@motherbase/client 1.5.0 → 1.5.1

package/dist/index.js

@@ -0,0 +1,365 @@
+import { HttpClient, toError } from './http.js';
+import { contractPath } from '@motherbase/contracts';
+import { SessionStore, memoryStorage, localStorageStorage, keyValueStorage, isKeyValueStorage, SESSION_COOKIE_KEY, } from './session.js';
+import { AuthClient } from './auth.js';
+import { verifierStore } from './pkce.js';
+import { StorageClient } from './storage.js';
+import { FunctionsClient } from './functions.js';
+import { RealtimeModule } from './realtime.js';
+import { RealtimeChannel } from './channel.js';
+import { PostgrestQueryBuilder } from './postgrest.js';
+import { isProduction } from './cookie.js';
+/**
+ * Pick the session storage from either options shape.
+ *
+ * Precedence: the native `storage` (explicit and already the right shape), then
+ * supabase-js's `auth.storage` (wrapped if it is a key/value store), then
+ * `auth.persistSession` on its own, which in supabase-js means localStorage.
+ * Returns `undefined` when nothing was asked for, so the caller can tell "no
+ * choice made" from "memory was chosen" and warn accordingly.
+ */
+function resolveStorage(options) {
+    if (options.storage)
+        return options.storage;
+    const key = options.auth?.storageKey;
+    const provided = options.auth?.storage;
+    if (provided) {
+        return isKeyValueStorage(provided) ? keyValueStorage(provided, key) : provided;
+    }
+    if (options.auth?.persistSession === true)
+        return localStorageStorage(key);
+    if (options.auth?.persistSession === false)
+        return memoryStorage();
+    return undefined;
+}
+/**
+ * Supabase-js-compatible client for a Motherbase backend.
+ *
+ * Drop-in shaped: `client.from(table).select()…`, `client.auth.signInWithPassword()`,
+ * `client.storage.from(bucket)`, `client.channel(name)`, `client.functions.invoke()`.
+ *
+ * Pass the type generated by `motherbase gen types typescript` to get real
+ * inference: `createClient<Database>(url, key)` then types every row, rejects
+ * unknown columns in `.select()`, checks `.insert()` payloads against the
+ * Insert shape and types `.rpc()` from `Functions`. Without it the client
+ * behaves exactly as it did before generics existed.
+ */
+export class MotherbaseClient {
+    constructor(url, 
+    /** Accepted for supabase-js signature parity; sent as an `apikey` header when set. */
+    key, options = {}) {
+        this.url = url;
+        this.key = key;
+        this.channels = new Map();
+        this.requestObservers = new Set();
+        // `globalThis.fetch` is a native function that requires `this === window`
+        // (or an equivalent global) when invoked: copying the reference without
+        // binding it throws "Illegal invocation" the moment it's called as
+        // `this.opts.fetch(...)` inside HttpClient. Bind it once here.
+        const fetchImpl = options.fetch ?? options.global?.fetch ?? globalThis.fetch?.bind(globalThis);
+        if (!fetchImpl) {
+            throw new Error('No fetch implementation found. Pass `fetch` in options for this runtime.');
+        }
+        const autoRefresh = options.autoRefresh ?? options.auth?.autoRefreshToken ?? true;
+        const headers = { ...options.global?.headers, ...options.headers };
+        if (key)
+            headers['apikey'] = key;
+        this.compat = options.compat === 'supabase';
+        // Tables are served from `public` only. A ported app that made another
+        // schema its default would otherwise read `public` under a different name
+        // and find the wrong rows (or none), which is far harder to diagnose than
+        // the error it gets here. Functions in an exposed schema stay reachable
+        // through `client.schema(name).rpc()`.
+        const schema = options.db?.schema;
+        if (schema && schema !== 'public') {
+            throw new Error(`db.schema: '${schema}' is not exposed as the default schema. The Motherbase REST API serves tables from `
+                + `public only. Call functions in another schema with client.schema('${schema}').rpc().`);
+        }
+        // A secret key runs every request as service_role, which bypasses row level
+        // security. In a browser it is readable by anyone who opens devtools, so it
+        // is not "a key that leaked", it is the whole database published. Warn
+        // rather than throw: a legitimate caller may run in a runtime that defines
+        // `window` (a test harness, an Electron main process), and refusing to
+        // construct would break them for a heuristic.
+        if (key?.startsWith('mb_secret_') && typeof window !== 'undefined') {
+            console.warn('[motherbase] A secret API key was passed to createClient in a browser context. '
+                + 'Secret keys bypass row level security and must stay server side. '
+                + 'Use the publishable key here.');
+        }
+        const storageAdapter = resolveStorage(options);
+        // The default adapter keeps the session in memory only: it does not survive
+        // a reload, and the server never sees it. That is the right default for a
+        // script or a test, and a bug in a browser app, and it presents as
+        // "getUser() returns null everywhere", which reads like an auth problem
+        // rather than a storage one. Point at the fix once, in development.
+        if (!storageAdapter && typeof window !== 'undefined' && !MotherbaseClient.warnedAboutStorage) {
+            MotherbaseClient.warnedAboutStorage = true;
+            if (!isProduction()) {
+                console.warn('[motherbase] createClient() was called in a browser without a `storage` adapter, so the '
+                    + 'session lives in memory and is lost on reload. Pass `storage: cookieStorage()` (or '
+                    + '`localStorageStorage()`), or use `createBrowserClient` from `@motherbase/ssr`, which '
+                    + 'writes the cookie the server needs to read.');
+            }
+        }
+        this.store = new SessionStore(storageAdapter ?? memoryStorage());
+        // auth needs the http client, and http needs auth._refresh for the 401 path,
+        // so wire them in two steps with a late-bound refresh callback.
+        // prefer-const cannot see the closure above: `auth` is read by the refresh
+        // callback before this line's assignment happens, so it has to be a `let`.
+        // eslint-disable-next-line prefer-const
+        let auth;
+        this.http = new HttpClient(url, this.store, { autoRefresh, fetch: fetchImpl, headers }, () => auth._refresh());
+        const flowType = options.auth?.flowType ?? 'implicit';
+        const keyValue = options.auth?.storage && isKeyValueStorage(options.auth.storage) ? options.auth.storage : undefined;
+        auth = new AuthClient(this.http, this.store, {
+            flowType,
+            verifiers: verifierStore(options.auth?.storageKey ?? SESSION_COOKIE_KEY, keyValue),
+        });
+        this.auth = auth;
+        this.storage = new StorageClient(this.http, url, fetchImpl);
+        this.functions = new FunctionsClient(this.http);
+        this.realtime = new RealtimeModule(url, this.store, fetchImpl, options.realtimeIoFactory);
+        // supabase-js finishes an OAuth redirect on its own (detectSessionInUrl
+        // defaults to true), so ported code never calls anything after the provider
+        // sends the browser back. Do the same, and only when there is actually a
+        // token in the fragment: on every other page load this is a no-op with no
+        // network call. Opt out with `auth: { detectSessionInUrl: false }`.
+        if (options.auth?.detectSessionInUrl !== false
+            && typeof window !== 'undefined'
+            && window.location?.hash?.includes('access_token=')) {
+            void this.auth.getSessionFromUrl();
+        }
+        // The PKCE equivalent: a `?code=` on the page the provider sent us back to.
+        // Stripped from the address bar first, so a reload cannot replay it.
+        if (options.auth?.detectSessionInUrl !== false && flowType === 'pkce' && typeof window !== 'undefined') {
+            const url = new URL(window.location.href);
+            const code = url.searchParams.get('code');
+            if (code) {
+                url.searchParams.delete('code');
+                window.history?.replaceState?.(window.history.state, '', url.href);
+                void this.auth.exchangeCodeForSession(code);
+            }
+        }
+    }
+    from(table) {
+        return new PostgrestQueryBuilder(this.http, table, this.compat);
+    }
+    /**
+     * Call a database function, typed from the generated `Functions` map.
+     *
+     * The transport is `POST /rest/v1/rpc/<fn>`, which the REST layer gains in
+     * Phase 2.8. The typing is independent of that work: it reads only the
+     * generated `Database`, so it is correct the moment the route exists.
+     *
+     * `get` and `head` switch to the read-only forms, which carry their arguments
+     * as query parameters rather than as a body, exactly as supabase-js does.
+     */
+    async rpc(fn, args, options = {}) {
+        return this.callRpc('public', fn, args, options);
+    }
+    /**
+     * The one `/rpc/` transport, for `rpc()` and for every `schema(name).rpc()`.
+     *
+     * A schema other than `public` rides in the profile header PostgREST defines:
+     * `Content-Profile` when there is a body, `Accept-Profile` on GET and HEAD.
+     * The server serves only the schemas a feature has exposed and answers any
+     * other with PGRST106, so nothing here needs to know which ones those are.
+     */
+    async callRpc(schema, fn, args, options) {
+        try {
+            const method = options.head ? 'HEAD' : options.get ? 'GET' : 'POST';
+            const params = new URLSearchParams();
+            if (method !== 'POST') {
+                for (const [name, value] of Object.entries((args ?? {}))) {
+                    if (value === undefined)
+                        continue;
+                    params.append(name, Array.isArray(value) ? `{${value.join(',')}}` : String(value));
+                }
+            }
+            const query = params.toString();
+            const path = `${contractPath.rest('rpc')}/${encodeURIComponent(fn)}${query ? `?${query}` : ''}`;
+            const headers = {};
+            if (options.count)
+                headers.Prefer = `count=${options.count}`;
+            if (schema !== 'public')
+                headers[method === 'POST' ? 'Content-Profile' : 'Accept-Profile'] = schema;
+            const result = await this.http.requestWithHeaders(path, {
+                method,
+                body: method === 'POST' ? (args ?? {}) : undefined,
+                headers,
+            });
+            const range = result.headers.get('content-range');
+            const total = range?.split('/')[1];
+            const count = total && total !== '*' && Number.isFinite(Number(total)) ? Number(total) : null;
+            return { data: options.head ? null : result.data, error: null, count };
+        }
+        catch (err) {
+            return { data: null, error: toError(err), count: null };
+        }
+    }
+    /**
+     * Watch every HTTP request this client makes.
+     *
+     * One event per round trip, with method, path, status, duration and the
+     * `x-request-id` the server logged it under. That id is the whole point: it
+     * is what turns "a query was slow for a user yesterday" into a line in the
+     * project's logs.
+     *
+     * ```ts
+     * client.on('request', e => console.log(e.method, e.path, e.status, e.durationMs))
+     * ```
+     *
+     * Returns the unsubscribe function. An observer that throws is ignored: it is
+     * a spectator, and a broken logger must not fail the request it was logging.
+     */
+    on(event, listener) {
+        if (event !== 'request')
+            throw new Error(`Unknown client event '${String(event)}'. Only 'request' exists.`);
+        this.requestObservers.add(listener);
+        this.syncRequestObserver();
+        return () => {
+            this.requestObservers.delete(listener);
+            this.syncRequestObserver();
+        };
+    }
+    syncRequestObserver() {
+        this.http.setRequestObserver(this.requestObservers.size
+            ? (event) => {
+                for (const listener of this.requestObservers)
+                    listener(event);
+            }
+            : undefined);
+    }
+    /**
+     * Several writes, applied in one database transaction, all or nothing.
+     *
+     * supabase-js has no equivalent. What people write instead is a sequence of
+     * awaited writes inside a `try`, which is not a rollback: whatever already
+     * committed stays committed, and the catch block is left holding half a
+     * change it cannot undo.
+     *
+     * The callback does not await anything. It DESCRIBES the writes; they are
+     * sent together and applied together:
+     *
+     * ```ts
+     * const { data, error } = await client.transaction(tx => {
+     *   tx.from('orders').insert({ id, total })
+     *   tx.from('stock').update({ count: 4 }).eq('sku', sku)
+     * })
+     * ```
+     *
+     * `data` is one result array per operation, in the order they were declared.
+     * Reads are refused: a batch exists to make writes atomic, and a read in the
+     * middle of one invites expectations about ordering that nothing guarantees.
+     */
+    async transaction(build) {
+        const recorded = [];
+        const tx = {
+            from: ((table) => {
+                const builder = new PostgrestQueryBuilder(this.http, table, this.compat);
+                recorded.push(builder);
+                return builder;
+            }),
+        };
+        try {
+            build(tx);
+            const operations = recorded.map(builder => {
+                const request = builder.toRequest();
+                if (request.method === 'GET' || request.method === 'HEAD') {
+                    throw new Error(`transaction(): '${request.model}' was read, not written. A transaction takes writes only `
+                        + '(insert, upsert, update, delete).');
+                }
+                return request;
+            });
+            if (!operations.length) {
+                throw new Error('transaction(): the callback declared no writes.');
+            }
+            const result = await this.http.request(`${contractPath.rest('batch')}`, {
+                method: 'POST',
+                body: { operations },
+            });
+            return { data: result.results, error: null, count: null };
+        }
+        catch (err) {
+            return { data: null, error: toError(err), count: null };
+        }
+    }
+    /** Create (or reuse) a realtime channel. */
+    channel(name, opts = {}) {
+        const existing = this.channels.get(name);
+        if (existing)
+            return existing;
+        const channel = new RealtimeChannel(name, this.realtime, opts);
+        this.channels.set(name, channel);
+        return channel;
+    }
+    /** Every channel this client created, as supabase-js reports them. */
+    getChannels() {
+        return Array.from(this.channels.values());
+    }
+    schema(name) {
+        if (name === 'public')
+            return this;
+        const scoped = {
+            rpc: (fn, args, options = {}) => this.callRpc(name, fn, args, options),
+            from: table => {
+                throw new Error(`schema('${name}').from('${table}') is not supported: the Motherbase REST API serves tables from the `
+                    + `public schema only. Functions in '${name}' can be called with schema('${name}').rpc().`);
+            },
+        };
+        return scoped;
+    }
+    /** Unsubscribe and drop a channel. */
+    async removeChannel(channel) {
+        await channel.unsubscribe();
+        this.channels.delete(channel.topic);
+        return 'ok';
+    }
+    /** Unsubscribe and drop every channel. */
+    async removeAllChannels() {
+        await Promise.all(Array.from(this.channels.values()).map(c => c.unsubscribe()));
+        this.channels.clear();
+        return 'ok';
+    }
+    /** Load any persisted session before first use. Optional but recommended. */
+    hydrate() {
+        return this.store.hydrate();
+    }
+}
+MotherbaseClient.warnedAboutStorage = false;
+/**
+ * Create a Supabase-compatible Motherbase client.
+ *
+ * In a Next.js app, prefer `createBrowserClient` / `createServerClient` from
+ * `@motherbase/ssr`: they persist the session to a cookie both halves can read.
+ * `createClient()` on its own keeps the session in memory, which the server
+ * cannot see, so every server-rendered `getUser()` returns null.
+ *
+ * @param url  Backend API base URL.
+ * @param key  Anon/publishable key (optional). Sent as an `apikey` header.
+ * @param options  Session storage, fetch override, extra headers.
+ *
+ * @example
+ * ```ts
+ * import type { Database } from './database.types'
+ * const client = createClient<Database>(url, anonKey)
+ * ```
+ */
+export function createClient(url, key, options = {}) {
+    return new MotherbaseClient(url, key, options);
+}
+export { BackendError } from './http.js';
+export { memoryStorage, localStorageStorage, keyValueStorage };
+export { normalizeSession, normalizeUser } from './compat.js';
+export { cookieStorage, serverCookieStorage, SESSION_COOKIE_KEY } from './cookie.js';
+export { PostgrestQueryBuilder } from './postgrest.js';
+export { AuthClient } from './auth.js';
+export { MfaClient } from './mfa.js';
+export { AuthAdminClient } from './admin.js';
+export { OrganizationClient } from './organization.js';
+export { PasskeyClient } from './passkey.js';
+export { SsoClient } from './sso.js';
+export { StorageClient, StorageBucket } from './storage.js';
+export { FunctionsClient, FunctionsError, FunctionsHttpError, FunctionsRelayError, FunctionsFetchError } from './functions.js';
+export { RealtimeChannel } from './channel.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAA+B,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0D3C;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAAsB;IAC5C,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAE5C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI;QAAE,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,IAAI,EAAE,cAAc,KAAK,KAAK;QAAE,OAAO,aAAa,EAAE,CAAC;IACnE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAmB3B,YACmB,GAAW;IAC5B,sFAAsF;IAC7E,GAAY,EACrB,UAAyB,EAAE;QAHV,QAAG,GAAH,GAAG,CAAQ;QAEnB,QAAG,GAAH,GAAG,CAAS;QATN,aAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;QAI9C,qBAAgB,GAAG,IAAI,GAAG,EAAmB,CAAC;QAQ7D,0EAA0E;QAC1E,wEAAwE;QACxE,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/F,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,EAAE,gBAAgB,IAAI,IAAI,CAAC;QAClF,MAAM,OAAO,GAA2B,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3F,IAAI,GAAG;YAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC;QAE5C,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,uCAAuC;QACvC,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC;QAClC,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,eAAe,MAAM,qFAAqF;kBACtG,qEAAqE,MAAM,WAAW,CAC3F,CAAC;QACJ,CAAC;QAED,4EAA4E;QAC5E,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,GAAG,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YACnE,OAAO,CAAC,IAAI,CACV,iFAAiF;kBAC7E,mEAAmE;kBACnE,+BAA+B,CACpC,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAE/C,4EAA4E;QAC5E,0EAA0E;QAC1E,mEAAmE;QACnE,wEAAwE;QACxE,oEAAoE;QACpE,IAAI,CAAC,cAAc,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;YAC7F,gBAAgB,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC3C,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CACV,0FAA0F;sBACtF,qFAAqF;sBACrF,uFAAuF;sBACvF,6CAA6C,CAClD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,cAAc,IAAI,aAAa,EAAE,CAAC,CAAC;QAEjE,6EAA6E;QAC7E,gEAAgE;QAChE,2EAA2E;QAC3E,2EAA2E;QAC3E,wCAAwC;QACxC,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/G,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,UAAU,CAAC;QACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACrH,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;YAC3C,QAAQ;YACR,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,kBAAkB,EAAE,QAAQ,CAAC;SACnF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAE1F,wEAAwE;QACxE,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,oEAAoE;QACpE,IACE,OAAO,CAAC,IAAI,EAAE,kBAAkB,KAAK,KAAK;eACvC,OAAO,MAAM,KAAK,WAAW;eAC7B,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC,EACnD,CAAC;YACD,KAAK,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACrC,CAAC;QACD,4EAA4E;QAC5E,qEAAqE;QACrE,IAAI,OAAO,CAAC,IAAI,EAAE,kBAAkB,KAAK,KAAK,IAAI,QAAQ,KAAK,MAAM,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YACvG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI,EAAE,CAAC;gBACT,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChC,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnE,KAAK,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAkBD,IAAI,CAAC,KAAa;QAChB,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,CACP,EAAQ,EACR,IAAiC,EACjC,UAAsB,EAAE;QAExB,OAAO,IAAI,CAAC,OAAO,CAAgC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,EAAU,EACV,IAAa,EACb,OAAmB;QAEnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,EAAE,CAAC;oBACpF,IAAI,KAAK,KAAK,SAAS;wBAAE,SAAS;oBAClC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAChG,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,KAAK;gBAAE,OAAO,CAAC,MAAM,GAAG,SAAS,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7D,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC;YAEpG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAS,IAAI,EAAE;gBAC9D,MAAM;gBACN,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClD,OAAO;aACR,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9F,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,EAAE,CAAC,KAAgB,EAAE,QAAyB;QAC5C,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC5G,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,CAAC,CAAC;IACJ,CAAC;IAEO,mBAAmB;QACzB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAC1B,IAAI,CAAC,gBAAgB,CAAC,IAAI;YACxB,CAAC,CAAC,CAAC,KAAmB,EAAE,EAAE;gBACtB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,gBAAgB;oBAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChE,CAAC;YACH,CAAC,CAAC,SAAS,CACd,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,WAAW,CAAC,KAAuC;QACvD,MAAM,QAAQ,GAAqD,EAAE,CAAC;QACtE,MAAM,EAAE,GAAuB;YAC7B,IAAI,EAAE,CAAC,CAAC,KAAa,EAAE,EAAE;gBACvB,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvB,OAAO,OAAO,CAAC;YACjB,CAAC,CAA0C;SAC5C,CAAC;QAEF,IAAI,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,CAAC;YACV,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;gBACxC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CACb,mBAAmB,OAAO,CAAC,KAAK,2DAA2D;0BACvF,mCAAmC,CACxC,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAA2B,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE;gBAChG,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,UAAU,EAAE;aACrB,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,OAAO,CAAC,IAAY,EAAE,OAA+B,EAAE;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sEAAsE;IACtE,WAAW;QACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAWD,MAAM,CAAC,IAAY;QACjB,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,MAAM,GAAiB;YAC3B,GAAG,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC;YACtE,IAAI,EAAE,KAAK,CAAC,EAAE;gBACZ,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,YAAY,KAAK,sEAAsE;sBAClG,qCAAqC,IAAI,gCAAgC,IAAI,WAAW,CAC7F,CAAC;YACJ,CAAC;SACF,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,aAAa,CAAC,OAAwB;QAC1C,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,iBAAiB;QACrB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;;AAxVc,mCAAkB,GAAG,KAAK,AAAR,CAAS;AA2V5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAI1B,GAAW,EAAE,GAAY,EAAE,UAAyB,EAAE;IACtD,OAAO,IAAI,gBAAgB,CAA+B,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AA8CvD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAY7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAYvD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAsBrC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE/H,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/dist/mfa.d.ts

@@ -0,0 +1,126 @@
+import type { HttpClient } from './http.js';
+import type { MotherbaseResponse } from './types.js';
+/**
+ * Two-factor authentication, shaped like `supabase.auth.mfa`.
+ *
+ * The server has shipped TOTP with backup codes and trusted devices since the
+ * beginning; only the client namespace was missing, which meant the product's
+ * strongest auth feature could not be reached from the SDK that sells it.
+ *
+ * The mapping onto Better Auth is not one-to-one, and the differences are stated
+ * per method rather than papered over:
+ *
+ *   * A factor here is TOTP or nothing. Better Auth models two-factor as a
+ *     property of the user, not as a list of enrolled factors, so `listFactors`
+ *     reports the single TOTP factor rather than an arbitrary set, and there is
+ *     no phone factor to enrol.
+ *   * Enrolment needs the user's password. supabase-js does not ask for one;
+ *     Better Auth does, because enabling two-factor is a credential change.
+ *   * `challenge()` is a local no-op for TOTP: there is nothing to send, the
+ *     code is already on the user's device. It exists so the supabase-js
+ *     challenge/verify sequence compiles unchanged. For the email or SMS second
+ *     factor, `challenge()` does send a code.
+ */
+export interface MfaFactor {
+    id: string;
+    /** Always `totp` today. */
+    factor_type: 'totp';
+    status: 'verified' | 'unverified';
+    friendly_name?: string;
+}
+export interface MfaEnrollResponse {
+    id: string;
+    type: 'totp';
+    totp: {
+        /** otpauth:// URI to render as a QR code. */
+        uri: string;
+        /** The shared secret, for users who type it in by hand. */
+        secret: string;
+    };
+    /** One-time codes to store somewhere safe. Shown only at enrolment. */
+    backupCodes: string[];
+}
+export type AuthenticatorAssuranceLevel = 'aal1' | 'aal2';
+export interface MfaChallengeResponse {
+    id: string;
+    expires_at: number | null;
+}
+export declare class MfaClient {
+    private readonly http;
+    /** Re-reads the session after a verify, so a stepped-up token is persisted. */
+    private readonly onVerified;
+    constructor(http: HttpClient, 
+    /** Re-reads the session after a verify, so a stepped-up token is persisted. */
+    onVerified: () => Promise<void>);
+    /**
+     * Start TOTP enrolment. Returns the otpauth URI, the secret and the backup
+     * codes. The factor is not usable until `verify()` accepts a code from it.
+     */
+    enroll(params: {
+        password: string;
+        issuer?: string;
+    }): Promise<MotherbaseResponse<MfaEnrollResponse>>;
+    /**
+     * For TOTP this resolves immediately and sends nothing: the code already lives
+     * on the user's device. Pass `channel` to send a second-factor code by email
+     * or SMS instead, when the project has that enabled.
+     */
+    challenge(params?: {
+        factorId?: string;
+        channel?: 'email' | 'sms';
+    }): Promise<MotherbaseResponse<MfaChallengeResponse>>;
+    /**
+     * Verify a code. `code` is a TOTP code by default; set `type` to `otp` for an
+     * emailed or texted second factor, or `backup` to spend a recovery code.
+     */
+    verify(params: {
+        code: string;
+        factorId?: string;
+        challengeId?: string;
+        type?: 'totp' | 'otp' | 'backup';
+        /** Remember this device for the project's configured trust window. */
+        trustDevice?: boolean;
+    }): Promise<MotherbaseResponse<{
+        verified: true;
+    }>>;
+    /** Turn two-factor off. Requires the password, as enabling did. */
+    unenroll(params: {
+        password: string;
+        factorId?: string;
+    }): Promise<MotherbaseResponse<{
+        id: string;
+    }>>;
+    /** Issue a fresh set of backup codes, invalidating the previous set. */
+    regenerateBackupCodes(params: {
+        password: string;
+    }): Promise<MotherbaseResponse<{
+        backupCodes: string[];
+    }>>;
+    /**
+     * Where this session stands, supabase-js style. `currentLevel` is `aal2`
+     * once the session passed a second factor (the server marks it then);
+     * `nextLevel` is `aal2` when the user has one to pass. `currentLevel` below
+     * `nextLevel` means: ask for the code before anything sensitive.
+     * `currentAuthenticationMethods` is always empty: sessions do not record
+     * which methods produced them.
+     */
+    getAuthenticatorAssuranceLevel(): Promise<MotherbaseResponse<{
+        currentLevel: AuthenticatorAssuranceLevel | null;
+        nextLevel: AuthenticatorAssuranceLevel | null;
+        currentAuthenticationMethods: Array<{
+            method: string;
+            timestamp: number;
+        }>;
+    }>>;
+    /**
+     * The user's factors. Reads the TOTP URI: getting one back means TOTP is
+     * enrolled, a failure means it is not. There is no list endpoint to call
+     * because there is no list, and inventing one client-side would be a lie about
+     * what the server models.
+     */
+    listFactors(): Promise<MotherbaseResponse<{
+        totp: MfaFactor[];
+        all: MfaFactor[];
+    }>>;
+}
+//# sourceMappingURL=mfa.d.ts.map

package/dist/mfa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.d.ts","sourceRoot":"","sources":["../src/mfa.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE;QACJ,6CAA6C;QAC7C,GAAG,EAAE,MAAM,CAAC;QACZ,2DAA2D;QAC3D,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,uEAAuE;IACvE,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,2BAA2B,GAAG,MAAM,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAaD,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAFV,IAAI,EAAE,UAAU;IACjC,+EAA+E;IAC9D,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAGlD;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IA6B3G;;;;OAIG;IACG,SAAS,CAAC,MAAM,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,GAAG,KAAK,CAAA;KAAO,GAAG,OAAO,CACrF,kBAAkB,CAAC,oBAAoB,CAAC,CACzC;IAYD;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;QACjC,sEAAsE;QACtE,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAmBnD,mEAAmE;IAC7D,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAS5G,wEAAwE;IAClE,qBAAqB,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAajH;;;;;;;OAOG;IACG,8BAA8B,IAAI,OAAO,CAC7C,kBAAkB,CAAC;QACjB,YAAY,EAAE,2BAA2B,GAAG,IAAI,CAAC;QACjD,SAAS,EAAE,2BAA2B,GAAG,IAAI,CAAC;QAC9C,4BAA4B,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5E,CAAC,CACH;IAiBD;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAAC,GAAG,EAAE,SAAS,EAAE,CAAA;KAAE,CAAC,CAAC;CAU1F"}