@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/LICENSE

@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) 2026 VIBES DEV LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,225 @@
-# Temporary Holding Version
+# @vibesdotdev/auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+## Stored identity and device sign-in
+
+Resolve `runtime/client:auth` with `getVibesClient<AuthApiClient>('auth', runtime)`.
+`getStoredIdentity()` returns only identity fields or confirmed `signed-out`.
+The host agent credential wins over a stored login, followed by the existing
+credential store's API-key/session precedence. Store failures propagate with
+their typed code, reason and cause.
+
+`signInDevice({ onProgress, signal })` delegates to the existing device flow.
+Progress is redacted and bounded to 300 characters. Results contain no tokens;
+failures retain their typed cause, including protocol denial and expiry.
+Cancellation rejects with `CANCELLED/device-sign-in-cancelled` and prevents a late
+approval from writing credentials. A missing consumer composition refuses with
+`UNAVAILABLE/consumer-auth-unavailable`.
+
+Consumer hosts compose `./consumer.plugin` alongside `./plugin` (or its API
+slice). Only consumer composition loads stored-credential and device-flow
+helpers; the portable client resolves the internal context through the kernel.
+The public credential-store, consumer-context and device-login adapters remain
+compatible; device-login failure results now also retain their typed cause.
+
+Proof: Studio's composed Auth suite covers signed-out state, identity precedence,
+approval, progress, denial, setup failures and cancellation through the real
+semantic client, credential store and device protocol with HTTP/browser fakes.
+
+
+Identity contract for the repository-collection. Owns the `auth/provider` runtime kind,
+the `config/manifest#auth` credential schema, the `api/client#auth` HTTP
+transport, and the `vibes auth ...` CLI commands. Other packages authenticate
+by resolving these through the runtime — they don't import auth internals.
+
+## Quickstart
+
+### Resolve the auth provider in feature code
+
+```ts
+// `runtime` is the one your host handed you: `event.locals.runtime` (SvelteKit),
+// `context.runtime` (CLI), or the constructor/first-parameter runtime elsewhere.
+const provider = await runtime.query('auth/provider').resolve();
+const ctx = await provider.getAuthContext();
+
+if (!ctx.isAuthenticated) {
+  throw new Error(ctx.error ?? 'not authenticated');
+}
+
+await fetch('/api/something', { headers: ctx.headers });
+```
+
+### Talk to the auth service
+
+```ts
+import { vibesAuthClient } from '@vibesdotdev/auth/client';
+
+const auth = vibesAuthClient();
+const session = await auth.get('/api/session');
+```
+
+Or resolve the registered `api/client`:
+
+```ts
+const auth = await runtime.query('api/client').withId('auth').resolve();
+```
+
+### Build sign-in / sign-up URLs
+
+```ts
+import { createAuthClient } from '@vibesdotdev/auth/client';
+
+const client = createAuthClient({
+  authOrigin: 'https://auth.vibes.dev',
+  clientOrigin: 'https://app.vibes.dev',
+  clientId: 'app'
+});
+
+window.location.href = client.signInUrl({ redirectTo: '/dashboard' });
+```
+
+### Read or write stored credentials
+
+```ts
+import {
+  getCredentials,
+  setCredentials,
+  clearCredentials
+} from '@vibesdotdev/auth/features/services/credential-store';
+
+await setCredentials({ apiKey: 'vbk_…', email: 'user@example.com' }, environmentId, runtime);
+const creds = await getCredentials(runtime, environmentId);
+await clearCredentials(runtime, environmentId);
+```
+
+All three go through `config/manifest#auth`; the runtime picks the storage
+adapter (default `storage.localdb`).
+
+Device login replaces the previous login with the approved session and its
+confirmed identity, clearing obsolete credential metadata. An explicit
+unknown-session answer preserves the previous login. If identity lookup is
+unavailable, the approved session is saved without the previous account's
+identity, with a warning. Ordinary `setCredentials` calls remain partial updates;
+`mode: 'replace-session'` selects whole-login replacement and requires a nonblank
+session token or a valid secure-store reference. Invalid modes, empty
+replacements and malformed references fail before runtime/storage resolution
+with `CapabilityError` code `INVALID_INPUT`, reason `credential-input-invalid`.
+Its fixed message contains no submitted values or validation cause.
+The portable `activateDeviceSession` flow also classifies `get-session` before
+one replacement write; unavailable lookup retains only data supplied by the new
+approval, and an explicit JSON null leaves both credential documents unchanged.
+The CLI warning and login
+audit retain the HTTP
+status and a single-line message excerpt of at most 200 characters, without
+copying request headers or credentials.
+
+Credential replacement commits the environment document before its legacy
+projection and reference retirement. Durable cleanup journals protect shared
+references by exact store, environment and key. Without partition discovery,
+cleanup retains custody; a failing discovery call refuses
+`UNAVAILABLE / credential-reference-discovery-unavailable` with value-free
+cause facts and no deleted material. The Storage LocalDB adapter supplies
+immediate-child namespace discovery through `listChildNamespaces()`, consumed
+as `listPartitions()`. The committed login and cleanup journal remain recoverable
+after a discovery failure.
+
+Sign-in method hints use Account's runtime-owned preferences: compose
+`@vibesdotdev/account/api-client-plugin` and construct `new UiPrefs(runtime)`.
+Signed-out hints remain page-local and report `persisted: false`.
+
+### Mobile PKCE
+
+`MOBILE_AUTH_CLIENTS` preserves the iOS and Android defaults, including
+`dev.vibes.app://auth/callback` and `https://vibes.dev/auth/mobile-callback`.
+Declare client settings under `config['auth.mobile'].clients`; the
+`auth.mobile` manifest validates names, platforms, redirect URIs and scopes.
+Compose `@vibesdotdev/auth/api-client-plugin` (or the full auth plugin), then
+hand the runtime to the existing helpers:
+
+```ts
+const url = await buildMobileAuthorizeUrl(options, runtime);
+const tokens = await exchangeMobileAuthorizationCode(exchangeOptions, runtime);
+```
+
+One-argument calls retain the declared manifest defaults; `buildMobileAuthorizeUrl(options)`
+remains synchronous. Unknown clients are `INVALID_INPUT` /
+`mobile-client-unknown`; unregistered redirects are `INVALID_INPUT` /
+`mobile-redirect-uri-unauthorized`. Both are refused before a network call.
+PKCE always uses S256. Token responses are schema-checked and durable credentials
+belong in native secure storage.
+
+The registered `runtime/client#auth` owns authority verdicts, bearer
+partitions, invalidation epochs, its private HMAC key and session verification
+state (JWKS resolvers, refresh cooldowns and human-key verdicts). Disposal
+clears that state and fences pending completions. The TUI plugin separately
+registers `runtime/client#auth.tui-actions` for action callbacks and disposal. Resolving through the
+kernel preserves runtime isolation and fences reads racing sign-in/sign-out.
+Resolve providers with `runtime.query('auth/provider').resolve()`; the deprecated
+root `DefaultAuthProvider` name is a runtime-resolving compatibility projection.
+
+### Admin operations
+
+```ts
+import { createAuthAdminClient } from '@vibesdotdev/auth/client';
+
+// The admin token is a credential: resolve it, never read it from the environment.
+const token = await runtime.resolveCredential({ source: 'secret', key: 'VIBES_AUTH_ADMIN_TOKEN' });
+if (!token.ok) throw token.error;
+
+const admin = createAuthAdminClient({
+  baseUrl: 'https://auth.vibes.dev',
+  adminToken: token.value
+});
+
+const stats = await admin.getSecurityStats();
+const users = await admin.listUsers({ page: 1, perPage: 50 });
+```
+
+### Register the plugin
+
+```ts
+import authPlugin from '@vibesdotdev/auth/plugin';
+
+await runtime.registerPlugin(authPlugin);
+```
+
+The full plugin depends on `config`, `docs` and `runtime-client`; compose those
+owners first. Web clients can use the narrow `./api-client-plugin` slice.
+Consumer and TUI implementations stay behind their explicit plugin subpaths.
+
+## CLI
+
+`apps/cli-bin` mounts the `vibes auth` command tree from this package:
+
+```bash
+vibes auth login --token vbk_…
+vibes auth login                  # interactive browser flow
+vibes auth status
+vibes auth profile
+vibes auth token
+vibes auth logout
+
+vibes auth api-key list
+vibes auth api-key create
+vibes auth api-key revoke <id>
+```
+
+The CLI resolves `config/environment` and `auth/provider` from the runtime to
+pick the API base URL and inject auth headers.
+
+## Test
+
+```bash
+bun run check
+bun run test
+bun run build
+```
+
+`bun run test` runs the non-browser Bun suite followed by the Chromium
+browser suite (`vitest.browser.config.ts`); `bun run test:browser` runs the
+browser stage alone.
+
+## Docs
+
+- [SPEC.md](./SPEC.md) — package contract, hard rules, migration debt
+- [auth-system](./SPEC.md), [auth-web](../../../apps/auth-web/SPEC.md)
+- [account](../account/SPEC.md), [config](../config/SPEC.md), [client](../client/SPEC.md), [storage](../storage/SPEC.md)

package/dist/api/auth.api-client.descriptor.d.ts

@@ -0,0 +1,33 @@
+/**
+ * auth api-client descriptor — declares the canonical `runtime/client`
+ * surface for cross-origin auth data access (sign-in/sign-up/sign-out/session,
+ * connected sign-in accounts, and OAuth provider URL builders).
+ *
+ * Per docs/architecture/FEATURE-API-CLIENT-RUNTIME-KIND.md, the FEATURE
+ * PACKAGE (this one) owns the runtime kind exposing the auth surface. Svelte
+ * components, CLI commands, browser stores all resolve via
+ * `getVibesClient<AuthApiClient>('auth', runtime)`. No surface package may import
+ * `fetch` directly against auth.vibes.dev/api/auth/* anymore.
+ *
+ * Auth data is hosted by `apps/auth-web` and exposed under `/api/auth/*` via
+ * better-auth's HTTP surface. The consumer variant (cli/browser/sveltekit)
+ * talks to that origin over HTTP. A cloud variant is deliberately omitted:
+ * the in-process better-auth instance lives in auth-web and is not packaged
+ * for direct consumption by other features — cross-app callers always go
+ * through the HTTP surface, even when co-located in workerd. If/when an
+ * in-process variant is needed it can be added without changing this
+ * descriptor.
+ *
+ * An explicit baseUrl belongs to this client descriptor. Otherwise the client
+ * asks the handed runtime for infra/service#auth at load time. There are no
+ * environment aliases or derived-domain fallbacks.
+ */
+export declare const authApiClientDescriptor: {
+    kind: "runtime/client";
+    id: string;
+    name: string;
+    description: string;
+    surfaces: string[];
+};
+export default authApiClientDescriptor;
+//# sourceMappingURL=auth.api-client.descriptor.d.ts.map

package/dist/api/auth.api-client.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-client.descriptor.d.ts","sourceRoot":"","sources":["../../src/api/auth.api-client.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,eAAO,MAAM,uBAAuB;;;;;;CAOlC,CAAC;AAEH,eAAe,uBAAuB,CAAC"}

package/dist/api/auth.api-client.descriptor.js

@@ -0,0 +1,34 @@
+/**
+ * auth api-client descriptor — declares the canonical `runtime/client`
+ * surface for cross-origin auth data access (sign-in/sign-up/sign-out/session,
+ * connected sign-in accounts, and OAuth provider URL builders).
+ *
+ * Per docs/architecture/FEATURE-API-CLIENT-RUNTIME-KIND.md, the FEATURE
+ * PACKAGE (this one) owns the runtime kind exposing the auth surface. Svelte
+ * components, CLI commands, browser stores all resolve via
+ * `getVibesClient<AuthApiClient>('auth', runtime)`. No surface package may import
+ * `fetch` directly against auth.vibes.dev/api/auth/* anymore.
+ *
+ * Auth data is hosted by `apps/auth-web` and exposed under `/api/auth/*` via
+ * better-auth's HTTP surface. The consumer variant (cli/browser/sveltekit)
+ * talks to that origin over HTTP. A cloud variant is deliberately omitted:
+ * the in-process better-auth instance lives in auth-web and is not packaged
+ * for direct consumption by other features — cross-app callers always go
+ * through the HTTP surface, even when co-located in workerd. If/when an
+ * in-process variant is needed it can be added without changing this
+ * descriptor.
+ *
+ * An explicit baseUrl belongs to this client descriptor. Otherwise the client
+ * asks the handed runtime for infra/service#auth at load time. There are no
+ * environment aliases or derived-domain fallbacks.
+ */
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const authApiClientDescriptor = createRuntimeAsset({
+    kind: 'runtime/client',
+    id: 'auth',
+    name: 'Auth API Client',
+    description: 'Canonical Auth client for web sessions and accounts, plus token-free stored identity and device sign-in with progress and cancellation through consumer-only composition. Web operations talk to the Auth service over HTTP.',
+    surfaces: ['cli', 'browser', 'sveltekit', 'cloud']
+});
+export default authApiClientDescriptor;
+//# sourceMappingURL=auth.api-client.descriptor.js.map

package/dist/api/auth.api-client.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-client.descriptor.js","sourceRoot":"","sources":["../../src/api/auth.api-client.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;IACzD,IAAI,EAAE,gBAAgB;IACtB,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,iBAAiB;IACvB,WAAW,EACV,8NAA8N;IAC/N,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC;CAClD,CAAC,CAAC;AAEH,eAAe,uBAAuB,CAAC"}

package/dist/api/auth.api-client.impl.d.ts

@@ -0,0 +1,165 @@
+/**
+ * Auth api-client — consumer variant.
+ *
+ * Cross-origin HTTP client against `${authOrigin}/api/auth/*`. Loaded in
+ * cli/browser/sveltekit/cloud scopes by the auth plugin's api-client loader.
+ *
+ * Auth on this surface is COOKIE-based (better-auth session cookies set by
+ * auth-web's `/api/auth/*` endpoints). Every request includes
+ * `credentials: 'include'` so the cookie carries across origins. We do NOT
+ * carry a bearer token — auth-web is the issuer; mounting `Authorization`
+ * headers here would mean re-encoding the cookie as a bearer, which is
+ * neither what better-auth expects nor safe to log.
+ *
+ * Hard rules (Constitution §`runtime/client` + AGENT-CONSTITUTION):
+ *   - NEVER log the password field, the request body of sign-in/sign-up, or
+ *     the resolved session payload's `session.id` / cookies.
+ *   - NEVER persist credentials here. Authority verdicts, bearer partitions and
+ *     the HMAC key live only in this runtime-owned client and clear on disposal.
+ *   - The `logger.warn` paths intentionally log only request paths, HTTP
+ *     status codes, and error class/message strings. Email is structurally
+ *     PII but is already exposed in the URL/body of `/api/auth/sign-in/email`
+ *     so logging it at warn level for diagnostics is acceptable; passwords
+ *     are NEVER touched.
+ *
+ * The descriptor may pin an endpoint. Otherwise the handed runtime resolves
+ * the declared infra/service auth origin in onLoad; absence is a typed error.
+ */
+import { BaseRuntimeClient, type RuntimeClientDescriptor } from '@vibesdotdev/kernel/client';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { type AuthApiClient, type AuthProviderId, type AuthApiRequestOptions, type AuthConnectedAccount, type AuthLinkSocialInput, type AuthLinkSocialResult, type AuthSession, type AuthRevokeSessionResult, type AuthUnlinkAccountResult, type AuthUserSearchOptions, type AuthUserSession, type AuthSignUpCredentials, type EmailPasswordCredentials } from './auth.api-client.types.ts';
+import type { UserListItem } from '@vibesdotdev/account/schemas';
+import { type ResolveAppJwtOptions, type ResolveFreshAppJwtInput } from '../schemas/app-jwt.ts';
+import { type RegisteredApp } from '../schemas/registered-app.ts';
+import { type DeviceSignInOptions } from '../schemas/consumer-auth.ts';
+export declare class AuthApiClientConsumer extends BaseRuntimeClient implements AuthApiClient {
+    getCredential(environmentId?: string): Promise<{
+        type: "none" | "session" | "apiKey";
+        token?: string | undefined;
+        apiKey?: string | undefined;
+        sessionToken?: string | undefined;
+        sessionTokenReference?: {
+            storeId: string;
+            environment: string;
+            key: string;
+        } | undefined;
+        refreshToken?: string | undefined;
+        refreshTokenReference?: {
+            storeId: string;
+            environment: string;
+            key: string;
+        } | undefined;
+        expiresAt?: string | undefined;
+        environment?: string | undefined;
+        userId?: string | undefined;
+        email?: string | undefined;
+        name?: string | undefined;
+        scopes?: ("chat:send" | "chat:read" | "knowledge:read" | "knowledge:write" | "session:join" | "session:create" | "forum:post" | "forum:react" | "presence:update" | "presentations:request" | "presentations:review" | "forge:read" | "forge:write" | "forge:review" | "forge:merge")[] | undefined;
+        projectId?: string | undefined;
+        ipWhitelist?: string[] | undefined;
+        dailyQuota?: number | undefined;
+        source?: string | undefined;
+    } | null>;
+    resolveAppJwt(input?: ResolveAppJwtOptions): Promise<string | null>;
+    resolveFreshAppJwt(input?: ResolveFreshAppJwtInput): Promise<string | null>;
+    getStoredIdentity(): Promise<{
+        status: "signed-in";
+        identity: {
+            email?: string | undefined;
+            name?: string | undefined;
+            userId?: string | undefined;
+        };
+    } | {
+        status: "signed-out";
+    }>;
+    signInDevice(input?: DeviceSignInOptions): Promise<{
+        success: boolean;
+        message: string;
+        cause?: Error | import("@vibesdotdev/kernel").ThrownNonError | undefined;
+    }>;
+    private readonly logger;
+    private resolvedAuthOrigin;
+    private readonly apiBase;
+    readonly sessionVerificationState: {
+        active: boolean;
+        jwksByOrigin: Map<string, {
+            resolver: import("jose").LocalJWKSet;
+            expiresAtMs: number;
+        }>;
+        jwksForceRefreshAtMs: Map<string, number>;
+        jwksRefillInFlight: Map<string, Promise<{
+            resolver: import("jose").LocalJWKSet;
+            expiresAtMs: number;
+        }>>;
+        apiKeyCache: Map<string, {
+            expiresAtMs: number;
+            payload: import("jose").JWTPayload | null;
+        }>;
+    };
+    readonly authorityState: {
+        epoch: number;
+        verdicts: Map<string, {
+            authOrigin: string;
+            credentialMac: string;
+            verdict: {
+                kind: "api-key";
+            } | {
+                kind: "session";
+                jwt?: string | undefined;
+            };
+        }>;
+        bearers: Map<string, string>;
+        credentialOperations?: Promise<void> | undefined;
+    };
+    private credentialMacKey?;
+    /** App `client_credentials` tokens by client id; cleared on disposal. */
+    private readonly appTokens;
+    private appTokenEpoch;
+    credentialMac(token: string): Promise<string>;
+    protected onDispose(): void;
+    constructor(descriptor: RuntimeClientDescriptor, context: {
+        runtime: VibesRuntime;
+    });
+    /**
+     * Resolved auth origin used by the URL builders. FAIL-LOUD: throws when the
+     * origin has not been resolved yet — call `ensureLoaded()` first (the
+     * documented client contract) rather than reading a silently invented
+     * fallback.
+     */
+    get authOrigin(): string;
+    protected onLoad(): Promise<void>;
+    signInEmail(input: EmailPasswordCredentials): Promise<AuthSession>;
+    signUpEmail(input: AuthSignUpCredentials): Promise<AuthSession>;
+    signOut(): Promise<void>;
+    getSession(): Promise<AuthSession>;
+    listSessions(): Promise<AuthUserSession[]>;
+    revokeSession(token: string): Promise<AuthRevokeSessionResult>;
+    revokeOtherSessions(): Promise<AuthRevokeSessionResult>;
+    revokeAllSessions(): Promise<AuthRevokeSessionResult>;
+    listAccounts(options?: AuthApiRequestOptions): Promise<AuthConnectedAccount[]>;
+    listEnabledSocialProviders(): Promise<string[]>;
+    linkSocial(input: AuthLinkSocialInput, options?: AuthApiRequestOptions): Promise<AuthLinkSocialResult>;
+    unlinkAccount(accountId: string, options?: AuthApiRequestOptions): Promise<AuthUnlinkAccountResult>;
+    searchUsers(options: AuthUserSearchOptions): Promise<UserListItem[]>;
+    resolveRegisteredOrigin(origin: string): Promise<RegisteredApp | null>;
+    /** This app's own Auth client credential, from the `auth.app-credentials` references. */
+    private appCredential;
+    /**
+     * A `client_credentials` access token for this app, cached until shortly
+     * before it expires. Concurrent callers share one mint. No scope is sent, so
+     * Auth grants every app-registry scope the registrar gave this client.
+     */
+    private appToken;
+    private dropAppToken;
+    providerSignInUrl(providerId: AuthProviderId, opts?: {
+        redirectTo?: string;
+        signInPath?: string;
+    }): string;
+    providerSignUpUrl(providerId: AuthProviderId, opts?: {
+        redirectTo?: string;
+        signUpPath?: string;
+    }): string;
+    private buildUrl;
+}
+export default AuthApiClientConsumer;
+//# sourceMappingURL=auth.api-client.impl.d.ts.map

package/dist/api/auth.api-client.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-client.impl.d.ts","sourceRoot":"","sources":["../../src/api/auth.api-client.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAQ7F,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMzE,OAAO,EAEN,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,MAAM,4BAA4B,CAAC;AAepC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAGjE,OAAO,EAEN,KAAK,oBAAoB,EAAE,KAAK,uBAAuB,EACvD,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAGN,KAAK,aAAa,EAClB,MAAM,8BAA8B,CAAC;AAMtC,OAAO,EACqB,KAAK,mBAAmB,EACnD,MAAM,6BAA6B,CAAC;AAoGrC,qBAAa,qBAAsB,SAAQ,iBAAkB,YAAW,aAAa;IAC9E,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;IAMpC,aAAa,CAAC,KAAK,GAAE,oBAAyB;IAW9C,kBAAkB,CAAC,KAAK,GAAE,uBAA4B;IAUtD,iBAAiB;;;;;;;;;;IAQjB,YAAY,CAAC,KAAK,GAAE,mBAAwB;;;;;IASlD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IACtD,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,QAAQ,CAAC,wBAAwB;;;;;;;;;;;;;;;MAA4C;IAC7E,QAAQ,CAAC,cAAc;;;;;;;;;;;;;;MAAsC;IAC7D,OAAO,CAAC,gBAAgB,CAAC,CAAqB;IAC9C,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,OAAO,CAAC,aAAa,CAAK;IAEpB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;cAShC,SAAS,IAAI,IAAI;gBAgBnC,UAAU,EAAE,uBAAuB,EACnC,OAAO,EAAE;QAAE,OAAO,EAAE,YAAY,CAAA;KAAE;IAYnC;;;;;OAKG;IACH,IAAI,UAAU,IAAI,MAAM,CAOvB;cAEwB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAY1C,WAAW,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,WAAW,CAAC;IAkClE,WAAW,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC;IAwB/D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBxB,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC;IA0BlC,YAAY,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IA4B1C,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAoB9D,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAmBvD,iBAAiB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAmBrD,YAAY,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAmB9E,0BAA0B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAoB/C,UAAU,CACf,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC;IAwB1B,aAAa,CAClB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAwB7B,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IA6BpE,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAuC5E,yFAAyF;YAC3E,aAAa;IAoC3B;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IAyChB,OAAO,CAAC,YAAY;IAIpB,iBAAiB,CAChB,UAAU,EAAE,cAAc,EAC1B,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,MAAM;IAST,iBAAiB,CAChB,UAAU,EAAE,cAAc,EAC1B,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,MAAM;IAWT,OAAO,CAAC,QAAQ;CAShB;AAED,eAAe,qBAAqB,CAAC"}