@pawabase/client 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,314 @@
-# Temporary Holding Version
+# @pawabase/client
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The official TypeScript client for [Pawabase](https://pawabase.com): records, auth, storage,
+functions, flows and realtime, with typed errors, safe retries and one shared session.
+
+- **Zero dependencies.** Standard `fetch` and `WebSocket` only. Tested on Node 26 and against a live stack; it uses no Node-only APIs in the library, so browsers and other runtimes with `fetch` should work (bring a `storage` on React Native).
+- **Typed end to end.** Generate a `Database` type from your project and resource names, rows, inserts and filters are checked.
+- **Built for the failures.** Rate limits and `502/503/504` are retried with backoff and `Retry-After`; refresh tokens are exchanged once, even from many tabs; errors are classes, not strings.
+- **ESM and CommonJS**, with types.
+
+```bash
+npm install @pawabase/client
+```
+
+```ts
+import { createClient } from "@pawabase/client";
+
+const pawabase = createClient({
+  url: "https://api.example.com",       // your gateway
+  apiKey: "pb_pk_…",                    // a publishable key
+});
+
+await pawabase.auth.signInWithPassword({ email: "ada@example.com", password: "…" });
+
+const { data, total } = await pawabase
+  .from("posts")
+  .eq("status", "live")
+  .order("created_at", "desc")
+  .perPage(20);
+```
+
+## Contents
+
+- [Keys](#keys) · [Records](#records) · [Auth](#auth) · [Storage](#storage) · [Functions, flows and routes](#functions-flows-and-routes) · [Realtime](#realtime)
+- [Managing an environment](#managing-an-environment-secret-key) · [Types](#types) · [Errors](#errors) · [Retries and timeouts](#retries-and-timeouts) · [Servers and SSR](#servers-and-ssr) · [Testing](#testing-your-app)
+
+## Keys
+
+Every request carries your project key in the `apikey` header; a signed-in user's token goes in
+`Authorization` automatically.
+
+| Key | Where | What it does |
+| --- | --- | --- |
+| `pb_pk_…` publishable | Browsers, mobile apps | Anonymous role. **Policies apply.** |
+| `pb_sk_…` secret | Servers only | Bypasses every policy. |
+
+A secret key in a browser is refused (`ConfigError`), because anyone can read it. Set
+`dangerouslyAllowBrowser: true` only if you know why you must.
+
+## Records
+
+```ts
+const posts = pawabase.from("posts");
+
+await posts.create({ title: "Hello" });                       // → the created row
+await posts.get(1, { expand: ["author"] });                   // 404 → NotFoundError
+await posts.maybeGet(1);                                      // 404 → null
+await posts.update(1, { title: "Hi" });                       // PATCH
+await posts.delete(1);
+```
+
+### Queries
+
+A query is built with chained methods, is immutable (reuse a base query freely), and runs when awaited.
+
+```ts
+const live = pawabase.from("posts").eq("status", "live");
+
+await live.gte("views", 100).order("views", "desc").perPage(50).page(2);
+await live.like("title", "Intro*").first();                   // Row | null
+await live.count();                                           // number
+await live.all({ maxRecords: 1000 });                         // every row, across pages
+for await (const post of live) { /* lazily, page by page */ }
+
+await pawabase.from("posts").where({ status: "live", views: { gte: 10 }, org_id: null });
+await pawabase.from("posts").in("id", [1, 2, 3]).select("id", "title").expand("author");
+```
+
+| Method | Server operator |
+| --- | --- |
+| `eq` `neq` `gt` `gte` `lt` `lte` | `eq` `neq` `gt` `gte` `lt` `lte` |
+| `like` `ilike` | `like` `ilike` (`*` or `%` match any run) |
+| `in` `notIn` | `in` `nin` |
+| `is` `isNot` | `is` `isnot` (`null`, `true`, `false`) |
+
+The client protects you from three server behaviours that would otherwise return wrong data without an error:
+
+1. **One filter per field.** The server keeps only the last filter on a repeated field, so a two-sided range
+   (`gte` + `lte` on one field) cannot be written. The client throws `InvalidQueryError` instead of dropping a bound.
+2. **Booleans.** `filter[flag]=eq.false` matches the wrong rows. `eq(col, false)` is sent as `is.false`.
+3. **`in` lists are split on commas**, so a value containing a comma is refused.
+
+`page.total` is `null` when a per-row policy makes the count unknowable; pages can then be short or empty with
+more behind them, and `all()` stops at the first empty page (`stopAfterEmptyPages` to be more patient).
+`select()` leaves unselected columns in the row as `null`.
+
+`createMany(rows)` creates a few at a time and returns `{ created, failed }`. It is **not atomic.**
+
+## Auth
+
+```ts
+const { session, verificationRequired } = await pawabase.auth.signUp({ email, password, data: { plan: "free" } });
+
+const result = await pawabase.auth.signInWithPassword({ email, password });
+if (result.status === "mfa_required") await result.verify(codeFromAuthenticator);
+
+pawabase.auth.onAuthStateChange((event, session) => { /* INITIAL_SESSION | SIGNED_IN | TOKEN_REFRESHED | USER_UPDATED | SIGNED_OUT */ });
+
+await pawabase.auth.getUser();
+await pawabase.auth.updateUser({ name: "Ada", data: { theme: "dark" } });
+await pawabase.auth.signOut();                 // { scope: "global" } ends every session
+```
+
+**The session is managed for you.** It is stored (`localStorage` in browsers, memory elsewhere; pass `auth.storage`
+for anything else), refreshed shortly before it expires, and refreshed **once** at a time. Akountz rotates refresh tokens and
+treats a reused one as theft, so concurrent refreshes would sign the user out: concurrent requests share one exchange,
+and across tabs the Web Locks API serialises it where the browser has it (tab-to-tab behaviour is covered by a simulated test, not a real browser). A `401` on a request triggers one refresh and a replay.
+
+Also: `signInWithMagicLink` / `verifyMagicLink`, `requestPasswordReset` / `resetPassword`, `verifyEmail`,
+`resendVerification`, `confirmEmailChange`, `mfa.*` (enroll, verify, disable, recovery codes), `sessions.*`,
+`orgs.*` (members, invitations, teams), `devices.*`, `apiKeys.*` (keys a user makes for themselves), `exchangeCode(code)`, `switchOrg(slug)`, `settings()`.
+
+Also: **guest sessions** (`signInAnonymously()`, then `upgradeAnonymous({ email, password })` keeps what the guest made), **emailed codes**
+(`sendEmailCode({ email })`, `verifyEmailCode({ email, code })`), **passkeys** (in a browser `auth.passkeys.register()` and
+`auth.passkeys.signIn()` do the whole WebAuthn ceremony; `list`, `remove`, and the `request…` / `finish…` pairs are there for native apps and tests),
+`issueToken("billing")` for a short-lived token for another service, and `jwks()` for the public keys that verify it.
+
+**Social sign-in** needs the `environment` in the options, because the provider URL names it (a publishable key only: a secret key is refused):
+
+```ts
+const pawabase = createClient({ url, apiKey, environment: "production" });
+pawabase.auth.signInWithOAuth("github", { redirectTo: location.origin });  // redirects
+// On return, the tokens in the URL fragment are picked up automatically (detectSessionInUrl).
+```
+
+## Storage
+
+```ts
+const avatars = pawabase.storage.from("avatars");
+
+await avatars.upload("u1/me.png", file);                       // Blob, File, bytes, string or stream
+const blob = await avatars.download("u1/me.png");
+const { files, prefixes, cursor } = await avatars.list({ prefix: "u1/" });
+for await (const file of avatars.listAll({ prefix: "u1/" })) { … }
+await avatars.remove("u1/me.png");
+
+avatars.getPublicUrl("u1/me.png");                             // public bucket, for <img src>
+const { url } = await avatars.createSignedUrl("u1/me.png", { expiresIn: 300 });
+const slot = await avatars.createSignedUploadUrl("u1/new.png", { contentType: "image/png", maxBytes: 1e6 });
+await avatars.uploadToSignedUrl(slot.url, file);               // sends no key: the URL is the credential
+```
+
+## Functions, flows and routes
+
+```ts
+await pawabase.functions.invoke<{ total: number }>("price", { sku: "a" });   // unwraps { data }
+await pawabase.flows.run("whoami");                                          // the flow's response body
+await pawabase.routes.post("checkout/start", { cart: 1 }, { query: { dry: true } });
+await pawabase.request("GET", "/v1/anything");                               // raw, with auth and retries
+```
+
+## Realtime
+
+```ts
+const room = pawabase.realtime.channel<{ text: string }>("chat:lobby", { presence: { name: "Ada" }, replay: 50 });
+
+room.on("message", (m) => console.log(m.from, m.payload.text));
+room.onEvent("typing", (m) => …);
+room.on("presence", ({ joins, leaves, members }) => …);
+
+await room.subscribe();                      // rejects with RealtimeError("forbidden") if the channel's rule refuses
+await room.send("message", { text: "hi" });  // resolves when the server accepted it
+await room.track({ name: "Ada", typing: true });
+await room.history(20);
+for await (const m of room) { … }            // or iterate
+await room.unsubscribe();
+```
+
+The connection reconnects with backoff, rejoins every channel, and with `replay: n` fetches what you missed
+and delivers it once (messages are de-duplicated by id). Pings run every 25 s and a silent link is recycled.
+A refreshed access token is sent to the open socket without reconnecting.
+
+No socket needed: `for await (const frame of pawabase.realtime.stream(["chat:lobby"])) …` listens over Server-Sent Events (stop with `break` or an
+`AbortSignal`), and `pawabase.realtime.publish(...)` sends. Channel rules and dashboards are managed with `manage(client).realtimeChannels` and
+`manage(client).dashboards`.
+
+On Node 20 there is no global `WebSocket`; pass one: `realtime: { webSocket: WebSocket }` from the `ws` package.
+
+HTTP counterparts need no socket: `realtime.publish(channel, event, payload)`, `realtime.presence(channel)`, `realtime.history(channel)`.
+
+## Managing an environment (secret key)
+
+Everything Studio does is available to your servers and scripts with an environment's secret key (`pb_sk_…`), as two subpath imports that stay out of
+your browser bundle unless you import them:
+
+```ts
+import { createClient } from "@pawabase/client";
+import { manage } from "@pawabase/client/manage";
+import { admin } from "@pawabase/client/admin";
+
+const pawabase = createClient({ url, apiKey: process.env.PAWABASE_SECRET_KEY!, environment: "production" });
+const m = manage(pawabase);
+
+await m.secrets.set("STRIPE_KEY", "sk_live_…");
+await m.firewall.ban("203.0.113.7", { seconds: 3600 });
+await m.jobs.replay({ job: "send_mail", sinceMinutes: 60, dryRun: true });
+await m.backups.snapshot("before-launch");
+await manage(pawabase, "staging").flows.list();            // the same API for another environment the key may manage
+
+const a = admin(pawabase);                                  // the people who sign in to your application
+await a.users.create({ email: "ada@example.com", password: "…", roles: ["editor"] });
+await a.users.update(userId, { disabled: true });
+await a.orgs.addMember("acme", { email: "ada@example.com", role: "admin" });
+```
+
+`manage()` groups the platform by what you are doing: **data** (`resources`, `schema`, `policies`, `schemas`, `transformers`, `routes`, `database`, `runtime`),
+**automation** (`flows`, `schedules`, `subscriptions`, `events`, `webhooks`, `inboundHooks`, `jobs`, `functions`), **files and mail** (`buckets`, `cache`, `mail`,
+`mailTemplates`), **access** (`keys`, `secrets`, `domains`, `firewall`), **observe** (`observability`, `alarms`, `statusPage`, `health`) and **lifecycle**
+(`environments`, `releases`, `backups`). Definitions (`flows`, `policies`, `webhooks`…) share `list`, `getOne`, `create`, `replace` and `remove`, and take
+`{ branch }` to work on a feature branch. `admin()` has `users`, `roles`, `orgs`, `invitations`, `sessions`, `apiKeys`, `devices` and `insight`
+(events, statistics, identity backup, hosted pages). Both refuse a publishable key, and a key manages only its own environment.
+
+To write the functions themselves in TypeScript, see [`@pawabase/functions`](https://github.com/Pawabase/pawabase-functions-js).
+
+## Types
+
+Generate a `Database` type from your environment's OpenAPI document:
+
+```bash
+npx pawabase-types --url https://api.example.com --project acme --env production --out src/pawabase.types.ts
+# or, with the document saved from Studio's API Explorer:
+npx pawabase-types --file openapi.json --out src/pawabase.types.ts
+```
+
+```ts
+import type { Database } from "./pawabase.types";
+const pawabase = createClient<Database>({ url, apiKey });
+
+await pawabase.from("posts").create({ title: "ok" });      // checked
+await pawabase.from("posts").create({ views: 3 });         // error: title is required
+pawabase.from("posts").eq("nope", 1);                      // error: no such column
+```
+
+The gateway serves the document when the environment's **public docs** setting is on. Run `pawabase-types --check` in CI to catch drift.
+Relations you `expand` are not in the document; add them to a row type yourself:
+`pawabase.resource<Post & { author: Author }>("posts")`.
+
+## Errors
+
+Everything thrown is a `PawabaseError`. Server answers are `ApiError`s (the server sends several body shapes, normalised here):
+
+| Class | When | Useful fields |
+| --- | --- | --- |
+| `AuthenticationError` | `401`: bad key (`code: "invalid_api_key"`), signed out, expired | |
+| `PermissionError` | `403` | `policy`: the refusing policy, when the server names it |
+| `NotFoundError` | `404`: no record, or a read policy hides it | |
+| `ValidationError` | `422` | `issues`, `fieldError("email")`, `byField()` |
+| `ConflictError` | `409` | |
+| `RateLimitError` | `429` | `retryAfter` (seconds) |
+| `ServerError` | `5xx` | |
+| `NetworkError` / `TimeoutError` / `AbortError` | no response | |
+| `ConfigError` / `InvalidQueryError` / `RealtimeError` | misuse, refused query, socket refusals | |
+
+Every `ApiError` has `status`, `code`, `message`, `details`, `body` and **`requestId`**: quote it to find the request in Studio → Observability.
+
+```ts
+try { await pawabase.from("posts").create(input); }
+catch (e) {
+  if (e instanceof ValidationError) showFieldErrors(e.byField());
+  else if (e instanceof PermissionError) console.warn(`refused by policy ${e.policy}`);
+  else throw e;
+}
+```
+
+## Retries and timeouts
+
+| Situation | Retried? |
+| --- | --- |
+| `429` | Yes, any method (it is answered before a handler runs), waiting `Retry-After` up to `maxRetryAfterMs` (30 s), else surfaced |
+| `502` `503` `504`, network failure, timeout | Yes for `GET` `PUT` `DELETE`; **not** for `POST` / `PATCH` unless `idempotent: true` |
+| `500`, `4xx` | No |
+| Token refresh | Never retried on a network failure: a replayed refresh token looks like theft |
+
+Defaults: 2 retries, full-jitter backoff 300 ms → 8 s, 30 s timeout per attempt.
+Configure with `retry`, `timeoutMs`; every call also takes an `AbortSignal` (`query.withOptions({ signal })`, `{ signal }`).
+
+`hooks: { onRequest, onResponse, onRetry, onError }` observe traffic (API keys and tokens are masked).
+
+## Servers and SSR
+
+```ts
+// A server acting for the signed-in user of this request: no session, no refresh, no storage.
+const asUser = pawabase.asUser(tokenFromTheRequest);
+await asUser.from("tasks").all();
+
+// A server acting as itself, bypassing policies.
+const server = createClient({ url, apiKey: process.env.PAWABASE_SECRET_KEY! });
+```
+
+## Testing your app
+
+Pass your own `fetch`, or point `url` at a local stack. `auth.storage` takes any `{ getItem, setItem, removeItem }`,
+and `client.dispose()` stops timers and the socket.
+
+## Development
+
+```bash
+npm install
+npm test                                   # unit tests against local fake servers
+PAWABASE_LIVE_CONFIG=/tmp/pb/config.json npm test   # plus contract tests against a real stack
+```
+
+The live config (`url`, `project`, `environment`, `publishable`, `secret`) is written by `scripts/live-provision.py`
+after the stack is up (`scripts/dev.sh`). Without it the live tests are skipped.

package/dist/cjs/admin.d.ts

@@ -0,0 +1,187 @@
+/**
+ * Administer the environment's users, organizations and roles, with the environment's secret key (`pb_sk_…`).
+ *
+ * These are the people who sign in to *your* application, not the project's own team. Every call is scoped to one environment;
+ * a user of one environment is never visible in another.
+ *
+ * ```ts
+ * import { createClient } from "@pawabase/client";
+ * import { admin } from "@pawabase/client/admin";
+ *
+ * const a = admin(createClient({ url, apiKey: "pb_sk_…", environment: "production" }));
+ * await a.users.create({ email: "ada@example.com", password: "…", roles: ["editor"] });
+ * await a.users.update(userId, { disabled: true });
+ * await a.orgs.addMember("acme", { email: "ada@example.com", role: "admin" });
+ * ```
+ */
+import type { PawabaseClient } from "./client.js";
+import type { HttpClient } from "./http.js";
+import { Service, type Api, type Body } from "./manage/base.js";
+declare class AdminService extends Service {
+    protected path(suffix?: string): string;
+}
+export interface NewUser {
+    email: string;
+    password?: string;
+    username?: string;
+    name?: string;
+    /** Default `true`: an operator vouches for the address. */
+    emailVerified?: boolean;
+    /** Visible to the user and editable by them. */
+    userMetadata?: Body;
+    /** Visible to your server only. */
+    appMetadata?: Body;
+    roles?: string[];
+}
+export interface UserChanges {
+    name?: string;
+    emailVerified?: boolean;
+    /** Blocks sign-in and ends the user's sessions. */
+    disabled?: boolean;
+    password?: string;
+    userMetadata?: Body;
+    appMetadata?: Body;
+    /** Replaces the user's roles. */
+    roles?: string[];
+    /** Clears a lockout after failed sign-ins. */
+    unlock?: boolean;
+}
+export declare class Users extends AdminService {
+    /** `search` matches email, username and name. `status`: `disabled`, `unverified`, `locked`, `mfa`, `no_mfa`. */
+    search(options?: {
+        search?: string;
+        status?: string;
+        limit?: number;
+        offset?: number;
+    }): Promise<Api>;
+    getUser(userId: string): Promise<Api>;
+    /** Create an account without the sign-up restrictions (allow-lists; the password policy still applies). */
+    create(user: NewUser): Promise<Api>;
+    update(userId: string, changes: UserChanges): Promise<Api>;
+    deleteUser(userId: string): Promise<Api>;
+    /** The user's recent sign-ins and security events. */
+    history(userId: string): Promise<Api>;
+    /** Remove the user's second factors, so they can sign in with a password alone and enrol again. */
+    resetMfa(userId: string): Promise<Api>;
+    /** Give the user permissions directly, beyond their roles' (`posts:write`, `billing:*`). */
+    grant(userId: string, permissions: string[]): Promise<Api>;
+    revoke(userId: string, permissions: string[]): Promise<Api>;
+    /** Sign the user out everywhere. */
+    revokeSessions(userId: string): Promise<Api>;
+    revokeSession(userId: string, sessionId: string): Promise<Api>;
+    devices(userId: string): Promise<Api>;
+    forgetDevice(userId: string, deviceId: string): Promise<Api>;
+    /** The user's own API keys (never the secrets). */
+    apiKeys(userId: string): Promise<Api>;
+}
+export declare class Roles extends AdminService {
+    /** Roles with their permissions. */
+    list(): Promise<Api>;
+    /** Create or replace a role. Names are lowercase (`editor`, `org:billing`); permissions are `resource:action` patterns with `*` wildcards. */
+    define(name: string, permissions: string[], options?: {
+        description?: string;
+    }): Promise<Api>;
+    remove(name: string): Promise<Api>;
+}
+/** Organizations (tenants) and their members. A member's role is `owner`, `admin` or `member`. */
+export declare class Orgs extends AdminService {
+    list(): Promise<Api>;
+    getOrg(slug: string): Promise<Api>;
+    create(slug: string, name: string, options?: {
+        ownerEmail?: string;
+        metadata?: Body;
+    }): Promise<Api>;
+    update(slug: string, changes: {
+        name?: string;
+        metadata?: Body;
+    }): Promise<Api>;
+    remove(slug: string): Promise<Api>;
+    /** Add an existing user straight in. */
+    addMember(slug: string, member: {
+        email: string;
+        role?: string;
+    }): Promise<Api>;
+    setMemberRole(slug: string, userId: string, role: string): Promise<Api>;
+    removeMember(slug: string, userId: string): Promise<Api>;
+    /** Mail an invitation; `redirectTo` must be one of the environment's allowed redirect URLs. */
+    invite(slug: string, invitation: {
+        email: string;
+        role?: string;
+        redirectTo?: string;
+    }): Promise<Api>;
+}
+export declare class Invitations extends AdminService {
+    /** Pending and past invitations across organizations. */
+    list(): Promise<Api>;
+    resend(invitationId: string, options?: {
+        redirectTo?: string;
+    }): Promise<Api>;
+    revoke(invitationId: string): Promise<Api>;
+}
+export declare class Sessions extends AdminService {
+    /** Active sessions across users. */
+    list(options?: {
+        limit?: number;
+    }): Promise<Api>;
+    /** End one session (all its refresh tokens). */
+    revoke(family: string): Promise<Api>;
+}
+/** API keys users made for themselves. */
+export declare class ApiKeys extends AdminService {
+    list(options?: {
+        limit?: number;
+    }): Promise<Api>;
+    revoke(keyId: string): Promise<Api>;
+}
+export declare class Devices extends AdminService {
+    /** Recent devices people signed in from. */
+    list(options?: {
+        limit?: number;
+    }): Promise<Api>;
+}
+/** Events, statistics, identity backup and the hosted pages. */
+export declare class Insight extends AdminService {
+    /** Authentication events (sign-ins, sign-ups, resets, MFA…). `failed` for failures only. */
+    events(options?: {
+        kind?: string;
+        failed?: boolean;
+        limit?: number;
+    }): Promise<Api>;
+    /** Counts of users, sign-ins, MFA use and failures. */
+    stats(): Promise<Api>;
+    /** Every identity (users, organizations, roles, factors) as a document. */
+    backup(): Promise<Api>;
+    /** Apply the `identities` of a backup. `dryRun` reports what would change. */
+    restore(identities: Body, options?: {
+        replace?: boolean;
+        dryRun?: boolean;
+    }): Promise<Api>;
+    /** The HTML a hosted sign-in page is served as for the branding being edited (the saved branding when omitted). */
+    /** The claims a token profile would put in a token for this user (and organization), without issuing one. */
+    previewTokenProfile(profile: Body, userId: string, options?: {
+        org?: string;
+    }): Promise<Api>;
+    hostedSource(page: string, options?: {
+        branding?: Body;
+        form?: Body;
+    }): Promise<Api>;
+}
+export declare class Admin {
+    private readonly http;
+    readonly environment: string;
+    readonly users: Users;
+    readonly roles: Roles;
+    readonly orgs: Orgs;
+    readonly invitations: Invitations;
+    readonly sessions: Sessions;
+    readonly apiKeys: ApiKeys;
+    readonly devices: Devices;
+    readonly insight: Insight;
+    constructor(http: HttpClient, environment: string);
+    /** The same services for another environment the key may manage. */
+    withEnvironment(name: string): Admin;
+}
+/** User administration for the client's environment (or `environment`). Needs a secret key. */
+export declare function admin(client: PawabaseClient<any>, environment?: string): Admin;
+export {};
+//# sourceMappingURL=admin.d.ts.map

package/dist/cjs/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAO,KAAK,GAAG,EAAE,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAGrE,cAAM,YAAa,SAAQ,OAAO;cACb,IAAI,CAAC,MAAM,SAAK,GAAG,MAAM;CAG7C;AAED,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gDAAgD;IAChD,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,mCAAmC;IACnC,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,KAAM,SAAQ,YAAY;IACrC,gHAAgH;IAChH,MAAM,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAIzG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAIrC,2GAA2G;IAC3G,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAanC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;IAa1D,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAIxC,sDAAsD;IACtD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAIrC,mGAAmG;IACnG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAItC,4FAA4F;IAC5F,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAI1D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAI3D,oCAAoC;IACpC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAI5C,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAI9D,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAIrC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAI5D,mDAAmD;IACnD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;CAGtC;AAED,qBAAa,KAAM,SAAQ,YAAY;IACrC,oCAAoC;IACpC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IAIpB,8IAA8I;IAC9I,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAIjG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;CAGnC;AAED,kGAAkG;AAClG,qBAAa,IAAK,SAAQ,YAAY;IACpC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IAIpB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAIlC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;KAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAIxG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAI/E,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAIlC,wCAAwC;IACxC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAI/E,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAIvE,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAIxD,+FAA+F;IAC/F,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;CAGtG;AAED,qBAAa,WAAY,SAAQ,YAAY;IAC3C,yDAAyD;IACzD,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC;IAIpB,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAIjF,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;CAG3C;AAED,qBAAa,QAAS,SAAQ,YAAY;IACxC,oCAAoC;IACpC,IAAI,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAIpD,gDAAgD;IAChD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;CAGrC;AAED,0CAA0C;AAC1C,qBAAa,OAAQ,SAAQ,YAAY;IACvC,IAAI,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAIpD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;CAGpC;AAED,qBAAa,OAAQ,SAAQ,YAAY;IACvC,4CAA4C;IAC5C,IAAI,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,GAAG,CAAC;CAGrD;AAED,gEAAgE;AAChE,qBAAa,OAAQ,SAAQ,YAAY;IACvC,4FAA4F;IAC5F,MAAM,CAAC,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAIvF,uDAAuD;IACvD,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC;IAIrB,2EAA2E;IAC3E,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC;IAItB,8EAA8E;IAC9E,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAI9F,mHAAmH;IACnH,6GAA6G;IAC7G,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAIhG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAO,GAAG,OAAO,CAAC,GAAG,CAAC;CAGzF;AAED,qBAAa,KAAK;IAWd,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM;IAX9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;gBAGP,IAAI,EAAE,UAAU,EACxB,WAAW,EAAE,MAAM;IAY9B,oEAAoE;IACpE,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK;CAGrC;AAED,+FAA+F;AAC/F,wBAAgB,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAK9E"}