@zshannon/streamstore 0.22.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stream Store
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,93 @@
+# @s2-dev/streamstore
+
+TypeScript SDK for [S2](https://s2.dev), a serverless data store for streams.
+
+This package is the core client for S2's [REST API](https://s2.dev/docs/rest/protocol), providing an ergonomic interface for appending to streams and reading data from them.
+
+## Installation
+
+```bash
+npm add @s2-dev/streamstore
+# or
+yarn add @s2-dev/streamstore
+# or
+bun add @s2-dev/streamstore
+```
+
+## Quick start
+
+Generate an access token from the S2 console at <https://s2.dev/dashboard>, then:
+
+<!-- snippet:start quick-start -->
+```ts
+import {
+	AppendAck,
+	AppendInput,
+	AppendRecord,
+	S2,
+	S2Environment,
+} from "@s2-dev/streamstore";
+
+const basinName = process.env.S2_BASIN ?? "my-existing-basin";
+const streamName = process.env.S2_STREAM ?? "my-new-stream";
+
+const s2 = new S2({
+	...S2Environment.parse(),
+	accessToken: process.env.S2_ACCESS_TOKEN ?? "my-access-token",
+});
+
+// Create a basin (namespace) client for basin-level operations.
+const basin = s2.basin(basinName);
+
+// Make a new stream within the basin, using the default configuration.
+const streamResponse = await basin.streams.create({ stream: streamName });
+console.dir(streamResponse, { depth: null });
+
+// Create a stream client on our new stream.
+const stream = basin.stream(streamName);
+
+// Make a single append call.
+const append: Promise<AppendAck> = stream.append(
+	// `append` expects an input batch of one or many records.
+	AppendInput.create([
+		// Records can use a string encoding...
+		AppendRecord.string({
+			body: "Hello from the docs snippet!",
+			headers: [["content-type", "text/plain"]],
+		}),
+		// ...or contain raw binary data.
+		AppendRecord.bytes({
+			body: new TextEncoder().encode("Bytes payload"),
+		}),
+	]),
+);
+
+// When the promise resolves, the data is fully durable and present on the stream.
+const ack = await append;
+console.log(
+	`Appended records ${ack.start.seqNum} through ${ack.end.seqNum} (exclusive).`,
+);
+console.dir(ack, { depth: null });
+
+// Read the two records back as binary.
+const batch = await stream.read(
+	{
+		start: { from: { seqNum: ack.start.seqNum } },
+		stop: { limits: { count: 2 } },
+	},
+	{ as: "bytes" },
+);
+
+for (const record of batch.records) {
+	console.dir(record, { depth: null });
+	console.log("decoded body: %s", new TextDecoder().decode(record.body));
+}
+```
+<!-- snippet:end quick-start -->
+
+> Tip: snippets look for `S2_ACCESS_TOKEN`, `S2_BASIN`, and `S2_STREAM` so you can run them with `npx tsx examples/<file>.ts`.
+
+## More documentation
+
+- Full SDK overview and additional examples: see the root repo README at <https://github.com/s2-streamstore/s2-sdk-typescript>.
+- S2 service docs: <https://s2.dev/docs>.

package/dist/cjs/accessTokens.d.ts

@@ -0,0 +1,51 @@
+import type { RetryConfig, S2RequestOptions } from "./common.js";
+import type { Client } from "./generated/client/types.gen.js";
+import type * as Types from "./types.js";
+/**
+ * Account-scoped helper for listing, issuing, and revoking access tokens.
+ *
+ * Acquire via {@link S2.accessTokens}. Use {@link S2AccessTokens.listAll} for async iteration.
+ */
+export declare class S2AccessTokens {
+    readonly client: Client;
+    private readonly retryConfig?;
+    constructor(client: Client, retryConfig?: RetryConfig);
+    /**
+     * List access tokens.
+     *
+     * @param args.prefix Filter to IDs beginning with this prefix
+     * @param args.startAfter Filter to IDs lexicographically after this value
+     * @param args.limit Max results (up to 1000)
+     */
+    list(args?: Types.ListAccessTokensInput, options?: S2RequestOptions): Promise<Types.ListAccessTokensResponse>;
+    /**
+     * List all access tokens with automatic pagination.
+     * Returns a lazy async iterable that fetches pages as needed.
+     *
+     * @param args - Optional filtering options: `prefix` to filter by ID prefix, `limit` for max results per page
+     *
+     * @example
+     * ```ts
+     * for await (const token of s2.accessTokens.listAll({ prefix: "service-" })) {
+     *   console.log(token.id);
+     * }
+     * ```
+     */
+    listAll(args?: Types.ListAllAccessTokensInput, options?: S2RequestOptions): AsyncIterable<Types.AccessTokenInfo>;
+    /**
+     * Issue a new access token.
+     *
+     * @param args.id Unique token ID (1-96 bytes)
+     * @param args.scope Token scope (operations and resource sets)
+     * @param args.autoPrefixStreams Namespace stream names by configured prefix scope
+     * @param args.expiresAt Expiration time (Date or RFC 3339 string); defaults to requestor's token expiry
+     */
+    issue(args: Types.IssueAccessTokenInput, options?: S2RequestOptions): Promise<Types.IssueAccessTokenResponse>;
+    /**
+     * Revoke an access token by ID.
+     *
+     * @param args.id Token ID to revoke
+     */
+    revoke(args: Types.RevokeAccessTokenInput, options?: S2RequestOptions): Promise<void>;
+}
+//# sourceMappingURL=accessTokens.d.ts.map

package/dist/cjs/accessTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessTokens.d.ts","sourceRoot":"","sources":["../../src/accessTokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAS9D,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAC;AA4BzC;;;;GAIG;AACH,qBAAa,cAAc;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAc;gBAE/B,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW;IAKrD;;;;;;OAMG;IACU,IAAI,CAChB,IAAI,CAAC,EAAE,KAAK,CAAC,qBAAqB,EAClC,OAAO,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAiB1C;;;;;;;;;;;;OAYG;IACI,OAAO,CACb,IAAI,CAAC,EAAE,KAAK,CAAC,wBAAwB,EACrC,OAAO,CAAC,EAAE,gBAAgB,GACxB,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC;IAYvC;;;;;;;OAOG;IACU,KAAK,CACjB,IAAI,EAAE,KAAK,CAAC,qBAAqB,EACjC,OAAO,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAkB1C;;;;OAIG;IACU,MAAM,CAClB,IAAI,EAAE,KAAK,CAAC,sBAAsB,EAClC,OAAO,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC;CAWhB"}

package/dist/cjs/accessTokens.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.S2AccessTokens = void 0;
+const error_js_1 = require("./error.js");
+const index_js_1 = require("./generated/index.js");
+const case_transform_js_1 = require("./internal/case-transform.js");
+const paginate_js_1 = require("./lib/paginate.js");
+const retry_js_1 = require("./lib/retry.js");
+/** Convert expiresAt input (Date, milliseconds, or string) to RFC 3339 string for API. */
+function toISOString(value) {
+    if (value === null)
+        return null;
+    if (value === undefined)
+        return undefined;
+    if (value instanceof Date)
+        return value.toISOString();
+    if (typeof value === "number")
+        return new Date(value).toISOString();
+    return value;
+}
+/** Convert expiresAt from API (ISO string) to Date. */
+function toDate(value) {
+    if (value === null)
+        return null;
+    if (value === undefined)
+        return undefined;
+    return new Date(value);
+}
+/** Transform AccessTokenInfo response: convert expiresAt to Date. */
+function transformTokenInfo(token) {
+    return {
+        ...token,
+        expiresAt: toDate(token.expiresAt),
+    };
+}
+/**
+ * Account-scoped helper for listing, issuing, and revoking access tokens.
+ *
+ * Acquire via {@link S2.accessTokens}. Use {@link S2AccessTokens.listAll} for async iteration.
+ */
+class S2AccessTokens {
+    client;
+    retryConfig;
+    constructor(client, retryConfig) {
+        this.client = client;
+        this.retryConfig = retryConfig;
+    }
+    /**
+     * List access tokens.
+     *
+     * @param args.prefix Filter to IDs beginning with this prefix
+     * @param args.startAfter Filter to IDs lexicographically after this value
+     * @param args.limit Max results (up to 1000)
+     */
+    async list(args, options) {
+        const response = await (0, retry_js_1.withRetries)(this.retryConfig, async () => {
+            return await (0, error_js_1.withS2Data)(() => (0, index_js_1.listAccessTokens)({
+                client: this.client,
+                query: (0, case_transform_js_1.toSnakeCase)(args),
+                ...options,
+            }));
+        });
+        const camelCased = (0, case_transform_js_1.toCamelCase)(response);
+        return {
+            ...camelCased,
+            accessTokens: camelCased.accessTokens.map(transformTokenInfo),
+        };
+    }
+    /**
+     * List all access tokens with automatic pagination.
+     * Returns a lazy async iterable that fetches pages as needed.
+     *
+     * @param args - Optional filtering options: `prefix` to filter by ID prefix, `limit` for max results per page
+     *
+     * @example
+     * ```ts
+     * for await (const token of s2.accessTokens.listAll({ prefix: "service-" })) {
+     *   console.log(token.id);
+     * }
+     * ```
+     */
+    listAll(args, options) {
+        return (0, paginate_js_1.paginate)((a) => this.list(a, options).then((r) => ({
+            items: r.accessTokens,
+            hasMore: r.hasMore,
+        })), args ?? {}, (token) => token.id);
+    }
+    /**
+     * Issue a new access token.
+     *
+     * @param args.id Unique token ID (1-96 bytes)
+     * @param args.scope Token scope (operations and resource sets)
+     * @param args.autoPrefixStreams Namespace stream names by configured prefix scope
+     * @param args.expiresAt Expiration time (Date or RFC 3339 string); defaults to requestor's token expiry
+     */
+    async issue(args, options) {
+        // Convert Date to ISO string for API
+        const apiArgs = {
+            ...args,
+            expiresAt: toISOString(args.expiresAt),
+        };
+        const response = await (0, retry_js_1.withRetries)(this.retryConfig, async () => {
+            return await (0, error_js_1.withS2Data)(() => (0, index_js_1.issueAccessToken)({
+                client: this.client,
+                body: (0, case_transform_js_1.toSnakeCase)(apiArgs),
+                ...options,
+            }));
+        });
+        return (0, case_transform_js_1.toCamelCase)(response);
+    }
+    /**
+     * Revoke an access token by ID.
+     *
+     * @param args.id Token ID to revoke
+     */
+    async revoke(args, options) {
+        await (0, retry_js_1.withRetries)(this.retryConfig, async () => {
+            return await (0, error_js_1.withS2Data)(() => (0, index_js_1.revokeAccessToken)({
+                client: this.client,
+                path: args,
+                ...options,
+            }));
+        });
+    }
+}
+exports.S2AccessTokens = S2AccessTokens;
+//# sourceMappingURL=accessTokens.js.map

package/dist/cjs/accessTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessTokens.js","sourceRoot":"","sources":["../../src/accessTokens.ts"],"names":[],"mappings":";;;AACA,yCAAwC;AAExC,mDAI8B;AAC9B,oEAAwE;AACxE,mDAA6C;AAC7C,6CAA6C;AAG7C,0FAA0F;AAC1F,SAAS,WAAW,CACnB,KAAgD;IAEhD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,OAAO,KAAK,CAAC;AACd,CAAC;AAED,uDAAuD;AACvD,SAAS,MAAM,CAAC,KAAgC;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,KAAU;IACrC,OAAO;QACN,GAAG,KAAK;QACR,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;KAClC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAa,cAAc;IACjB,MAAM,CAAS;IACP,WAAW,CAAe;IAE3C,YAAY,MAAc,EAAE,WAAyB;QACpD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,IAAI,CAChB,IAAkC,EAClC,OAA0B;QAE1B,MAAM,QAAQ,GAAG,MAAM,IAAA,sBAAW,EAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;YAC/D,OAAO,MAAM,IAAA,qBAAU,EAAC,GAAG,EAAE,CAC5B,IAAA,2BAAgB,EAAC;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,IAAA,+BAAW,EAAC,IAAI,CAAC;gBACxB,GAAG,OAAO;aACV,CAAC,CACF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAA,+BAAW,EAAM,QAAQ,CAAC,CAAC;QAC9C,OAAO;YACN,GAAG,UAAU;YACb,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC;SAC7D,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,OAAO,CACb,IAAqC,EACrC,OAA0B;QAE1B,OAAO,IAAA,sBAAQ,EACd,CAAC,CAAC,EAAE,EAAE,CACL,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,KAAK,EAAE,CAAC,CAAC,YAAY;YACrB,OAAO,EAAE,CAAC,CAAC,OAAO;SAClB,CAAC,CAAC,EACJ,IAAI,IAAI,EAAE,EACV,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CACnB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,KAAK,CACjB,IAAiC,EACjC,OAA0B;QAE1B,qCAAqC;QACrC,MAAM,OAAO,GAAG;YACf,GAAG,IAAI;YACP,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;SACtC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAA,sBAAW,EAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;YAC/D,OAAO,MAAM,IAAA,qBAAU,EAAC,GAAG,EAAE,CAC5B,IAAA,2BAAgB,EAAC;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,IAAA,+BAAW,EAAC,OAAO,CAAC;gBAC1B,GAAG,OAAO;aACV,CAAC,CACF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,IAAA,+BAAW,EAAiC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,MAAM,CAClB,IAAkC,EAClC,OAA0B;QAE1B,MAAM,IAAA,sBAAW,EAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;YAC9C,OAAO,MAAM,IAAA,qBAAU,EAAC,GAAG,EAAE,CAC5B,IAAA,4BAAiB,EAAC;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,IAAI;gBACV,GAAG,OAAO;aACV,CAAC,CACF,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;CACD;AAhHD,wCAgHC"}

package/dist/cjs/auth/biscuit.d.ts

@@ -0,0 +1,42 @@
+export type BiscuitTokenOptions = {
+    /** P256 private key as base58-encoded 32 bytes */
+    privateKey: string;
+    /** Public key to bind the token to (base58). If not provided, derives from privateKey. */
+    publicKey?: string;
+    /** Token expiry in seconds from now (default: 3600 = 1 hour) */
+    expiresIn?: number;
+    /** Operation groups to grant (default: all read+write) */
+    opGroups?: Array<{
+        level: string;
+        access: string;
+    }>;
+    /** Basin scope (default: prefix "" = all basins) */
+    basinScope?: {
+        type: "prefix" | "exact" | "none";
+        value: string;
+    };
+    /** Stream scope (default: prefix "" = all streams) */
+    streamScope?: {
+        type: "prefix" | "exact" | "none";
+        value: string;
+    };
+    /** Access token scope (default: prefix "" = all tokens) */
+    accessTokenScope?: {
+        type: "prefix" | "exact" | "none";
+        value: string;
+    };
+};
+/**
+ * Creates an admin Biscuit token from a root private key.
+ * This enables bootstrap mode where the admin can operate without a pre-existing token.
+ *
+ * @returns Base64-encoded Biscuit token
+ */
+export declare function createBiscuitToken(options: BiscuitTokenOptions): Promise<string>;
+/**
+ * Derives the public key from a private key.
+ * @param privateKey Base58-encoded P256 private key (32 bytes)
+ * @returns Base58-encoded compressed public key (33 bytes)
+ */
+export declare function derivePublicKey(privateKey: string): string;
+//# sourceMappingURL=biscuit.d.ts.map

package/dist/cjs/auth/biscuit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"biscuit.d.ts","sourceRoot":"","sources":["../../../src/auth/biscuit.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,mBAAmB,GAAG;IACjC,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,oDAAoD;IACpD,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,sDAAsD;IACtD,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACxE,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyDtF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D"}

package/dist/cjs/auth/biscuit.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createBiscuitToken = createBiscuitToken;
+exports.derivePublicKey = derivePublicKey;
+const base_1 = require("@scure/base");
+const signing_key_js_1 = require("./signing-key.js");
+// Dynamic import for biscuit-wasm to handle WASM initialization
+let biscuitModule = null;
+let initPromise = null;
+async function getBiscuit() {
+    if (!biscuitModule) {
+        biscuitModule = await Promise.resolve().then(() => require("@biscuit-auth/biscuit-wasm"));
+        if (!initPromise) {
+            initPromise = Promise.resolve(biscuitModule.init());
+        }
+        await initPromise;
+    }
+    return biscuitModule;
+}
+/**
+ * Creates an admin Biscuit token from a root private key.
+ * This enables bootstrap mode where the admin can operate without a pre-existing token.
+ *
+ * @returns Base64-encoded Biscuit token
+ */
+async function createBiscuitToken(options) {
+    const { privateKey, publicKey: providedPublicKey, expiresIn = 3600, opGroups = [
+        { level: "account", access: "read" },
+        { level: "account", access: "write" },
+        { level: "basin", access: "read" },
+        { level: "basin", access: "write" },
+        { level: "stream", access: "read" },
+        { level: "stream", access: "write" },
+    ], basinScope = { type: "prefix", value: "" }, streamScope = { type: "prefix", value: "" }, accessTokenScope = { type: "prefix", value: "" }, } = options;
+    const biscuit = await getBiscuit();
+    // Use SigningKey for validation and key derivation
+    const signingKey = signing_key_js_1.SigningKey.fromBase58(privateKey);
+    const privateKeyBytes = signingKey.getPrivateKeyBytes();
+    const publicKeyBase58 = providedPublicKey ?? signingKey.publicKeyBase58();
+    // Create Biscuit private key (P256 = secp256r1)
+    const biscuitPrivateKey = biscuit.PrivateKey.fromBytes(privateKeyBytes, biscuit.SignatureAlgorithm.Secp256r1);
+    // Build the token
+    const expiresTs = Math.floor(Date.now() / 1000) + expiresIn;
+    const builder = biscuit.biscuit `
+		public_key(${publicKeyBase58});
+		expires(${expiresTs});
+	`;
+    builder.merge(biscuit.block `
+		check if time($t), $t < ${expiresTs};
+	`);
+    for (const { level, access } of opGroups) {
+        builder.merge(biscuit.block `
+			op_group(${level}, ${access});
+		`);
+    }
+    builder.merge(biscuit.block `
+		basin_scope(${basinScope.type}, ${basinScope.value});
+		stream_scope(${streamScope.type}, ${streamScope.value});
+		access_token_scope(${accessTokenScope.type}, ${accessTokenScope.value});
+	`);
+    const token = builder.build(biscuitPrivateKey);
+    return base_1.base64.encode(token.toBytes());
+}
+/**
+ * Derives the public key from a private key.
+ * @param privateKey Base58-encoded P256 private key (32 bytes)
+ * @returns Base58-encoded compressed public key (33 bytes)
+ */
+function derivePublicKey(privateKey) {
+    return signing_key_js_1.SigningKey.fromBase58(privateKey).publicKeyBase58();
+}
+//# sourceMappingURL=biscuit.js.map

package/dist/cjs/auth/biscuit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"biscuit.js","sourceRoot":"","sources":["../../../src/auth/biscuit.ts"],"names":[],"mappings":";;AAyCA,gDAyDC;AAOD,0CAEC;AA3GD,sCAAqC;AACrC,qDAA8C;AAE9C,gEAAgE;AAChE,IAAI,aAAa,GAAuD,IAAI,CAAC;AAC7E,IAAI,WAAW,GAAyB,IAAI,CAAC;AAE7C,KAAK,UAAU,UAAU;IACxB,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,aAAa,GAAG,2CAAa,4BAA4B,EAAC,CAAC;QAC3D,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,WAAW,CAAC;IACnB,CAAC;IACD,OAAO,aAAa,CAAC;AACtB,CAAC;AAmBD;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CAAC,OAA4B;IACpE,MAAM,EACL,UAAU,EACV,SAAS,EAAE,iBAAiB,EAC5B,SAAS,GAAG,IAAI,EAChB,QAAQ,GAAG;QACV,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QACpC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE;QACrC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE;QAClC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QACnC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;QACnC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;KACpC,EACD,UAAU,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAC1C,WAAW,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAC3C,gBAAgB,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,GAChD,GAAG,OAAO,CAAC;IAEZ,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IAEnC,mDAAmD;IACnD,MAAM,UAAU,GAAG,2BAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,UAAU,CAAC,kBAAkB,EAAE,CAAC;IACxD,MAAM,eAAe,GAAG,iBAAiB,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;IAE1E,gDAAgD;IAChD,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CACrD,eAAe,EACf,OAAO,CAAC,kBAAkB,CAAC,SAAS,CACpC,CAAC;IAEF,kBAAkB;IAClB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;IAE5D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;eACjB,eAAe;YAClB,SAAS;EACnB,CAAC;IAEF,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAA;4BACA,SAAS;EACnC,CAAC,CAAC;IAEH,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAA;cACf,KAAK,KAAK,MAAM;GAC3B,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAA;gBACZ,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,KAAK;iBACnC,WAAW,CAAC,IAAI,KAAK,WAAW,CAAC,KAAK;uBAChC,gBAAgB,CAAC,IAAI,KAAK,gBAAgB,CAAC,KAAK;EACrE,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC/C,OAAO,aAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,UAAkB;IACjD,OAAO,2BAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,eAAe,EAAE,CAAC;AAC5D,CAAC"}

package/dist/cjs/auth/index.d.ts

@@ -0,0 +1,5 @@
+export { createBiscuitToken, derivePublicKey, type BiscuitTokenOptions } from "./biscuit.js";
+export { signRequest, signHeaders, type SignRequestOptions, type SignHeadersOptions } from "./sign.js";
+export { createPkiAuth, type PkiAuthConfig, type PkiAuthContext } from "./pki-auth.js";
+export { SigningKey } from "./signing-key.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACvG,OAAO,EAAE,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/cjs/auth/index.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SigningKey = exports.createPkiAuth = exports.signHeaders = exports.signRequest = exports.derivePublicKey = exports.createBiscuitToken = void 0;
+var biscuit_js_1 = require("./biscuit.js");
+Object.defineProperty(exports, "createBiscuitToken", { enumerable: true, get: function () { return biscuit_js_1.createBiscuitToken; } });
+Object.defineProperty(exports, "derivePublicKey", { enumerable: true, get: function () { return biscuit_js_1.derivePublicKey; } });
+var sign_js_1 = require("./sign.js");
+Object.defineProperty(exports, "signRequest", { enumerable: true, get: function () { return sign_js_1.signRequest; } });
+Object.defineProperty(exports, "signHeaders", { enumerable: true, get: function () { return sign_js_1.signHeaders; } });
+var pki_auth_js_1 = require("./pki-auth.js");
+Object.defineProperty(exports, "createPkiAuth", { enumerable: true, get: function () { return pki_auth_js_1.createPkiAuth; } });
+var signing_key_js_1 = require("./signing-key.js");
+Object.defineProperty(exports, "SigningKey", { enumerable: true, get: function () { return signing_key_js_1.SigningKey; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":";;;AAAA,2CAA6F;AAApF,gHAAA,kBAAkB,OAAA;AAAE,6GAAA,eAAe,OAAA;AAC5C,qCAAuG;AAA9F,sGAAA,WAAW,OAAA;AAAE,sGAAA,WAAW,OAAA;AACjC,6CAAuF;AAA9E,4GAAA,aAAa,OAAA;AACtB,mDAA8C;AAArC,4GAAA,UAAU,OAAA"}

package/dist/cjs/auth/pki-auth.d.ts

@@ -0,0 +1,60 @@
+import { SigningKey } from "./signing-key.js";
+import type { SignHeadersOptions } from "./sign.js";
+/**
+ * Configuration for PKI authentication.
+ *
+ * Two modes are supported:
+ *
+ * 1. **Token + SigningKey mode** (for regular operations): Provide `token` and `signingKey`.
+ *    Use this for basins, streams, and other regular operations.
+ *
+ * 2. **Root key mode** (for all operations): Provide only `rootKey`.
+ *    The SDK generates tokens locally (signed by root key, bound to a generated client key).
+ */
+export type PkiAuthConfig = {
+    /** Biscuit token issued with the signing key's public key */
+    token?: string;
+    /** P256 signing key that matches the token's bound public key */
+    signingKey?: SigningKey;
+    /** P256 private key as base58-encoded 32 bytes (root key) */
+    rootKey?: string;
+    /** Token expiry in seconds (default: 3600 = 1 hour) */
+    tokenExpiresIn?: number;
+    /** Signature expiry in seconds (default: 300 = 5 minutes) */
+    signatureExpiresIn?: number;
+};
+/**
+ * Auth mode indicates what operations are allowed.
+ */
+export type PkiAuthMode = "root" | "token";
+export type PkiAuthContext = {
+    /** The auth mode */
+    mode: PkiAuthMode;
+    /** The signing key's public key (base58) */
+    publicKey: string;
+    /** Get current token */
+    getToken: () => Promise<string>;
+    /** Sign a request with RFC 9421 HTTP message signatures */
+    signRequest: (request: Request) => Promise<Request>;
+    /** Sign headers with RFC 9421 HTTP message signatures */
+    signHeaders: (options: Omit<SignHeadersOptions, "signingKey" | "expiresIn">) => Promise<void>;
+    /** The signing key (for token mode, can be used to issue sub-tokens) */
+    signingKey: SigningKey;
+};
+/**
+ * Creates a PKI auth context.
+ *
+ * @example Token + SigningKey mode (for regular operations)
+ * ```typescript
+ * const auth = createPkiAuth({ token: accessToken, signingKey });
+ * const s2 = new S2({ authContext: auth, endpoints: { ... } });
+ * ```
+ *
+ * @example Root key mode (for all operations)
+ * ```typescript
+ * const auth = createPkiAuth({ rootKey: "..." });
+ * const s2 = new S2({ authContext: auth, endpoints: { ... } });
+ * ```
+ */
+export declare function createPkiAuth(config: PkiAuthConfig): PkiAuthContext;
+//# sourceMappingURL=pki-auth.d.ts.map

package/dist/cjs/auth/pki-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pki-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/pki-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GAAG;IAC3B,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3C,MAAM,MAAM,cAAc,GAAG;IAC5B,oBAAoB;IACpB,IAAI,EAAE,WAAW,CAAC;IAClB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,2DAA2D;IAC3D,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,yDAAyD;IACzD,WAAW,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,WAAW,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F,wEAAwE;IACxE,UAAU,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,cAAc,CAcnE"}

package/dist/cjs/auth/pki-auth.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPkiAuth = createPkiAuth;
+const biscuit_js_1 = require("./biscuit.js");
+const sign_js_1 = require("./sign.js");
+const signing_key_js_1 = require("./signing-key.js");
+/**
+ * Creates a PKI auth context.
+ *
+ * @example Token + SigningKey mode (for regular operations)
+ * ```typescript
+ * const auth = createPkiAuth({ token: accessToken, signingKey });
+ * const s2 = new S2({ authContext: auth, endpoints: { ... } });
+ * ```
+ *
+ * @example Root key mode (for all operations)
+ * ```typescript
+ * const auth = createPkiAuth({ rootKey: "..." });
+ * const s2 = new S2({ authContext: auth, endpoints: { ... } });
+ * ```
+ */
+function createPkiAuth(config) {
+    const { signatureExpiresIn = 300 } = config;
+    if (config.token && config.signingKey) {
+        return createTokenAuth(config.token, config.signingKey, signatureExpiresIn);
+    }
+    else if (config.rootKey) {
+        return createRootKeyAuth(config.rootKey, config.tokenExpiresIn ?? 3600, signatureExpiresIn);
+    }
+    else if (config.token && !config.signingKey) {
+        throw new Error("PKI auth: token provided without signingKey");
+    }
+    else if (!config.token && config.signingKey) {
+        throw new Error("PKI auth: signingKey provided without token");
+    }
+    else {
+        throw new Error("PKI auth: either (token + signingKey) or rootKey required");
+    }
+}
+function createTokenAuth(token, signingKey, signatureExpiresIn) {
+    const publicKey = signingKey.publicKeyBase58();
+    function isAccessTokenEndpoint(path) {
+        return /^\/v\d+\/access-tokens(\/[^\/]+)?$/.test(path);
+    }
+    function extractPath(urlOrRequest) {
+        const url = typeof urlOrRequest === "string" ? new URL(urlOrRequest) : new URL(urlOrRequest.url);
+        return url.pathname;
+    }
+    return {
+        mode: "token",
+        publicKey,
+        signingKey,
+        async getToken() {
+            return token;
+        },
+        async signRequest(request) {
+            const path = extractPath(request);
+            if (isAccessTokenEndpoint(path)) {
+                throw new Error("Token mode cannot be used for access token endpoints. Use root key mode instead.");
+            }
+            return (0, sign_js_1.signRequest)({ request, signingKey, expiresIn: signatureExpiresIn });
+        },
+        async signHeaders(options) {
+            const path = extractPath(options.url);
+            if (isAccessTokenEndpoint(path)) {
+                throw new Error("Token mode cannot be used for access token endpoints. Use root key mode instead.");
+            }
+            return (0, sign_js_1.signHeaders)({ ...options, signingKey, expiresIn: signatureExpiresIn });
+        },
+    };
+}
+function createRootKeyAuth(rootKey, tokenExpiresIn, signatureExpiresIn) {
+    const clientKey = signing_key_js_1.SigningKey.generate();
+    const clientPublicKey = clientKey.publicKeyBase58();
+    let cachedToken = null;
+    let tokenExpiry = 0;
+    async function getToken() {
+        const now = Date.now();
+        if (!cachedToken || now >= tokenExpiry - 60000) {
+            cachedToken = await (0, biscuit_js_1.createBiscuitToken)({
+                privateKey: rootKey,
+                publicKey: clientPublicKey,
+                expiresIn: tokenExpiresIn,
+            });
+            tokenExpiry = now + tokenExpiresIn * 1000;
+        }
+        return cachedToken;
+    }
+    return {
+        mode: "root",
+        publicKey: clientPublicKey,
+        signingKey: clientKey,
+        getToken,
+        async signRequest(request) {
+            return (0, sign_js_1.signRequest)({ request, signingKey: clientKey, expiresIn: signatureExpiresIn });
+        },
+        async signHeaders(options) {
+            return (0, sign_js_1.signHeaders)({ ...options, signingKey: clientKey, expiresIn: signatureExpiresIn });
+        },
+    };
+}
+//# sourceMappingURL=pki-auth.js.map

package/dist/cjs/auth/pki-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pki-auth.js","sourceRoot":"","sources":["../../../src/auth/pki-auth.ts"],"names":[],"mappings":";;AAgEA,sCAcC;AA9ED,6CAAkD;AAClD,uCAAqD;AACrD,qDAA8C;AA+C9C;;;;;;;;;;;;;;GAcG;AACH,SAAgB,aAAa,CAAC,MAAqB;IAClD,MAAM,EAAE,kBAAkB,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC;IAE5C,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAC7E,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC7F,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC9E,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CACvB,KAAa,EACb,UAAsB,EACtB,kBAA0B;IAE1B,MAAM,SAAS,GAAG,UAAU,CAAC,eAAe,EAAE,CAAC;IAE/C,SAAS,qBAAqB,CAAC,IAAY;QAC1C,OAAO,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,SAAS,WAAW,CAAC,YAA8B;QAClD,MAAM,GAAG,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACjG,OAAO,GAAG,CAAC,QAAQ,CAAC;IACrB,CAAC;IAED,OAAO;QACN,IAAI,EAAE,OAAO;QACb,SAAS;QACT,UAAU;QAEV,KAAK,CAAC,QAAQ;YACb,OAAO,KAAK,CAAC;QACd,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,OAAgB;YACjC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YACrG,CAAC;YACD,OAAO,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,OAA6D;YAC9E,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YACrG,CAAC;YACD,OAAO,IAAA,qBAAW,EAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/E,CAAC;KACD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACzB,OAAe,EACf,cAAsB,EACtB,kBAA0B;IAE1B,MAAM,SAAS,GAAG,2BAAU,CAAC,QAAQ,EAAE,CAAC;IACxC,MAAM,eAAe,GAAG,SAAS,CAAC,eAAe,EAAE,CAAC;IAEpD,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,WAAW,GAAW,CAAC,CAAC;IAE5B,KAAK,UAAU,QAAQ;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,IAAI,GAAG,IAAI,WAAW,GAAG,KAAK,EAAE,CAAC;YAChD,WAAW,GAAG,MAAM,IAAA,+BAAkB,EAAC;gBACtC,UAAU,EAAE,OAAO;gBACnB,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,cAAc;aACzB,CAAC,CAAC;YACH,WAAW,GAAG,GAAG,GAAG,cAAc,GAAG,IAAI,CAAC;QAC3C,CAAC;QACD,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,OAAO;QACN,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,eAAe;QAC1B,UAAU,EAAE,SAAS;QACrB,QAAQ;QAER,KAAK,CAAC,WAAW,CAAC,OAAgB;YACjC,OAAO,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,OAA6D;YAC9E,OAAO,IAAA,qBAAW,EAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC1F,CAAC;KACD,CAAC;AACH,CAAC"}