@appport/sdk 1.0.1

package/LICENSE

@@ -0,0 +1,126 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work.
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner.
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      shall any Contributor be liable to You for damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 AppPort contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,39 @@
+# @appport/sdk
+
+The developer-facing AppPort implementation SDK. Use it to give an application
+a stable identity and define portable, contract-driven capabilities without
+coupling application code to a process, URL, transport, AppBoundry, or FeltDB.
+
+Install it in an application repository:
+
+```sh
+npm install @appport/sdk
+```
+
+```ts
+import { AppPortApplication, defineCapability, s } from "@appport/sdk";
+
+const history = defineCapability({
+  name: "tracker.history",
+  version: 1,
+  input: s.object({ trackerId: s.string() }),
+  output: s.object({ entries: s.array(s.string()) }),
+  async handler({ trackerId }) {
+    return { entries: await existingTracker.history(trackerId) };
+  }
+});
+```
+
+Capability implementations are transport-independent. Choose in-process,
+HTTP, WebSocket, Electron, Tauri, web, or mobile adapters at the process edge.
+
+The supported surface is the package root plus the Node-only
+`@appport/sdk/node` host entrypoint. The root supports modern browsers and Node
+20+ where the selected adapter's platform APIs are available; Bun and Deno are
+not yet qualified. AppPort is the open protocol and application boundary.
+AppBoundry is an optional downstream authority that discovers, authorizes, and
+governs AppPort applications—it is not required to use this SDK.
+
+The first public release treats the documented exports as the compatibility
+surface under semantic versioning. Protocol requirements are defined in the
+[AppPort specification](../../spec/appport-1.0.md).

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+/** The intentional, curated AppPort developer surface. */
+export * from "@appport/core/public";
+export { s, toSchema, toJSONSchema, fromJSONSchema, type Schema, type SchemaInput } from "@appport/schema";
+export { AppPortError, errors, type AppRequest, type AppResponse, type AppEventEnvelope, type AppStreamRequest, type JsonValue } from "@appport/protocol";
+export { AppPort, createClient, type AppPortClient, type AppTransport, type CallOptions, type TypedStream, type Unsubscribe } from "@appport/client";
+export { AppPortServer, createServer, type Identity } from "@appport/server";
+export { permissionAuthorizer, allowAllAuthorizer, authorizerFrom, combineAuthorizers, createAuthorizationContext, type Authorizer, type AuthorizationContext, type AuthorizationDecision } from "@appport/authorization";
+export { createInProcessTransport, type InProcessTransportOptions } from "@appport/transport-inprocess";
+export { createHttpTransport, type HttpTransportOptions } from "@appport/transport-http";
+export { createWebSocketTransport, type WebSocketTransportOptions } from "@appport/transport-websocket";
+export { createElectronTransport, serveElectronIpc, exposeAppPort } from "@appport/transport-electron";
+export { createTauriTransport, APPPORT_COMMAND, APPPORT_EVENT, type TauriTransportOptions } from "@appport/transport-tauri";
+export { MobileAppPortClient, type MobileAppPort, type MobileConnectOptions } from "@appport/mobile";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC3G,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC1J,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACrJ,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,KAAK,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACxG,OAAO,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,KAAK,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACxG,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAC5H,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,14 @@
+/** The intentional, curated AppPort developer surface. */
+export * from "@appport/core/public";
+export { s, toSchema, toJSONSchema, fromJSONSchema } from "@appport/schema";
+export { AppPortError, errors } from "@appport/protocol";
+export { AppPort, createClient } from "@appport/client";
+export { AppPortServer, createServer } from "@appport/server";
+export { permissionAuthorizer, allowAllAuthorizer, authorizerFrom, combineAuthorizers, createAuthorizationContext } from "@appport/authorization";
+export { createInProcessTransport } from "@appport/transport-inprocess";
+export { createHttpTransport } from "@appport/transport-http";
+export { createWebSocketTransport } from "@appport/transport-websocket";
+export { createElectronTransport, serveElectronIpc, exposeAppPort } from "@appport/transport-electron";
+export { createTauriTransport, APPPORT_COMMAND, APPPORT_EVENT } from "@appport/transport-tauri";
+export { MobileAppPortClient } from "@appport/mobile";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAiC,MAAM,iBAAiB,CAAC;AAC3G,OAAO,EAAE,YAAY,EAAE,MAAM,EAAmG,MAAM,mBAAmB,CAAC;AAC1J,OAAO,EAAE,OAAO,EAAE,YAAY,EAA+F,MAAM,iBAAiB,CAAC;AACrJ,OAAO,EAAE,aAAa,EAAE,YAAY,EAAiB,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,0BAA0B,EAI3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAkC,MAAM,8BAA8B,CAAC;AACxG,OAAO,EAAE,mBAAmB,EAA6B,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAkC,MAAM,8BAA8B,CAAC;AACxG,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,aAAa,EAA8B,MAAM,0BAA0B,CAAC;AAC5H,OAAO,EAAE,mBAAmB,EAAiD,MAAM,iBAAiB,CAAC"}

package/dist/node.d.ts

@@ -0,0 +1,3 @@
+export { serve, serveDesktopHost, type RunningServer } from "@appport/server/node";
+export * from "./index.js";
+//# sourceMappingURL=node.d.ts.map

package/dist/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACnF,cAAc,YAAY,CAAC"}

package/dist/node.js

@@ -0,0 +1,3 @@
+export { serve, serveDesktopHost } from "@appport/server/node";
+export * from "./index.js";
+//# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAsB,MAAM,sBAAsB,CAAC;AACnF,cAAc,YAAY,CAAC"}

package/node_modules/@appport/authorization/README.md

@@ -0,0 +1,28 @@
+# @appport/authorization
+
+The capability authorization model.
+
+Authorization in AppPort operates on capabilities, never on transports. A
+capability declares the permissions it requires; an authorizer decides whether
+the caller holds them.
+
+```ts
+import { permissionAuthorizer, combineAuthorizers, authorizerFrom } from "@appport/authorization";
+
+const authorizer = combineAuthorizers([
+  permissionAuthorizer(),
+  authorizerFrom("owner", ({ session, input }) => isOwner(session, input))
+]);
+```
+
+- `permissionAuthorizer()` — the session's permissions must cover the
+  capability's. Wildcards (`documents.*`, `*`) are supported.
+- `authorizerFrom(name, fn)` — resource-level policy.
+- `combineAuthorizers([...])` — every authorizer must allow; first denial wins.
+- `allowAllAuthorizer()` — local runtimes and tests only.
+
+`UNAUTHORIZED` and `FORBIDDEN` are distinguished deliberately: a client needs to
+tell "sign in" from "you cannot do this".
+
+Nothing here infers trust from the carrier. Desktop IPC is not identity, and
+neither is HTTPS.

package/node_modules/@appport/authorization/dist/index.d.ts

@@ -0,0 +1,94 @@
+/**
+ * `@appport/authorization` — the capability authorization model (§34, §37, §38).
+ *
+ * Authorization in AppPort operates on capabilities, never on transports.
+ * A capability declares the permissions it requires; an {@link Authorizer}
+ * decides whether the current principal holds them. Nothing here infers trust
+ * from the transport: desktop IPC is not privileged, and HTTPS is not identity.
+ */
+import { AppPortError, type CapabilityRef, type Principal, type Session } from "@appport/protocol";
+export type Permission = string;
+/**
+ * Matches a permission against a granted permission, supporting `*` wildcards
+ * at segment granularity: `documents.*` grants `documents.write`, and the bare
+ * `*` grants everything.
+ */
+export declare function permissionMatches(granted: Permission, required: Permission): boolean;
+export declare function grantsPermission(granted: Iterable<Permission>, required: Permission): boolean;
+/**
+ * The authorization view handed to capability handlers (§10).
+ *
+ * Handlers use it for resource-level checks that the declarative capability
+ * permissions cannot express ("may this principal write *this* document").
+ */
+export interface AuthorizationContext {
+    readonly session?: Session;
+    readonly principal?: Principal;
+    /** Permissions effectively granted to the caller. */
+    readonly permissions: readonly Permission[];
+    has(permission: Permission): boolean;
+    hasAll(permissions: readonly Permission[]): boolean;
+    /** Throws `FORBIDDEN` (or `UNAUTHORIZED` when anonymous) if not granted. */
+    require(permission: Permission): void;
+}
+export declare function createAuthorizationContext(options: {
+    session?: Session;
+    principal?: Principal;
+    permissions?: readonly Permission[];
+}): AuthorizationContext;
+export interface AuthorizationRequest {
+    capability: CapabilityRef;
+    /** Permissions declared by the capability version. */
+    required: readonly Permission[];
+    session?: Session;
+    principal?: Principal;
+    /** Validated capability input, so policies can make resource-aware decisions. */
+    input: unknown;
+    /** Transport kind, for auditing only — never for granting trust (§37, §38). */
+    transport?: string;
+}
+export type AuthorizationDecision = {
+    allowed: true; /** Permissions to expose on the handler context. */
+    permissions?: readonly Permission[];
+} | {
+    allowed: false;
+    code: "UNAUTHORIZED" | "FORBIDDEN";
+    reason?: string;
+};
+export interface Authorizer {
+    readonly name: string;
+    authorize(request: AuthorizationRequest): AuthorizationDecision | Promise<AuthorizationDecision>;
+}
+export declare const ALLOW: AuthorizationDecision;
+export declare function deny(reason?: string, code?: "UNAUTHORIZED" | "FORBIDDEN"): AuthorizationDecision;
+/**
+ * The default authorizer: the session's permission set must cover every
+ * permission the capability declares.
+ *
+ * A capability that declares no permissions is public. A capability that
+ * declares permissions with no session present fails `UNAUTHORIZED`, so clients
+ * can distinguish "log in" from "not allowed".
+ */
+export declare function permissionAuthorizer(options?: {
+    /** Permissions granted to every caller, authenticated or not. */
+    publicPermissions?: readonly Permission[];
+    /** Resolves additional permissions for a principal. */
+    resolvePermissions?: (request: AuthorizationRequest) => readonly Permission[] | Promise<readonly Permission[]>;
+}): Authorizer;
+/**
+ * Allows everything. Appropriate for local single-user runtimes and tests, and
+ * never appropriate for a networked deployment.
+ */
+export declare function allowAllAuthorizer(): Authorizer;
+/** Wraps a plain predicate as an authorizer. */
+export declare function authorizerFrom(name: string, fn: (request: AuthorizationRequest) => boolean | AuthorizationDecision | Promise<boolean | AuthorizationDecision>): Authorizer;
+/**
+ * Runs authorizers in order; every authorizer must allow. The first denial
+ * wins, so put the cheapest check first.
+ */
+export declare function combineAuthorizers(authorizers: readonly Authorizer[]): Authorizer;
+/** Converts a denial into the corresponding protocol error. */
+export declare function decisionToError(decision: Extract<AuthorizationDecision, {
+    allowed: false;
+}>): AppPortError;
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@appport/authorization/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAU,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE3G,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,GAAG,OAAO,CAKpF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,UAAU,GAAG,OAAO,CAK7F;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;IACrC,MAAM,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAAC;IACpD,4EAA4E;IAC5E,OAAO,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;CACvC;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;CACrC,GAAG,oBAAoB,CAgBvB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,aAAa,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,iFAAiF;IACjF,KAAK,EAAE,OAAO,CAAC;IACf,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,OAAO,EAAE,IAAI,CAAC,CAAC,oDAAoD;IAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,GAC3G;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,cAAc,GAAG,WAAW,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAClG;AAED,eAAO,MAAM,KAAK,EAAE,qBAAyC,CAAC;AAE9D,wBAAgB,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,cAAc,GAAG,WAAyB,GAAG,qBAAqB,CAI7G;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,GAAE;IACP,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC1C,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,SAAS,UAAU,EAAE,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;CAC3G,GACL,UAAU,CAqBZ;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED,gDAAgD;AAChD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,GAAG,qBAAqB,GAAG,OAAO,CAAC,OAAO,GAAG,qBAAqB,CAAC,GAChH,UAAU,CAWZ;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,CAajF;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,qBAAqB,EAAE;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,GAAG,YAAY,CAI1G"}

package/node_modules/@appport/authorization/dist/index.js

@@ -0,0 +1,131 @@
+/**
+ * `@appport/authorization` — the capability authorization model (§34, §37, §38).
+ *
+ * Authorization in AppPort operates on capabilities, never on transports.
+ * A capability declares the permissions it requires; an {@link Authorizer}
+ * decides whether the current principal holds them. Nothing here infers trust
+ * from the transport: desktop IPC is not privileged, and HTTPS is not identity.
+ */
+import { AppPortError, errors } from "@appport/protocol";
+/**
+ * Matches a permission against a granted permission, supporting `*` wildcards
+ * at segment granularity: `documents.*` grants `documents.write`, and the bare
+ * `*` grants everything.
+ */
+export function permissionMatches(granted, required) {
+    if (granted === "*" || granted === required)
+        return true;
+    if (!granted.endsWith(".*"))
+        return false;
+    const prefix = granted.slice(0, -1); // keep the trailing dot
+    return required.startsWith(prefix);
+}
+export function grantsPermission(granted, required) {
+    for (const permission of granted) {
+        if (permissionMatches(permission, required))
+            return true;
+    }
+    return false;
+}
+export function createAuthorizationContext(options) {
+    const permissions = options.permissions ?? options.session?.permissions ?? [];
+    const principal = options.principal ?? options.session?.principal;
+    const context = {
+        ...(options.session ? { session: options.session } : {}),
+        ...(principal ? { principal } : {}),
+        permissions,
+        has: (permission) => grantsPermission(permissions, permission),
+        hasAll: (required) => required.every((permission) => grantsPermission(permissions, permission)),
+        require: (permission) => {
+            if (grantsPermission(permissions, permission))
+                return;
+            if (!principal)
+                throw errors.unauthorized();
+            throw errors.forbidden(`Missing permission: ${permission}`, { required: [permission] });
+        }
+    };
+    return context;
+}
+export const ALLOW = { allowed: true };
+export function deny(reason, code = "FORBIDDEN") {
+    return code === "UNAUTHORIZED"
+        ? { allowed: false, code, ...(reason ? { reason } : {}) }
+        : { allowed: false, code, ...(reason ? { reason } : {}) };
+}
+/**
+ * The default authorizer: the session's permission set must cover every
+ * permission the capability declares.
+ *
+ * A capability that declares no permissions is public. A capability that
+ * declares permissions with no session present fails `UNAUTHORIZED`, so clients
+ * can distinguish "log in" from "not allowed".
+ */
+export function permissionAuthorizer(options = {}) {
+    return {
+        name: "permission",
+        async authorize(request) {
+            const granted = [
+                ...(options.publicPermissions ?? []),
+                ...(request.session?.permissions ?? []),
+                ...(options.resolvePermissions ? await options.resolvePermissions(request) : [])
+            ];
+            if (request.required.length === 0)
+                return { allowed: true, permissions: granted };
+            const missing = request.required.filter((permission) => !grantsPermission(granted, permission));
+            if (missing.length === 0)
+                return { allowed: true, permissions: granted };
+            const principal = request.principal ?? request.session?.principal;
+            if (!principal) {
+                return { allowed: false, code: "UNAUTHORIZED", reason: "Authentication is required" };
+            }
+            return { allowed: false, code: "FORBIDDEN", reason: `Missing permission: ${missing.join(", ")}` };
+        }
+    };
+}
+/**
+ * Allows everything. Appropriate for local single-user runtimes and tests, and
+ * never appropriate for a networked deployment.
+ */
+export function allowAllAuthorizer() {
+    return { name: "allow-all", authorize: () => ({ allowed: true, permissions: ["*"] }) };
+}
+/** Wraps a plain predicate as an authorizer. */
+export function authorizerFrom(name, fn) {
+    return {
+        name,
+        async authorize(request) {
+            const result = await fn(request);
+            if (typeof result === "boolean") {
+                return result ? { allowed: true } : { allowed: false, code: "FORBIDDEN" };
+            }
+            return result;
+        }
+    };
+}
+/**
+ * Runs authorizers in order; every authorizer must allow. The first denial
+ * wins, so put the cheapest check first.
+ */
+export function combineAuthorizers(authorizers) {
+    return {
+        name: `combined(${authorizers.map((a) => a.name).join(",")})`,
+        async authorize(request) {
+            let permissions;
+            for (const authorizer of authorizers) {
+                const decision = await authorizer.authorize(request);
+                if (!decision.allowed)
+                    return decision;
+                if (decision.permissions)
+                    permissions = decision.permissions;
+            }
+            return permissions ? { allowed: true, permissions } : { allowed: true };
+        }
+    };
+}
+/** Converts a denial into the corresponding protocol error. */
+export function decisionToError(decision) {
+    return decision.code === "UNAUTHORIZED"
+        ? errors.unauthorized(decision.reason ?? "Authentication is required")
+        : errors.forbidden(decision.reason ?? "Capability is not authorized");
+}
+//# sourceMappingURL=index.js.map

package/node_modules/@appport/authorization/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,EAAoD,MAAM,mBAAmB,CAAC;AAI3G;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAmB,EAAE,QAAoB;IACzE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB;IAC7D,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA6B,EAAE,QAAoB;IAClF,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QACjC,IAAI,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAmBD,MAAM,UAAU,0BAA0B,CAAC,OAI1C;IACC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;IAC9E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;IAClE,MAAM,OAAO,GAAyB;QACpC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,WAAW;QACX,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC;QAC9D,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/F,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE;YACtB,IAAI,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC;gBAAE,OAAO;YACtD,IAAI,CAAC,SAAS;gBAAE,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,MAAM,CAAC,SAAS,CAAC,uBAAuB,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;KACF,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAuBD,MAAM,CAAC,MAAM,KAAK,GAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAE9D,MAAM,UAAU,IAAI,CAAC,MAAe,EAAE,OAAqC,WAAW;IACpF,OAAO,IAAI,KAAK,cAAc;QAC5B,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACzD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAKI,EAAE;IAEN,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,OAAO,GAAiB;gBAC5B,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;gBACpC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;gBACvC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC;YACF,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;YAElF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;YAChG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;YAEzE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;YAClE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;YACxF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACpG,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,EAAiH;IAEjH,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAC5E,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAkC;IACnE,OAAO;QACL,IAAI,EAAE,YAAY,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAC7D,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,IAAI,WAA8C,CAAC;YACnD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBACrD,IAAI,CAAC,QAAQ,CAAC,OAAO;oBAAE,OAAO,QAAQ,CAAC;gBACvC,IAAI,QAAQ,CAAC,WAAW;oBAAE,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;YAC/D,CAAC;YACD,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,QAA4D;IAC1F,OAAO,QAAQ,CAAC,IAAI,KAAK,cAAc;QACrC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,IAAI,4BAA4B,CAAC;QACtE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,8BAA8B,CAAC,CAAC;AAC1E,CAAC"}

package/node_modules/@appport/authorization/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@appport/authorization",
+  "version": "1.0.0",
+  "description": "Capability authorization model for AppPort.",
+  "license": "Apache-2.0",
+  "repository": "github:rkendel1/appport",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -b",
+    "clean": "tsc -b --clean"
+  },
+  "dependencies": {
+    "@appport/protocol": "1.0.0"
+  },
+  "private": true
+}

package/node_modules/@appport/client/README.md

@@ -0,0 +1,35 @@
+# @appport/client
+
+The transport-independent application client.
+
+```ts
+import { createClient } from "@appport/client";
+
+const client = createClient({ transport });
+await client.connect();
+await client.load(); // discovers capabilities and versions from the manifest
+
+await client.call("documents.save", { documentId, content });
+await client.capabilities.documents.save({ documentId, content });
+
+for await (const chunk of client.stream("build.logs", { buildId })) console.log(chunk.line);
+
+const unsubscribe = await client.events.subscribe("documents.changed", (payload) => refresh(payload));
+```
+
+The client builds envelopes, correlates responses, resolves capability versions
+from the manifest, unwraps errors into `AppPortError`, and exposes capabilities
+as a namespaced proxy. Application code never touches a protocol envelope.
+
+`createDuplexTransport` implements request correlation, subscriptions and stream
+reassembly once, for every carrier that can push: WebSocket, Electron IPC, Tauri
+IPC and the in-process bridge.
+
+With a generated contract the client is fully typed:
+
+```ts
+import { createDocumentsClient } from "./appport/generated/client.ts";
+
+const client = createDocumentsClient({ transport });
+const { version } = await client.capabilities.documents.save({ documentId, content });
+```

package/node_modules/@appport/client/dist/channel.d.ts

@@ -0,0 +1,14 @@
+/**
+ * A minimal async queue used by duplex transports to hand server-pushed chunks
+ * to an async iterator. Kept local to the client so `@appport/client` stays
+ * dependency-free and browser-safe.
+ */
+export declare class ClientChannel<T> implements AsyncIterable<T> {
+    #private;
+    get closed(): boolean;
+    push(value: T): void;
+    end(): void;
+    fail(reason: unknown): void;
+    [Symbol.asyncIterator](): AsyncIterator<T>;
+}
+//# sourceMappingURL=channel.d.ts.map

package/node_modules/@appport/client/dist/channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../src/channel.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,aAAa,CAAC,CAAC,CAAE,YAAW,aAAa,CAAC,CAAC,CAAC;;IAMvD,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI;IAOpB,GAAG,IAAI,IAAI;IAMX,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAOpB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC;CAkBlD"}

package/node_modules/@appport/client/dist/channel.js

@@ -0,0 +1,58 @@
+/**
+ * A minimal async queue used by duplex transports to hand server-pushed chunks
+ * to an async iterator. Kept local to the client so `@appport/client` stays
+ * dependency-free and browser-safe.
+ */
+export class ClientChannel {
+    #queue = [];
+    #waiters = [];
+    #closed = false;
+    #failure;
+    get closed() {
+        return this.#closed;
+    }
+    push(value) {
+        if (this.#closed)
+            return;
+        const waiter = this.#waiters.shift();
+        if (waiter)
+            waiter.resolve({ value, done: false });
+        else
+            this.#queue.push(value);
+    }
+    end() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        while (this.#waiters.length)
+            this.#waiters.shift().resolve({ value: undefined, done: true });
+    }
+    fail(reason) {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        this.#failure = reason;
+        while (this.#waiters.length)
+            this.#waiters.shift().reject(reason);
+    }
+    async *[Symbol.asyncIterator]() {
+        for (;;) {
+            if (this.#queue.length > 0) {
+                yield this.#queue.shift();
+                continue;
+            }
+            if (this.#failure !== undefined)
+                throw this.#failure;
+            if (this.#closed)
+                return;
+            const next = await new Promise((resolve, reject) => this.#waiters.push({ resolve, reject }));
+            if (next.done) {
+                if (this.#failure !== undefined)
+                    throw this.#failure;
+                return;
+            }
+            yield next.value;
+        }
+    }
+}
+//# sourceMappingURL=channel.js.map

package/node_modules/@appport/client/dist/channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.js","sourceRoot":"","sources":["../src/channel.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,aAAa;IACf,MAAM,GAAQ,EAAE,CAAC;IACjB,QAAQ,GAA+F,EAAE,CAAC;IACnH,OAAO,GAAG,KAAK,CAAC;IAChB,QAAQ,CAAU;IAElB,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,KAAQ;QACX,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrC,IAAI,MAAM;YAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,GAAG;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,IAAI,CAAC,MAAe;QAClB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;QACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;QAC3B,SAAS,CAAC;YACR,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAG,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;YACrD,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACpE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CACxC,CAAC;YACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;oBAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}