@soulcode/bexio-oauth 0.1.0 → 0.3.0

package/README.md

@@ -11,12 +11,14 @@ It is **not** an auth framework: your app keeps its own login. For "Sign in with
 
 ```bash
 npm install @soulcode/bexio-oauth pg
-npx @soulcode/bexio-oauth sql > migrations/0001_bexio_grants.sql   # then apply it
+npx @soulcode/bexio-oauth sql > migrations/0001_bexio_oauth.sql    # then apply it
 npx @soulcode/bexio-oauth keygen                                    # encryption key
 ```
 
 Requires Node ≥ 24 and PostgreSQL.
 
+Use one Bexio OAuth client per app: Bexio keeps one refresh token chain per user, company and client, so apps sharing a client id invalidate each other's grants. Owners of your app that connect the same Bexio user and company share one connection, refreshed once for all of them ([guide §2](https://github.com/SoulcodeAgency/bexio-oauth/blob/main/docs/integration.md#why-owners-of-the-same-identity-share-a-connection)).
+
 ## Quickstart
 
 ```ts
@@ -37,14 +39,16 @@ export const bexio = createBexioOAuth({
 ```
 
 ```ts
-// GET /api/bexio/connect
+// app/api/bexio/connect/route.ts
 export const GET = async (req: Request) =>
-  bexio.start(req, {
+  bexio.start({
     ownerId: await currentWorkspaceId(req),
     returnTo: "/settings",
   });
+```
 
-// GET /api/bexio/callback  (your redirectUri)
+```ts
+// app/api/bexio/callback/route.ts  (your redirectUri)
 export const GET = async (req: Request) =>
   bexio.callback(req, { ownerId: await currentWorkspaceId(req) });
 ```
@@ -60,7 +64,7 @@ await fetch("https://api.bexio.com/2.0/contact", {
 });
 ```
 
-Also: `listGrants`, `disconnect`, `refreshIdle` (keep idle grants alive), `saveGrant` (tokens from your auth framework). Every error is a `BexioOAuthError` with a stable `code`.
+Also: `listGrants`, `disconnect`, `refreshIdle` (keep idle connections alive), `saveGrant` (tokens from your auth framework). Every error is a `BexioOAuthError` with a stable `code`.
 
 ## License
 

package/dist/claims.d.ts

@@ -6,7 +6,7 @@ export declare const BEXIO_API_BASE_URL = "https://api.bexio.com";
  * Always requested. `company_profile` adds the company claims; `offline_access`
  * issues a refresh token that keeps working without the user present.
  */
-export declare const BASE_SCOPES: string[];
+export declare const BASE_SCOPES: readonly string[];
 export type ClaimBag = Record<string, unknown>;
 /** Who granted access, as read from Bexio's ID token, access token and userinfo. */
 export interface BexioIdentity {
@@ -26,6 +26,6 @@ export interface BexioIdentity {
  * missing.
  */
 export declare function mapClaims(claims: ClaimBag): BexioIdentity;
-/** The value a grant's ciphertext is bound to (see `TokenCipher`). */
-export declare function grantBinding(ownerId: string, companyId: string, userId: string): string;
+/** The value a connection's ciphertext is bound to (see `TokenCipher`). */
+export declare function connectionBinding(companyId: string, userId: string): string;
 //# sourceMappingURL=claims.d.ts.map

package/dist/claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAEA,uDAAuD;AACvD,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAClE,uCAAuC;AACvC,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAC1D;;;GAGG;AACH,eAAO,MAAM,WAAW,UAMvB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE/C,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAaD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,QAAQ,GAAG,aAAa,CAwBzD;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,MAAM,CAER"}
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAEA,uDAAuD;AACvD,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAClE,uCAAuC;AACvC,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAC1D;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAMvC,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE/C,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAaD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,QAAQ,GAAG,aAAa,CAwBzD;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3E"}

package/dist/claims.js

@@ -7,13 +7,13 @@ export const BEXIO_API_BASE_URL = "https://api.bexio.com";
  * Always requested. `company_profile` adds the company claims; `offline_access`
  * issues a refresh token that keeps working without the user present.
  */
-export const BASE_SCOPES = [
+export const BASE_SCOPES = Object.freeze([
     "openid",
     "profile",
     "email",
     "company_profile",
     "offline_access",
-];
+]);
 function text(value) {
     if (typeof value === "string" && value.length > 0)
         return value;
@@ -51,8 +51,8 @@ export function mapClaims(claims) {
         userEmail: text(claims.email),
     };
 }
-/** The value a grant's ciphertext is bound to (see `TokenCipher`). */
-export function grantBinding(ownerId, companyId, userId) {
-    return `${ownerId}\u0000${companyId}\u0000${userId}`;
+/** The value a connection's ciphertext is bound to (see `TokenCipher`). */
+export function connectionBinding(companyId, userId) {
+    return `${companyId}\u0000${userId}`;
 }
 //# sourceMappingURL=claims.js.map

package/dist/claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"claims.js","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,uDAAuD;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAClE,uCAAuC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,QAAQ;IACR,SAAS;IACT,OAAO;IACP,iBAAiB;IACjB,gBAAgB;CACjB,CAAC;AAiBF,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAgB;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,OAAO;QACL,MAAM;QACN,SAAS;QACT,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACtC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;QAC9C,QAAQ,EACN,KAAK,IAAI,MAAM;YACb,CAAC,CAAC,GAAG,KAAK,IAAI,MAAM,EAAE;YACtB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,SAAiB,EACjB,MAAc;IAEd,OAAO,GAAG,OAAO,SAAS,SAAS,SAAS,MAAM,EAAE,CAAC;AACvD,CAAC"}
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,uDAAuD;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAClE,uCAAuC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1D,QAAQ;IACR,SAAS;IACT,OAAO;IACP,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAiBH,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAgB;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,OAAO;QACL,MAAM;QACN,SAAS;QACT,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACtC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;QAC9C,QAAQ,EACN,KAAK,IAAI,MAAM;YACb,CAAC,CAAC,GAAG,KAAK,IAAI,MAAM,EAAE;YACtB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACjE,OAAO,GAAG,SAAS,SAAS,MAAM,EAAE,CAAC;AACvC,CAAC"}

package/dist/client.d.ts

@@ -1,140 +1,7 @@
-import { type Keyring } from "./crypto.js";
-import { type Duration } from "./duration.js";
-import { type Role } from "./permissions.js";
-import type { GrantRecord, GrantStore } from "./store/types.js";
-export interface BexioOAuthConfig {
-    /** From your Bexio OAuth app. */
-    clientId: string;
-    clientSecret: string;
-    /** Must exactly match a redirect URI registered at Bexio. */
-    redirectUri: string;
-    /** Bexio API scopes your app needs; `BASE_SCOPES` are always added. */
-    scopes?: string[];
-    /** Encryption keyring (see `generateKey`). */
-    keys: Keyring;
-    store: GrantStore;
-    /** Defaults to Bexio's production issuer. Override only to point at a mock. */
-    issuer?: string;
-    /** Defaults to `https://api.bexio.com`. Override only to point at a mock. */
-    apiBaseUrl?: string;
-    /** How long one refresh may hold a grant's lock. Default `"30s"`. */
-    refreshLockTtl?: Duration;
-    /** Where `callback` redirects when the flow cookie is gone. Default `"/"`. */
-    defaultReturnTo?: string;
-    /** Custom `fetch` for every outgoing request (tests, proxies). */
-    fetch?: typeof fetch;
-    /** Clock override for tests. */
-    clock?: () => Date;
-}
-/** A grant as the app sees it: no token material. */
-export interface Grant {
-    id: string;
-    ownerId: string;
-    companyId: string;
-    companyName: string | null;
-    userId: string;
-    userName: string | null;
-    userEmail: string | null;
-    companyUserId: number | null;
-    role: Role;
-    status: GrantRecord["status"];
-    scope: string | null;
-    accessExpiresAt: Date | null;
-    lastRefreshedAt: Date;
-    createdAt: Date;
-    updatedAt: Date;
-}
-/** Identifies one grant of an owner. */
-export interface GrantSelector {
-    ownerId: string;
-    companyId?: string;
-    grantId?: string;
-}
-export interface AccessToken {
-    accessToken: string;
-    expiresAt: Date | null;
-    grant: Grant;
-}
-/** Tokens obtained by your auth framework, for `saveGrant`. */
-export interface ExternalTokens {
-    accessToken: string;
-    refreshToken?: string | null;
-    idToken?: string | null;
-    /** Access-token expiry; defaults to the access token's `exp` claim. */
-    expiresAt?: Date | null;
-    scope?: string | null;
-}
-export interface RefreshIdleResult {
-    refreshed: number;
-    /** Idle grants another process was refreshing at the same time. */
-    skipped: number;
-    reauthRequired: number;
-    failed: number;
-}
+import type { BexioOAuth, BexioOAuthConfig } from "./types.js";
 /**
- * How the callback checks the owner. Either the `ownerId` your app derives
- * from the signed-in session (must equal the one passed to `start`), or
- * `authorizeOwner`, which receives the owner recorded at `start` and returns
- * whether the signed-in user may connect Bexio for it. Use the latter when
- * one callback URL serves many owners (e.g. workspaces).
+ * Creates the client. Validates the config up front (throws `invalid_config`);
+ * OIDC discovery runs lazily on first use.
  */
-export type CallbackOptions = {
-    ownerId: string;
-} | {
-    authorizeOwner: (ownerId: string) => boolean | Promise<boolean>;
-};
-export interface CallbackResult {
-    grant: Grant;
-    returnTo: string;
-    /** Contains the `Set-Cookie` that deletes the flow cookie; copy it onto your response. */
-    headers: Headers;
-}
-export type BexioOAuth = ReturnType<typeof createBexioOAuth>;
-export declare function createBexioOAuth(config: BexioOAuthConfig): {
-    /**
-     * Starts the Connect flow: redirects to Bexio and sets the encrypted flow
-     * cookie. Derive `ownerId` from your authenticated session.
-     */
-    start(_request: Request, options: {
-        ownerId: string;
-        returnTo?: string;
-    }): Promise<Response>;
-    /**
-     * Handles the redirect back from Bexio and saves the grant. Throws a
-     * `BexioOAuthError` on failure; use `callback` for a ready-made redirect.
-     */
-    handleCallback(request: Request, options: CallbackOptions): Promise<CallbackResult>;
-    /**
-     * Handles the redirect back from Bexio, saves the grant, and redirects to
-     * `returnTo` (or `returnTo?bexio_error=<code>` on failure).
-     */
-    callback(request: Request, options: CallbackOptions): Promise<Response>;
-    /**
-     * Saves tokens obtained by your auth framework ("Sign in with Bexio").
-     * Verifies the tokens' signatures against Bexio's keys first.
-     */
-    saveGrant(input: {
-        ownerId: string;
-        tokens: ExternalTokens;
-    }): Promise<Grant>;
-    /**
-     * A valid access token for the owner's grant, refreshed when needed.
-     * Safe to call from background jobs and from many instances at once.
-     */
-    getAccessToken(selector: GrantSelector): Promise<AccessToken>;
-    /** The owner's grants, without token material. */
-    listGrants(query: {
-        ownerId: string;
-    }): Promise<Grant[]>;
-    /** Revokes the refresh token at Bexio (best effort) and deletes the grant. */
-    disconnect(selector: GrantSelector): Promise<void>;
-    /**
-     * Refreshes active grants not refreshed for `idleFor`, so Bexio doesn't end
-     * their offline sessions. Run it on a schedule.
-     */
-    refreshIdle(options: {
-        idleFor: Duration;
-        limit?: number;
-    }): Promise<RefreshIdleResult>;
-};
+export declare function createBexioOAuth(config: BexioOAuthConfig): BexioOAuth;
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAe,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAQ,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAa,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8CAA8C;IAC9C,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,cAAc,CAAC,EAAE,QAAQ,CAAC;IAC1B,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CACpB;AAED,qDAAqD;AACrD,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,IAAI,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;CACd;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uEAAuE;IACvE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;CAClB;AAqHD,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE7D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB;IAuQrD;;;OAGG;oBAES,OAAO,WACR;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC,QAAQ,CAAC;IAmCpB;;;OAGG;4BAEQ,OAAO,WACP,eAAe,GACvB,OAAO,CAAC,cAAc,CAAC;IAyG1B;;;OAGG;sBAEQ,OAAO,WACP,eAAe,GACvB,OAAO,CAAC,QAAQ,CAAC;IAqBpB;;;OAGG;qBACoB;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,cAAc,CAAC;KACxB,GAAG,OAAO,CAAC,KAAK,CAAC;IA4FlB;;;OAGG;6BAC4B,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IAkDnE,kDAAkD;sBAC1B;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAM9D,8EAA8E;yBACnD,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxD;;;OAGG;yBACwB;QACzB,OAAO,EAAE,QAAQ,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,iBAAiB,CAAC;EA2DjC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE/D;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAYrE"}