@secureport/sdk 0.5.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Andrew Jordan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,73 @@
+# @secureport/sdk
+
+A typed client for the [Secureport](https://secureport.io/) hosted API.
+
+```ts
+import { createClient } from '@secureport/sdk';
+
+const client = createClient({
+  apiKey: process.env.SECUREPORT_API_KEY!,
+  baseUrl: 'https://api.secureport.io',
+});
+```
+
+The transport authenticates every call, retries `429`/`502`/`503`/`504`
+with backoff (honouring `Retry-After` when the API sends one), and throws a
+typed `SecureportError` — carrying the same closed `code` union the API
+answers with — for everything else. A request that never reaches a server at
+all throws `SecureportNetworkError` instead, and is not retried.
+
+Resource methods — `targets`, `runs`, `issues`, `reports` and `branding` —
+sit on top of this transport; `client.request()` / `client.requestRaw()` are
+there too, for anything they don't cover yet (`/analytics`, once it ships).
+
+## Upload a scan, get a report
+
+From an existing target to a rendered report:
+
+```ts
+import { readFileSync } from 'node:fs';
+
+const run = await client.runs.create({
+  targetId: 'target_9c1c1347-5539-4432-b1b9-3bdba5a4f576',
+  kind: 'upload',
+  trigger: 'api',
+});
+
+const artifact = await client.runs.import(run.id, {
+  body: readFileSync('scan.jsonl'),
+  contentType: 'application/x-ndjson',
+  engine: 'nuclei',
+});
+
+// A file at or over 5 MiB parses off-request and answers `202 queued` —
+// `finish` refuses with `conflict` until it's done. A small file like this
+// one already comes back `done`, so this resolves immediately.
+const finished =
+  artifact.processingStatus === 'queued' || artifact.processingStatus === 'processing'
+    ? await client.runs.waitForArtifact(run.id, artifact.id)
+    : artifact;
+
+await client.runs.finish(run.id, {
+  status: finished.processingStatus === 'failed' ? 'failed' : 'finished',
+});
+
+const report = await client.reports.request(run.id, { kind: 'vap', format: 'json' });
+console.log(await report.text());
+```
+
+**A file too large for `runs.import()`** — Cloud Run caps a request body at
+32 MiB, whatever the API wants — uses `runs.createUploadUrl()` and
+`runs.completeUpload()` instead: mint a signed URL, `PUT` the bytes yourself
+with a plain `fetch` (not through this client — it would attach your API key
+and the wrong base URL), then complete it. See
+[`examples/runs-create-upload-url.ts`](examples/runs-create-upload-url.ts)
+and [`examples/runs-complete-upload.ts`](examples/runs-complete-upload.ts)
+for the full sequence.
+
+`reports.request` is the one method that doesn't answer typed JSON — every
+format it can ask for streams back as the raw `Response`, since a report is
+Markdown, CSV or SARIF as often as it is JSON. `docs/api.md` has the curl
+equivalent of every endpoint above, plus `issues` and target verification.
+
+**MIT licensed.**

package/dist/client.d.ts

@@ -0,0 +1,135 @@
+import { BrandingResource } from './resources/branding.js';
+import { IssuesResource } from './resources/issues.js';
+import { ReportsResource } from './resources/reports.js';
+import { RunsResource } from './resources/runs.js';
+import { SuppressionRulesResource } from './resources/suppression-rules.js';
+import { TargetsResource } from './resources/targets.js';
+/**
+ * The narrow interface a resource (`targets`, and later `issues`/`runs`/
+ * `reports`) depends on — {@link SecureportClient.request} bound to its
+ * instance, not the whole client. Keeps a resource's own tests, if it ever
+ * needs its own, from having to construct a full client.
+ */
+export type Requester = <T = unknown>(input: RequestInput) => Promise<T>;
+/**
+ * The narrow interface {@link ReportsResource} depends on —
+ * {@link SecureportClient.requestRaw} bound to its instance, the same way
+ * {@link Requester} is {@link SecureportClient.request} bound.
+ */
+export type RawRequester = (input: RequestInput) => Promise<Response>;
+/** The `fetch` shape the transport needs — the global function satisfies it. */
+export type Fetch = typeof globalThis.fetch;
+/**
+ * What a `fetch` body may be — `RequestInit['body']` rather than the DOM
+ * lib's `BodyInit`, since `tsconfig.base.json`'s `lib` is `ES2023` only and
+ * does not carry that name; the global `RequestInit`/`Response` interfaces
+ * `@types/node` merges in are what `Fetch` itself already relies on.
+ */
+export type FetchBody = Exclude<RequestInit['body'], null | undefined>;
+/**
+ * What a client is constructed with.
+ *
+ * `apiKey` comes from wherever the caller reads it — this package takes no
+ * position on environment variables, unlike `@secureport/cli`'s hosted mode,
+ * which is a terminal program and can insist on one. A library has no
+ * terminal to insist to.
+ */
+export interface ClientOptions {
+    /** Sent as `Authorization: Bearer <apiKey>` on every request. */
+    readonly apiKey: string;
+    /** The API's base URL, with no trailing slash required. */
+    readonly baseUrl: string;
+    /** Overrides the transport's `fetch`. Defaults to the global. Tests use this. */
+    readonly fetch?: Fetch;
+    /**
+     * How many times a retryable response is retried before giving up.
+     *
+     * Sized for scan polling, not just upload-and-done calls: a hosted scan
+     * run can sit behind a busy queue for longer than an upload ever would, so
+     * the default favours patience over a fast failure.
+     *
+     * @defaultValue 4
+     */
+    readonly maxAttempts?: number;
+    /**
+     * How long a single attempt may take before it is aborted and treated as a
+     * network failure.
+     *
+     * @defaultValue 30_000
+     */
+    readonly timeoutMs?: number;
+}
+/** One HTTP call the transport makes. */
+export interface RequestInput {
+    /** e.g. `'GET'`, `'POST'`. */
+    readonly method: string;
+    /** Path only, e.g. `'/issues'` — joined onto {@link ClientOptions.baseUrl}. */
+    readonly path: string;
+    /** Sent as `?name=value`. A `undefined` value is omitted, not sent empty. */
+    readonly query?: Readonly<Record<string, string | number | boolean | undefined>>;
+    /** JSON-serialised and sent with `content-type: application/json`. Omitted entirely when absent. */
+    readonly body?: unknown;
+    /**
+     * A body sent exactly as given, with this `content-type` — never
+     * JSON-encoded. Mutually exclusive with {@link RequestInput.body}; used
+     * only by `runs.import()`, the one route that accepts a raw scanner
+     * artifact rather than a JSON payload.
+     */
+    readonly rawBody?: {
+        readonly data: FetchBody;
+        readonly contentType: string;
+    };
+}
+/**
+ * The transport every resource client is built on: authentication, retry
+ * with backoff on the four statuses the API answers transiently with, and
+ * typed errors for everything else. Usable on its own via
+ * {@link SecureportClient.request}/{@link SecureportClient.requestRaw}
+ * without going through a resource.
+ */
+export declare class SecureportClient {
+    private readonly apiKey;
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    private readonly maxAttempts;
+    private readonly timeoutMs;
+    /** Targets, and the per-target verification flow every hosted scan needs. */
+    readonly targets: TargetsResource;
+    /** Issues — the tracked entity findings reconcile into. */
+    readonly issues: IssuesResource;
+    /** Runs — one execution against a target, and the scan lifecycle around it. */
+    readonly runs: RunsResource;
+    /** Reports — rendering a run's snapshot into a document or a machine-readable export. */
+    readonly reports: ReportsResource;
+    /** Branding — the one record per organisation reports render with. */
+    readonly branding: BrandingResource;
+    /** Suppression rules — pre-emptive "never open an issue for this" globs. */
+    readonly suppressionRules: SuppressionRulesResource;
+    constructor(options: ClientOptions);
+    /**
+     * Makes one logical call, retrying transient failures internally. Resolves
+     * with the parsed JSON body, or `undefined` for a `204`.
+     *
+     * @throws {SecureportError} for any response the API answered with, after
+     * retries (if any) are exhausted.
+     * @throws {SecureportNetworkError} if no response was ever received.
+     */
+    request<T = unknown>(input: RequestInput): Promise<T>;
+    /**
+     * The same authentication, retry-with-backoff and typed-error handling as
+     * {@link SecureportClient.request}, but without the JSON parse: resolves with the raw
+     * `Response` itself, for a route whose body is not JSON — currently just
+     * `reports.request()`, whose formats are streamed text (`text/csv`,
+     * `application/sarif+json`, …) rather than a parsed envelope.
+     *
+     * @throws {SecureportError} for any response the API answered with, after
+     * retries (if any) are exhausted.
+     * @throws {SecureportNetworkError} if no response was ever received.
+     */
+    requestRaw(input: RequestInput): Promise<Response>;
+    private attempt;
+    private buildUrl;
+}
+/** Constructs a {@link SecureportClient}. The package's one entry point. */
+export declare function createClient(options: ClientOptions): SecureportClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEtE,gFAAgF;AAChF,MAAM,MAAM,KAAK,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAEvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,yCAAyC;AACzC,MAAM,WAAW,YAAY;IAC3B,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC;IAEjF,oGAAoG;IACpG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAExB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/E;AAgBD;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAElC,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAEhC,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAE5B,yFAAyF;IACzF,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAElC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,4EAA4E;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;gBAExC,OAAO,EAAE,aAAa;IAclC;;;;;;;OAOG;IACG,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC;IAM3D;;;;;;;;;;OAUG;IACG,UAAU,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC;YAsB1C,OAAO;IA6BrB,OAAO,CAAC,QAAQ;CAOjB;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,gBAAgB,CAErE"}

package/dist/client.js

@@ -0,0 +1,191 @@
+import { FALLBACK_CODE_BY_STATUS, RETRYABLE_STATUSES, SecureportError, SecureportNetworkError, } from './errors.js';
+import { BrandingResource } from './resources/branding.js';
+import { IssuesResource } from './resources/issues.js';
+import { ReportsResource } from './resources/reports.js';
+import { RunsResource } from './resources/runs.js';
+import { SuppressionRulesResource } from './resources/suppression-rules.js';
+import { TargetsResource } from './resources/targets.js';
+const DEFAULT_MAX_ATTEMPTS = 4;
+const DEFAULT_TIMEOUT_MS = 30_000;
+const BASE_DELAY_MS = 500;
+const MAX_DELAY_MS = 8_000;
+/**
+ * The transport every resource client is built on: authentication, retry
+ * with backoff on the four statuses the API answers transiently with, and
+ * typed errors for everything else. Usable on its own via
+ * {@link SecureportClient.request}/{@link SecureportClient.requestRaw}
+ * without going through a resource.
+ */
+export class SecureportClient {
+    apiKey;
+    baseUrl;
+    fetchImpl;
+    maxAttempts;
+    timeoutMs;
+    /** Targets, and the per-target verification flow every hosted scan needs. */
+    targets;
+    /** Issues — the tracked entity findings reconcile into. */
+    issues;
+    /** Runs — one execution against a target, and the scan lifecycle around it. */
+    runs;
+    /** Reports — rendering a run's snapshot into a document or a machine-readable export. */
+    reports;
+    /** Branding — the one record per organisation reports render with. */
+    branding;
+    /** Suppression rules — pre-emptive "never open an issue for this" globs. */
+    suppressionRules;
+    constructor(options) {
+        this.apiKey = options.apiKey;
+        this.baseUrl = options.baseUrl.replace(/\/+$/u, '');
+        this.fetchImpl = options.fetch ?? globalThis.fetch;
+        this.maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.targets = new TargetsResource(this.request.bind(this));
+        this.issues = new IssuesResource(this.request.bind(this));
+        this.runs = new RunsResource(this.request.bind(this));
+        this.reports = new ReportsResource(this.requestRaw.bind(this));
+        this.branding = new BrandingResource(this.request.bind(this));
+        this.suppressionRules = new SuppressionRulesResource(this.request.bind(this));
+    }
+    /**
+     * Makes one logical call, retrying transient failures internally. Resolves
+     * with the parsed JSON body, or `undefined` for a `204`.
+     *
+     * @throws {SecureportError} for any response the API answered with, after
+     * retries (if any) are exhausted.
+     * @throws {SecureportNetworkError} if no response was ever received.
+     */
+    async request(input) {
+        const response = await this.requestRaw(input);
+        if (response.status === 204)
+            return undefined;
+        return (await response.json());
+    }
+    /**
+     * The same authentication, retry-with-backoff and typed-error handling as
+     * {@link SecureportClient.request}, but without the JSON parse: resolves with the raw
+     * `Response` itself, for a route whose body is not JSON — currently just
+     * `reports.request()`, whose formats are streamed text (`text/csv`,
+     * `application/sarif+json`, …) rather than a parsed envelope.
+     *
+     * @throws {SecureportError} for any response the API answered with, after
+     * retries (if any) are exhausted.
+     * @throws {SecureportNetworkError} if no response was ever received.
+     */
+    async requestRaw(input) {
+        const url = this.buildUrl(input.path, input.query);
+        const { headers, body } = requestBody(input);
+        for (let attempt = 1; attempt <= this.maxAttempts; attempt++) {
+            const response = await this.attempt(url, input.method, headers, body);
+            if (RETRYABLE_STATUSES.has(response.status) && attempt < this.maxAttempts) {
+                await delay(retryDelayMs(response, attempt));
+                continue;
+            }
+            if (response.status >= 200 && response.status < 300)
+                return response;
+            throw await toSecureportError(response);
+        }
+        // Unreachable while maxAttempts >= 1: the loop above always either
+        // returns or throws on its final iteration.
+        throw new Error('request() exhausted its attempts without a terminal response');
+    }
+    async attempt(url, method, headers, body) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            return await this.fetchImpl(url, {
+                method,
+                headers: {
+                    authorization: `Bearer ${this.apiKey}`,
+                    accept: 'application/json',
+                    ...headers,
+                },
+                ...(body === undefined ? {} : { body }),
+                signal: controller.signal,
+            });
+        }
+        catch (error) {
+            throw new SecureportNetworkError(`cannot reach ${this.baseUrl}: ${error instanceof Error ? error.message : String(error)}`, error);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    buildUrl(path, query) {
+        const url = new URL(`${this.baseUrl}${path}`);
+        for (const [name, value] of Object.entries(query ?? {})) {
+            if (value !== undefined)
+                url.searchParams.set(name, String(value));
+        }
+        return url.toString();
+    }
+}
+/** Constructs a {@link SecureportClient}. The package's one entry point. */
+export function createClient(options) {
+    return new SecureportClient(options);
+}
+/** How long to wait before the next attempt, honouring `Retry-After` when the API sends one. */
+function retryDelayMs(response, attempt) {
+    const retryAfter = response.headers.get('retry-after');
+    if (retryAfter !== null) {
+        const seconds = Number(retryAfter);
+        if (Number.isFinite(seconds) && seconds >= 0)
+            return seconds * 1000;
+    }
+    return Math.min(BASE_DELAY_MS * 2 ** (attempt - 1), MAX_DELAY_MS);
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * The headers and body one request sends — {@link RequestInput.rawBody} wins
+ * when both it and {@link RequestInput.body} are given, though a resource
+ * method never sets both.
+ */
+function requestBody(input) {
+    if (input.rawBody !== undefined) {
+        return { headers: { 'content-type': input.rawBody.contentType }, body: input.rawBody.data };
+    }
+    if (input.body !== undefined) {
+        return { headers: { 'content-type': 'application/json' }, body: JSON.stringify(input.body) };
+    }
+    return { headers: {}, body: undefined };
+}
+/**
+ * Builds the typed error for a terminal (non-retried, non-2xx) response.
+ *
+ * `502`/`504` are the edge answering for a dead or slow origin — the body is
+ * Cloudflare's, not this API's envelope — so those (and `429`, sent by this
+ * API but read defensively the same way) fall back to a status-derived code
+ * rather than assuming the body parses.
+ */
+async function toSecureportError(response) {
+    const parsed = await parseErrorBody(response);
+    if (parsed !== undefined) {
+        return new SecureportError(parsed.error.code, parsed.error.message, response.status, parsed.error.requestId);
+    }
+    const fallbackCode = FALLBACK_CODE_BY_STATUS[response.status];
+    return new SecureportError(fallbackCode ?? 'internal', fallbackCode === undefined
+        ? `the API answered ${String(response.status)} with a body this SDK could not read.`
+        : `the API answered ${String(response.status)} with no readable body — the edge, not the API itself.`, response.status);
+}
+/** The response body as this API's error envelope, or `undefined` if it doesn't parse as one. */
+async function parseErrorBody(response) {
+    try {
+        const body = await response.json();
+        if (typeof body !== 'object' || body === null || !('error' in body))
+            return undefined;
+        const error = body.error;
+        if (typeof error !== 'object' || error === null)
+            return undefined;
+        if (!('code' in error) || !('message' in error))
+            return undefined;
+        if (typeof error.code !== 'string' || typeof error.message !== 'string')
+            return undefined;
+        return body;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAkGzD,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,YAAY,GAAG,KAAK,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IACV,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,SAAS,CAAQ;IACjB,WAAW,CAAS;IACpB,SAAS,CAAS;IAEnC,6EAA6E;IACpE,OAAO,CAAkB;IAElC,2DAA2D;IAClD,MAAM,CAAiB;IAEhC,+EAA+E;IACtE,IAAI,CAAe;IAE5B,yFAAyF;IAChF,OAAO,CAAkB;IAElC,sEAAsE;IAC7D,QAAQ,CAAmB;IAEpC,4EAA4E;IACnE,gBAAgB,CAA2B;IAEpD,YAAY,OAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC/D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,gBAAgB,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAc,KAAmB;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QACnD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;IACtC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,UAAU,CAAC,KAAmB;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAE7C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAEtE,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1E,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,QAAQ,CAAC;YAErE,MAAM,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,mEAAmE;QACnE,4CAA4C;QAC5C,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,GAAW,EACX,MAAc,EACd,OAAyC,EACzC,IAA2B;QAE3B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBAC/B,MAAM;gBACN,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,MAAM,EAAE,kBAAkB;oBAC1B,GAAG,OAAO;iBACX;gBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBACvC,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAsB,CAC9B,gBAAgB,IAAI,CAAC,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACzF,KAAK,CACN,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,KAA4B;QACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YACxD,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,OAAsB;IACjD,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,gGAAgG;AAChG,SAAS,YAAY,CAAC,QAAkB,EAAE,OAAe;IACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;YAAE,OAAO,OAAO,GAAG,IAAI,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAmB;IAItC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,QAAkB;IACjD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,eAAe,CACxB,MAAM,CAAC,KAAK,CAAC,IAAiB,EAC9B,MAAM,CAAC,KAAK,CAAC,OAAO,EACpB,QAAQ,CAAC,MAAM,EACf,MAAM,CAAC,KAAK,CAAC,SAAS,CACvB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9D,OAAO,IAAI,eAAe,CACxB,YAAY,IAAI,UAAU,EAC1B,YAAY,KAAK,SAAS;QACxB,CAAC,CAAC,oBAAoB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,uCAAuC;QACpF,CAAC,CAAC,oBAAoB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,wDAAwD,EACvG,QAAQ,CAAC,MAAM,CAChB,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,cAAc,CAAC,QAAkB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAEtF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAClE,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAClE,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAE1F,OAAO,IAAqB,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Every error code the hosted API can answer with.
+ *
+ * Mirrored from `apps/api/src/errors.ts`'s `ERROR_CODES` rather than imported
+ * from it: `apps/api` is `"private": true` and pulls in Hono, drizzle and
+ * postgres, so a published package cannot depend on it. Kept honest by a
+ * drift assertion in `apps/api/tests/openapi.test.ts`, which compares this
+ * list against the live `/openapi.json` document's `Error` schema — the same
+ * technique that file already uses to keep `docs/api-endpoints.md` from
+ * drifting.
+ *
+ * The union is closed on purpose: a `switch` over {@link ErrorCode} is
+ * exhaustive, and adding a code here without the API test agreeing fails
+ * that test rather than shipping quietly out of sync.
+ */
+export declare const ERROR_CODES: readonly ["malformed", "validation", "unauthorized", "payment_required", "forbidden", "not_entitled", "org_deleted", "terms_required", "verification_required", "not_found", "method_not_allowed", "not_acceptable", "request_timeout", "conflict", "gone", "precondition_failed", "payload_too_large", "uri_too_long", "unsupported_media_type", "misdirected_request", "rate_limited", "quota_exceeded", "headers_too_large", "internal", "not_implemented", "bad_gateway", "unavailable", "gateway_timeout"];
+/** One of {@link ERROR_CODES}. What a caller branches on. */
+export type ErrorCode = (typeof ERROR_CODES)[number];
+/**
+ * The four statuses the transport retries with backoff, and nothing else.
+ *
+ * `terms_required` and `verification_required` both answer `403` — a settled
+ * refusal, not a transient one — so `403` is deliberately absent here even
+ * though it shares a status family with codes that could look retryable.
+ * Retrying an authorisation refusal would turn a clear "do this first" into a
+ * slow, confusing one.
+ */
+export declare const RETRYABLE_STATUSES: ReadonlySet<number>;
+/**
+ * The code a response is assumed to carry when its body cannot be read as
+ * this API's error envelope — which happens exactly on `502`/`504`, because
+ * those are the edge answering for a dead or slow origin and the body is
+ * Cloudflare's, not this API's. Each of the four statuses here maps to
+ * exactly one {@link ErrorCode}, so the fallback is unambiguous; no other
+ * status gets one; a `403` with an unparseable body, for instance, could be
+ * any of four different codes and none should be silently guessed.
+ */
+export declare const FALLBACK_CODE_BY_STATUS: Readonly<Partial<Record<number, ErrorCode>>>;
+/**
+ * Thrown for every non-2xx response the API returns, and for a response the
+ * transport gave up retrying.
+ *
+ * `requestId` is the same id the API's own `x-request-id` response header and
+ * error envelope carry, worth including in a support request. It is absent
+ * only when the body could not be read as this API's envelope at all (the
+ * `502`/`504` edge case above).
+ */
+export declare class SecureportError extends Error {
+    /** What to branch on. */
+    readonly code: ErrorCode;
+    /** The HTTP status the response actually carried. */
+    readonly status: number;
+    /** The API's `x-request-id` for this call, when the body could be read as its envelope. */
+    readonly requestId?: string | undefined;
+    constructor(
+    /** What to branch on. */
+    code: ErrorCode, message: string, 
+    /** The HTTP status the response actually carried. */
+    status: number, 
+    /** The API's `x-request-id` for this call, when the body could be read as its envelope. */
+    requestId?: string | undefined);
+}
+/**
+ * Thrown when the request never reached a server at all — DNS failure,
+ * connection refused, TLS error. Distinct from {@link SecureportError}
+ * because there is no status and no code: nothing answered.
+ *
+ * Not retried by the transport. A network failure of this kind is usually a
+ * configuration problem (wrong `baseUrl`, no connectivity) rather than a
+ * transient one, and retrying it silently would turn a five-second failure
+ * into a much slower one for no better odds of success.
+ */
+export declare class SecureportNetworkError extends Error {
+    /** Whatever `fetch` itself threw or rejected with. */
+    readonly cause: unknown;
+    constructor(message: string, 
+    /** Whatever `fetch` itself threw or rejected with. */
+    cause: unknown);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,WAAW,ifA6Bd,CAAC;AAEX,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAiC,CAAC;AAErF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAKhF,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS;IAExB,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM;;IAN3B,yBAAyB;IAChB,IAAI,EAAE,SAAS,EACxB,OAAO,EAAE,MAAM;IACf,qDAAqD;IAC5C,MAAM,EAAE,MAAM;IACvB,2FAA2F;IAClF,SAAS,CAAC,EAAE,MAAM,YAAA;CAK9B;AAED;;;;;;;;;GASG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAG7C,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,OAAO;gBAFvB,OAAO,EAAE,MAAM;IACf,sDAAsD;IAC7C,KAAK,EAAE,OAAO;CAK1B"}

package/dist/errors.js

@@ -0,0 +1,118 @@
+/**
+ * Every error code the hosted API can answer with.
+ *
+ * Mirrored from `apps/api/src/errors.ts`'s `ERROR_CODES` rather than imported
+ * from it: `apps/api` is `"private": true` and pulls in Hono, drizzle and
+ * postgres, so a published package cannot depend on it. Kept honest by a
+ * drift assertion in `apps/api/tests/openapi.test.ts`, which compares this
+ * list against the live `/openapi.json` document's `Error` schema — the same
+ * technique that file already uses to keep `docs/api-endpoints.md` from
+ * drifting.
+ *
+ * The union is closed on purpose: a `switch` over {@link ErrorCode} is
+ * exhaustive, and adding a code here without the API test agreeing fails
+ * that test rather than shipping quietly out of sync.
+ */
+export const ERROR_CODES = [
+    'malformed',
+    'validation',
+    'unauthorized',
+    'payment_required',
+    'forbidden',
+    'not_entitled',
+    'org_deleted',
+    'terms_required',
+    'verification_required',
+    'not_found',
+    'method_not_allowed',
+    'not_acceptable',
+    'request_timeout',
+    'conflict',
+    'gone',
+    'precondition_failed',
+    'payload_too_large',
+    'uri_too_long',
+    'unsupported_media_type',
+    'misdirected_request',
+    'rate_limited',
+    'quota_exceeded',
+    'headers_too_large',
+    'internal',
+    'not_implemented',
+    'bad_gateway',
+    'unavailable',
+    'gateway_timeout',
+];
+/**
+ * The four statuses the transport retries with backoff, and nothing else.
+ *
+ * `terms_required` and `verification_required` both answer `403` — a settled
+ * refusal, not a transient one — so `403` is deliberately absent here even
+ * though it shares a status family with codes that could look retryable.
+ * Retrying an authorisation refusal would turn a clear "do this first" into a
+ * slow, confusing one.
+ */
+export const RETRYABLE_STATUSES = new Set([429, 502, 503, 504]);
+/**
+ * The code a response is assumed to carry when its body cannot be read as
+ * this API's error envelope — which happens exactly on `502`/`504`, because
+ * those are the edge answering for a dead or slow origin and the body is
+ * Cloudflare's, not this API's. Each of the four statuses here maps to
+ * exactly one {@link ErrorCode}, so the fallback is unambiguous; no other
+ * status gets one; a `403` with an unparseable body, for instance, could be
+ * any of four different codes and none should be silently guessed.
+ */
+export const FALLBACK_CODE_BY_STATUS = {
+    429: 'rate_limited',
+    502: 'bad_gateway',
+    503: 'unavailable',
+    504: 'gateway_timeout',
+};
+/**
+ * Thrown for every non-2xx response the API returns, and for a response the
+ * transport gave up retrying.
+ *
+ * `requestId` is the same id the API's own `x-request-id` response header and
+ * error envelope carry, worth including in a support request. It is absent
+ * only when the body could not be read as this API's envelope at all (the
+ * `502`/`504` edge case above).
+ */
+export class SecureportError extends Error {
+    code;
+    status;
+    requestId;
+    constructor(
+    /** What to branch on. */
+    code, message, 
+    /** The HTTP status the response actually carried. */
+    status, 
+    /** The API's `x-request-id` for this call, when the body could be read as its envelope. */
+    requestId) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.requestId = requestId;
+        this.name = 'SecureportError';
+    }
+}
+/**
+ * Thrown when the request never reached a server at all — DNS failure,
+ * connection refused, TLS error. Distinct from {@link SecureportError}
+ * because there is no status and no code: nothing answered.
+ *
+ * Not retried by the transport. A network failure of this kind is usually a
+ * configuration problem (wrong `baseUrl`, no connectivity) rather than a
+ * transient one, and retrying it silently would turn a five-second failure
+ * into a much slower one for no better odds of success.
+ */
+export class SecureportNetworkError extends Error {
+    cause;
+    constructor(message, 
+    /** Whatever `fetch` itself threw or rejected with. */
+    cause) {
+        super(message);
+        this.cause = cause;
+        this.name = 'SecureportNetworkError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,WAAW;IACX,YAAY;IACZ,cAAc;IACd,kBAAkB;IAClB,WAAW;IACX,cAAc;IACd,aAAa;IACb,gBAAgB;IAChB,uBAAuB;IACvB,WAAW;IACX,oBAAoB;IACpB,gBAAgB;IAChB,iBAAiB;IACjB,UAAU;IACV,MAAM;IACN,qBAAqB;IACrB,mBAAmB;IACnB,cAAc;IACd,wBAAwB;IACxB,qBAAqB;IACrB,cAAc;IACd,gBAAgB;IAChB,mBAAmB;IACnB,UAAU;IACV,iBAAiB;IACjB,aAAa;IACb,aAAa;IACb,iBAAiB;CACT,CAAC;AAKX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAErF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAiD;IACnF,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,iBAAiB;CACvB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAG7B;IAGA;IAEA;IAPX;IACE,yBAAyB;IAChB,IAAe,EACxB,OAAe;IACf,qDAAqD;IAC5C,MAAc;IACvB,2FAA2F;IAClF,SAAkB;QAE3B,KAAK,CAAC,OAAO,CAAC,CAAC;QAPN,SAAI,GAAJ,IAAI,CAAW;QAGf,WAAM,GAAN,MAAM,CAAQ;QAEd,cAAS,GAAT,SAAS,CAAS;QAG3B,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAIpC;IAHX,YACE,OAAe;IACf,sDAAsD;IAC7C,KAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,UAAK,GAAL,KAAK,CAAS;QAGvB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF"}