@motherbase/client 1.5.0 → 1.5.2

package/dist/auth.d.ts

@@ -0,0 +1,463 @@
+import { MfaClient } from './mfa.js';
+import { AuthAdminClient } from './admin.js';
+import { type VerifierStore } from './pkce.js';
+import { OrganizationClient } from './organization.js';
+import { PasskeyClient } from './passkey.js';
+import { SsoClient } from './sso.js';
+import type { HttpClient } from './http.js';
+import type { SessionStore } from './session.js';
+import type { AuthChangeListener, MotherbaseResponse, Session, User, UserIdentity } from './types.js';
+/**
+ * The CAPTCHA response token from the hCaptcha or Turnstile widget. Required
+ * by every guarded endpoint once the project turns CAPTCHA protection on
+ * (Studio → Authentication → Attack Protection), exactly as in supabase-js.
+ */
+export interface CaptchaOptions {
+    captchaToken?: string;
+}
+export interface SignUpCredentials {
+    email: string;
+    password: string;
+    /** Optional extra profile field supported by the backend. */
+    username?: string;
+    options?: CaptchaOptions & {
+        /** Where the email-verification link sends the user. Must be an allowed redirect URL. */
+        emailRedirectTo?: string;
+    };
+}
+export interface SignInWithPasswordCredentials {
+    email: string;
+    password: string;
+    options?: CaptchaOptions;
+}
+export interface SignInWithOtpCredentials {
+    email?: string;
+    /** E.164 phone number. Routes to the SMS one-time code flow instead. */
+    phone?: string;
+    options?: CaptchaOptions;
+}
+export interface SignInAnonymouslyCredentials {
+    options?: CaptchaOptions & {
+        /** Profile fields for the guest, stored like `updateUser({ data })`. */
+        data?: Record<string, unknown>;
+    };
+}
+export interface VerifyOtpParams {
+    email?: string;
+    /** E.164 phone number, when the code was sent by SMS. */
+    phone?: string;
+    /** The code that was sent. Named `token` for supabase-js parity. */
+    token: string;
+    /**
+     * supabase-js verification type. The channel actually follows the identifier
+     * you pass; this only disambiguates if both are present. `recovery` and
+     * `email_change` are not routed: use `resetPassword` for the first, and
+     * email changes are not supported.
+     */
+    type?: 'email' | 'sms' | 'phone_change' | 'recovery' | 'email_change' | 'signup';
+}
+export interface SignInWithOAuthCredentials {
+    /** Social provider id, e.g. 'google' or 'apple'. Must be enabled on the backend. */
+    provider: string;
+    options?: {
+        /** Where the provider should send the user back to after auth. */
+        redirectTo?: string;
+        /** Space-separated OAuth scopes. */
+        scopes?: string;
+        /** Skip the automatic `window.location` redirect and just return the URL. */
+        skipBrowserRedirect?: boolean;
+    };
+}
+export interface DeleteUserAttributes {
+    /** Required unless the session is already "fresh" (i.e. just re-authenticated). */
+    password?: string;
+    /** Deletion-confirmation token, when the backend's delete flow requires an email confirmation step. */
+    token?: string;
+    callbackURL?: string;
+}
+export interface UpdateUserAttributes {
+    /**
+     * Give an anonymous user an email address, which makes it permanent. The id
+     * does not change, so everything the guest owned stays owned. A permanent
+     * user cannot change its address through this call.
+     */
+    email?: string;
+    /**
+     * New password. Replacing an existing one takes either `currentPassword` or
+     * the `nonce` that `reauthenticate()` emailed. A user with no password yet
+     * (a converted guest, a social sign-in) needs neither.
+     */
+    password?: string;
+    currentPassword?: string;
+    /** The code from `reauthenticate()`. */
+    nonce?: string;
+    /** Arbitrary profile fields (name, image, or any custom additional field). */
+    data?: Record<string, unknown>;
+}
+export interface PasswordSignInData {
+    user: User | null;
+    session: Session | null;
+    /** The password was accepted, but no authenticated session exists yet. */
+    twoFactorRequired?: boolean;
+    twoFactorMethods?: string[];
+}
+/**
+ * Read the token an OAuth callback left in the URL fragment and return the URL
+ * with it removed, so a reload or a shared link cannot replay it.
+ *
+ * The provider callback cannot answer the SDK with a JSON body: it is a browser
+ * redirect. The backend therefore appends `#access_token=…` to the redirect it
+ * issues, the same implicit flow supabase-js reads. Exported for testing.
+ */
+export declare function readAccessTokenFromUrl(href: string): {
+    accessToken: string;
+    cleanedHref: string;
+} | null;
+export interface Subscription {
+    unsubscribe(): void;
+}
+export interface AuthClientOptions {
+    /** `pkce` makes OAuth and SSO redirects come back with `?code=` for `exchangeCodeForSession`. */
+    flowType?: 'implicit' | 'pkce';
+    /** Where the PKCE verifier waits out the redirect. Defaults to localStorage, else memory. */
+    verifiers?: VerifierStore;
+}
+/**
+ * Supabase-compatible auth client. Maps supabase-js method names onto the
+ * Motherbase auth endpoints and reuses the existing token/refresh/session-store
+ * machinery. Returns `{ data, error }` and never throws for expected failures.
+ */
+export declare class AuthClient {
+    private readonly http;
+    private readonly store;
+    /**
+     * Two-factor, shaped like `supabase.auth.mfa`. The server has shipped TOTP
+     * from the start; this is the namespace that makes it reachable.
+     */
+    readonly mfa: MfaClient;
+    /**
+     * User administration for server code holding a secret key. Present on every
+     * client, because whether the key is secret is a server-side fact: calling
+     * these with a publishable key is a 401, not a missing method.
+     */
+    readonly admin: AuthAdminClient;
+    /**
+     * End-user organizations, members, invitations and teams. Not part of
+     * supabase-js; method names follow Better Auth's organization client.
+     */
+    readonly organization: OrganizationClient;
+    /** The signed-in user's passkeys. Signing in with one is `signInWithPasskey`. */
+    readonly passkey: PasskeyClient;
+    /** Identity providers registered at runtime. Signing in through one is `signInWithSSO`. */
+    readonly sso: SsoClient;
+    private autoRefreshTimer;
+    private readonly flowType;
+    private readonly verifiers;
+    constructor(http: HttpClient, store: SessionStore, options?: AuthClientOptions);
+    signUp(credentials: SignUpCredentials): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
+    signInWithPassword(credentials: SignInWithPasswordCredentials): Promise<MotherbaseResponse<PasswordSignInData>>;
+    /**
+     * Sign in as a new guest, supabase-js style. The project must allow
+     * anonymous sign-ins (Studio → Authentication → Sign In / Providers).
+     *
+     * The guest is a real user whose `is_anonymous` is true, and RLS sees the
+     * same flag as the `is_anonymous` claim. Make it permanent without changing
+     * its id with `updateUser({ email })` or `linkIdentity()`.
+     */
+    signInAnonymously(credentials?: SignInAnonymouslyCredentials): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
+    /**
+     * Email the signed-in user a one-time nonce, then pass it to
+     * `updateUser({ password, nonce })`. GoTrue's "secure password change".
+     */
+    reauthenticate(): Promise<MotherbaseResponse<{
+        user: null;
+        session: null;
+    }>>;
+    /**
+     * Request a password-reset OTP by email. Always resolves successfully
+     * (whether or not the email is registered) to avoid leaking account
+     * existence; check `error` only for transport/server failures.
+     */
+    resetPasswordForEmail(email: string, options?: CaptchaOptions): Promise<{
+        error: MotherbaseResponse<null>['error'];
+    }>;
+    /** Complete a password reset using the OTP sent to the user's email. */
+    resetPassword(args: {
+        email: string;
+        otp: string;
+        password: string;
+    }): Promise<{
+        error: MotherbaseResponse<null>['error'];
+    }>;
+    /**
+     * Send a one-time sign-in code, by email or by SMS. Pair with `verifyOtp` to
+     * complete the sign-in.
+     *
+     * `{ phone }` routes to the phone-number plugin, which the project has to
+     * have enabled with an SMS sender configured; without one the call resolves
+     * with the backend's error rather than pretending a code was sent.
+     */
+    signInWithOtp(credentials: SignInWithOtpCredentials): Promise<{
+        data: Record<string, never>;
+        error: MotherbaseResponse<null>['error'];
+    }>;
+    /**
+     * Send the one-time code again, supabase-js style.
+     *
+     * supabase-js names the flows `signup` (confirm a new address), `email_change`
+     * and `recovery`; Better Auth names them `email-verification` and
+     * `forget-password`. The mapping lives here so ported code keeps working.
+     * `sms` and `phone_change` re-send an SMS code through the phone-number flow.
+     */
+    resend(params: {
+        type: 'signup' | 'email_change' | 'recovery' | 'sms' | 'phone_change';
+        email?: string;
+        phone?: string;
+    }): Promise<{
+        data: Record<string, never>;
+        error: MotherbaseResponse<null>['error'];
+    }>;
+    /**
+     * Complete a `signInWithOtp` sign-in with the code that was sent.
+     *
+     * The channel follows the identifier, as in supabase-js: `{ phone }` verifies
+     * an SMS code, `{ email }` an email one. `type` is accepted for signature
+     * parity and only disambiguates when both are somehow present.
+     */
+    verifyOtp(params: VerifyOtpParams): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
+    /**
+     * Start an OAuth sign-in with a configured social provider. Resolves with the
+     * provider's authorize URL and, in a browser, redirects to it immediately
+     * unless `options.skipBrowserRedirect` is set.
+     */
+    signInWithOAuth(credentials: SignInWithOAuthCredentials): Promise<MotherbaseResponse<{
+        provider: string;
+        url: string | null;
+    }>>;
+    /**
+     * Sign in with a passkey saved on this device or a synced one. Opens the
+     * browser's passkey prompt; dismissing it resolves with an error, not a throw.
+     * Needs Auth · Passkey on and a browser (see `auth.passkey`).
+     */
+    signInWithPasskey(): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
+    /**
+     * Start an enterprise SSO sign-in. Identify the provider by the user's email
+     * domain, by an explicit `domain`, or by `providerId` when you already know
+     * which one to use.
+     *
+     * Resolves with the identity provider's URL and, in a browser, redirects to it
+     * unless `options.skipBrowserRedirect` is set. The project must have the SSO
+     * plugin enabled and at least one provider registered (Studio →
+     * Authentication → Organizations & SSO).
+     */
+    signInWithSSO(params: {
+        domain?: string;
+        email?: string;
+        providerId?: string;
+        organizationSlug?: string;
+        options?: {
+            redirectTo?: string;
+            skipBrowserRedirect?: boolean;
+        };
+    }): Promise<MotherbaseResponse<{
+        url: string | null;
+    }>>;
+    /**
+     * Update the signed-in user's profile fields and/or password. Password
+     * changes require `currentPassword` (a Better Auth requirement. There is no
+     * blind password overwrite from an authenticated session).
+     */
+    updateUser(attributes: UpdateUserAttributes): Promise<MotherbaseResponse<{
+        user: User | null;
+    }>>;
+    /**
+     * Permanently delete the signed-in user's account. Not part of the
+     * supabase-js client surface (there it's admin-only). Kept here because
+     * self-service account deletion is a real product need. Requires the
+     * backend's `delete-user` flow to be enabled; clears the local session on
+     * success.
+     */
+    deleteUser(attributes?: DeleteUserAttributes): Promise<{
+        error: MotherbaseResponse<null>['error'];
+    }>;
+    /**
+     * Adopt an externally-obtained access token as the current session (e.g. one
+     * captured from an OAuth redirect). Validates it against the server before
+     * persisting. `refresh_token` is accepted for supabase-js signature parity
+     * and unused: Better Auth bearer sessions have none.
+     */
+    setSession(currentSession: {
+        access_token: string;
+        refresh_token?: string;
+    }): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
+    signOut(): Promise<{
+        error: MotherbaseResponse<null>['error'];
+    }>;
+    /**
+     * Finish an OAuth / SSO sign-in after the provider redirected back.
+     *
+     * `signInWithOAuth` only starts the flow; the session is created during the
+     * redirect the browser makes to the backend callback, so the SDK has to pick
+     * it up from the URL the browser landed on. Call this once on the page you
+     * pointed `redirectTo` at (or on app start, which is where supabase-js does
+     * the equivalent). Without it the user is signed in on the backend and signed
+     * out in your app.
+     *
+     * Resolves with a null session and no error when there is nothing to read, so
+     * it is safe to call on every page load.
+     */
+    getSessionFromUrl(href?: string): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
+    /**
+     * Finish a PKCE sign-in: trade the `?code=` the provider redirect came back
+     * with for the session. Needs the verifier `signInWithOAuth` stored, so it
+     * works once, in the browser that started the flow.
+     */
+    exchangeCodeForSession(authCode: string): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
+    /**
+     * The redirect a flow should use. Implicit: as given. PKCE: with a fresh
+     * challenge on it, the verifier stored for `exchangeCodeForSession`; the
+     * challenge rides on the redirect URL, so PKCE needs one, and in a browser
+     * the current page stands in when none is given.
+     */
+    private redirectForFlow;
+    /** Fetch the current user from Better Auth (requires a valid session). */
+    getUser(): Promise<MotherbaseResponse<{
+        user: User | null;
+    }>>;
+    /**
+     * NEVER USE FOR AN AUTHORIZATION DECISION. Use {@link getUser} instead.
+     *
+     * The locally-held session, if any (no network call). It is whatever the
+     * caller's cookie or storage said, parsed: unsigned JSON the browser sent,
+     * which anyone can set by hand. `session.user.id`, `.email` and `.role` are
+     * therefore attacker-controlled, and an admin allowlist checked against
+     * them is checked against nothing.
+     *
+     * Reads and writes through `from()` are unaffected: they carry the access
+     * token to the backend, which verifies it under RLS. It is the decisions
+     * your own app takes from `session.user` that are forgeable.
+     *
+     * `getUser()` costs one round trip and returns the user the backend
+     * confirms, in the same `{ data, error }` shape. Prefer it everywhere but a
+     * cosmetic "am I probably signed in" check.
+     */
+    getSession(): Promise<MotherbaseResponse<{
+        session: Session | null;
+    }>>;
+    /**
+     * Revalidate the current session against the server. Better Auth bearer
+     * sessions have no refresh token: if the session is still valid the user is
+     * refreshed; otherwise the local session is cleared.
+     */
+    refreshSession(): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
+    /**
+     * Subscribe to auth changes, supabase-js style.
+     *
+     * The callback fires once with `INITIAL_SESSION` as soon as the stored
+     * session has been read, before any later event. That first call is not a
+     * nicety: the standard Supabase bootstrap is
+     * `if (event === 'INITIAL_SESSION') setLoading(false)`, and without it the
+     * app renders its loading state forever for a signed-out visitor, who never
+     * produces any other event.
+     *
+     * It is delivered asynchronously (after hydration), so unsubscribing
+     * synchronously suppresses it, exactly as in supabase-js.
+     */
+    /**
+     * The providers linked to the signed-in user, in the supabase-js identity
+     * shape. Backed by Better Auth's `list-accounts`, which is why `email` shows
+     * up as an identity for a password account: it is a real linked credential,
+     * exactly as in Supabase.
+     */
+    getUserIdentities(): Promise<MotherbaseResponse<{
+        identities: UserIdentity[];
+    }>>;
+    /**
+     * Link another provider to the signed-in user. Like `signInWithOAuth`, this
+     * only starts the flow: the browser is sent to the provider and comes back
+     * through the callback.
+     */
+    linkIdentity(credentials: SignInWithOAuthCredentials): Promise<MotherbaseResponse<{
+        provider: string;
+        url: string | null;
+    }>>;
+    /** Unlink a provider from the signed-in user. */
+    unlinkIdentity(identity: {
+        provider: string;
+        id?: string;
+        identity_id?: string;
+    }): Promise<MotherbaseResponse<Record<string, never>>>;
+    /**
+     * Native mobile sign-in with a provider id token (Sign in with Apple, Google
+     * One Tap), routed to Better Auth's social sign-in with an `idToken`.
+     * The provider must be configured on the backend.
+     */
+    signInWithIdToken(params: {
+        provider: string;
+        token: string;
+        access_token?: string;
+        nonce?: string;
+    }): Promise<MotherbaseResponse<{
+        user: User | null;
+        session: Session | null;
+    }>>;
+    /**
+     * Claims for the current session, as a JWT payload.
+     *
+     * supabase-js reads them out of the access token, which is itself a JWT.
+     * A Better Auth session token is an opaque bearer, so this asks the server's
+     * jwt plugin to mint one and decodes it. The decode is NOT a verification:
+     * the token came from the authenticated endpoint over TLS, and a client
+     * verifying a token it just asked for proves nothing. Verify server side,
+     * against `/api/auth/jwks`.
+     */
+    getClaims(): Promise<MotherbaseResponse<{
+        claims: Record<string, unknown>;
+        token: string;
+    }>>;
+    /**
+     * Revalidate the session on a timer, the way supabase-js does while the tab
+     * is focused. Motherbase refreshes on a 401 already, so this is opt-in: it
+     * exists so a ported app that calls it keeps working, and so a long-lived
+     * screen notices a revoked session without waiting for its next request.
+     */
+    startAutoRefresh(intervalMs?: number): void;
+    /** Stop the timer started by `startAutoRefresh`. Safe to call when none runs. */
+    stopAutoRefresh(): void;
+    onAuthStateChange(callback: AuthChangeListener): {
+        data: {
+            subscription: Subscription;
+        };
+    };
+    /**
+     * Internal: refresh used by the HttpClient's 401 path. Returns true on success.
+     * Not part of the public Supabase surface.
+     */
+    _refresh(): Promise<boolean>;
+    private persist;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAA4E,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,aAAa,EAA2B,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAEV,kBAAkB,EAGlB,kBAAkB,EAClB,OAAO,EACP,IAAI,EACJ,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,yFAAyF;QACzF,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,wEAAwE;QACxE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAChC,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,cAAc,GAAG,UAAU,GAAG,cAAc,GAAG,QAAQ,CAAC;CAClF;AAED,MAAM,WAAW,0BAA0B;IACzC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,kEAAkE;QAClE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,oCAAoC;QACpC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,6EAA6E;QAC7E,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uGAAuG;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAQD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AA2DD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUxG;AAUD,MAAM,WAAW,YAAY;IAC3B,WAAW,IAAI,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,iGAAiG;IACjG,QAAQ,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAC/B,6FAA6F;IAC7F,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED;;;;GAIG;AACH,qBAAa,UAAU;IA8BT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAc,OAAO,CAAC,QAAQ,CAAC,KAAK;IA7BrE;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAExB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAEhC;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAE1C,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAEhC,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAExB,OAAO,CAAC,gBAAgB,CAA+C;IACvE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;gBAEb,IAAI,EAAE,UAAU,EAAmB,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,iBAAsB;IAY9G,MAAM,CACV,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAuBxE,kBAAkB,CACtB,WAAW,EAAE,6BAA6B,GACzC,OAAO,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;IAkClD;;;;;;;OAOG;IACG,iBAAiB,CACrB,WAAW,GAAE,4BAAiC,GAC7C,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAwB9E;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IASlF;;;;OAIG;IACG,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAe3H,wEAAwE;IAClE,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAclI;;;;;;;OAOG;IACG,aAAa,CAAC,WAAW,EAAE,wBAAwB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IA4B9I;;;;;;;OAOG;IACG,MAAM,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,QAAQ,GAAG,cAAc,GAAG,UAAU,GAAG,KAAK,GAAG,cAAc,CAAC;QACtE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IA8BtF;;;;;;OAMG;IACG,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA2BrH;;;;OAIG;IACG,eAAe,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA+CrI;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAOtG;;;;;;;;;OASG;IACG,aAAa,CAAC,MAAM,EAAE;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAClE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA+BvD;;;;OAIG;IACG,UAAU,CAAC,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAsCtG;;;;;;OAMG;IACG,UAAU,CAAC,UAAU,GAAE,oBAAyB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAc9G;;;;;OAKG;IACG,UAAU,CAAC,cAAc,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAiBzJ,OAAO,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAUtE;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IA6B9E;;;;OAIG;IACG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAoB3H;;;;;OAKG;YACW,eAAe;IAS7B,0EAA0E;IACpE,OAAO,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IASnE;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAK5E;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAyBnG;;;;;;;;;;;;OAYG;IACH;;;;;OAKG;IACG,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,UAAU,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC,CAAC;IAoBtF;;;;OAIG;IACG,YAAY,CAAC,WAAW,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAsBlI,iDAAiD;IAC3C,cAAc,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAa3I;;;;OAIG;IACG,iBAAiB,CAAC,MAAM,EAAE;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAyB/E;;;;;;;;;OASG;IACG,SAAS,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAclG;;;;;OAKG;IACH,gBAAgB,CAAC,UAAU,SAAS,GAAG,IAAI;IAU3C,iFAAiF;IACjF,eAAe,IAAI,IAAI;IAOvB,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG;QAAE,IAAI,EAAE;YAAE,YAAY,EAAE,YAAY,CAAA;SAAE,CAAA;KAAE;IAsBzF;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;YAKpB,OAAO;CAKtB"}