@pawabase/client 0.0.0-stage → 0.1.0

package/dist/esm/auth.d.ts

@@ -0,0 +1,448 @@
+import type { HttpClient, TokenProvider } from "./http.js";
+import { type SessionStorage } from "./session-store.js";
+import type { AuthSettings, Identity, Invitation, MfaEnrollment, MfaStatus, OrgMember, OrgRole, Organization, Session, SessionInfo, SignInEvent, Team, User } from "./types.js";
+export type AuthChangeEvent = "INITIAL_SESSION" | "SIGNED_IN" | "SIGNED_OUT" | "TOKEN_REFRESHED" | "USER_UPDATED";
+export type AuthListener = (event: AuthChangeEvent, session: Session | null) => unknown;
+export interface AuthOptions {
+    /**
+     * Where the session lives. Default: `localStorage` in a browser, memory elsewhere.
+     * Pass your own (React Native's AsyncStorage, a cookie jar…) with `getItem`/`setItem`/`removeItem`.
+     */
+    storage?: SessionStorage;
+    /** Key under which the session is stored. Default: derived from the URL and API key. */
+    storageKey?: string;
+    /** Keep the session between page loads. Default `true`. `false` keeps it in memory only. */
+    persistSession?: boolean;
+    /** Refresh the access token shortly before it expires. Default `true`. */
+    autoRefreshToken?: boolean;
+    /** Seconds before expiry at which the token counts as expiring. Default `60`. */
+    refreshMarginSeconds?: number;
+    /** Read tokens a social sign-in left in the URL fragment. Default `true` in browsers. */
+    detectSessionInUrl?: boolean;
+}
+export type SignInResult = {
+    status: "signed_in";
+    session: Session;
+} | {
+    status: "mfa_required";
+    mfaToken: string;
+    factors: string[];
+    /** Finish the sign-in with an authenticator or recovery code. */
+    verify: (code: string) => Promise<Session>;
+};
+export interface SignUpResult {
+    user: User;
+    /** `null` when the address must be confirmed first. */
+    session: Session | null;
+    verificationRequired: boolean;
+}
+export type UrlSessionResult = {
+    status: "signed_in";
+    session: Session;
+} | {
+    status: "mfa_required";
+    mfaToken: string;
+    verify: (code: string) => Promise<Session>;
+} | {
+    status: "linked";
+    provider: string;
+} | {
+    status: "error";
+    error: string;
+} | {
+    status: "none";
+};
+export interface UpdateUserInput {
+    name?: string;
+    avatar_url?: string;
+    /** Merged into `user_metadata`. */
+    data?: Record<string, unknown>;
+    password?: string;
+    /** Required when changing the password of an account that has one. */
+    current_password?: string;
+    /** Starts an email change: a confirmation link goes to the new address. */
+    email?: string;
+}
+interface WireSession extends Omit<Session, "user" | "expires_at"> {
+    user?: User;
+    expires_at?: number;
+}
+/**
+ * Sign-in, session lifecycle and everything about the signed-in person.
+ *
+ * The session is kept in storage, refreshed before it expires, and refreshed only
+ * once at a time: Akountz rotates refresh tokens and treats a reused one as theft,
+ * so two refreshes racing (two requests, or two tabs) would sign the user out.
+ * Concurrent callers share one refresh; across tabs the Web Locks API serialises it.
+ */
+export declare class AuthClient implements TokenProvider {
+    private readonly http;
+    private readonly options;
+    private session;
+    private readonly listeners;
+    private readonly storage;
+    private readonly persist;
+    private readonly storageKey;
+    private readonly autoRefresh;
+    private readonly margin;
+    private timer;
+    private inflight;
+    private readonly ready;
+    private disposers;
+    private disposed;
+    readonly mfa: AuthMfa;
+    readonly sessions: AuthSessions;
+    readonly orgs: AuthOrgs;
+    /** Browsers and apps the user has signed in from. */
+    readonly devices: AuthDevices;
+    /** Keys a user makes for themselves to call the API as themselves. */
+    readonly apiKeys: AuthApiKeys;
+    /** Passkeys (WebAuthn): register one, sign in with one. */
+    readonly passkeys: AuthPasskeys;
+    constructor(http: HttpClient, options?: AuthOptions & {
+        project?: string | undefined;
+        environment?: string | undefined;
+    });
+    private initialize;
+    /** Resolves once the stored session has been read. Everything else awaits it for you. */
+    initialized(): Promise<void>;
+    /** Stop timers and listeners. Call when discarding a client (tests, hot reload). */
+    dispose(): void;
+    /**
+     * Be told about sign-ins, sign-outs and refreshes (also from other tabs).
+     * The listener is called once, soon, with `INITIAL_SESSION`.
+     */
+    onAuthStateChange(listener: AuthListener): {
+        unsubscribe: () => void;
+    };
+    private emit;
+    private call;
+    /**
+     * The current session, refreshed first when it is about to expire. `null` when signed out.
+     * Throws only if the token has already expired and refreshing failed for a reason that
+     * may pass (offline, a server error).
+     */
+    getSession(): Promise<Session | null>;
+    /** The access token to send as a bearer, or `null`. */
+    getAccessToken(): Promise<string | null>;
+    /** The signed-in user as last known, without a request. */
+    getCachedUser(): Promise<User | null>;
+    /** Called by the transport after a `401`: refresh once, unless someone already did. */
+    onUnauthorized(failed: string): Promise<string | null>;
+    private expiring;
+    /**
+     * Adopt a session you obtained elsewhere (a server-side rendered page's cookies,
+     * a mobile deep link). Both tokens are required; the user is fetched with them.
+     */
+    setSession(tokens: {
+        access_token: string;
+        refresh_token: string;
+    }): Promise<Session>;
+    private store;
+    private schedule;
+    private watchOtherTabs;
+    /** Exchange the refresh token for a new session. Concurrent calls share one exchange. */
+    refreshSession(options?: {
+        org?: string | null;
+    }): Promise<Session>;
+    private exclusive;
+    private doRefresh;
+    /** What this environment offers: sign-up, magic links, MFA, providers, password rules. */
+    settings(): Promise<AuthSettings>;
+    /**
+     * Create an account. When the project requires email confirmation the result has no
+     * session (`verificationRequired` is `true`); otherwise the user is signed in.
+     */
+    signUp(input: {
+        email: string;
+        password: string;
+        username?: string;
+        name?: string;
+        /** Initial `user_metadata`. */
+        data?: Record<string, unknown>;
+        /** Where the confirmation link sends the user. Must be an allowed redirect URL. */
+        redirectTo?: string;
+    }): Promise<SignUpResult>;
+    /**
+     * Sign in with email and password. When the account has MFA the result is
+     * `{ status: "mfa_required" }`; call its `verify(code)` to finish.
+     */
+    signInWithPassword(input: {
+        email: string;
+        password: string;
+        org?: string;
+    }): Promise<SignInResult>;
+    private challenge;
+    /** Finish an MFA sign-in with an authenticator code or a recovery code. */
+    verifyMfa(input: {
+        mfaToken: string;
+        code: string;
+        org?: string;
+    }): Promise<Session>;
+    /** Email a one-time sign-in link. Always resolves the same way, so it does not reveal whether an account exists. */
+    signInWithMagicLink(input: {
+        email: string;
+        redirectTo?: string;
+        createUser?: boolean;
+    }): Promise<void>;
+    /** Exchange the token from a magic-link email for a session. */
+    verifyMagicLink(token: string): Promise<SignInResult>;
+    /** Keep a session the server just issued and announce it. */
+    private adopt;
+    /**
+     * Start a guest session: an account with no email or password, for someone who has not signed up yet. Turn it into a real account with
+     * {@link upgradeAnonymous}, keeping everything the guest created. The environment must allow guest sign-in.
+     */
+    signInAnonymously(): Promise<Session>;
+    /** Turn the signed-in guest into a full account. A verification email is sent. */
+    upgradeAnonymous(input: {
+        email: string;
+        password?: string;
+        name?: string;
+        redirectTo?: string;
+    }): Promise<{
+        user: User;
+        verification_sent: boolean;
+    }>;
+    /** Email a short sign-in code. The answer is the same whether or not the address has an account. */
+    sendEmailCode(input: {
+        email: string;
+        createUser?: boolean;
+    }): Promise<void>;
+    /** Sign in with the code from {@link sendEmailCode}. An account with a second factor answers `mfa_required`. */
+    verifyEmailCode(input: {
+        email: string;
+        code: string;
+    }): Promise<SignInResult>;
+    /** The public keys that verify integration tokens ({@link issueToken}), for a server that checks them. */
+    jwks(): Promise<{
+        keys: Array<Record<string, unknown>>;
+    }>;
+    /**
+     * Exchange the signed-in session for a short-lived token for another service, shaped by a token profile you defined in Studio.
+     */
+    issueToken(profile: string): Promise<IssuedToken>;
+    /** Where to send the browser for a social sign-in. Needs `environment` in the client options (or a signed-in session, which names it). */
+    signInWithOAuthUrl(provider: string, options?: {
+        redirectTo?: string;
+    }): string;
+    /** Trade the `code` a sign-in redirect carried for a session (pass the verifier of a PKCE `code_challenge` if the sign-in began with one). */
+    exchangeCode(code: string, codeVerifier?: string): Promise<Session>;
+    /** Redirect the browser to a provider. After the round trip, {@link getSessionFromUrl} (run automatically) picks the session up. */
+    signInWithOAuth(provider: string, options?: {
+        redirectTo?: string;
+    }): void;
+    private scope;
+    /**
+     * Read what a social sign-in left in the URL fragment (`#access_token=…`), store the
+     * session, and clean the URL. Called automatically in browsers; call it yourself in
+     * a mobile deep-link handler.
+     */
+    getSessionFromUrl(url?: string): Promise<UrlSessionResult>;
+    /**
+     * Sign out. `local` (default) ends this session, `others` every other one, `global` all of them.
+     * The local session is always cleared, even when the server cannot be reached.
+     */
+    signOut(options?: {
+        scope?: "local" | "global" | "others";
+    }): Promise<void>;
+    /** The user, fresh from the server (and the session's cached copy is updated). */
+    getUser(): Promise<User>;
+    /** Update the profile, password or (with confirmation) email. */
+    updateUser(input: UpdateUserInput): Promise<User>;
+    /** Send the confirmation email again. Always resolves the same way. */
+    resendVerification(input: {
+        email: string;
+        redirectTo?: string;
+    }): Promise<void>;
+    /** Confirm an address with the token from the email. Signs the user in. */
+    verifyEmail(token: string): Promise<Session>;
+    /** Confirm a new address with the token from the email. */
+    confirmEmailChange(token: string): Promise<void>;
+    /** Email a password reset link. Always resolves the same way. */
+    requestPasswordReset(input: {
+        email: string;
+        redirectTo?: string;
+    }): Promise<void>;
+    /** Set a new password with the token from the reset email. Every other session is ended and this one is signed in. */
+    resetPassword(input: {
+        token: string;
+        password: string;
+    }): Promise<Session>;
+    /** A URL that links a provider to the signed-in account when the browser visits it. */
+    linkIdentityUrl(provider: string, options?: {
+        redirectTo?: string;
+    }): Promise<string>;
+    unlinkIdentity(identityId: number): Promise<void>;
+    identities(): Promise<Identity[]>;
+    /** Issue tokens for another organization the user belongs to (or `null` for none). */
+    switchOrg(slug: string | null): Promise<Session>;
+    /** Wait `ms` (abortable). Handy in tests. */
+    protected pause(ms: number): Promise<void>;
+}
+declare class AuthMfa {
+    private readonly http;
+    private readonly refresh;
+    constructor(http: HttpClient, refresh: () => Promise<Session>);
+    status(): Promise<MfaStatus>;
+    /** Start enrolling an authenticator app. Show `otpauth_uri` as a QR code, then call {@link verifyEnrollment}. */
+    enroll(): Promise<MfaEnrollment>;
+    /** Confirm enrolment with a first code. Returns one-time recovery codes: show them once. */
+    verifyEnrollment(code: string): Promise<{
+        enabled: boolean;
+        recovery_codes: string[];
+    }>;
+    /** Start using emailed codes as a factor (a code is sent to the account's address). */
+    enrollEmail(): Promise<unknown>;
+    /** Send the emailed code for a sign-in that is waiting on MFA. */
+    challenge(mfaToken: string): Promise<unknown>;
+    /** When the environment requires MFA, a sign-in is held until a factor is set up: start it (`totp` or `email`). */
+    startSetup(input: {
+        mfaToken: string;
+        method: "totp" | "email";
+    }): Promise<unknown>;
+    /** Finish the required setup with a first code: the response carries the session and the recovery codes. */
+    completeSetup(input: {
+        mfaToken: string;
+        code: string;
+        org?: string;
+    }): Promise<{
+        recovery_codes?: string[];
+        access_token?: string;
+    }>;
+    disable(code: string): Promise<{
+        enabled: boolean;
+    }>;
+    /** Replace the recovery codes. Needs a current authenticator code. */
+    regenerateRecoveryCodes(code: string): Promise<{
+        recovery_codes: string[];
+    }>;
+}
+export interface IssuedToken {
+    token: string;
+    token_type: string;
+    expires_in: number;
+    expires_at: number;
+    audience: string;
+}
+export interface Passkey {
+    id: string;
+    name: string;
+    device_type: string;
+    backed_up: boolean;
+    transports: string[];
+    created_at: string;
+    last_used_at: string | null;
+}
+/** What the server asks the device to do, and the ticket that ties the answer back to the request. */
+export interface PasskeyChallenge {
+    ticket: string;
+    options: Record<string, unknown>;
+}
+/**
+ * Passkeys. In a browser, {@link register} and {@link signIn} do the whole ceremony. Anywhere else (a native app, a test), use the
+ * `request…` and `finish…` pairs: hand `options` to the platform's WebAuthn, and send what it returns (already encoded as the
+ * server expects) back with the `ticket`.
+ */
+declare class AuthPasskeys {
+    private readonly http;
+    private readonly adopt;
+    constructor(http: HttpClient, adopt: (wire: WireSession) => Promise<Session>);
+    list(): Promise<Passkey[]>;
+    remove(passkeyId: string): Promise<void>;
+    /** Begin adding a passkey to the signed-in account. */
+    requestRegistration(): Promise<PasskeyChallenge>;
+    /** Finish adding a passkey with the credential the device made. */
+    finishRegistration(input: {
+        ticket: string;
+        credential: Record<string, unknown>;
+        name?: string;
+    }): Promise<{
+        passkey: Passkey;
+    }>;
+    /** Begin signing in with a passkey. With an email, only that account's passkeys are offered. */
+    requestSignIn(input?: {
+        email?: string;
+    }): Promise<PasskeyChallenge>;
+    /** Finish signing in with the credential the device made. */
+    finishSignIn(input: {
+        ticket: string;
+        credential: Record<string, unknown>;
+    }): Promise<Session>;
+    /** In a browser: ask the device to make a passkey and add it to the signed-in account. */
+    register(input?: {
+        name?: string;
+    }): Promise<Passkey>;
+    /** In a browser: ask the device for a passkey and sign in with it. */
+    signIn(input?: {
+        email?: string;
+    }): Promise<Session>;
+}
+declare class AuthSessions {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(): Promise<SessionInfo[]>;
+    /** Sign one session out (a lost phone, another browser). */
+    revoke(sessionId: string): Promise<void>;
+    /** Recent sign-in activity for the account. */
+    history(): Promise<SignInEvent[]>;
+}
+declare class AuthDevices {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(): Promise<Array<Record<string, unknown>>>;
+    forget(deviceId: string): Promise<void>;
+}
+declare class AuthApiKeys {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(): Promise<Array<Record<string, unknown>>>;
+    /** Make a key. The secret is in the answer once and never again. */
+    create(input: {
+        name: string;
+        scopes?: string[];
+        expiresInDays?: number;
+        org?: string;
+    }): Promise<{
+        secret?: string;
+    } & Record<string, unknown>>;
+    revoke(keyId: string): Promise<void>;
+}
+declare class AuthOrgs {
+    private readonly http;
+    constructor(http: HttpClient);
+    private base;
+    list(): Promise<Organization[]>;
+    create(input: {
+        slug: string;
+        name: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<Organization>;
+    get(slug: string): Promise<Organization>;
+    update(slug: string, input: {
+        name?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<Organization>;
+    delete(slug: string): Promise<void>;
+    members(slug: string): Promise<OrgMember[]>;
+    setMemberRole(slug: string, userId: string, role: OrgRole): Promise<unknown>;
+    removeMember(slug: string, userId: string): Promise<void>;
+    invite(slug: string, input: {
+        email: string;
+        role?: OrgRole;
+        redirectTo?: string;
+    }): Promise<Invitation>;
+    invitations(slug: string): Promise<Invitation[]>;
+    revokeInvitation(slug: string, invitationId: number): Promise<void>;
+    /** Accept an invitation with the token from the email. The user must be signed in. */
+    acceptInvitation(token: string): Promise<unknown>;
+    teams(slug: string): Promise<Team[]>;
+    createTeam(slug: string, input: {
+        slug: string;
+        name: string;
+    }): Promise<Team>;
+    addTeamMember(slug: string, team: string, userId: string): Promise<void>;
+    removeTeamMember(slug: string, team: string, userId: string): Promise<void>;
+}
+export type { AuthMfa, AuthSessions, AuthOrgs };
+//# sourceMappingURL=auth.d.ts.map

package/dist/esm/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAiC,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EACV,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,aAAa,EACb,SAAS,EACT,SAAS,EACT,OAAO,EACP,YAAY,EACZ,OAAO,EACP,WAAW,EACX,WAAW,EACX,IAAI,EACJ,IAAI,EACL,MAAM,YAAY,CAAC;AAGpB,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,WAAW,GACX,YAAY,GACZ,iBAAiB,GACjB,cAAc,CAAC;AAEnB,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC;AAExF,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4FAA4F;IAC5F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yFAAyF;IACzF,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACzC;IACE,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iEAAiE;IACjE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEN,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,uDAAuD;IACvD,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,GACxF;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvB,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,WAAY,SAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC;IAChE,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAoCD;;;;;;;GAOG;AACH,qBAAa,UAAW,YAAW,aAAa;IAyB5C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAzB1B,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAU;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,SAAS,CAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAS;IAEzB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;gBAGb,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,WAAW,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAO;YAoBnG,UAAU;IAoBxB,yFAAyF;IACnF,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlC,oFAAoF;IACpF,OAAO,IAAI,IAAI;IASf;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,YAAY,GAAG;QAAE,WAAW,EAAE,MAAM,IAAI,CAAA;KAAE;IAQtE,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,IAAI;IAWZ;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAc3C,uDAAuD;IACjD,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI9C,2DAA2D;IACrD,aAAa,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAK3C,uFAAuF;IACjF,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAW5D,OAAO,CAAC,QAAQ;IAIhB;;;OAGG;IACG,UAAU,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;YAwB7E,KAAK;IAgBnB,OAAO,CAAC,QAAQ;IAiBhB,OAAO,CAAC,cAAc;IAkCtB,yFAAyF;IACzF,cAAc,CAAC,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAUzD,SAAS;YAST,SAAS;IA0CvB,0FAA0F;IAC1F,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC;IAIjC;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,+BAA+B;QAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,mFAAmF;QACnF,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,YAAY,CAAC;IAwBzB;;;OAGG;IACG,kBAAkB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBzG,OAAO,CAAC,SAAS;IASjB,2EAA2E;IACrE,SAAS,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB1F,oHAAoH;IAC9G,mBAAmB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAa7G,gEAAgE;IAC1D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAU3D,6DAA6D;YAC/C,KAAK;IAOnB;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC;IAK3C,kFAAkF;IAC5E,gBAAgB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAA;KAAE,CAAC;IAoB5J,oGAAoG;IAC9F,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlF,gHAAgH;IAC1G,eAAe,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IASpF,0GAA0G;IACpG,IAAI,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IAK/D;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAIjD,0IAA0I;IAC1I,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,MAAM;IASnF,8IAA8I;IACxI,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYzE,oIAAoI;IACpI,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,IAAI;IAO9E,OAAO,CAAC,KAAK;IASb;;;;OAIG;IACG,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAmChE;;;OAGG;IACG,OAAO,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBrF,kFAAkF;IAC5E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAU9B,iEAAiE;IAC3D,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAQvD,uEAAuE;IACjE,kBAAkB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAStF,2EAA2E;IACrE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYlD,2DAA2D;IACrD,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtD,iEAAiE;IAC3D,oBAAoB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASxF,sHAAsH;IAChH,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAcjF,uFAAuF;IACjF,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IASzF,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjD,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAIvC,sFAAsF;IACtF,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD,6CAA6C;IAC7C,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3C;AAED,cAAM,OAAO;IAET,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC;IAGlD,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC;IAI5B,iHAAiH;IACjH,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC;IAIhC,4FAA4F;IACtF,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAU7F,uFAAuF;IACvF,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,kEAAkE;IAClE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7C,mHAAmH;IACnH,UAAU,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAInF,4GAA4G;IAC5G,aAAa,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IASrI,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAIpD,sEAAsE;IACtE,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAG7E;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,sGAAsG;AACtG,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAwBD;;;;GAIG;AACH,cAAM,YAAY;IAEd,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC;IAG3D,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAK1B,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,uDAAuD;IACvD,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAIhD,mEAAmE;IACnE,kBAAkB,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAQhI,gGAAgG;IAChG,aAAa,CAAC,KAAK,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIxE,6DAA6D;IACvD,YAAY,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAUpG,0FAA0F;IACpF,QAAQ,CAAC,KAAK,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA8B/D,sEAAsE;IAChE,MAAM,CAAC,KAAK,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC;CA2B/D;AAED,cAAM,YAAY;IACJ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAIpC,4DAA4D;IACtD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,+CAA+C;IACzC,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;CAGxC;AAED,cAAM,WAAW;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAK/C,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG9C;AAED,cAAM,WAAW;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAKrD,oEAAoE;IACpE,MAAM,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ1I,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3C;AAED,cAAM,QAAQ;IACA,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,OAAO,CAAC,IAAI;IAIN,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAGrC,MAAM,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAGxG,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAGxC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAGnG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAGjD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAGtE,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAWlG,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAGhD,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAGzE,sFAAsF;IACtF,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI3C,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAG1C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAGxE,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxE,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlF;AAED,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC"}