axonium 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,27 @@
+MIT License
+
+Copyright (c) 2026 Emeric Espiritu Santiago
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Additional Terms for Enterprise Use:
+
+For commercial or enterprise use, please contact the copyright holder at
+emericespiritusantiago@gmail.com to discuss licensing terms and potential
+remuneration.

package/README.md

@@ -1,3 +1,158 @@
-# Temporary Holding Version
+# Axonium for TypeScript
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The Axonium SDK for the Prometheus inference platform, for Node, Bun, Deno and edge runtimes.
+
+> **Status: `0.1.0`, ready to publish and not yet published.** Every resource, streaming, vision, tool
+> calling and structured output; **49 of 49** shared contract cases; 77 unit tests and 16 integration
+> tests against a live gateway; five runnable [examples](examples/) and an
+> [API reference](docs/api.md). **9.5 KB** minified and gzipped, against a 50 KB budget.
+>
+> Not here yet: OpenTelemetry and a logging hook (`0.2.0`), `usage.export` (in no SDK of this family),
+> and `X-Prometheus-Ignored-Parameters` on a success (held until all five SDKs agree on the shape). Bun,
+> Deno and edge are **untested** — only Node 20, 22 and 24 are in CI, and claiming the rest because this
+> only uses `fetch` would be the kind of unmeasured assertion this repository keeps catching.
+>
+> Requested in
+> `apeiron_axonium_prometheus/solicitud-axonium-sdk-typescript.md`; see that channel for scope and
+> dates.
+
+```ts
+import { Transport, resolveConfig } from "axonium";
+
+const transport = new Transport(resolveConfig()); // reads AXONIUM_GATEWAY_BASE_URL, …
+
+const catalog = await transport.sendJSON("GET", "/v1/models", {});
+const answer = await transport.sendJSON("POST", "/v1/chat/completions", {
+  model: "qwen3-0.6b",
+  body: { model: "qwen3-0.6b", messages: [{ role: "user", content: "hola" }] },
+});
+```
+
+`Transport` is the layer the resource methods will sit on; it is exported because it is useful on its
+own and because nothing about it should be a surprise later.
+
+## What is decided, and why
+
+**Zero runtime dependencies, and a test that says so.** `fetch` is the platform's. A transitive
+dependency is how a 50 KB budget becomes 400 KB and how an edge build breaks, and both get discovered
+by the consumer rather than here — so `test/package.test.ts` fails if `dependencies` is ever
+non-empty, and if anything under `src/` imports a `node:` module.
+
+**`fetch` is injected, not patched.** `options.fetch` exists so the contract corpus can be replayed
+against a function. That is why this package has no HTTP-mocking dev dependency, and a test refuses
+one: with a mocking library, what the suite exercises stops being the real transport.
+
+**The source is erasable TypeScript.** `erasableSyntaxOnly` is on, so no parameter properties, enums
+or decorators — nothing that compiles to code. The reason is concrete rather than stylistic: Node
+runs this package's own `.ts` with `--experimental-strip-types`, so the whole suite needs no build
+step and no test runner. Writing one parameter property is what revealed this, and a compiler flag is
+cheaper than remembering.
+
+**A credential is refused where this cannot establish it is on a server.** Not via
+`typeof window !== "undefined"` — jsdom defines `window`, so that fires in anyone's vitest suite, and
+a guard with false positives in CI is a guard somebody disables. It looks for positive evidence of a
+server runtime instead, so an environment nobody anticipated reads as unknown rather than as safe.
+
+The rule it enforces is about **whose** credential it is, not where the code runs. A `client_id` is
+the principal that model grants and every usage row are keyed to, so an integrator's credential must
+never reach a machine its users control — while an end client's **own** credential may live on their
+own device, which the platform supports explicitly. A bundle cannot tell those apart, so the default
+refuses and `allowInsecureCredential` is how a caller states which case theirs is.
+
+**`request` defaults to 600 s, deliberately.** The gateway allows its backends 600 s and some image
+backends take 2–8 minutes. A client timeout shorter than the server's, combined with a retry, is a
+known failure mode: the backend keeps computing and the retry queues a second expensive generation.
+**An edge runtime cannot wait that long** — that is a real conflict rather than a tuning question, and
+a deployment that cannot afford it should say so instead of meeting it as a truncated request.
+
+## What the transport does
+
+**Retries only what the contract says reached no model.** This API deduplicates nothing server-side,
+so a retried generation is a _new billable one_ rather than a replay — which makes an over-eager
+policy expensive rather than merely noisy. Three attempts, 1s base, 60s cap, full jitter. An
+`idempotencyKey` is what turns a repeat into a replay, and every call accepts one.
+
+**A client timeout is never retried.** The backend is probably still generating, so a retry queues a
+second expensive generation on top of the first rather than resuming it.
+
+**`Retry-After` is honoured verbatim**, because the gateway computes it from the real reset time or
+the breaker's expected recovery. It is still capped: a wait longer than `maxBackoff` is handed to the
+caller rather than slept through, since blocking for ten minutes is a scheduling decision that belongs
+to the application.
+
+**Cooldowns are keyed by model, not by gateway.** `backend-unavailable` means every replica of _that_
+model is out while others on the same gateway keep serving.
+
+**A 401 refreshes the token once, then gives up.** Bounded deliberately: the condition compares the
+rejected token with the one just used, which is false again after every refresh, so without a counter
+a gateway answering 401 to everything loops forever.
+
+**Correlation ids are read from the body and then the headers.** The fallback is load-bearing: a body
+that is not an envelope at all still arrives — an HTML page from a proxy that never reached the
+gateway — and there the ids exist only in the headers, if anywhere.
+
+## The error taxonomy
+
+One class per catalogued `type` suffix, dispatched on the **last path segment** of the problem-details
+`type` URI. An unknown suffix falls back by status rather than throwing: the catalogue grows, and an
+error documented on a Tuesday must not become a parse failure in a version already published.
+
+```ts
+try {
+  /* … */
+} catch (err) {
+  if (err instanceof ForbiddenError) console.log(err.detail, err.meta.requestId);
+}
+```
+
+Two deliberate shapes:
+
+- **`OAuthError` does not extend `APIError`.** The token endpoint answers RFC 6749
+  `{error, error_description}`, not problem+json, and the remedies differ: an inference failure may be
+  worth retrying with the same credential, a credential failure never is. Both extend `AxoniumError`,
+  so one `catch` still covers the package.
+- **`PredictBackendRejectedError.retryable` is derived from the status**, because the pass-through
+  route keeps the _engine's_ status: one suffix covers a `422` that will never succeed and a `429`
+  that will.
+
+## Documentation
+
+- **[`docs/api.md`](docs/api.md)** — every export, including all 34 error classes against their `type`
+  suffix. A test asserts that nothing is exported without an entry.
+- **[`docs/migrating-from-python.md`](docs/migrating-from-python.md)** — call by call, including the three
+  things Python has that this does not and why.
+- **[`examples/`](examples/)** — chat, streaming from a Next.js Route Handler, vision, tool calling, and
+  governed mode. They import `axonium` by name, so they typecheck against the **published** `.d.ts`
+  rather than against `src/`.
+
+## A custom certificate authority
+
+There is no `caBundle` option and there cannot be one: `fetch` has no option for a CA, and reaching one
+means either an `undici` dependency or a `node:` import — each breaking a requirement this package was
+built to. Use the runtime's own mechanism:
+
+```bash
+NODE_EXTRA_CA_CERTS=/path/to/ca.pem node app.js   # Node, Bun
+deno run --cert /path/to/ca.pem app.ts            # Deno
+```
+
+## Development
+
+```bash
+npm install
+npm test               # node --test, no runner, no build step (needs Node 22+)
+npm run build          # ESM + CJS + .d.ts
+npm run lint           # prettier --check, plus tsc on the package and on the examples
+
+AXONIUM_INTEGRATION=1 AXONIUM_GATEWAY_BASE_URL=… AXONIUM_CLIENT_ID=… AXONIUM_CLIENT_SECRET=… \
+  npm run test:integration
+```
+
+The integration suite is **skipped without credentials and never runs in CI** — it spends real
+inference, so a contributor who has not opted in must not pay for it. It picks models by **modality**
+from the live catalogue rather than hardcoding ids, because a fixed id fails on every deployment that
+does not serve it and that failure reads as a broken SDK.
+
+The published package supports Node 20+. Node 20 cannot strip types, so the suite above proves
+nothing about it — CI runs the **built** artifact there instead, which is what a consumer on 20
+installs.

package/dist/cjs/auth.cjs

@@ -0,0 +1,298 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenManager = void 0;
+exports.decodeClaims = decodeClaims;
+const errors_ts_1 = require("./errors.cjs");
+const version_ts_1 = require("./version.cjs");
+/** Refresh once this much of the token's life has gone. */
+const REFRESH_AHEAD_RATIO = 0.8;
+/** …or this little is left, whichever comes first. */
+const REFRESH_AHEAD_MIN_SECONDS = 30;
+/**
+ * A ceiling on any advertised lifetime.
+ *
+ * An `expires_in` of a year is a misconfiguration rather than a gift, and honouring it would mean
+ * holding a token that the gateway has long since forgotten, failing every request until the process
+ * restarts.
+ */
+const MAX_PLAUSIBLE_TTL_SECONDS = 86_400;
+/**
+ * Decodes a JWT's payload without verifying it.
+ *
+ * **Not verification, and it must not be used as such.** The signature is the gateway's to check; this
+ * reads the claims so a caller can see which `client_id` and scopes they are operating as, and so the
+ * token's own `exp` can be used as a second reading of its lifetime.
+ *
+ * Done by hand because the alternative is a dependency, and because all that is needed is one
+ * base64url segment. A malformed token yields empty claims rather than throwing: the gateway decides
+ * whether a token is good, and a decode failure here must not become the reason a request never left.
+ */
+function decodeClaims(accessToken) {
+    const empty = {
+        subject: undefined,
+        authorizedParty: undefined,
+        scope: [],
+        expiresAt: undefined,
+        issuedAt: undefined,
+        raw: {},
+    };
+    const parts = accessToken.split(".");
+    if (parts.length !== 3)
+        return empty;
+    const payload = parts[1];
+    if (!payload)
+        return empty;
+    let json;
+    try {
+        const padded = payload.replace(/-/g, "+").replace(/_/g, "/");
+        const binary = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
+        // atob gives latin1; a claim with a non-ASCII character would otherwise come back mangled.
+        json = new TextDecoder().decode(Uint8Array.from(binary, (c) => c.charCodeAt(0)));
+    }
+    catch {
+        return empty;
+    }
+    let raw;
+    try {
+        const parsed = JSON.parse(json);
+        if (typeof parsed !== "object" || parsed === null)
+            return empty;
+        raw = parsed;
+    }
+    catch {
+        return empty;
+    }
+    const scope = raw["scope"];
+    const text = (key) => typeof raw[key] === "string" ? raw[key] : undefined;
+    return {
+        subject: text("sub"),
+        authorizedParty: text("azp"),
+        scope: typeof scope === "string" ? scope.split(" ").filter(Boolean) : [],
+        expiresAt: typeof raw["exp"] === "number" ? raw["exp"] : undefined,
+        issuedAt: typeof raw["iat"] === "number" ? raw["iat"] : undefined,
+        raw,
+    };
+}
+/**
+ * How long a token is really good for, in seconds.
+ *
+ * `expires_in` is the server's own answer and is normally used as-is. When the response's `Date`
+ * header and the token's own `exp` are both present, their difference is a **second, independent
+ * reading of the same lifetime** — and a skew-free one, because both come from the server's clock
+ * rather than being compared against ours. The platform confirmed this is the right anchor.
+ *
+ * The shorter wins. Disagreement should not happen, and treating a token as expiring sooner only
+ * costs an early refresh, while treating it as living longer costs a request.
+ */
+function effectiveLifetime(headers, accessToken, expiresIn) {
+    const date = headers.get("Date");
+    const exp = decodeClaims(accessToken).expiresAt;
+    if (!date || exp === undefined)
+        return expiresIn;
+    const serverNow = Date.parse(date);
+    if (Number.isNaN(serverNow))
+        return expiresIn;
+    const serverRemaining = exp - serverNow / 1000;
+    // Already expired by the server's own reckoning: fail fast rather than spend a request finding out.
+    if (serverRemaining <= 0)
+        return 0;
+    return Math.min(expiresIn, serverRemaining);
+}
+/**
+ * Holds the credential and hands out tokens.
+ *
+ * **Concurrent callers share one in-flight refresh.** A promise is kept rather than a lock, which is
+ * the JavaScript shape of double-checked locking: the second caller awaits the first one's request
+ * instead of starting its own. Without it, a cold client answering ten simultaneous requests would
+ * send ten token requests, and nine of them would be charged against the rate-limit budget for
+ * nothing.
+ */
+class TokenManager {
+    config;
+    provider;
+    current;
+    inFlight;
+    /** The last token a provider gave us, so a 401 can tell the provider *which* one was rejected. */
+    lastProvided;
+    constructor(config) {
+        this.config = config;
+        this.provider = config.tokenProvider;
+    }
+    /** The claims of the token currently held, or `undefined` before the first one is obtained. */
+    get claims() {
+        const token = this.current?.accessToken ?? this.lastProvided;
+        return token === undefined ? undefined : decodeClaims(token);
+    }
+    /** The scope the gateway granted, which may be narrower than the one requested. */
+    get grantedScope() {
+        return this.current?.scope ?? this.claims?.scope ?? [];
+    }
+    /** A token to send now, fetching or refreshing if the one held is spent. */
+    async token() {
+        if (this.provider) {
+            const token = await this.provider.token();
+            this.lastProvided = token;
+            return token;
+        }
+        if (this.current && !this.needsRefresh(this.current))
+            return this.current.accessToken;
+        return (await this.obtain()).accessToken;
+    }
+    /**
+     * Discards the token the gateway just rejected and gets another, exactly once per rejection.
+     *
+     * Compares against what was rejected rather than refreshing unconditionally: when several
+     * concurrent requests are all rejected with the same stale token, the first one's replacement
+     * serves them all, and the rest must not each throw away a token that is already good.
+     */
+    async refreshAfterRejection(rejected) {
+        if (this.provider) {
+            const token = await this.provider.refresh(rejected);
+            if (token === rejected) {
+                throw new errors_ts_1.ConfigurationError("The tokenProvider returned the same token the gateway had just rejected, so retrying " +
+                    "would fail identically. refresh() must obtain a new one.");
+            }
+            this.lastProvided = token;
+            return token;
+        }
+        if (this.current && this.current.accessToken !== rejected) {
+            return this.current.accessToken;
+        }
+        this.current = undefined;
+        return (await this.obtain()).accessToken;
+    }
+    needsRefresh(token) {
+        const remaining = (token.expiresAt - performance.now()) / 1000;
+        return (remaining <= Math.max(token.expiresIn * (1 - REFRESH_AHEAD_RATIO), 0) ||
+            remaining <= REFRESH_AHEAD_MIN_SECONDS);
+    }
+    async obtain() {
+        // The second caller joins the first one's request instead of starting another.
+        if (this.inFlight)
+            return this.inFlight;
+        const attempt = this.fetchToken()
+            .then((token) => {
+            this.current = token;
+            return token;
+        })
+            .finally(() => {
+            this.inFlight = undefined;
+        });
+        this.inFlight = attempt;
+        return attempt;
+    }
+    async fetchToken() {
+        const body = new URLSearchParams({
+            grant_type: "client_credentials",
+            client_id: this.config.clientId,
+            client_secret: this.config.clientSecret,
+        });
+        // Omitted rather than sent empty: an empty `scope` is a request for no scopes at all, while
+        // omitting it asks for everything the account holds.
+        if (this.config.scope)
+            body.set("scope", this.config.scope);
+        // Captured before the request so the round trip is charged against the token's life rather than
+        // granted as extra margin. performance.now() rather than Date.now() so a system clock adjustment
+        // mid-flight cannot move the deadline.
+        const issuedAt = performance.now();
+        const signal = AbortSignal.timeout(this.config.timeouts.connect + this.config.timeouts.request);
+        let response;
+        try {
+            response = await this.config.fetch(`${this.config.gatewayBaseURL}/oauth2/token`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    Accept: "application/json",
+                    "User-Agent": version_ts_1.USER_AGENT,
+                },
+                body,
+                signal,
+            });
+        }
+        catch (cause) {
+            throw new errors_ts_1.TransportError(`Could not reach the token endpoint at ${this.config.gatewayBaseURL}/oauth2/token.`, { cause });
+        }
+        const text = await response.text();
+        let parsed;
+        try {
+            parsed = text ? JSON.parse(text) : undefined;
+        }
+        catch {
+            parsed = undefined;
+        }
+        const payload = (typeof parsed === "object" && parsed !== null ? parsed : {});
+        if (!response.ok)
+            throw tokenError(response, payload, text);
+        const accessToken = payload["access_token"];
+        const expiresIn = payload["expires_in"];
+        if (typeof accessToken !== "string" || !accessToken) {
+            throw new errors_ts_1.TransportError("The token response carried no access_token.");
+        }
+        if (typeof expiresIn !== "number" || !(expiresIn > 0)) {
+            throw new errors_ts_1.TransportError(`The auth-service returned an unusable expires_in: ${JSON.stringify(expiresIn)}.`);
+        }
+        // The GRANTED scope, never the requested one. Asking for a subset is honoured, so what came back
+        // is what this token can actually do -- and a caller that assumed otherwise would diagnose a 403
+        // as a platform fault.
+        const granted = payload["scope"];
+        const scope = typeof granted === "string" ? granted.split(" ").filter(Boolean) : [];
+        const lifetime = Math.min(effectiveLifetime(response.headers, accessToken, expiresIn), MAX_PLAUSIBLE_TTL_SECONDS);
+        return {
+            accessToken,
+            expiresAt: issuedAt + lifetime * 1000,
+            expiresIn: lifetime,
+            scope,
+        };
+    }
+}
+exports.TokenManager = TokenManager;
+/**
+ * Types a failed token response, which arrives in either of two envelopes.
+ *
+ * A `4xx` is an RFC 6749 outcome — wrong credentials, a scope the account does not hold — and is
+ * never worth retrying. A `5xx` is the gateway failing to do its job and comes back as problem+json,
+ * so it maps into the gateway taxonomy where `upstream-unavailable` is retryable.
+ */
+function tokenError(response, payload, text) {
+    if (response.status >= 500) {
+        const type = typeof payload["type"] === "string" ? payload["type"] : "";
+        return (0, errors_ts_1.errorFromProblem)({
+            status: response.status,
+            typeSuffix: type.split("/").pop() ?? "",
+            title: typeof payload["title"] === "string" ? payload["title"] : "",
+            detail: typeof payload["detail"] === "string"
+                ? payload["detail"]
+                : `The token endpoint answered ${response.status}.`,
+            instance: typeof payload["instance"] === "string" ? payload["instance"] : "",
+            retryAfter: undefined,
+            meta: {
+                // Body first, then the headers. Same fallback as every other error path, and load-bearing for
+                // the same reason: these envelopes carry the ids in the body and some non-gateway answers
+                // carry them only in the headers.
+                requestId: (typeof payload["request_id"] === "string" ? payload["request_id"] : undefined) ??
+                    response.headers.get("X-Request-ID") ??
+                    undefined,
+                traceId: (typeof payload["trace_id"] === "string" ? payload["trace_id"] : undefined) ??
+                    response.headers.get("X-Trace-ID") ??
+                    undefined,
+                instance: undefined,
+                instanceId: undefined,
+                idempotentReplay: false,
+                idempotentReplayOf: undefined,
+                rateLimit: undefined,
+                ignoredParameters: undefined,
+            },
+            raw: payload,
+        });
+    }
+    const code = typeof payload["error"] === "string" ? payload["error"] : "";
+    if (!code) {
+        // A 4xx that is not RFC 6749 at all. Said plainly, because the usual cause is that something
+        // other than the gateway answered -- a proxy, a login page -- and the status alone misleads.
+        return new errors_ts_1.TransportError(`The token endpoint answered ${response.status} without an RFC 6749 error code. ` +
+            `Body: ${text.slice(0, 200)}`);
+    }
+    const description = typeof payload["error_description"] === "string" ? payload["error_description"] : "";
+    return (0, errors_ts_1.errorFromOAuth)(response.status, code, description);
+}
+//# sourceMappingURL=auth.js.map

package/dist/cjs/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":";;;AA0DA,oCA6CC;AAvGD,2CAAmG;AAEnG,6CAA0C;AAgC1C,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,sDAAsD;AACtD,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,SAAgB,YAAY,CAAC,WAAmB;IAC9C,MAAM,KAAK,GAAgB;QACzB,OAAO,EAAE,SAAS;QAClB,eAAe,EAAE,SAAS;QAC1B,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,SAAS;QACnB,GAAG,EAAE,EAAE;KACR,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxE,2FAA2F;QAC3F,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChE,GAAG,GAAG,MAAiC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAsB,EAAE,CAC/C,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;QACpB,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC;QAC5B,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QACxE,SAAS,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QAClE,QAAQ,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QACjE,GAAG;KACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,OAAgB,EAAE,WAAmB,EAAE,SAAiB;IACjF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC;IAChD,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,eAAe,GAAG,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC;IAC/C,oGAAoG;IACpG,IAAI,eAAe,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAa,YAAY;IACN,MAAM,CAAiB;IACvB,QAAQ,CAA4B;IAC7C,OAAO,CAAuB;IAC9B,QAAQ,CAAgC;IAChD,kGAAkG;IAC1F,YAAY,CAAqB;IAEzC,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC;IACvC,CAAC;IAED,+FAA+F;IAC/F,IAAI,MAAM;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC;QAC7D,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,mFAAmF;IACnF,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;IACzD,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC1C,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACtF,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CAAC,QAAgB;QAC1C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,MAAM,IAAI,8BAAkB,CAC1B,uFAAuF;oBACrF,0DAA0D,CAC7D,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC;IAC3C,CAAC;IAEO,YAAY,CAAC,KAAe;QAClC,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QAC/D,OAAO,CACL,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;YACrE,SAAS,IAAI,yBAAyB,CACvC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,+EAA+E;QAC/E,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE;aAC9B,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;SACxC,CAAC,CAAC;QACH,4FAA4F;QAC5F,qDAAqD;QACrD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE5D,gGAAgG;QAChG,iGAAiG;QACjG,uCAAuC;QACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEnC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChG,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,eAAe,EAAE;gBAC/E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;oBAC1B,YAAY,EAAE,uBAAU;iBACzB;gBACD,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,0BAAc,CACtB,yCAAyC,IAAI,CAAC,MAAM,CAAC,cAAc,gBAAgB,EACnF,EAAE,KAAK,EAAE,CACV,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAG3E,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YACpD,MAAM,IAAI,0BAAc,CAAC,6CAA6C,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,0BAAc,CACtB,qDAAqD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAClF,CAAC;QACJ,CAAC;QAED,iGAAiG;QACjG,iGAAiG;QACjG,uBAAuB;QACvB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEpF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,EAC3D,yBAAyB,CAC1B,CAAC;QAEF,OAAO;YACL,WAAW;YACX,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI;YACrC,SAAS,EAAE,QAAQ;YACnB,KAAK;SACN,CAAC;IACJ,CAAC;CACF;AAlKD,oCAkKC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,QAAkB,EAAE,OAAgC,EAAE,IAAY;IACpF,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,IAAA,4BAAgB,EAAC;YACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE;YACvC,KAAK,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;YACnE,MAAM,EACJ,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ;gBACnC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACnB,CAAC,CAAC,+BAA+B,QAAQ,CAAC,MAAM,GAAG;YACvD,QAAQ,EAAE,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5E,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,8FAA8F;gBAC9F,0FAA0F;gBAC1F,kCAAkC;gBAClC,SAAS,EACP,CAAC,OAAO,OAAO,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC/E,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;oBACpC,SAAS;gBACX,OAAO,EACL,CAAC,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC3E,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;oBAClC,SAAS;gBACX,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,SAAS;gBACrB,gBAAgB,EAAE,KAAK;gBACvB,kBAAkB,EAAE,SAAS;gBAC7B,SAAS,EAAE,SAAS;gBACpB,iBAAiB,EAAE,SAAS;aAC7B;YACD,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,6FAA6F;QAC7F,6FAA6F;QAC7F,OAAO,IAAI,0BAAc,CACvB,+BAA+B,QAAQ,CAAC,MAAM,mCAAmC;YAC/E,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAChC,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GACf,OAAO,OAAO,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,OAAO,IAAA,0BAAc,EAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;AAC5D,CAAC"}