ramosedb 0.0.0-stage → 0.4.0

package/dist/better-auth/index.d.ts

@@ -0,0 +1,140 @@
+import { type AuthConfig } from "../Auth.ts";
+import type { ClaimsPolicy } from "../Auth.ts";
+import { type GenericEndpointContext, type Session, type User } from "better-auth";
+import { type JwtOptions } from "better-auth/plugins/jwt";
+import * as z from "zod";
+/** The Better Auth session, as {@link ClassOf} sees it. */
+export interface SessionInfo {
+    readonly session: Session & Record<string, unknown>;
+    readonly user: User & Record<string, unknown>;
+}
+/** What {@link ClassOf} decides: a class, optionally with `ramose.attrs`. */
+export interface ClassGrant {
+    readonly class: string;
+    readonly attrs?: Readonly<Record<string, unknown>> | undefined;
+}
+/** What {@link ClassOf} receives: the caller and the endpoint. */
+export interface ClassOfInput {
+    readonly session: SessionInfo;
+    readonly ctx: GenericEndpointContext;
+}
+/**
+ * The one decision the app owns: the caller's deployment-global policy
+ * class, or `null` for no access (a 403). Return a {@link ClassGrant} to
+ * also carry `ramose.attrs`. Classes and attributes must be genuinely
+ * global — not derived from a requested route, database, or org slug.
+ * Database-local roles stay out of the JWT.
+ */
+export type ClassOf = (input: ClassOfInput) => string | ClassGrant | null | Promise<string | ClassGrant | null>;
+export interface RamoseTokenOptions {
+    readonly auth: AuthConfig;
+    readonly classOf: ClassOf;
+    readonly policy?: ClaimsPolicy;
+    readonly path?: string;
+}
+/**
+ * Mint a new JWKS row when the latest private key cannot be decrypted with
+ * the current Better Auth secret. No-op when encryption is off, when no key
+ * exists yet (`signJWT` / `/jwks` create the first one), or when decrypt
+ * succeeds.
+ */
+export declare const ensureDecryptableJwks: (ctx: GenericEndpointContext, options: JwtOptions | undefined) => Promise<void>;
+/**
+ * The mint-route server plugin. `POST {path}` with a session cookie answers
+ * `{ token, class, exp }`; `classOf` returning `null` is a 403 and a
+ * missing session a 401. Requires the `jwt` plugin (checked at init) and
+ * signs with its JWKS via the same server-only path as `auth.api.signJWT`.
+ * The request body is not a database selector — leftover `{ db }` is ignored.
+ *
+ * JWKS private keys are encrypted with Better Auth's signing secret. If that
+ * secret is reminted (Alchemy `Random` lives only in stack state; a cache
+ * miss creates a new `BetterAuthSecret`) the existing `jwks` rows stay in
+ * D1 but can no longer be decrypted. The jwt plugin's default `/get-session`
+ * after-hook then throws while attaching `set-auth-jwt`, which is the
+ * "signed in, bounced to create-account" hole: sign-in writes a session,
+ * `useSession` refetches, the 500 looks like no user. {@link
+ * ensureDecryptableJwks} mints a new key when decrypt fails so a rotated
+ * secret does not brick login or mint. Existing public keys stay in `/jwks`
+ * so in-flight tokens still verify until they expire.
+ */
+export declare const ramoseToken: (options: RamoseTokenOptions) => {
+    id: "ramose-token";
+    init: (ctx: import("better-auth").AuthContext) => void;
+    hooks: {
+        before: {
+            matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+        }[];
+    };
+    endpoints: {
+        ramoseToken: import("better-auth").StrictEndpoint<string, {
+            method: "POST";
+            body: z.ZodOptional<z.ZodObject<{}, z.core.$strip>>;
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            metadata: {
+                openapi: {
+                    operationId: string;
+                    description: string;
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            token: {
+                                                type: string;
+                                            };
+                                            class: {
+                                                type: string;
+                                            };
+                                            exp: {
+                                                type: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, {
+            token: string;
+            class: string;
+            exp: number | undefined;
+        }>;
+    };
+};
+/**
+ * The org-role → policy-class mapping Reef established: `owner` and `admin`
+ * are `owner`, `member` is `member`, anything else (or absent) is `viewer`.
+ * Better Auth roles can be comma-separated; the first one decides.
+ * `owner` is a schema class, not a bypass class.
+ */
+export declare const classOfRole: (role: string) => "owner" | "member" | "viewer";
+//# sourceMappingURL=index.d.ts.map

package/dist/better-auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/better-auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAU,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,OAAO,EACZ,KAAK,IAAI,EACV,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAa,KAAK,UAAU,EAAW,MAAM,yBAAyB,CAAC;AAC9E,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/C;AAED,6EAA6E;AAC7E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CAChE;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,sBAAsB,CAAC;CACtC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GAAG,CACpB,KAAK,EAAE,YAAY,KAChB,MAAM,GAAG,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;AAEtE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAoBD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAC3B,sBAAsB,WAClB,UAAU,GAAG,SAAS,KAC9B,OAAO,CAAC,IAAI,CAyBd,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,WAAW,YAAa,kBAAkB;;;;;;;;;;QA2BjD,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CAmBS,KAAK;gDAAI,IAAI;;4CACb,KAAK;gDAAI,IAAI;;4CACb,GAAG;gDAAI,IAAI;;;;;;;;;;;;;;;;;CAgDpC,CAAC;AAEF;;;;;GAKG;AAEH,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,OAAO,GAAG,QAAQ,GAAG,QAW/D,CAAC"}

package/dist/better-auth/index.js

@@ -0,0 +1,168 @@
+import { claims } from "../Auth.js";
+import { BetterAuthError, } from "better-auth";
+import { APIError, createAuthEndpoint, createAuthMiddleware, sessionMiddleware } from "better-auth/api";
+import { symmetricDecrypt } from "better-auth/crypto";
+import { createJwk, signJWT } from "better-auth/plugins/jwt";
+import * as z from "zod";
+const jwtOptionsOf = (ctx) => {
+    const jwtPlugin = ctx.context.options.plugins?.find((plugin) => plugin.id === "jwt");
+    return jwtPlugin?.options;
+};
+const asDate = (value) => {
+    if (value == null)
+        return undefined;
+    return value instanceof Date ? value : new Date(value);
+};
+/**
+ * Mint a new JWKS row when the latest private key cannot be decrypted with
+ * the current Better Auth secret. No-op when encryption is off, when no key
+ * exists yet (`signJWT` / `/jwks` create the first one), or when decrypt
+ * succeeds.
+ */
+export const ensureDecryptableJwks = async (ctx, options) => {
+    if (options?.jwks?.disablePrivateKeyEncryption)
+        return;
+    const rows = (await ctx.context.adapter.findMany({ model: "jwks" })) ?? [];
+    const latest = rows
+        .slice()
+        .sort((a, b) => (asDate(b.createdAt)?.getTime() ?? 0) -
+        (asDate(a.createdAt)?.getTime() ?? 0))[0];
+    if (latest === undefined)
+        return;
+    const expiresAt = asDate(latest.expiresAt);
+    if (expiresAt !== undefined && expiresAt < new Date()) {
+        await createJwk(ctx, options);
+        return;
+    }
+    try {
+        await symmetricDecrypt({
+            key: ctx.context.secretConfig,
+            data: JSON.parse(latest.privateKey),
+        });
+    }
+    catch {
+        await createJwk(ctx, options);
+    }
+};
+/**
+ * The mint-route server plugin. `POST {path}` with a session cookie answers
+ * `{ token, class, exp }`; `classOf` returning `null` is a 403 and a
+ * missing session a 401. Requires the `jwt` plugin (checked at init) and
+ * signs with its JWKS via the same server-only path as `auth.api.signJWT`.
+ * The request body is not a database selector — leftover `{ db }` is ignored.
+ *
+ * JWKS private keys are encrypted with Better Auth's signing secret. If that
+ * secret is reminted (Alchemy `Random` lives only in stack state; a cache
+ * miss creates a new `BetterAuthSecret`) the existing `jwks` rows stay in
+ * D1 but can no longer be decrypted. The jwt plugin's default `/get-session`
+ * after-hook then throws while attaching `set-auth-jwt`, which is the
+ * "signed in, bounced to create-account" hole: sign-in writes a session,
+ * `useSession` refetches, the 500 looks like no user. {@link
+ * ensureDecryptableJwks} mints a new key when decrypt fails so a rotated
+ * secret does not brick login or mint. Existing public keys stay in `/jwks`
+ * so in-flight tokens still verify until they expire.
+ */
+export const ramoseToken = (options) => {
+    const mintPath = options.path ?? "/ramose/token";
+    return {
+        id: "ramose-token",
+        init: (ctx) => {
+            if (!(ctx.options.plugins ?? []).some((plugin) => plugin.id === "jwt")) {
+                throw new BetterAuthError("ramose: the ramoseToken plugin requires Better Auth's jwt plugin — " +
+                    "it signs with the same JWKS the server's RAMOSE_JWKS_URL reads. " +
+                    "Add jwt() to the plugins array.");
+            }
+        },
+        hooks: {
+            before: [
+                {
+                    matcher: (ctx) => ctx.path === "/get-session" ||
+                        ctx.path === "/token" ||
+                        ctx.path === mintPath,
+                    handler: createAuthMiddleware(async (ctx) => {
+                        await ensureDecryptableJwks(ctx, jwtOptionsOf(ctx));
+                    }),
+                },
+            ],
+        },
+        endpoints: {
+            ramoseToken: createAuthEndpoint(mintPath, {
+                method: "POST",
+                body: z.object({}).optional(),
+                use: [sessionMiddleware],
+                metadata: {
+                    openapi: {
+                        operationId: "mintRamoseToken",
+                        description: "Mint a Ramose identity JWT, signed with the jwt plugin's JWKS",
+                        responses: {
+                            "200": {
+                                description: "The minted token",
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object",
+                                            properties: {
+                                                token: { type: "string" },
+                                                class: { type: "string" },
+                                                exp: { type: "number" },
+                                            },
+                                            required: ["token", "class", "exp"],
+                                        },
+                                    },
+                                },
+                            },
+                        },
+                    },
+                },
+            }, async (ctx) => {
+                const session = ctx.context.session;
+                const granted = await options.classOf({ session, ctx });
+                const grant = typeof granted === "string" ? { class: granted } : granted;
+                if (grant === null) {
+                    throw new APIError("FORBIDDEN", {
+                        message: "ramose: no access",
+                    });
+                }
+                let payload;
+                try {
+                    payload = claims(options.auth, {
+                        sub: session.user.id,
+                        class: grant.class,
+                        attrs: grant.attrs,
+                    }, options.policy);
+                }
+                catch (cause) {
+                    throw new APIError("INTERNAL_SERVER_ERROR", {
+                        message: cause instanceof Error ? cause.message : String(cause),
+                    });
+                }
+                const jwtOptions = jwtOptionsOf(ctx);
+                await ensureDecryptableJwks(ctx, jwtOptions);
+                const token = await signJWT(ctx, {
+                    options: jwtOptions,
+                    payload: { ...payload },
+                });
+                return ctx.json({ token, class: grant.class, exp: payload.exp });
+            }),
+        },
+    };
+};
+/**
+ * The org-role → policy-class mapping Reef established: `owner` and `admin`
+ * are `owner`, `member` is `member`, anything else (or absent) is `viewer`.
+ * Better Auth roles can be comma-separated; the first one decides.
+ * `owner` is a schema class, not a bypass class.
+ */
+export const classOfRole = (role) => {
+    const primary = role.split(",")[0]?.trim() ?? role;
+    switch (primary) {
+        case "owner":
+        case "admin":
+            return "owner";
+        case "member":
+            return "member";
+        default:
+            return "viewer";
+    }
+};
+//# sourceMappingURL=index.js.map

package/dist/better-auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/better-auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,EACL,eAAe,GAKhB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAmB,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAsCzB,MAAM,YAAY,GAAG,CAAC,GAA2B,EAA0B,EAAE;IAC3E,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,CACQ,CAAC;IAC1C,OAAO,SAAS,EAAE,OAAO,CAAC;AAC5B,CAAC,CAAC;AAQF,MAAM,MAAM,GAAG,CAAC,KAAuC,EAAoB,EAAE;IAC3E,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,GAA2B,EAC3B,OAA+B,EAChB,EAAE;IACjB,IAAI,OAAO,EAAE,IAAI,EAAE,2BAA2B;QAAE,OAAO;IACvD,MAAM,IAAI,GACR,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI;SAChB,KAAK,EAAE;SACP,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CACxC,CAAC,CAAC,CAAC,CAAC;IACP,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACtD,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC;YACrB,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY;YAC7B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAW;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAA2B,EAAE,EAAE;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC;IACjD,OAAO;QACL,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,eAAe,CACvB,qEAAqE;oBACnE,kEAAkE;oBAClE,iCAAiC,CACpC,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,EAAE;YACL,MAAM,EAAE;gBACN;oBACE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,GAAG,CAAC,IAAI,KAAK,cAAc;wBAC3B,GAAG,CAAC,IAAI,KAAK,QAAQ;wBACrB,GAAG,CAAC,IAAI,KAAK,QAAQ;oBACvB,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;wBAC1C,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;oBACtD,CAAC,CAAC;iBACH;aACF;SACF;QACD,SAAS,EAAE;YACT,WAAW,EAAE,kBAAkB,CAC7B,QAAQ,EACR;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;gBAC7B,GAAG,EAAE,CAAC,iBAAiB,CAAC;gBACxB,QAAQ,EAAE;oBACR,OAAO,EAAE;wBACP,WAAW,EAAE,iBAAiB;wBAC9B,WAAW,EACT,+DAA+D;wBACjE,SAAS,EAAE;4BACT,KAAK,EAAE;gCACL,WAAW,EAAE,kBAAkB;gCAC/B,OAAO,EAAE;oCACP,kBAAkB,EAAE;wCAClB,MAAM,EAAE;4CACN,IAAI,EAAE,QAAQ;4CACd,UAAU,EAAE;gDACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gDACzB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gDACzB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;6CACxB;4CACD,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;yCACpC;qCACF;iCACF;6BACF;yBACF;qBACF;iBACF;aACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;gBACpC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;gBACxD,MAAM,KAAK,GACT,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;gBAC7D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACnB,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE;wBAC9B,OAAO,EAAE,mBAAmB;qBAC7B,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,OAAkC,CAAC;gBACvC,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,CACd,OAAO,CAAC,IAAI,EACZ;wBACE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;wBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;qBACnB,EACD,OAAO,CAAC,MAAM,CACf,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE;wBAC1C,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAChE,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBACrC,MAAM,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBAC7C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;oBAC/B,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,EAAE,GAAG,OAAO,EAA6B;iBACnD,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACnE,CAAC,CACF;SACF;KACyB,CAAC;AAC/B,CAAC,CAAC;AAEF;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAiC,EAAE;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACnD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO,CAAC;QACb,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC,CAAC"}

package/dist/client/activation.d.ts

@@ -0,0 +1,2 @@
+export declare const observeActivation: (wake: () => void) => (() => void);
+//# sourceMappingURL=activation.d.ts.map

package/dist/client/activation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activation.d.ts","sourceRoot":"","sources":["../../src/client/activation.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,iBAAiB,SAAU,MAAM,IAAI,KAAG,CAAC,MAAM,IAAI,CAuB/D,CAAC"}

package/dist/client/activation.js

@@ -0,0 +1,33 @@
+const eventTarget = (value) => value !== null && typeof value === "object" &&
+    typeof value.addEventListener === "function" &&
+    typeof value.removeEventListener === "function"
+    ? value
+    : undefined;
+const hidden = () => globalThis
+    .document?.visibilityState === "hidden";
+export const observeActivation = (wake) => {
+    const target = eventTarget(globalThis);
+    const document = eventTarget(globalThis.document);
+    if (target === undefined && document === undefined)
+        return () => undefined;
+    const activated = () => {
+        if (hidden())
+            return;
+        wake();
+    };
+    target?.addEventListener("focus", activated);
+    target?.addEventListener("pageshow", activated);
+    target?.addEventListener("online", activated);
+    document?.addEventListener("visibilitychange", activated);
+    let released = false;
+    return () => {
+        if (released)
+            return;
+        released = true;
+        target?.removeEventListener("focus", activated);
+        target?.removeEventListener("pageshow", activated);
+        target?.removeEventListener("online", activated);
+        document?.removeEventListener("visibilitychange", activated);
+    };
+};
+//# sourceMappingURL=activation.js.map

package/dist/client/activation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activation.js","sourceRoot":"","sources":["../../src/client/activation.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,GAAG,CAAC,KAAc,EAA+B,EAAE,CAClE,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;IACzC,OAAQ,KAAyB,CAAC,gBAAgB,KAAK,UAAU;IACjE,OAAQ,KAAyB,CAAC,mBAAmB,KAAK,UAAU;IACpE,CAAC,CAAC,KAAwB;IAC1B,CAAC,CAAC,SAAS,CAAC;AAEhB,MAAM,MAAM,GAAG,GAAY,EAAE,CAC1B,UAA4E;KAC1E,QAAQ,EAAE,eAAe,KAAK,QAAQ,CAAC;AAE5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAgB,EAAgB,EAAE;IAClE,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,WAAW,CACzB,UAA8C,CAAC,QAAQ,CACzD,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAC3E,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,IAAI,MAAM,EAAE;YAAE,OAAO;QACrB,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,EAAE,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,EAAE,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9C,QAAQ,EAAE,gBAAgB,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,GAAG,EAAE;QACV,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChD,MAAM,EAAE,mBAAmB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjD,QAAQ,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/client/catalog.d.ts

@@ -0,0 +1,15 @@
+import type { AnySchema, AnySchemaDefinition } from "../db/Schema.ts";
+import type { ReadCompatibilityHash } from "../internal/authorization/identities.ts";
+import type { CompositionIndex } from "../internal/core/composition.ts";
+import type { AttributeSpec } from "../internal/core/schema.ts";
+import { type ClientProjectionCatalog, type InstalledProjection } from "../internal/replication/projection-binding.ts";
+export type ClientCatalog = {
+    readonly key: string;
+    readonly schema: AnySchema;
+    readonly attributes: readonly AttributeSpec[];
+    readonly composition: CompositionIndex;
+    readonly readCompatibilityHash: ReadCompatibilityHash;
+    readonly projections: ClientProjectionCatalog;
+};
+export declare const installClientCatalog: (definition: AnySchemaDefinition, projections?: readonly InstalledProjection[]) => Promise<ClientCatalog>;
+//# sourceMappingURL=catalog.d.ts.map

package/dist/client/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/client/catalog.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAMrF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACzB,MAAM,+CAA+C,CAAC;AAuCvD,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,uBAAuB,CAAC;CAC/C,CAAC;AAEF,eAAO,MAAM,oBAAoB,eACnB,mBAAmB,gBAClB,SAAS,mBAAmB,EAAE,KAC1C,OAAO,CAAC,aAAa,CAgBvB,CAAC"}

package/dist/client/catalog.js

@@ -0,0 +1,48 @@
+import * as Effect from "effect/Effect";
+import { compositionFromSchema } from "../db/composition.js";
+import { schemaTx } from "../db/ensure.js";
+import { hashReadCompatibility } from "../internal/authorization/read-compatibility.js";
+import { catalogReadTables, completeSchema, } from "../internal/authorization/read-tables.js";
+import { makeClientProjectionCatalog, } from "../internal/replication/projection-binding.js";
+const CARDINALITY = {
+    ":db.cardinality/one": "one",
+    ":db.cardinality/many": "many",
+};
+const UNIQUE = {
+    ":db.unique/identity": "identity",
+    ":db.unique/value": "value",
+};
+const attributeSpecs = (schema) => Object.freeze(schemaTx(schema).map((attribute) => {
+    const cardinality = CARDINALITY[attribute[":db/cardinality"]];
+    if (cardinality === undefined) {
+        throw new Error(`ramose/client: unknown cardinality for ${attribute[":db/ident"]}`);
+    }
+    const unique = attribute[":db/unique"] === undefined
+        ? undefined
+        : UNIQUE[attribute[":db/unique"]];
+    if (attribute[":db/unique"] !== undefined && unique === undefined) {
+        throw new Error(`ramose/client: unknown uniqueness for ${attribute[":db/ident"]}`);
+    }
+    return {
+        ident: attribute[":db/ident"],
+        valueType: attribute[":db/valueType"],
+        cardinality,
+        ...(unique === undefined ? {} : { unique }),
+        index: attribute[":db/index"] === true,
+        isComponent: attribute[":db/isComponent"] === true,
+        optional: attribute[":db/optional"] === true,
+    };
+}));
+export const installClientCatalog = async (definition, projections = []) => {
+    const schema = completeSchema(definition);
+    const readCompatibilityHash = await Effect.runPromise(hashReadCompatibility(catalogReadTables(definition)));
+    return Object.freeze({
+        key: definition.key,
+        schema,
+        attributes: attributeSpecs(schema),
+        composition: compositionFromSchema(schema),
+        readCompatibilityHash,
+        projections: makeClientProjectionCatalog(`${definition.key}:${readCompatibilityHash}`, projections),
+    });
+};
+//# sourceMappingURL=catalog.js.map

package/dist/client/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/client/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AACxF,OAAO,EACL,iBAAiB,EACjB,cAAc,GACf,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EACL,2BAA2B,GAG5B,MAAM,+CAA+C,CAAC;AAEvD,MAAM,WAAW,GAAmC;IAClD,qBAAqB,EAAE,KAAK;IAC5B,sBAAsB,EAAE,MAAM;CAC/B,CAAC;AAEF,MAAM,MAAM,GAAyC;IACnD,qBAAqB,EAAE,UAAU;IACjC,kBAAkB,EAAE,OAAO;CAC5B,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,MAAiB,EAA4B,EAAE,CACrE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAiB,EAAE;IAC9D,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,0CAA0C,SAAS,CAAC,WAAW,CAAC,EAAE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,KAAK,SAAS;QAClD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IACpC,IAAI,SAAS,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,yCAAyC,SAAS,CAAC,WAAW,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC;QAC7B,SAAS,EAAE,SAAS,CAAC,eAAe,CAA+B;QACnE,WAAW;QACX,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,KAAK,IAAI;QACtC,WAAW,EAAE,SAAS,CAAC,iBAAiB,CAAC,KAAK,IAAI;QAClD,QAAQ,EAAE,SAAS,CAAC,cAAc,CAAC,KAAK,IAAI;KAC7C,CAAC;AACJ,CAAC,CAAC,CAAC,CAAC;AAWN,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,UAA+B,EAC/B,WAAW,GAAmC,EAAE,EACxB,EAAE;IAC1B,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,qBAAqB,GAAG,MAAM,MAAM,CAAC,UAAU,CACnD,qBAAqB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CACrD,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,MAAM;QACN,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC;QAClC,WAAW,EAAE,qBAAqB,CAAC,MAAM,CAAC;QAC1C,qBAAqB;QACrB,WAAW,EAAE,2BAA2B,CACtC,GAAG,UAAU,CAAC,GAAG,IAAI,qBAAqB,EAAE,EAC5C,WAAW,CACZ;KACF,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/client/changesets.d.ts

@@ -0,0 +1,85 @@
+import { type Subscription } from "./subscription.ts";
+import type { QuerySnapshot } from "./database.ts";
+import type { AnyComposer } from "../db/Composer.ts";
+import { OwnedOperations } from "../db/Operation.ts";
+import type { MutationRef } from "../db/refs.ts";
+import type { MutationInput } from "./mutation-schema.ts";
+import { DatabaseView } from "./view.ts";
+import { type ChangesetResponse } from "../internal/changesets/protocol.ts";
+import type { ClientOperations } from "./operations.ts";
+declare const PreparedOperation: unique symbol;
+export type ChangesetOperation = {
+    readonly [PreparedOperation]: {
+        readonly owner: {
+            readonly kind: "entity" | "trait";
+            readonly name: string;
+        };
+        readonly name: string;
+        readonly input: unknown;
+        readonly target?: string;
+    };
+};
+type OperationsOf<N> = N extends {
+    readonly [OwnedOperations]: infer O;
+} ? O : never;
+type InputOf<O> = O extends {
+    readonly input: infer I;
+} ? MutationInput<I> : never;
+export type ProposalOperations<N extends AnyComposer> = {
+    readonly [K in keyof OperationsOf<N>]: OperationsOf<N>[K] extends {
+        readonly self: false;
+    } ? (input: InputOf<OperationsOf<N>[K]>) => ChangesetOperation : (target: MutationRef, input: InputOf<OperationsOf<N>[K]>) => ChangesetOperation;
+};
+export type ChangesetChange = {
+    readonly entity: string;
+    readonly field: string;
+    readonly value: unknown;
+    readonly added: boolean;
+};
+export type Changeset = ChangesetResponse;
+export type ChangesetProposal = {
+    readonly id: string;
+    readonly revision?: string;
+    readonly title: string;
+    readonly reviewers?: readonly string[];
+    readonly operations: readonly ChangesetOperation[];
+};
+export type ChangesetPage = {
+    readonly items: readonly Changeset[];
+    readonly nextCursor: string | null;
+    readonly version: string;
+};
+export type ChangesetListOptions = {
+    readonly after?: string;
+    readonly limit?: number;
+};
+export type ClientChangesets = {
+    readonly list: (options?: ChangesetListOptions) => Promise<ChangesetPage>;
+    readonly observe: (options?: ChangesetListOptions & {
+        readonly id?: string;
+    }) => Subscription<QuerySnapshot<ChangesetPage>>;
+    readonly operations: <N extends AnyComposer>(owner: N) => ProposalOperations<N>;
+    readonly open: (id: string, revision: string) => DatabaseView;
+    readonly append: (id: string, revision: string, operations: readonly ChangesetOperation[]) => Promise<Changeset>;
+    readonly prepare: (proposal: ChangesetProposal) => Promise<Changeset>;
+    readonly inspect: (id: string) => Promise<Changeset>;
+    readonly commit: (id: string, revision: string) => Promise<Changeset>;
+    readonly discard: (id: string, revision: string) => Promise<Changeset>;
+};
+export declare class ChangesetError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, status: number);
+}
+export declare const clientChangesets: (context: {
+    readonly signal: AbortSignal;
+    readonly endpoint: string;
+    readonly credential: () => Promise<{
+        readonly token: string;
+    }>;
+    readonly operations: () => ClientOperations;
+    readonly assertLive: () => void;
+    readonly subscribe: (changed: () => void) => () => void;
+}) => ClientChangesets;
+export {};
+//# sourceMappingURL=changesets.d.ts.map

package/dist/client/changesets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changesets.d.ts","sourceRoot":"","sources":["../../src/client/changesets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAoE,KAAK,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC9I,OAAO,KAAK,EAAmB,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEzE,QAAA,MAAM,iBAAiB,EAAE,OAAO,MAA4C,CAAC;AAC7E,MAAM,MAAM,kBAAkB,GAAG;IAAE,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE;QAC/D,QAAQ,CAAC,KAAK,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;YAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAA;CAAE,CAAC;AAEJ,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,CAAC,GAAG,KAAK,CAAC;AACrF,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AACnF,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,WAAW,IAAI;IACtD,QAAQ,EAAE,CAAC,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KAAE,GACtF,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,GAC1D,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB;CACpF,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAE1C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AACnI,MAAM,MAAM,oBAAoB,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACxF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG;QAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,YAAY,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5H,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAChF,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC;IAC9D,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,kBAAkB,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACjH,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACtE,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACtE,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;CACxE,CAAC;AAEF,qBAAa,cAAe,SAAQ,KAAK;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;IAA1D,YAAqB,IAAI,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM,EAGzD;CACF;AAED,eAAO,MAAM,gBAAgB,YAAa;IACxC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,gBAAgB,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAC;CACzD,KAAG,gBAgIH,CAAC"}