@sentroy-co/client-sdk 2.13.7 → 2.13.9

package/dist/auth/admin/index.d.ts

@@ -0,0 +1,153 @@
+import type { SentroyAuthUser, SignupResponse, LoginResponse, LoginOutcome, AuthTokensResponse } from "../types";
+/**
+ * Server-side Sentroy Auth admin SDK. **Node only — apiKey browser'a
+ * koymayın**; bu sınıf Project'in master `aps_` token'ını taşır.
+ *
+ * Tüm public auth endpoint'lerini apiKey'le proxy eder ve JWT'yi local
+ * verify edebilir (JWKS cache + RSA Subtle). RP backend tipik akış:
+ *
+ *   const admin = new SentroyAuthAdmin({ projectSlug, apiKey })
+ *   const out = await admin.users.signIn({ email, password })
+ *   if (out.kind === "tokens") setCookie(out.data.accessToken, ...)
+ *   else // MFA flow
+ *
+ *   // Mid-request: verify
+ *   const claims = await admin.verifyIdToken(req.cookies.accessToken)
+ *
+ * Token persistence yok — server-side request-scoped; caller cookie /
+ * session / DB nereye isterse oraya yazar.
+ */
+export interface SentroyAuthAdminOptions {
+    authBaseUrl?: string;
+    projectSlug: string;
+    apiKey: string;
+    /** JWKS cache TTL (saniye). Default 3600 (1 saat) — JWT rotation
+     *  grace period'una uyumlu; daha agresif rotation yapan project'ler
+     *  daha düşük set edebilir. */
+    jwksCacheTtl?: number;
+}
+export declare class SentroyAuthAdmin {
+    private readonly http;
+    private readonly jwksCacheTtl;
+    private cachedJwks;
+    constructor(opts: SentroyAuthAdminOptions);
+    get projectSlug(): string;
+    get baseUrl(): string;
+    users: {
+        /**
+         * Server-side signup proxy. apiKey backend'de — browser'a sızmaz.
+         * Email verification project config'ine bağlı: required ise
+         * `emailVerificationRequired: true` döner, tokens undefined.
+         */
+        create: (input: {
+            email: string;
+            password: string;
+            displayName?: string;
+            metadata?: Record<string, unknown>;
+        }) => Promise<SignupResponse>;
+        /**
+         * Server-side login proxy. MFA-aware: tokens VEYA MFA challenge.
+         * RP backend `out.kind === "mfa"` ise kullanıcıdan code alıp
+         * `users.verifyMfa(...)` çağırır.
+         */
+        signIn: (input: {
+            email: string;
+            password: string;
+            rememberMe?: boolean;
+        }) => Promise<LoginOutcome>;
+        /** MFA verify ikinci adımı — `signIn` kind:"mfa" döndüyse. */
+        verifyMfa: (input: {
+            mfaToken: string;
+            code?: string;
+            recoveryCode?: string;
+        }) => Promise<LoginResponse>;
+        /** Refresh access token (rotation). Yeni refresh + access döner. */
+        refresh: (refreshToken: string) => Promise<AuthTokensResponse>;
+        /** Logout (refresh token revoke). */
+        signOut: (refreshToken: string) => Promise<void>;
+        /** Verify email — link'ten gelen token. */
+        verifyEmail: (token: string) => Promise<{
+            user: SentroyAuthUser;
+        }>;
+        /** Password reset mail tetikle. */
+        requestPasswordReset: (email: string) => Promise<void>;
+        /** Reset token + yeni şifre ile finalize. */
+        confirmPasswordReset: (input: {
+            token: string;
+            newPassword: string;
+        }) => Promise<{
+            user: SentroyAuthUser;
+        }>;
+        /** Magic-link mail tetikle. */
+        sendMagicLink: (input: {
+            email: string;
+            redirectUri?: string;
+        }) => Promise<void>;
+        /** Magic-link token consume → login. */
+        consumeMagicLink: (token: string) => Promise<LoginResponse>;
+        /** Davet token'ı ile yeni hesap + login. */
+        acceptInvitation: (input: {
+            token: string;
+            password: string;
+            displayName?: string;
+        }) => Promise<LoginResponse>;
+        /**
+         * Access token ile remote /me — JWT'ye bağımlı kalmadan canlı
+         * profile çek. Token expire ise SentroyAuthError fırlatır.
+         */
+        getUser: (accessToken: string) => Promise<SentroyAuthUser>;
+        /**
+         * Token bazlı userinfo (OIDC tarzı). `/userinfo` claims response —
+         * SentroyAuthUser shape'inden daha minimal olabilir.
+         */
+        getUserinfo: (accessToken: string) => Promise<{
+            sub: string;
+            email?: string;
+            email_verified?: boolean;
+            name?: string;
+            picture?: string;
+        }>;
+        /**
+         * Admin list (paginated). **Şu an public API yok** — dashboard
+         * cookie-auth `/api/companies/[slug]/auth-projects/[id]/users`
+         * kullan. v2'de stk_ token'lı admin endpoint açılacak.
+         */
+        list: (_opts?: {
+            limit?: number;
+            skip?: number;
+            emailVerified?: boolean;
+        }) => Promise<{
+            items: SentroyAuthUser[];
+            pagination: {
+                total: number;
+                limit: number;
+                skip: number;
+            };
+        }>;
+    };
+    /**
+     * Local verify — JWKS cache'lenir (default 1h TTL, opts ile değişir),
+     * JWT signature RS256 ile WebCrypto Subtle üzerinden verify edilir.
+     * `iss`/`aud` claim eşleşmesi de kontrol edilir.
+     *
+     * Throw'lar: malformed JWT, expired, iss/aud mismatch, key not found,
+     * signature mismatch. Tipik kullanım `try/catch` içinde — fail ise
+     * 401 dön.
+     */
+    verifyIdToken(token: string): Promise<{
+        sub: string;
+        email?: string;
+        email_verified?: boolean;
+        name?: string;
+        picture?: string;
+        iss: string;
+        aud: string;
+        iat: number;
+        exp: number;
+        [claim: string]: unknown;
+    }>;
+    /** JWKS cache'ini elle temizle (key rotation sonrası). */
+    invalidateJwksCache(): void;
+    private fetchJwks;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/admin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/admin/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,EACZ,kBAAkB,EAEnB,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,uBAAuB;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd;;mCAE+B;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAOD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,UAAU,CAA0B;gBAEhC,IAAI,EAAE,uBAAuB;IAKzC,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAID,KAAK;QACH;;;;WAIG;wBACa;YACd,KAAK,EAAE,MAAM,CAAA;YACb,QAAQ,EAAE,MAAM,CAAA;YAChB,WAAW,CAAC,EAAE,MAAM,CAAA;YACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SACnC,KAAG,OAAO,CAAC,cAAc,CAAC;QAM3B;;;;WAIG;wBACmB;YACpB,KAAK,EAAE,MAAM,CAAA;YACb,QAAQ,EAAE,MAAM,CAAA;YAChB,UAAU,CAAC,EAAE,OAAO,CAAA;SACrB,KAAG,OAAO,CAAC,YAAY,CAAC;QAUzB,8DAA8D;2BAC3C;YACjB,QAAQ,EAAE,MAAM,CAAA;YAChB,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,YAAY,CAAC,EAAE,MAAM,CAAA;SACtB,KAAG,OAAO,CAAC,aAAa,CAAC;QAM1B,oEAAoE;gCAC5C,MAAM,KAAG,OAAO,CAAC,kBAAkB,CAAC;QAM5D,qCAAqC;gCACb,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;QAQ9C,2CAA2C;6BACtB,MAAM,KAAG,OAAO,CAAC;YAAE,IAAI,EAAE,eAAe,CAAA;SAAE,CAAC;QAMhE,mCAAmC;sCACL,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;QAQpD,6CAA6C;sCACf;YAC5B,KAAK,EAAE,MAAM,CAAA;YACb,WAAW,EAAE,MAAM,CAAA;SACpB,KAAG,OAAO,CAAC;YAAE,IAAI,EAAE,eAAe,CAAA;SAAE,CAAC;QAMtC,+BAA+B;+BACR;YACrB,KAAK,EAAE,MAAM,CAAA;YACb,WAAW,CAAC,EAAE,MAAM,CAAA;SACrB,KAAG,OAAO,CAAC,IAAI,CAAC;QAQjB,wCAAwC;kCACd,MAAM,KAAG,OAAO,CAAC,aAAa,CAAC;QAMzD,4CAA4C;kCAClB;YACxB,KAAK,EAAE,MAAM,CAAA;YACb,QAAQ,EAAE,MAAM,CAAA;YAChB,WAAW,CAAC,EAAE,MAAM,CAAA;SACrB,KAAG,OAAO,CAAC,aAAa,CAAC;QAM1B;;;WAGG;+BACoB,MAAM,KAAG,OAAO,CAAC,eAAe,CAAC;QAMxD;;;WAGG;mCAEY,MAAM,KAClB,OAAO,CAAC;YACT,GAAG,EAAE,MAAM,CAAA;YACX,KAAK,CAAC,EAAE,MAAM,CAAA;YACd,cAAc,CAAC,EAAE,OAAO,CAAA;YACxB,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,OAAO,CAAC,EAAE,MAAM,CAAA;SACjB,CAAC;QAMF;;;;WAIG;uBACW;YACZ,KAAK,CAAC,EAAE,MAAM,CAAA;YACd,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,aAAa,CAAC,EAAE,OAAO,CAAA;SACxB,KAAQ,OAAO,CAAC;YACf,KAAK,EAAE,eAAe,EAAE,CAAA;YACxB,UAAU,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAA;SAC3D,CAAC;MAKH;IAID;;;;;;;;OAQG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAC1C,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,cAAc,CAAC,EAAE,OAAO,CAAA;QACxB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KACzB,CAAC;IAmDF,0DAA0D;IAC1D,mBAAmB,IAAI,IAAI;YAIb,SAAS;CAaxB"}

package/dist/auth/admin/index.js

@@ -0,0 +1,228 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SentroyAuthAdmin = void 0;
+const http_1 = require("../http");
+class SentroyAuthAdmin {
+    http;
+    jwksCacheTtl;
+    cachedJwks = null;
+    constructor(opts) {
+        this.http = new http_1.AuthHttp(opts);
+        this.jwksCacheTtl = opts.jwksCacheTtl ?? 3600;
+    }
+    get projectSlug() {
+        return this.http.projectSlug;
+    }
+    get baseUrl() {
+        return this.http.baseUrl;
+    }
+    // ─── User pool admin ──────────────────────────────────────────────────
+    users = {
+        /**
+         * Server-side signup proxy. apiKey backend'de — browser'a sızmaz.
+         * Email verification project config'ine bağlı: required ise
+         * `emailVerificationRequired: true` döner, tokens undefined.
+         */
+        create: (input) => this.http.request("/signup", {
+            method: "POST",
+            json: input,
+        }),
+        /**
+         * Server-side login proxy. MFA-aware: tokens VEYA MFA challenge.
+         * RP backend `out.kind === "mfa"` ise kullanıcıdan code alıp
+         * `users.verifyMfa(...)` çağırır.
+         */
+        signIn: async (input) => {
+            const res = await this.http.request("/login", { method: "POST", json: input });
+            if ("mfaRequired" in res && res.mfaRequired) {
+                return { kind: "mfa", data: res };
+            }
+            return { kind: "tokens", data: res };
+        },
+        /** MFA verify ikinci adımı — `signIn` kind:"mfa" döndüyse. */
+        verifyMfa: (input) => this.http.request("/login/mfa/verify", {
+            method: "POST",
+            json: input,
+        }),
+        /** Refresh access token (rotation). Yeni refresh + access döner. */
+        refresh: (refreshToken) => this.http.request("/refresh", {
+            method: "POST",
+            json: { refreshToken },
+        }),
+        /** Logout (refresh token revoke). */
+        signOut: (refreshToken) => this.http
+            .request("/logout", {
+            method: "POST",
+            json: { refreshToken },
+        })
+            .then(() => undefined),
+        /** Verify email — link'ten gelen token. */
+        verifyEmail: (token) => this.http.request("/verify-email", {
+            method: "POST",
+            json: { token },
+        }),
+        /** Password reset mail tetikle. */
+        requestPasswordReset: (email) => this.http
+            .request("/password-reset/request", {
+            method: "POST",
+            json: { email },
+        })
+            .then(() => undefined),
+        /** Reset token + yeni şifre ile finalize. */
+        confirmPasswordReset: (input) => this.http.request("/password-reset/confirm", {
+            method: "POST",
+            json: input,
+        }),
+        /** Magic-link mail tetikle. */
+        sendMagicLink: (input) => this.http
+            .request("/magic-link/request", {
+            method: "POST",
+            json: input,
+        })
+            .then(() => undefined),
+        /** Magic-link token consume → login. */
+        consumeMagicLink: (token) => this.http.request("/magic-link/consume", {
+            method: "POST",
+            json: { token },
+        }),
+        /** Davet token'ı ile yeni hesap + login. */
+        acceptInvitation: (input) => this.http.request("/invitation/accept", {
+            method: "POST",
+            json: input,
+        }),
+        /**
+         * Access token ile remote /me — JWT'ye bağımlı kalmadan canlı
+         * profile çek. Token expire ise SentroyAuthError fırlatır.
+         */
+        getUser: (accessToken) => this.http.request("/me", {
+            method: "GET",
+            bearer: accessToken,
+        }),
+        /**
+         * Token bazlı userinfo (OIDC tarzı). `/userinfo` claims response —
+         * SentroyAuthUser shape'inden daha minimal olabilir.
+         */
+        getUserinfo: (accessToken) => this.http.request("/userinfo", {
+            method: "GET",
+            bearer: accessToken,
+        }),
+        /**
+         * Admin list (paginated). **Şu an public API yok** — dashboard
+         * cookie-auth `/api/companies/[slug]/auth-projects/[id]/users`
+         * kullan. v2'de stk_ token'lı admin endpoint açılacak.
+         */
+        list: (_opts = {}) => {
+            throw new Error("admin.users.list requires session-authenticated admin API; use dashboard /api/companies/[slug]/auth-projects/[id]/users instead. (v2 admin SDK will proxy this with stk_ tokens.)");
+        },
+    };
+    // ─── ID token verification ─────────────────────────────────────────────
+    /**
+     * Local verify — JWKS cache'lenir (default 1h TTL, opts ile değişir),
+     * JWT signature RS256 ile WebCrypto Subtle üzerinden verify edilir.
+     * `iss`/`aud` claim eşleşmesi de kontrol edilir.
+     *
+     * Throw'lar: malformed JWT, expired, iss/aud mismatch, key not found,
+     * signature mismatch. Tipik kullanım `try/catch` içinde — fail ise
+     * 401 dön.
+     */
+    async verifyIdToken(token) {
+        const parts = token.split(".");
+        if (parts.length !== 3) {
+            throw new Error("Malformed JWT — expected three segments.");
+        }
+        const [headerB64, payloadB64, sigB64] = parts;
+        const header = JSON.parse(decodeBase64Url(headerB64));
+        if (header.alg !== "RS256") {
+            throw new Error("Only RS256 supported.");
+        }
+        const claims = JSON.parse(decodeBase64Url(payloadB64));
+        if (typeof claims.exp !== "number" || claims.exp * 1000 < Date.now()) {
+            throw new Error("Token expired.");
+        }
+        const expectedIssSuffix = `/p/${this.http.projectSlug}`;
+        if (typeof claims.iss !== "string" ||
+            !claims.iss.endsWith(expectedIssSuffix)) {
+            throw new Error("Issuer mismatch.");
+        }
+        // aud == project apiKeyPrefix (first 12 chars of api key)
+        if (typeof claims.aud !== "string" ||
+            !this.http.apiKey?.startsWith(claims.aud)) {
+            throw new Error("Audience mismatch.");
+        }
+        const jwks = await this.fetchJwks();
+        const key = jwks.keys.find((k) => k.kid === header.kid) ?? jwks.keys[0];
+        if (!key)
+            throw new Error("No public key in JWKS.");
+        await verifyRsaSignature({
+            data: `${headerB64}.${payloadB64}`,
+            sigB64,
+            jwk: key,
+        });
+        return claims;
+    }
+    /** JWKS cache'ini elle temizle (key rotation sonrası). */
+    invalidateJwksCache() {
+        this.cachedJwks = null;
+    }
+    async fetchJwks() {
+        if (this.cachedJwks && this.cachedJwks.expiresAt > Date.now()) {
+            return { keys: this.cachedJwks.keys };
+        }
+        const jwks = await this.http.request("/jwks.json", { method: "GET" });
+        this.cachedJwks = {
+            keys: jwks.keys,
+            expiresAt: Date.now() + this.jwksCacheTtl * 1000,
+        };
+        return jwks;
+    }
+}
+exports.SentroyAuthAdmin = SentroyAuthAdmin;
+// ─── Helpers ─────────────────────────────────────────────────────────────
+function decodeBase64Url(s) {
+    const padded = s.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - (padded.length % 4));
+    if (typeof atob === "function") {
+        const binary = atob(padded + pad);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++)
+            bytes[i] = binary.charCodeAt(i);
+        return new TextDecoder().decode(bytes);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const B = globalThis.Buffer;
+    if (B)
+        return B.from(padded + pad, "base64").toString("utf8");
+    throw new Error("No base64 decoder available");
+}
+function base64UrlToBytes(s) {
+    const padded = s.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - (padded.length % 4));
+    if (typeof atob === "function") {
+        const binary = atob(padded + pad);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++)
+            bytes[i] = binary.charCodeAt(i);
+        return bytes;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const B = globalThis.Buffer;
+    if (B)
+        return new Uint8Array(B.from(padded + pad, "base64"));
+    throw new Error("No base64 decoder available");
+}
+async function verifyRsaSignature(input) {
+    // Browser + modern Node (>=18) have crypto.subtle. Tek kod yolu.
+    const subtle = typeof crypto !== "undefined" && crypto.subtle ? crypto.subtle : null;
+    if (!subtle) {
+        throw new Error("Web Crypto unavailable — upgrade Node >= 18 or run in a browser.");
+    }
+    const key = await subtle.importKey("jwk", input.jwk, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+    // Web Crypto types want ArrayBuffer-backed BufferSource. Bytes are
+    // created fresh from base64 decode so they are ArrayBuffer-safe.
+    const sigBytes = base64UrlToBytes(input.sigB64);
+    const dataBytes = new TextEncoder().encode(input.data);
+    const ok = await subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, sigBytes, dataBytes);
+    if (!ok)
+        throw new Error("Signature mismatch.");
+}
+//# sourceMappingURL=index.js.map

package/dist/auth/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/admin/index.ts"],"names":[],"mappings":";;;AAAA,kCAAkC;AA4ClC,MAAa,gBAAgB;IACV,IAAI,CAAU;IACd,YAAY,CAAQ;IAC7B,UAAU,GAAsB,IAAI,CAAA;IAE5C,YAAY,IAA6B;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,eAAQ,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAA;IAC/C,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;IAC9B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAA;IAC1B,CAAC;IAED,yEAAyE;IAEzE,KAAK,GAAG;QACN;;;;WAIG;QACH,MAAM,EAAE,CAAC,KAKR,EAA2B,EAAE,CAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAiB,SAAS,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,KAAK;SACZ,CAAC;QAEJ;;;;WAIG;QACH,MAAM,EAAE,KAAK,EAAE,KAId,EAAyB,EAAE;YAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAEjC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5C,IAAI,aAAa,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;YACnC,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAoB,EAAE,CAAA;QACvD,CAAC;QAED,8DAA8D;QAC9D,SAAS,EAAE,CAAC,KAIX,EAA0B,EAAE,CAC3B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAgB,mBAAmB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,KAAK;SACZ,CAAC;QAEJ,oEAAoE;QACpE,OAAO,EAAE,CAAC,YAAoB,EAA+B,EAAE,CAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAqB,UAAU,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,YAAY,EAAE;SACvB,CAAC;QAEJ,qCAAqC;QACrC,OAAO,EAAE,CAAC,YAAoB,EAAiB,EAAE,CAC/C,IAAI,CAAC,IAAI;aACN,OAAO,CAAO,SAAS,EAAE;YACxB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,YAAY,EAAE;SACvB,CAAC;aACD,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QAE1B,2CAA2C;QAC3C,WAAW,EAAE,CAAC,KAAa,EAAsC,EAAE,CACjE,IAAI,CAAC,IAAI,CAAC,OAAO,CAA4B,eAAe,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE;SAChB,CAAC;QAEJ,mCAAmC;QACnC,oBAAoB,EAAE,CAAC,KAAa,EAAiB,EAAE,CACrD,IAAI,CAAC,IAAI;aACN,OAAO,CAAO,yBAAyB,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE;SAChB,CAAC;aACD,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QAE1B,6CAA6C;QAC7C,oBAAoB,EAAE,CAAC,KAGtB,EAAsC,EAAE,CACvC,IAAI,CAAC,IAAI,CAAC,OAAO,CAA4B,yBAAyB,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,KAAK;SACZ,CAAC;QAEJ,+BAA+B;QAC/B,aAAa,EAAE,CAAC,KAGf,EAAiB,EAAE,CAClB,IAAI,CAAC,IAAI;aACN,OAAO,CAAO,qBAAqB,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,KAAK;SACZ,CAAC;aACD,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QAE1B,wCAAwC;QACxC,gBAAgB,EAAE,CAAC,KAAa,EAA0B,EAAE,CAC1D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAgB,qBAAqB,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE;SAChB,CAAC;QAEJ,4CAA4C;QAC5C,gBAAgB,EAAE,CAAC,KAIlB,EAA0B,EAAE,CAC3B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAgB,oBAAoB,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,KAAK;SACZ,CAAC;QAEJ;;;WAGG;QACH,OAAO,EAAE,CAAC,WAAmB,EAA4B,EAAE,CACzD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAkB,KAAK,EAAE;YACxC,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,WAAW;SACpB,CAAC;QAEJ;;;WAGG;QACH,WAAW,EAAE,CACX,WAAmB,EAOlB,EAAE,CACH,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;YAC7B,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,WAAW;SACpB,CAAC;QAEJ;;;;WAIG;QACH,IAAI,EAAE,CAAC,QAIH,EAAE,EAGH,EAAE;YACH,MAAM,IAAI,KAAK,CACb,mLAAmL,CACpL,CAAA;QACH,CAAC;KACF,CAAA;IAED,0EAA0E;IAE1E;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAY/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAGnD,CAAA;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,CAIpD,CAAA;QACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;QACnC,CAAC;QACD,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;QACvD,IACE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EACvC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;QACrC,CAAC;QACD,0DAA0D;QAC1D,IACE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAE,CAAsB,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAClD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAEnD,MAAM,kBAAkB,CAAC;YACvB,IAAI,EAAE,GAAG,SAAS,IAAI,UAAU,EAAE;YAClC,MAAM;YACN,GAAG,EAAE,GAAiB;SACvB,CAAC,CAAA;QAEF,OAAO,MAAe,CAAA;IACxB,CAAC;IAED,0DAA0D;IAC1D,mBAAmB;QACjB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;IACxB,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;QACvC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAEjC,YAAY,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QACnC,IAAI,CAAC,UAAU,GAAG;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,GAAG,IAAI;SACjD,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AArRD,4CAqRC;AAED,4EAA4E;AAE5E,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9E,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACvE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IACD,8DAA8D;IAC9D,MAAM,CAAC,GAAI,UAAkB,CAAC,MAAM,CAAA;IACpC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7D,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9E,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACvE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,8DAA8D;IAC9D,MAAM,CAAC,GAAI,UAAkB,CAAC,MAAM,CAAA;IACpC,IAAI,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC5D,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;AAChD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAIjC;IACC,iEAAiE;IACjE,MAAM,MAAM,GACV,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACvE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAChC,KAAK,EACL,KAAK,CAAC,GAAG,EACT,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAA;IACD,mEAAmE;IACnE,iEAAiE;IACjE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAe,CAAA;IAC7D,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAe,CAAA;IACpE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAC5B,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAC7B,GAAG,EACH,QAAkC,EAClC,SAAmC,CACpC,CAAA;IACD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;AACjD,CAAC"}

package/dist/auth/client.d.ts

@@ -0,0 +1,212 @@
+import { type SentroyAuthUser, type SignupResponse, type LoginResponse, type LoginOutcome, type SessionSummary, type ActivityEntry, type MfaStatus, type MfaEnrollResponse, type MfaVerifyEnrollmentResponse, type PasskeySummary, type SocialProvider } from "./types";
+import { type AuthHttpOptions } from "./http";
+/**
+ * Browser-facing Sentroy Auth SDK — Firebase Auth tarzı session API.
+ *
+ * `apiKey` BROWSER'DA OLMAMALI; bu sınıf `apiKey`'i header'a koyacaktır.
+ * RP backend gerçek api-key tutar; browser'da end-user kendi access/refresh
+ * token'larıyla yaşar. Yine de DX için sınıf hem apiKey-less browser
+ * akışına (signup/login backend proxy üzerinden) hem apiKey'li server
+ * akışına (admin) tek tip API sunar — caller hangi mod'da olduğunu
+ * `SentroyAuthAdmin` (admin SDK, sunucu) vs `SentroyAuth` (browser SDK,
+ * apiKey-less) seçimiyle netleştirir.
+ *
+ * Storage: browser'da access + refresh `storage` adapter'a yazılır
+ * (default `localStorage`). Refresh expire'a 5dk kala arka planda
+ * yenilenir; fail olursa `onAuthStateChanged(null)` ve storage silinir.
+ *
+ * **Server-side rendering**: `typeof window === "undefined"` korumalı —
+ * Node ortamında `localStorage` yok, default `memory` storage'a düşer.
+ */
+export type AuthStateChangeListener = (user: SentroyAuthUser | null) => void;
+export interface AuthStorageAdapter {
+    read(): {
+        accessToken: string;
+        refreshToken: string;
+        user: SentroyAuthUser;
+    } | null;
+    write(value: {
+        accessToken: string;
+        refreshToken: string;
+        user: SentroyAuthUser;
+    }): void;
+    clear(): void;
+}
+export interface SentroyAuthOptions extends AuthHttpOptions {
+    /** Token persistence stratejisi. Default `"localStorage"` browser'da,
+     *  Node'da otomatik `"memory"`. Custom için adapter geçilebilir. */
+    storage?: "localStorage" | "memory" | AuthStorageAdapter;
+    /** Background refresh tetikleme süresi (saniye, expiresIn altında).
+     *  Default 300 (5dk). */
+    refreshSkew?: number;
+}
+export declare class SentroyAuth {
+    private readonly http;
+    private readonly storage;
+    private readonly listeners;
+    private readonly refreshSkew;
+    private refreshTimer;
+    private currentUser;
+    constructor(opts: SentroyAuthOptions);
+    get user(): SentroyAuthUser | null;
+    get accessToken(): string | null;
+    signUp(input: {
+        email: string;
+        password: string;
+        displayName?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<SignupResponse>;
+    /**
+     * Sign in with email/password. MFA enrolled user'lar için response
+     * discriminated union: `kind: "mfa"` → caller `verifyMfa()` çağırır.
+     * `kind: "tokens"` → session kuruldu.
+     */
+    signIn(input: {
+        email: string;
+        password: string;
+        rememberMe?: boolean;
+    }): Promise<LoginOutcome>;
+    /**
+     * MFA verify — `signIn` ile `kind: "mfa"` döndüyse, kullanıcıdan code
+     * (veya recovery code) alıp bu method'u çağır. Başarılıysa session
+     * kurulur ve login tamamlanır.
+     */
+    verifyMfa(input: {
+        mfaToken: string;
+        code?: string;
+        recoveryCode?: string;
+    }): Promise<LoginResponse>;
+    signOut(): Promise<void>;
+    sendPasswordReset(email: string): Promise<void>;
+    /**
+     * Reset password using token from email. `newPassword` policy +
+     * HaveIBeenPwned breach check yapılır.
+     */
+    confirmPasswordReset(input: {
+        token: string;
+        newPassword: string;
+    }): Promise<SentroyAuthUser>;
+    verifyEmail(token: string): Promise<SentroyAuthUser>;
+    /**
+     * Email magic-link request. Project'in `magicLinkEnabled` true
+     * olması gerekir. Uniform 200 response — email yoksa da hata vermez.
+     */
+    sendMagicLink(input: {
+        email: string;
+        redirectUri?: string;
+    }): Promise<void>;
+    /**
+     * Magic link mail'inden gelen token ile login. Session kurulur.
+     */
+    consumeMagicLink(token: string): Promise<LoginResponse>;
+    /**
+     * Accept admin invitation. Token mail'den gelir, kullanıcı password
+     * + optional displayName girer; hesap create + session kurulur.
+     */
+    acceptInvitation(input: {
+        token: string;
+        password: string;
+        displayName?: string;
+    }): Promise<LoginResponse>;
+    /**
+     * Provider authorize URL üret. `window.location.assign(url)` ile
+     * RP'nin sayfasından redirect — callback'te Sentroy session kurulur,
+     * redirectUri fragment'ında token'lar döner.
+     */
+    socialAuthorizeUrl(provider: SocialProvider, opts?: {
+        redirectUri?: string;
+        rememberMe?: boolean;
+    }): string;
+    /**
+     * `window.location.hash`tan social login redirect sonrası gelen
+     * `#access_token=...&refresh_token=...&token_type=Bearer` parse +
+     * session kur. RP sayfasına redirectUri varsayılan akış kullanıldıysa
+     * çağırın. Başarılıysa user döner, fail'da null.
+     */
+    consumeRedirectFragment(): Promise<SentroyAuthUser | null>;
+    getCurrentUser(): Promise<SentroyAuthUser | null>;
+    private fetchMe;
+    listSessions(): Promise<SessionSummary[]>;
+    revokeSession(id: string): Promise<void>;
+    /**
+     * Change password. Backend tüm session'ları revoke eder; SDK local
+     * session'ı temizler — caller `signIn` ile tekrar oturum açar.
+     */
+    changePassword(input: {
+        currentPassword: string;
+        newPassword: string;
+    }): Promise<void>;
+    /**
+     * Request email change — confirmation mail yeni adrese gönderilir.
+     * Kullanıcı `confirmEmailChange(token)` ile finalize eder.
+     */
+    requestEmailChange(input: {
+        newEmail: string;
+        currentPassword: string;
+    }): Promise<void>;
+    /** Token-based confirm (mail link'inden gelir). */
+    confirmEmailChange(token: string): Promise<SentroyAuthUser>;
+    requestAccountDeletion(currentPassword: string): Promise<void>;
+    confirmAccountDeletion(token: string): Promise<void>;
+    getActivity(): Promise<ActivityEntry[]>;
+    readonly mfa: {
+        getStatus: () => Promise<MfaStatus>;
+        enrollTotp: () => Promise<MfaEnrollResponse>;
+        verifyTotpEnrollment: (code: string) => Promise<MfaVerifyEnrollmentResponse>;
+        disableTotp: (currentPassword: string) => Promise<void>;
+    };
+    readonly passkey: {
+        list: () => Promise<PasskeySummary[]>;
+        delete: (id: string) => Promise<void>;
+        /**
+         * Register a new passkey on this device.
+         *
+         * Browser-only: dynamically imports `@simplewebauthn/browser`. RP
+         * SDK kullanıyor ama webauthn/browser bağımlılığı yoksa caller
+         * `peerDependencies` aracılığıyla manuel ekler.
+         */
+        register: (deviceName?: string) => Promise<void>;
+        /**
+         * Sign in with passkey. Email opsiyonel — verilirse server o
+         * user'ın passkey'lerini allowList yapar, yoksa "usernameless".
+         * Session kurulur.
+         */
+        authenticate: (opts?: {
+            email?: string;
+            rememberMe?: boolean;
+        }) => Promise<LoginResponse>;
+    };
+    /**
+     * Force refresh now — caller'ın sürdüğü access token süresi dolmuş
+     * olabilir; bu method yeni token'ları persist eder.
+     */
+    refreshNow(): Promise<void>;
+    /** Manual session injection — fragment / cookie redirect dışında tokens
+     *  başka bir kanaldan elde edildiyse (örn. RP custom auth callback). */
+    setSession(input: {
+        accessToken: string;
+        refreshToken: string;
+        user: SentroyAuthUser;
+    }): void;
+    private requireToken;
+    /**
+     * Subscription pattern — Firebase Auth uyumlu. Caller'ın hemen mevcut
+     * state'i alabilmesi için constructor'da restore edilen user
+     * subscribe sırasında bir kez dispatch edilir.
+     */
+    onAuthStateChanged(listener: AuthStateChangeListener): () => void;
+    private persist;
+    private clearSession;
+    private notify;
+    /**
+     * JWT'nin `exp` claim'inden expiry'i tahmin et. Parsing fail ise
+     * 1 saat varsay (default access TTL). Refresh window: exp - skew.
+     *
+     * **Browser-safe**: `Buffer` Node'a özel, tarayıcıda yok. `atob`
+     * + URL-safe charset normalization ile decode ediyoruz.
+     */
+    private estimateExpiry;
+    private scheduleRefresh;
+    private refresh;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/auth/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/auth/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,EAElB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAChC,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,SAAS,CAAA;AAChB,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,QAAQ,CAAA;AAEvD;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,KAAK,IAAI,CAAA;AAE5E,MAAM,WAAW,kBAAkB;IACjC,IAAI,IAAI;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,eAAe,CAAA;KAAE,GAAG,IAAI,CAAA;IACnF,KAAK,CAAC,KAAK,EAAE;QACX,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,EAAE,eAAe,CAAA;KACtB,GAAG,IAAI,CAAA;IACR,KAAK,IAAI,IAAI,CAAA;CACd;AA8GD,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD;wEACoE;IACpE,OAAO,CAAC,EAAE,cAAc,GAAG,QAAQ,GAAG,kBAAkB,CAAA;IACxD;6BACyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,OAAO,CAAC,YAAY,CAA6C;IACjE,OAAO,CAAC,WAAW,CAA+B;gBAEtC,IAAI,EAAE,kBAAkB;IA2BpC,IAAI,IAAI,IAAI,eAAe,GAAG,IAAI,CAEjC;IAED,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAEK,MAAM,CAAC,KAAK,EAAE;QAClB,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACnC,GAAG,OAAO,CAAC,cAAc,CAAC;IAe3B;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE;QAClB,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,MAAM,CAAA;QAChB,UAAU,CAAC,EAAE,OAAO,CAAA;KACrB,GAAG,OAAO,CAAC,YAAY,CAAC;IAgBzB;;;;OAIG;IACG,SAAS,CAAC,KAAK,EAAE;QACrB,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,aAAa,CAAC;IAapB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAexB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrD;;;OAGG;IACG,oBAAoB,CAAC,KAAK,EAAE;QAChC,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,eAAe,CAAC;IAQtB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAmB1D;;;OAGG;IACG,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOlF;;OAEG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAe7D;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,aAAa,CAAC;IAe1B;;;;OAIG;IACH,kBAAkB,CAChB,QAAQ,EAAE,cAAc,EACxB,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACxD,MAAM;IAQT;;;;;OAKG;IACG,uBAAuB,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAsB1D,cAAc,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAUzC,OAAO;IAaf,YAAY,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAOzC,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS9C;;;OAGG;IACG,cAAc,CAAC,KAAK,EAAE;QAC1B,eAAe,EAAE,MAAM,CAAA;QACvB,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC;IAWjB;;;OAGG;IACG,kBAAkB,CAAC,KAAK,EAAE;QAC9B,QAAQ,EAAE,MAAM,CAAA;QAChB,eAAe,EAAE,MAAM,CAAA;KACxB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjB,mDAAmD;IAC7C,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAY3D,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9D,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpD,WAAW,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAS7C,QAAQ,CAAC,GAAG;yBACW,OAAO,CAAC,SAAS,CAAC;0BAKjB,OAAO,CAAC,iBAAiB,CAAC;qCAMxC,MAAM,KACX,OAAO,CAAC,2BAA2B,CAAC;uCAKF,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;MAO5D;IAID,QAAQ,CAAC,OAAO;oBACE,OAAO,CAAC,cAAc,EAAE,CAAC;qBAKtB,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;QAMzC;;;;;;WAMG;gCAC2B,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;QA0BpD;;;;WAIG;8BAEK;YAAE,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,KAC7C,OAAO,CAAC,aAAa,CAAC;MA8B1B;IAED;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;4EACwE;IACxE,UAAU,CAAC,KAAK,EAAE;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,EAAE,eAAe,CAAA;KACtB,GAAG,IAAI;IAIR,OAAO,CAAC,YAAY;IAQpB;;;;OAIG;IACH,kBAAkB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,MAAM,IAAI;IAYjE,OAAO,CAAC,OAAO;IAWf,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,MAAM;IAUd;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,eAAe;YAaT,OAAO;CAiBtB"}