KAAK,UAAU,KAAK,IAAI,QAAQ,QAAQ,CAAC;EACzC,OAAO;CACT;CAEA,IAAW,iBAAiC;EAC1C,OAAO,KAAK;CACd;CAEA,IAAW,eAAyC;EAClD,OAAO,KAAK;CACd;;;;CAKA,IAAW,gBAAyB;EAClC,OAAO,KAAK,oBAAoB,KAAA;CAClC;;CAGA,IAAW,WAA0B;EACnC,IAAI,CAAC,KAAK,eAAe,MAAM,IAAI,MAAM,6BAA6B;EACtE,IAAI,KAAK,iBAAiB,UAAU;GAClC,IAAI,KAAK,cAAc,SAAS,GAC9B,OAAOC,WAAAA,WAAW,KAAK,iBAAiB,QAAQ,CAAC,CAAC;GAEpD,OAAOA,WAAAA,WAAW,KAAK,iBAAiB,QAAQ,CAAC,CAAC,KAAK;EACzD,OAAO,OAAO;CAChB;CAEA,aAAqB,WAA+B;EAClD,QAAQ,eAAe;GACrB,IAAI,KAAK,YAAY,WAAW;IAC9B,KAAK,UAAU;IACf,IAAI,KAAK,mBAAmB,KAAA,GAAW,KAAK,eAAe,KAAK,OAAO;IACvE,IAAI,cAAc,qBAAqB,KAAK,gBAAgB,KAAA,GAAW,KAAK,YAAY;GAC1F;EACF,CAAC;CACH;;;;;;;;CASA,MAAc,yCAAwD;EACpE,IAAI,KAAK,YAAY,QAAQ,KAAK,mBAAmB;EACrD,KAAK,oBAAoB;EACzB,IAAI;GACF,MAAM,KAAK,eAAe;EAC5B,SAAS,GAAG;GACV,IAAIC,eAAAA,kBAAkB,CAAC,GAAG,KAAK,aAAa,iBAAiB;EAC/D,UAAU;GACR,KAAK,oBAAoB;EAC3B;CACF;CAEA,IAAW,SAA6B;EACtC,OAAO,KAAK;CACd;CAEA,wBAAyC;CAEzC,iCAA+C;EAC7C,IACE,KAAK,qBAAqB,KAAA,KAC1B,KAAK,IAAI,IAAI,KAAK,oBAClB,KAAK,yBACL,KAAK,YAAY,mBAEjB;EAGF,KAAK,wBAAwB;EAC7B,CAAM,YAAY;GAChB,IAAI;IACF,MAAM,MAAM,OAAO,KAAK,KAAK,cAAc;IAC3C,MAAM,QAAQ,KAAK,cAAc,SAAS,IACtC,MAAM,KAAK,aAAa,EAAE,YAAY,IAAI,CAAC,IAC3C,MAAM,KAAK,YAAY,GAAG;IAC9B,KAAK,kBAAkB,EAAE,UAAU,MAAM;IACzC,KAAK,mBAAmBZ,aAAAA,qBACtB,KAAK,iBACL,KAAK,KAAK,qBACZ;IACA,IAAI,KAAK,cAAc,KAAK,aAAa,KAAK,eAAe;GAC/D,SAAS,GAAY;IACnB,IAAI,KAAK,sBAAsB,KAAK,qBAAqB,CAAC;GAC5D,UAAU;IACR,KAAK,wBAAwB;GAC/B;EACF,EAAA,CAAG;CACL;;;;;;CAOA,4BAAgD;EAC9C,OAAO,EACL,YAAY,OAAO,EAAE,SAAS,UAAU,UAAU,SAAS,eAAe;GACxE,MAAM,EAAE,MAAM,GAAG,eAAe;GAEhC,IAAI;IAAC;IAAK;IAAK;GAAG,CAAC,CAAC,SAAS,SAAS,MAAM,GAAG;IAE7C,KAAK,aAAa,cAAc;IAChC,OAAO,IAAI,SAAS,MAAM;KAAE,GAAG;KAAY,QAAQ,SAAS;IAAO,CAAC;GACtE;GAEA,MAAM,UAAU,MAAMa,cAAAA,mBAAmB,QAAQ;GACjD,IAAI,CAAC,QAAQ,OAEX,OAAO,IAAI,SAAS,QAAQ,YAAY,MAAM;IAAE,GAAG;IAAY,QAAQ,SAAS;GAAO,CAAC;GAG1F,IAAI,OAAO,QAAQ,UAAU,UAE3B,OAAO,IAAI,SAAS,QAAQ,OAAO;IAAE,GAAG;IAAY,QAAQ,SAAS;GAAO,CAAC;GAG/E,IAAI,QAAQ,MAAM,SAAA,IAChB,KAAU,uCAAuC;GAInD,OAAO,IAAI,SAAS,QAAQ,UAAU;IAAE,GAAG;IAAY,QAAQ,SAAS;GAAO,CAAC;EAClF,EACF;CACF;;CAGA,6BAAkD;EAChD,QAAQ,SAAS,aAAa;GAC5B,OAAO,IAAIC,cAAAA,iBAAiB,SAAS,OAAO,GAAG,EAC7C,QAAQ,UAAU,UAAU,SAAS;IACnC,KAAK,UAAU,EACb,kBAAkB,QAAQ,SAAS;KACjC,IAAI,OAAO,QAAQC,cAAAA,OAAW,iBAE5B,KAAU,uCAAuC;KACnD,IAAI,OAAO,QAAQA,cAAAA,OAAW,aAE5B,KAAK,aAAa,cAAc;KAClC,KAAK,MAAM;IACb,EACF,CAAC;GACH,EACF,CAAC;EACH;CACF;CAEA,4BAA6E;EAC3E,QAAQ,aAAa;GACnB,QAAQ,SAAS,YAAY;IAC3B,IAAI,KAAK,iBAAiB,aAAa,KAAA,GAAW;KAEhD,QAAQ,UAAU;MAChB,GAAG,QAAQ;MACX,eAAe,YAAY,KAAK,gBAAgB;KAClD;KACA,KAAK,+BAA+B;IACtC;IAEA,OAAO,SAAS,SAAS,OAAO;GAClC;EACF;CACF;;CAGA,4BAAiD;EAC/C,QAAQ,SAAS,aAAa;GAC5B,OAAO,IAAID,cAAAA,iBAAiB,SAAS,OAAO,GAAG,EAC7C,QAAQ,UAAU,UAAU,SAAS;IACnC,IAAI,KAAK,iBAAiB,aAAa,KAAA,GAAW;KAChD,SAAS,IAAI,iBAAiB,YAAY,KAAK,gBAAgB,QAAQ;KACvE,KAAK,+BAA+B;KACpC,KAAK,UAAU,QAAQ;IACzB,OACE,KAAK,UAAU,QAAQ;GAE3B,EACF,CAAC;EACH;CACF;CAEA,MAAa,YACX,YACA,SACiB;EACjB,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,MAAM,OAAO,SAAS,QAAA;EAEtB,IAAI,cAAcZ,mBAAAA,gBAAiB;GACjC,MAAM,OAA+B,CAAC;GACtC,IAAI,SAAS,eAAe,KAAK,gBAAgB,QAAQ;GACzD,QACE,MAAM,GAAG,YACP;IACE,YAAY;KAAE,SAAS;KAAY,OAAO;IAAE;IAC5C,eAAe;GACjB,GACA;IAAE;IAAM,SAASc,eAAAA;GAAsB,CACzC,CAAC,CAAC,SAAA,CACF;EACJ,OAAO;GACL,MAAM,UAAkC,CAAC;GACzC,IAAI,SAAS,eAAe,QAAQ,gBAAgB,QAAQ;GAK5D,QAAA,GAAA,2BAAA,SAAA,EAAiB,MAJJ,GAAG,KAAK,sBAAsB;IACzC,MAAM;KAAE,YAAY,GAAG,WAAW;KAAI,eAAe;IAAK;IAC1D;GACF,CAC0B,EAAA,CAAG,MAAM,4CAA4C,CAAC,CAAC;EACnF;CACF;;CAGA,MAAa,WACX,MACA,UACA,OAAqD,CAAC,GACrC;EACjB,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,MAAM,MAAM,KAAK,cAAc,OAAO,KAAK,KAAK,cAAc;EAC9D,MAAM,OAAO,KAAK,QAAA;EAElB,IAAI,cAAcd,mBAAAA,gBAChB,QACE,MAAM,GAAG,MACP;GACE,aAAa;IACX,WAAW;IACX,OAAO;KAAE,OAAO;KAAM;IAAS;GACjC;GACA,YAAY;IAAE,SAAS;IAAK,OAAO;GAAE;GACrC,eAAe;EACjB,GACA,EAAE,SAASc,eAAAA,sBAAsB,CACnC,CAAC,CAAC,SAAA,CACF;OAWF,QAAA,GAAA,2BAAA,SAAA,EAAiB,MATJ,GAAG,KAAK,kBAAkB,EAGrC,MAAM;GACJ,OAAO;IAAE,OAAO;IAAM;GAAS;GAC/B,YAAY,GAAG,IAAI;GACnB,eAAe;EACjB,EACF,CAC0B,EAAA,CAAG,MAAM,wCAAwC,CAAC,CAAC;CAEjF;;;CAIA,MAAa,eACX,OACA,OAAqD,CAAC,GACrC;EACjB,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,MAAM,MAAM,KAAK,cAAc,OAAO,KAAK,KAAK,cAAc;EAC9D,MAAM,OAAO,KAAK,QAAA;EAClB,MAAM,QAAQ,OAAO,UAAU,WAAW,OAAO,KAAK,OAAO,MAAM,IAAI;EAEvE,IAAI,cAAcd,mBAAAA,gBAChB,QACE,MAAM,GAAG,MACP;GACE,aAAa;IACX,WAAW;IACX,OAAO,EAAE,OAAO,MAAM;GACxB;GACA,YAAY;IAAE,SAAS;IAAK,OAAO;GAAE;GACrC,eAAe;EACjB,GACA,EAAE,SAASc,eAAAA,sBAAsB,CACnC,CAAC,CAAC,SAAA,CACF;OAWF,QAAA,GAAA,2BAAA,SAAA,EAAiB,MATJ,GAAG,KAAK,kBAAkB,EAGrC,MAAM;GACJ,OAAO,EAAE,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ,EAAE;GACtD,YAAY,GAAG,IAAI;GACnB,eAAe;EACjB,EACF,CAC0B,EAAA,CAAG,MAAM,wCAAwC,CAAC,CAAC;CAEjF;;;CAIA,MAAa,SAAS,eAA4C;EAChE,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI,cAAcd,mBAAAA,gBAChB,QACE,MAAM,GAAG,MACP,EACE,aAAa;GACX,WAAW;GACX,KAAK,EAAE,cAAc;EACvB,EACF,GACA,EAAE,SAASc,eAAAA,sBAAsB,CACnC,CAAC,CAAC,SAAA,CACF;OAOF,QAAA,GAAA,2BAAA,SAAA,EAAiB,MALJ,GAAG,KAAK,kBAAkB,EACrC,MAAM,EACJ,KAAK,EAAE,eAAe,OAAO,KAAK,aAAa,CAAC,CAAC,SAAS,QAAQ,EAAE,EACtE,EACF,CAC0B,EAAA,CAAG,MAAM,4CAA4C,CAAC,CAAC;CAErF;;;;CAKA,MAAa,gBAAoF;EAC/F,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI,cAAcd,mBAAAA,gBAAiB;GACjC,MAAM,QAAQ,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,SAAA,CAAU;GACnD,IAAI,KAAK,cAAc,cACrB,MAAM,IAAI,MAAM,mCAAmC,KAAK,WAAW;GAErE,MAAM,OAAA,GAAA,2BAAA,SAAA,CAAe,KAAK,WAAW,WAAW,kCAAkC;GAClF,OAAO;IACL,OAAO,KAAK,WAAW;IACvB,WAAWe,kBAAAA,UAAU,OAAO,GAAG;IAC/B,cAAc,KAAK,WAAW;GAChC;EACF,OAAO;GAKL,MAAM,QAAA,GAAA,2BAAA,SAAA,EAAA,GAAA,2BAAA,SAAA,EAHH,MAAM,GAAG,KAAK,4BAA4B,EAAE,MAAM,CAAC,EAAE,CAAC,EAAA,CAAG,MAC1D,gDAE6B,CAAC,CAAC,YAAY,2CAA2C;GACxF,OAAO;IACL,OAAO,KAAK;IACZ,WAAW,IAAI,KAAK,KAAK,SAAS;IAClC,cAAc,KAAK;GACrB;EACF;CACF;;CAGA,MAAa,aAAa,OAAgC,CAAC,GAAoB;EAC7E,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,MAAM,MAAM,KAAK,cAAc,OAAO,KAAK,KAAK,cAAc;EAC9D,MAAM,gBAAA,GAAA,2BAAA,SAAA,CACJ,KAAK,iBAAiB,UACtB,2CACF;EAEA,IAAI,cAAcf,mBAAAA,gBAChB,QACE,MAAM,GAAG,aACP;GACE,OAAO;GACP,YAAY;IAAE,SAAS;IAAK,OAAO;GAAE;EACvC,GACA,EAAE,SAASc,eAAAA,sBAAsB,CACnC,CAAC,CAAC,SAAA,CACF;OAKF,QAAA,GAAA,2BAAA,SAAA,EAAiB,MAHJ,GAAG,KAAK,oBAAoB,EACvC,MAAM;GAAE,OAAO;GAAc,YAAY,GAAG,IAAI;EAAG,EACrD,CAC0B,EAAA,CAAG,MAAM,0CAA0C,CAAC,CAAC;CAEnF;CAEA,MAAa,OAAwD;EACnE,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI;EAEJ,MAAM,YAAY,YAAY,IAAI;EAClC,IAAI,cAAcd,mBAAAA,gBAChB,QAAQ,MAAM,GAAG,KAAK,CAAC,CAAC,EAAA,CAAG;OACtB;GAGL,MAAM,YAAA,GAAA,2BAAA,SAAA,EACH,MAAM,GAAG,IAAI,UAAU,EAAA,CAAG,MAC3B,uCACF;GACA,OAAO;IACL,GAAI;IACJ,cAAe,SAAiB,gBAAgB,CAAC;GACnD;EACF;EACA,KAAK,UAAU,YAAY,IAAI,IAAI,SAAS;EAC5C,KAAK,cAAc;EACnB,OAAO;CACT;;CAGA,IAAW,aAAqD;EAC9D,IAAI,CAAC,KAAK,aACR,MAAM,IAAI,MAAM,yDAAyD;EAE3E,OAAO,KAAK;CACd;;CAGA,cAAqB,YAAwC;EAC3D,OAAOgB,qBAAAA,cAAc,KAAK,WAAW,cAAc,UAAU;CAC/D;;;;CAKA,IAAW,6BAAsC;EAC/C,OAAO,iBAAiB,KAAK,WAAW,aAAa;GAAC;GAAG;GAAG;EAAC,CAAC;CAChE;;;;;;;;;CAUA,IAAW,+BAAwC;EACjD,OAAO,eAAe,KAAK,WAAW,aAAa;GAAC;GAAG;GAAG;EAAC,CAAC;CAC9D;;;;;;CAOA,MAAc,4BAA4B;EACxC,IAAI,KAAK,KAAK,cACZ;EAUF,MAAM,oBAAoB;EAC1B,MAAM,mBAAmB;EACzB,MAAM,eAA6B;GACjC,MAAM;GACN,aAAa;GACb,cAAc;GACd,mBAAmB;GACnB,QAAQ;GACR,UAAU;EACZ;EAEA,IAAI,UAAU;EACd,IAAI,gBAAgB;EACpB,OAAA,GAAA,2BAAA,MAAA,QAAA,GAAA,2BAAA,YAAA,CACoB,KAAK,KAAK,GAAG,aAAa,GAC5C,eACC,MAAe;GACd,IAAIC,eAAAA,eAAe,CAAC,GAAG;IACrB,KAAK,IAAI,QAAQ,KACf,+CAA+C,cAAc,cAAc,QAAQ,SAAS,KAAK,YACnG;IAEA,IAAI,UAAU,MAAM,GAElB,gBAAgB,KAAK,IACnB,KAAK,MAAM,gBAAgB,iBAAiB,GAC5C,gBACF;GAEJ,OACE,KAAK,IAAI,QAAQ,KACf,+CAA+C,QAAQ,SAAS,KAAK,WAAW,QAAQ,OAAO,CAAC,GAClG;GAGF;GACA,MAAM,WAAW,KAAK,eAAe,SAAS,SAAS;GACvD,KAAK,IAAI,QAAQ,KACf,yDAAyD,SAAS,iBAAiB,cAAc,GACnG;GACA,KAAK,mBAAmB,QAAQ;GAChC,OAAO;EACT,CACF;CACF;CAEA,MAAa,UAA8D;EACzE,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI,cAAcjB,mBAAAA,gBAChB,QAAQ,MAAM,GAAG,QAAQ,CAAC,CAAC,EAAA,CAAG;OACzB;GACL,MAAM,QAAA,GAAA,2BAAA,SAAA,EACH,MAAM,GAAG,IAAI,aAAa,EAAA,CAAG,MAC9B,0CACF;GACA,OAAO;IACL,QAAQ,KAAK;IACb,MAAM,KAAK;IACX,cAAc,WAAW,KAAK,OAAO,KAAK,KAAK,YAAY,CAAC;GAC9D;EACF;CACF;CAEA,MAAa,cAA+D;EAC1E,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI;EACJ,IAAI,cAAcA,mBAAAA,gBAChB,QAAQ,MAAM,GAAG,YAAY,CAAC,CAAC,EAAA,CAAG;OAQlC,OAAO,EACL,WAAA,GAAA,2BAAA,SAAA,EANC,MAAM,GAAG,IAAI,kBAAkB,EAAA,CAAG,MACnC,+CAKmB,CAAC,CAAC,WAAW,CAAC,EAAA,CAAG,KAAK,MAAgD;GACvF,MAAM,OAAO;IAAE,IAAI,EAAE;IAAI,aAAa,EAAE;GAAY;GACpD,IAAI,EAAE,UAAU,KAAA,GACd,OAAO;IAAE,GAAG;IAAM,QAAQ;KAAE,WAAW;KAAS,OAAO,EAAE;IAAM;GAAE;GAEnE,IAAI,EAAE,UAAU,KAAA,GACd,OAAO;IAAE,GAAG;IAAM,QAAQ;KAAE,WAAW;KAAS,OAAO,EAAE;IAAM;GAAE;GAEnE,IAAI,EAAE,QAAQ,KAAA,GACZ,OAAO;IAAE,GAAG;IAAM,QAAQ;KAAE,WAAW;KAAO,KAAK,EAAE;IAAI;GAAE;GAE7D,OAAO;IAAE,GAAG;IAAM,QAAQ,EAAE,WAAW,KAAA,EAAU;GAAE;EACrD,CAAC,EACH;EAGF,KAAK,mBAAmB;EACxB,OAAO;CACT;CAEA,IAAW,kBAA0D;EACnE,IAAI,CAAC,KAAK,kBACR,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO,KAAK;CACd;CAEA,MAAa,YACX,OAAwD,CAAC,GACR;EAGjD,OAAO,MAAM,KAAK,oBAAoB,qBAAqB,KAAK,gBAAgB,IAAI,CAAC;CACvF;CAEA,MAAc,gBACZ,OAAwD,CAAC,GACR;EACjD,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI,cAAcA,mBAAAA,gBAChB,QACE,MAAM,GAAG,YAAY;GACnB,OAAO,KAAK,SAAS;GACrB,mBAAmB,KAAK,qBAAqB;EAC/C,CAAC,EAAA,CACD;OACG;GACL,MAAM,QAAA,GAAA,2BAAA,SAAA,EAEF,MAAM,GAAG,KAAK,sBAAsB,EAClC,MAAM;IACJ,OAAO,KAAK,SAAS;IACrB,mBAAmB,KAAK,qBAAqB;GAC/C,EACF,CAAC,EAAA,CACD,MACF,8CACF;GACA,OAAO,EACL,UAAU,KAAK,WACX;IACE,YAAY,OAAO,KAAK,SAAS,UAAU;IAC3C,mBAAmB,WAAW,KAC5B,OAAO,KAAK,KAAK,SAAS,mBAAmB,QAAQ,CACvD;GACF,IACA,KAAA,EACN;EACF;CACF;CAEA,MAAa,kBACX,OAA+D,CAAC,GACP;EACzD,MAAM,KAAK,KAAK,eAAe,IAAI;EAEnC,IAAI,EAAE,cAAcA,mBAAAA,iBAClB,MAAM,IAAI,MAAM,sEAAsE;EAGxF,MAAM,OAAO,GAAG,kBAAkB;GAChC,OAAO,KAAK,SAAS;GACrB,WAAW,KAAK,aAAa;GAC7B,OAAO,KAAK,SAAS;EACvB,CAAC;EACD,MAAM,YAA4D,CAAC;EACnE,WAAW,MAAM,OAAO,KAAK,WAC3B,UAAU,KAAK,GAAG;EAEpB,OAAO;CACT;;;CAIA,MAAa,iBAAqE;EAChF,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI,cAAcA,mBAAAA,gBAChB,QAAQ,MAAM,GAAG,eAAe,CAAC,CAAC,EAAA,CAAG;OAChC;GACL,MAAM,QAAA,GAAA,2BAAA,SAAA,EACH,MAAM,GAAG,KAAK,yBAAyB,EAAE,MAAM,CAAC,EAAE,CAAC,EAAA,CAAG,MACvD,iDACF;GACA,OAAO;IACL,WAAW,WAAW,KAAK,OAAO,KAAK,KAAK,WAAW,QAAQ,CAAC;IAChE,MAAM,KAAK;GACb;EACF;CACF;;;;CAKA,MAAa,YAA+C;EAC1D,MAAM,KAAK,KAAK,eAAe,IAAI;EAEnC,IAAI,EAAE,cAAcA,mBAAAA,iBAClB,MAAM,IAAI,MAAM,8DAA8D;EAGhF,QAAQ,MAAM,GAAG,UAAU,CAAC,CAAC,EAAA,CAAG,SAAS;CAC3C;CAEA,MAAa,OAAO,MAA6B;EAC/C,MAAM,KAAK,KAAK,eAAe,IAAI;EACnC,IAAI,cAAcA,mBAAAA,gBAChB,MAAM,GAAG,OAAO,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;OAEtC,MAAM,GAAG,KAAK,eAAe,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,EAAE,CAAC;CAEpE;CAEA,SAAS,IAAa,MAAiB,CAAC,GAAoB;EAC1D,OAAO,IAAIkB,uBAAAA,iBAAiB,gBAAgB;GAC1C,IAAI,mBAAmB;GACvB,IAAI,IAAI,aAAa,mBAAmB,YAAY,IAAI,CAAC,kBAAkB,IAAI,WAAW,CAAC;GAE3F,MAAM,UACJ,IAAI,YACH,KAAK,KAAK,KAAK,8BAA8B,KAAK,KAAK;GAE1D,MAAM,KAAK,KAAK,eAAe,IAAI;GACnC,IAAI,cAAclB,mBAAAA,gBAChB,OAAO,GAAG,GAAG;IACX,OAAO;IACP;GACF,CAAC;GAGH,MAAM,WAAW,KAAK;GACtB,IAAI,SAAS,SAAS,QAAQ;IAE5B,IAAI,YAAY,KAAA,GACd,mBAAmB,YAAY,IAAI,CAAC,kBAAkB,YAAY,QAAQ,OAAO,CAAC,CAAC;IAIrF,KAAK,+BAA+B;IAMpC,OAAO,IAAImB,yBAAAA,oBAJG,KAAK,KAAK,MACpB,SAAS,KAAK,KAAK,YAAY,aAC/B,QAAQ,KAAK,KAAK,YAAY,aAI/B,QAAQC,YAAAA,oBAAoB,SAAS,GAAG,IACxC,SAASC,YAAAA,oBAAoB,WAAW,IAAI,WAAW,IAAI,CAAC,GAC7D;KACE,aAAa;KACb,UAAU,KAAK,iBAAiB;KAChC,YAAY,SAAS;KAErB,YAAY,OAAO,WACjB,OAAO,SAAS,KAAK;MAEnB,WAAW;MACX,SAAS;OAAE,WAAW;OAAe,aAAa,CAAC;MAAE;KACvD,CAAC;IACL,CACF;GACF;GAEA,MAAM,IAAI,MAAM,oDAAoD,KAAK,YAAY;EACvF,CAAC;CACH;;CAGA,MAAa,QAAQ;EACnB,IAAI,KAAK,eAAe,SAAS,QAC/B,KAAK,eAAe,UAAU,MAAM;EAItC,MAAM,KAAK,eAAe,QAAQ;CACpC;AACF"}

package/dist/core/ll_client.d.ts

@@ -35,6 +35,13 @@ declare class LLPlClient implements WireClientProviderFactory {
   private readonly statusListener?;
   private _wireProto;
   private _wireConn;
+  /** The live GrpcOptions object handed to GrpcTransport. The transport keeps it by
+   * reference and re-reads it on every call, so mutating `timeout` here retunes
+   * subsequent deadlines without tearing down the connection. */
+  private _grpcOptions?;
+  /** Smoothed round-trip estimate in ms, from ping timings. Undefined until the first
+   * successful ping, in which case the configured deadline is used as-is. */
+  private _rttMs?;
   private readonly _restInterceptors;
   private readonly _restMiddlewares;
   private readonly _grpcInterceptors;
@@ -56,6 +63,18 @@ declare class LLPlClient implements WireClientProviderFactory {
    * @param gzip - whether to enable gzip compression
    */
   private initGrpcConnection;
+  /** Unary deadline derived from the observed RTT, floored by the configured value so
+   * a fast link behaves exactly as before, and capped by
+   * {@link MAX_ADAPTIVE_REQUEST_TIMEOUT}. */
+  private unaryDeadline;
+  /** Folds a fresh round-trip sample into the estimate and retunes the live unary
+   * deadline. Called after every successful ping. */
+  private recordRtt;
+  /** Smoothed round-trip estimate in ms, or undefined before the first ping. */
+  get rttEstimateMs(): number | undefined;
+  /** Runs an idempotent unary call with a bounded retry on transient transport failures.
+   * Safe only for calls with no side effects, since a retry may duplicate the request. */
+  private withIdempotentRetry;
   private _replaceWireConnection;
   private providerCleanupCounter;
   /**
@@ -156,6 +175,7 @@ declare class LLPlClient implements WireClientProviderFactory {
     login?: string;
     createIfNotExists?: boolean;
   }): Promise<AuthAPI_GetUserRoot_Response>;
+  private getUserRootOnce;
   listUserResources(opts?: {
     login?: string;
     startFrom?: bigint;

package/dist/core/ll_client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ll_client.d.ts","names":[],"sources":["../../src/core/ll_client.ts"],"mappings":";;;;;;;;;;;UA+CiB,SAAA;EACf,OAAA;EACA,WAAA,GAAc,WAAW;AAAA;;cA0Dd,UAAA,YAAsB,yBAAA;EAAA,SAmEf,IAAA,EAAM,cAAA;EAAA,iBACL,GAAA;EA9HM;EAAA,QA4DjB,eAAA;EAFc;EAAA,iBAIL,YAAA;EA+DO;EAAA,iBA7DP,WAAA;EAsBqD;EAAA,iBApBrD,oBAAA;EAsBe;EAAA,QApBxB,gBAAA;EAyBG;EAAA,QAtBH,WAAA;EAAA,QACA,gBAAA;EAAA,QAEA,OAAA;EAAA,QACA,iBAAA;EAAA,iBACS,cAAA;EAAA,QAET,UAAA;EAAA,QACA,SAAA;EAAA,iBAES,iBAAA;EAAA,iBACA,gBAAA;EAAA,iBACA,iBAAA;EAAA,iBACA,SAAA;EAAA,SAED,cAAA,EAAgB,kBAAA,CAAmB,gBAAA,GAAmB,cAAA;EAAA,SAEtD,cAAA,EAAgB,UAAA;EAAA,OAEZ,KAAA,CAClB,eAAA,EAAiB,cAAA,WACjB,GAAA;IACE,IAAA,GAAO,OAAA;IACP,cAAA,GAAiB,0BAAA;IACjB,aAAA;IACA,MAAA,GAAS,QAAA;IACT,yBAAA;EAAA,IACI,OAAA,CAAA,UAAA;EAAA,QA0BD,WAAA;EAAA,QA4DC,kBAAA;EAAA,QAiBA,kBAAA;EA4dqB;;;;EAAA,QA9crB,kBAAA;EAAA,QAkDA,sBAAA;EAAA,QAoBA,sBAAA;EA6gBoB;;;;;EAtgBrB,wBAAA,SACL,iBAAA,GAAoB,SAAA,EAAW,cAAA,KAAmB,MAAA,GACjD,kBAAA,CAAmB,MAAA;EAAA,IAqBX,cAAA,IAAkB,cAAA;EAAA,IAIlB,YAAA,IAAgB,YAAA;EAimBO;;;EAAA,IA1lBvB,aAAA;EA6mBiC;EAAA,IAxmBjC,QAAA;EAAA,QAUH,YAAA;EA3RkD;;;;;;;EAAA,QA4S5C,sCAAA;EAAA,IAYH,MAAA,IAAU,kBAAA;EAAA,QAIb,qBAAA;EAAA,QAEA,8BAAA;EAjTA;;;;;EAAA,QAqVA,yBAAA;EA7UA;EAAA,QA8WA,0BAAA;EAAA,QAoBA,yBAAA;EA9XS;EAAA,QAgZT,yBAAA;EAgBK,WAAA,CACX,UAAA,UACA,OAAA;IAAY,aAAA;IAAwB,IAAA,GAAO,YAAA;EAAA,IAC1C,OAAA;EA9Za;EA0bH,UAAA,CACX,IAAA,UACA,QAAA,UACA,IAAA;IAAQ,UAAA;IAAqB,IAAA,GAAO,YAAA;EAAA,IACnC,OAAA;EAzbC;;EAydS,cAAA,CACX,KAAA,EAAO,UAAA,WACP,IAAA;IAAQ,UAAA;IAAqB,IAAA,GAAO,YAAA;EAAA,IACnC,OAAA;EAzdU;;EA0fA,QAAA,CAAS,aAAA,EAAe,UAAA,GAAa,OAAA;EAxf1C;;;EAghBK,aAAA,IAAiB,OAAA;IAAU,KAAA;IAAe,SAAA,EAAW,IAAA;IAAM,YAAA;EAAA;EA9UjE;EA0WM,YAAA,CAAa,IAAA;IAAQ,UAAA;EAAA,IAA6B,OAAA;EAuBlD,IAAA,IAAQ,OAAA,CAAQ,4BAAA;EAhY3B;EAAA,IAsZS,UAAA,IAAc,4BAAA;EArZH;EA6Zf,aAAA,CAAc,UAAA,EAAY,iBAAA;EAxYJ;;;EAAA,IA+YlB,0BAAA;EA/XA;;;;;;;;EAAA,IA2YA,4BAAA;EArQH;;;;;EAAA,QA8QM,yBAAA;EA0DD,OAAA,IAAW,OAAA,CAAQ,+BAAA;EAiBnB,WAAA,IAAe,OAAA,CAAQ,4BAAA;EAAA,IAiCzB,eAAA,IAAmB,4BAAA;EAOjB,WAAA,CACX,IAAA;IAAQ,KAAA;IAAgB,iBAAA;EAAA,IACvB,OAAA,CAAQ,4BAAA;EAkCE,iBAAA,CACX,IAAA;IAAQ,KAAA;IAAgB,SAAA;IAAoB,KAAA;EAAA,IAC3C,OAAA,CAAQ,kCAAA;EAjUF;;EAsVI,cAAA,IAAkB,OAAA,CAAQ,+BAAA;EArVR;;;EAwWlB,SAAA,IAAa,OAAA,CAAQ,YAAA;EAUrB,MAAA,CAAO,IAAA,WAAe,OAAA;EASnC,QAAA,CAAS,EAAA,WAAa,GAAA,GAAK,SAAA,GAAiB,eAAA;EAzVtB;EAgZT,KAAA,IAAK,OAAA;AAAA"}
+{"version":3,"file":"ll_client.d.ts","names":[],"sources":["../../src/core/ll_client.ts"],"mappings":";;;;;;;;;;;UAsDiB,SAAA;EACf,OAAA;EACA,WAAA,GAAc,WAAW;AAAA;;cAqEd,UAAA,YAAsB,yBAAA;EAAA,SA+Ef,IAAA,EAAM,cAAA;EAAA,iBACL,GAAA;EArJM;EAAA,QAuEjB,eAAA;EAFc;EAAA,iBAIL,YAAA;EA2EO;EAAA,iBAzEP,WAAA;EA+BqD;EAAA,iBA7BrD,oBAAA;EA+Be;EAAA,QA7BxB,gBAAA;EAkCG;EAAA,QA/BH,WAAA;EAAA,QACA,gBAAA;EAAA,QAEA,OAAA;EAAA,QACA,iBAAA;EAAA,iBACS,cAAA;EAAA,QAET,UAAA;EAAA,QACA,SAAA;EA0QL;;;EAAA,QArQK,YAAA;EAodqC;;EAAA,QAhdrC,MAAA;EAAA,iBAES,iBAAA;EAAA,iBACA,gBAAA;EAAA,iBACA,iBAAA;EAAA,iBACA,SAAA;EAAA,SAED,cAAA,EAAgB,kBAAA,CAAmB,gBAAA,GAAmB,cAAA;EAAA,SAEtD,cAAA,EAAgB,UAAA;EAAA,OAEZ,KAAA,CAClB,eAAA,EAAiB,cAAA,WACjB,GAAA;IACE,IAAA,GAAO,OAAA;IACP,cAAA,GAAiB,0BAAA;IACjB,aAAA;IACA,MAAA,GAAS,QAAA;IACT,yBAAA;EAAA,IACI,OAAA,CAAA,UAAA;EAAA,QA6BD,WAAA;EAAA,QA4DC,kBAAA;EAAA,QAiBA,kBAAA;EAupBoB;;;;EAAA,QAzoBpB,kBAAA;EA+tBL;;;EAAA,QAzqBK,aAAA;EAitBkB;;EAAA,QA3sBlB,SAAA;EA8tBoC;EAAA,IA/sBjC,aAAA;EApPsB;;EAAA,QA0PnB,mBAAA;EAAA,QAQN,sBAAA;EAAA,QAoBA,sBAAA;EAvMgB;;;;;EA8MjB,wBAAA,SACL,iBAAA,GAAoB,SAAA,EAAW,cAAA,KAAmB,MAAA,GACjD,kBAAA,CAAmB,MAAA;EAAA,IAqBX,cAAA,IAAkB,cAAA;EAAA,IAIlB,YAAA,IAAgB,YAAA;EA1SnB;;;EAAA,IAiTG,aAAA;EA3SH;EAAA,IAgTG,QAAA;EAAA,QAUH,YAAA;EAhTA;;;;;;;EAAA,QAiUM,sCAAA;EAAA,IAYH,MAAA,IAAU,kBAAA;EAAA,QAIb,qBAAA;EAAA,QAEA,8BAAA;EAxUY;;;;;EAAA,QA4WZ,yBAAA;EAxWa;EAAA,QAyYb,0BAAA;EAAA,QAoBA,yBAAA;EA3ZK;EAAA,QA6aL,yBAAA;EAgBK,WAAA,CACX,UAAA,UACA,OAAA;IAAY,aAAA;IAAwB,IAAA,GAAO,YAAA;EAAA,IAC1C,OAAA;EArWK;EAiYK,UAAA,CACX,IAAA,UACA,QAAA,UACA,IAAA;IAAQ,UAAA;IAAqB,IAAA,GAAO,YAAA;EAAA,IACnC,OAAA;EA3RQ;;EA8TE,cAAA,CACX,KAAA,EAAO,UAAA,WACP,IAAA;IAAQ,UAAA;IAAqB,IAAA,GAAO,YAAA;EAAA,IACnC,OAAA;EAvR8B;;EA2TpB,QAAA,CAAS,aAAA,EAAe,UAAA,GAAa,OAAA;EA3ThD;;;EAsVW,aAAA,IAAiB,OAAA;IAAU,KAAA;IAAe,SAAA,EAAW,IAAA;IAAM,YAAA;EAAA;EAhT7D;EA4UE,YAAA,CAAa,IAAA;IAAQ,UAAA;EAAA,IAA6B,OAAA;EA0BlD,IAAA,IAAQ,OAAA,CAAQ,4BAAA;EA3TrB;EAAA,IAoVG,UAAA,IAAc,4BAAA;EA9SjB;EAsTD,aAAA,CAAc,UAAA,EAAY,iBAAA;EAjQzB;;;EAAA,IAwQG,0BAAA;EApOG;;;;;;;;EAAA,IAgPH,4BAAA;EAhNoB;;;;;EAAA,QAyNjB,yBAAA;EA0DD,OAAA,IAAW,OAAA,CAAQ,+BAAA;EAiBnB,WAAA,IAAe,OAAA,CAAQ,4BAAA;EAAA,IAiCzB,eAAA,IAAmB,4BAAA;EAOjB,WAAA,CACX,IAAA;IAAQ,KAAA;IAAgB,iBAAA;EAAA,IACvB,OAAA,CAAQ,4BAAA;EAAA,QAMG,eAAA;EAoCD,iBAAA,CACX,IAAA;IAAQ,KAAA;IAAgB,SAAA;IAAoB,KAAA;EAAA,IAC3C,OAAA,CAAQ,kCAAA;EApR4C;;EAyS1C,cAAA,IAAkB,OAAA,CAAQ,+BAAA;EA7Q1B;;;EAgSA,SAAA,IAAa,OAAA,CAAQ,YAAA;EAUrB,MAAA,CAAO,IAAA,WAAe,OAAA;EASnC,QAAA,CAAS,EAAA,WAAa,GAAA,GAAK,SAAA,GAAiB,eAAA;EAzRf;EAgVhB,KAAA,IAAK,OAAA;AAAA"}

package/dist/core/ll_client.js

@@ -1,8 +1,8 @@
 import { setResourceSignaturesRequired } from "./types.js";
 import { Timestamp } from "../proto-grpc/google/protobuf/timestamp.js";
 import { TxAPI_ClientMessage, TxAPI_ServerMessage } from "../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api.js";
-import { isAbortedError, isUnauthenticated } from "./errors.js";
-import { SUPPORTED_WIRE_PROTOCOLS, plAddressToConfig } from "./config.js";
+import { isAbortedError, isTransientCallFailure, isUnauthenticated } from "./errors.js";
+import { DEFAULT_LOGIN_TIMEOUT, SUPPORTED_WIRE_PROTOCOLS, deriveUnaryDeadline, plAddressToConfig, smoothRtt } from "./config.js";
 import { PlatformClient } from "../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api.client.js";
 import { LLPlTransaction } from "./ll_transaction.js";
 import { parsePlJwt } from "../util/pl.js";
@@ -17,6 +17,16 @@ import { interceptors } from "undici";
 import { defaultHttpDispatcher } from "@milaboratories/pl-http";
 import { parseHttpAuth } from "@milaboratories/pl-model-common";
 //#region src/core/ll_client.ts
+/** Bounded retry for idempotent unary calls. Deliberately short: these calls sit on the
+* connect path and gate the UI, so a few quick attempts beat a long grind. */
+const IDEMPOTENT_RETRY_OPTIONS = {
+	type: "exponentialBackoff",
+	maxAttempts: 4,
+	initialDelay: 200,
+	backoffMultiplier: 2,
+	jitter: .3,
+	maxDelay: 2e3
+};
 function isVersionAtLeast(version, target) {
 	const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version);
 	if (!match) return false;
@@ -78,6 +88,13 @@ var LLPlClient = class LLPlClient {
 	statusListener;
 	_wireProto = "grpc";
 	_wireConn;
+	/** The live GrpcOptions object handed to GrpcTransport. The transport keeps it by
+	* reference and re-reads it on every call, so mutating `timeout` here retunes
+	* subsequent deadlines without tearing down the connection. */
+	_grpcOptions;
+	/** Smoothed round-trip estimate in ms, from ping timings. Undefined until the first
+	* successful ping, in which case the configured deadline is used as-is. */
+	_rttMs;
 	_restInterceptors;
 	_restMiddlewares;
 	_grpcInterceptors;
@@ -87,7 +104,7 @@ var LLPlClient = class LLPlClient {
 	static async build(configOrAddress, ops = {}) {
 		const pl = new LLPlClient(typeof configOrAddress === "string" ? plAddressToConfig(configOrAddress) : configOrAddress, ops);
 		if (ops.useAutoDetectWireProtocol) await pl.detectOptimalWireProtocol();
-		if (!pl._serverInfo) await pl.ping();
+		if (!pl._serverInfo) await pl.withIdempotentRetry("ping", () => pl.ping());
 		setResourceSignaturesRequired(pl.supportsResourceSignatures);
 		if (!pl._authMethodsSync) await pl.authMethods();
 		return pl;
@@ -166,7 +183,7 @@ var LLPlClient = class LLPlClient {
 		if (gzip) clientOptions["grpc.default_compression_algorithm"] = compressionAlgorithms.gzip;
 		const grpcOptions = {
 			host: this.conf.hostAndPort,
-			timeout: this.conf.defaultRequestTimeout,
+			timeout: this.unaryDeadline(),
 			channelCredentials: this.conf.ssl ? ChannelCredentials.createSsl() : ChannelCredentials.createInsecure(),
 			clientOptions
 		};
@@ -181,11 +198,43 @@ var LLPlClient = class LLPlClient {
 			}
 			process.env.grpc_proxy = url.toString();
 		} else delete process.env.grpc_proxy;
+		this._grpcOptions = grpcOptions;
 		this._replaceWireConnection({
 			type: "grpc",
 			Transport: new GrpcTransport(grpcOptions)
 		});
 	}
+	/** Unary deadline derived from the observed RTT, floored by the configured value so
+	* a fast link behaves exactly as before, and capped by
+	* {@link MAX_ADAPTIVE_REQUEST_TIMEOUT}. */
+	unaryDeadline() {
+		return deriveUnaryDeadline(this.conf.defaultRequestTimeout, this._rttMs);
+	}
+	/** Folds a fresh round-trip sample into the estimate and retunes the live unary
+	* deadline. Called after every successful ping. */
+	recordRtt(sampleMs) {
+		this._rttMs = smoothRtt(this._rttMs, sampleMs);
+		if (this._grpcOptions) {
+			const next = this.unaryDeadline();
+			if (next !== this._grpcOptions.timeout) {
+				this.ops.logger?.info(`Unary deadline retuned to ${next}ms (rtt estimate ${Math.round(this._rttMs)}ms)`);
+				this._grpcOptions.timeout = next;
+			}
+		}
+	}
+	/** Smoothed round-trip estimate in ms, or undefined before the first ping. */
+	get rttEstimateMs() {
+		return this._rttMs;
+	}
+	/** Runs an idempotent unary call with a bounded retry on transient transport failures.
+	* Safe only for calls with no side effects, since a retry may duplicate the request. */
+	async withIdempotentRetry(name, cb) {
+		return await retry(cb, IDEMPOTENT_RETRY_OPTIONS, (e) => {
+			if (!isTransientCallFailure(e)) return false;
+			this.ops.logger?.info(`${name}: transient failure, retrying. err=${String(e)}`);
+			return true;
+		});
+	}
 	_replaceWireConnection(newConn) {
 		const oldConn = this._wireConn;
 		this._wireConn = newConn;
@@ -371,7 +420,10 @@ var LLPlClient = class LLPlClient {
 					nanos: 0
 				},
 				requestedRole: role
-			}, { meta }).response).token;
+			}, {
+				meta,
+				timeout: DEFAULT_LOGIN_TIMEOUT
+			}).response).token;
 		} else {
 			const headers = {};
 			if (options?.authorization) headers.authorization = options.authorization;
@@ -402,7 +454,7 @@ var LLPlClient = class LLPlClient {
 				nanos: 0
 			},
 			requestedRole: role
-		}).response).token;
+		}, { timeout: DEFAULT_LOGIN_TIMEOUT }).response).token;
 		else return notEmpty((await cl.POST("/v1/auth/login", { body: {
 			basic: {
 				login: user,
@@ -429,7 +481,7 @@ var LLPlClient = class LLPlClient {
 				nanos: 0
 			},
 			requestedRole: role
-		}).response).token;
+		}, { timeout: DEFAULT_LOGIN_TIMEOUT }).response).token;
 		else return notEmpty((await cl.POST("/v1/auth/login", { body: {
 			token: { token: Buffer.from(bytes).toString("base64") },
 			expiration: `${ttl}s`,
@@ -443,7 +495,7 @@ var LLPlClient = class LLPlClient {
 		if (cl instanceof PlatformClient) return (await cl.login({ credentials: {
 			oneofKind: "sso",
 			sso: { tokenResponse }
-		} }).response).token;
+		} }, { timeout: DEFAULT_LOGIN_TIMEOUT }).response).token;
 		else return notEmpty((await cl.POST("/v1/auth/login", { body: { sso: { tokenResponse: Buffer.from(tokenResponse).toString("base64") } } })).data, "REST: empty response for SSO login request").token;
 	}
 	/** Request a one-time PKCE nonce + its expiry from the backend. The desktop is
@@ -480,7 +532,7 @@ var LLPlClient = class LLPlClient {
 				seconds: ttl,
 				nanos: 0
 			}
-		}).response).token;
+		}, { timeout: DEFAULT_LOGIN_TIMEOUT }).response).token;
 		else return notEmpty((await cl.POST("/v1/auth/refresh", { body: {
 			token: currentToken,
 			expiration: `${ttl}s`
@@ -489,6 +541,7 @@ var LLPlClient = class LLPlClient {
 	async ping() {
 		const cl = this.clientProvider.get();
 		let resp;
+		const startedAt = performance.now();
 		if (cl instanceof PlatformClient) resp = (await cl.ping({})).response;
 		else {
 			const pingData = notEmpty((await cl.GET("/v1/ping")).data, "REST: empty response for ping request");
@@ -497,6 +550,7 @@ var LLPlClient = class LLPlClient {
 				capabilities: pingData.capabilities ?? []
 			};
 		}
+		this.recordRtt(performance.now() - startedAt);
 		this._serverInfo = resp;
 		return resp;
 	}
@@ -620,6 +674,9 @@ var LLPlClient = class LLPlClient {
 		return this._authMethodsSync;
 	}
 	async getUserRoot(opts = {}) {
+		return await this.withIdempotentRetry("getUserRoot", () => this.getUserRootOnce(opts));
+	}
+	async getUserRootOnce(opts = {}) {
 		const cl = this.clientProvider.get();
 		if (cl instanceof PlatformClient) return (await cl.getUserRoot({
 			login: opts.login ?? "",