@astrale-os/sdk 0.4.19 → 0.5.0-beta.2

package/dist/auth/verify.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/auth/verify.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,UAAU,EAEV,kBAAkB,EACnB,MAAM,yBAAyB,CAAA;AAYhC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAKzD,MAAM,MAAM,eAAe,GAAG;IAC5B,2DAA2D;IAC3D,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAA;IACd,2DAA2D;IAC3D,WAAW,EAAE,WAAW,CAAA;IACxB,yEAAyE;IACzE,UAAU,EAAE,UAAU,CAAA;CACvB,CAAA;AAkBD,oFAAoF;AACpF,wBAAgB,cAAc,IAAI,IAAI,CAGrC;AAiFD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,eAAe,EAC3B,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,eAAe,CAAC,CA+C1B"}

package/dist/auth/verify.js

@@ -1,151 +0,0 @@
-/**
- * Inbound credential verification.
- *
- * Uses kernel-core's credential verification infrastructure
- * (CredentialMethodResolver, MethodRegistry) instead of manual JWT handling.
- * Not tied to JWT — supports any credential method kernel-core provides.
- */
-import { CredentialMethodResolver, MethodRegistry, SignatureVerificationError, SigningKeyNotFoundError, verifyAudience, verifyCredential, } from '@astrale-os/kernel-core';
-import { createLocalJWKSet, createRemoteJWKSet } from 'jose';
-import { derivePublicJwk } from '../server/jwks.js';
-import { canonicalizeServingUrl } from '../server/serving-url.js';
-const methodResolver = new CredentialMethodResolver(new MethodRegistry());
-// JWKS resolvers cached per JWKS URL (module-level, like the pools/selfIds
-// Maps in kernel-client.ts). jose handles freshness WITHIN a resolver: 10min
-// max-age, 30s fetch cooldown, and auto-refetch on kid-miss when not cooling
-// down. The one gap — issuer restarts with new keys while the cooldown pins
-// the old set (the incident that got a prior indefinite cache removed) — is
-// covered by evict-and-retry-once in `verifyInboundCredential`, so indefinite
-// Map residency is safe and the per-call JWKS fetch is gone.
-const remoteResolvers = new Map();
-// Self-issued credentials verify against the worker's own in-memory key;
-// cache the local JWKS per canonical self-issuer (one key per worker) so the
-// public-JWK derivation isn't redone on every request.
-const localResolvers = new Map();
-/** Clear cached JWKS resolvers. Used in tests when keys rotate between fixtures. */
-export function clearJwksCache() {
-    remoteResolvers.clear();
-    localResolvers.clear();
-}
-/**
- * M-28 fix: a bare-slug iss (`mails.localhost`) makes
- * `new URL('mails.localhost/.well-known/jwks.json')` throw "Invalid URL
- * string". The dispatcher's identity map normalizes the iss it signs with,
- * but inbound creds from older clients may still carry the slug form. Coerce
- * to a URL with a default `https://` scheme (matches kernel.astrale.ai
- * canonical form). If the actual receiver is on http://localhost the
- * receiver-side resolver still works because both endpoints are on localhost
- * — but for prod targets requiring TLS this is the right default.
- */
-function jwksUrlFor(issuer) {
-    const normalized = /^https?:\/\//.test(issuer) ? issuer : `https://${issuer}`;
-    return `${normalized}/.well-known/jwks.json`;
-}
-function getRemoteResolver(jwksUrl) {
-    let resolver = remoteResolvers.get(jwksUrl);
-    if (!resolver) {
-        resolver = createRemoteJWKSet(new URL(jwksUrl));
-        remoteResolvers.set(jwksUrl, resolver);
-    }
-    return resolver;
-}
-function getLocalResolver(selfIssuer, privateKey) {
-    let resolver = localResolvers.get(selfIssuer);
-    if (!resolver) {
-        resolver = createLocalJWKSet({ keys: [derivePublicJwk(privateKey)] });
-        localResolvers.set(selfIssuer, resolver);
-    }
-    return resolver;
-}
-/**
- * Build the key resolver for one verifying server. Captures `config` so it can
- * short-circuit the server's OWN issuer (`config.issuer`): a self-issued
- * credential is verified against the in-memory public key, never fetched — a
- * Worker can't fetch its own hostname, and it already holds the key. Every other
- * issuer is resolved via the cached per-URL JWKS resolvers above; every JWKS
- * URL touched is recorded in `resolvedJwksUrls` so the caller can evict
- * exactly those resolvers if verification fails on an unknown signing key.
- */
-function makeResolveKeys(config, resolvedJwksUrls) {
-    // The worker's own canonical iss. STRICT: `config.issuer` is the serving URL
-    // by contract (both producers — buildIdentityMap / buildAuxIdentityMap — feed
-    // it `canonicalizeServingUrl(config.url)`), so a value that doesn't parse is
-    // a construction-time config error. Swallowing it would silently disable
-    // self-verification and route self-issued credentials to a JWKS fetch on the
-    // worker's own hostname — which Cloudflare forbids — turning a config bug
-    // into an opaque per-call failure.
-    const selfIssuer = canonicalizeServingUrl(config.issuer);
-    return async (issuer, _method, _kid) => {
-        const url = issuer;
-        // Self-issued credential (iss == this worker's own serving URL): resolve
-        // from the in-memory public key. Never fetch self — Cloudflare forbids a
-        // Worker fetching its own hostname, and the published JWKS is this key.
-        if (selfIssuer !== undefined) {
-            let canonical;
-            try {
-                canonical = canonicalizeServingUrl(url);
-            }
-            catch {
-                canonical = undefined;
-            }
-            if (canonical === selfIssuer) {
-                return getLocalResolver(selfIssuer, config.privateKey);
-            }
-        }
-        const jwksUrl = jwksUrlFor(url);
-        resolvedJwksUrls.add(jwksUrl);
-        return getRemoteResolver(jwksUrl);
-    };
-}
-/**
- * Verify an inbound delegation credential using kernel-core's verification.
- *
- * @throws AuthenticationError subclasses from kernel-core on verification failure
- */
-export async function verifyInboundCredential(credential, config) {
-    // Verify using kernel-core's credential verification pipeline
-    const resolvedJwksUrls = new Set();
-    const deps = { methodResolver, resolveKeys: makeResolveKeys(config, resolvedJwksUrls) };
-    let verified;
-    try {
-        verified = await verifyCredential(deps, credential);
-    }
-    catch (error) {
-        // A cached resolver can hold a stale key set after the issuer rotates:
-        //  - new kid → jose kid-misses but its 30s fetch cooldown blocks the
-        //    refetch (SigningKeyNotFoundError) — the incident that got a prior
-        //    indefinite cache removed;
-        //  - SAME kid, new key material (kernel kids derive from the subject, so
-        //    a re-keyed issuer reuses its kid) → the signature check fails
-        //    (SignatureVerificationError).
-        // Both: evict the resolver(s) this verification touched and retry ONCE
-        // with fresh ones. Forged-token spam thus costs at most one JWKS fetch
-        // per bad credential — equal to the uncached per-call baseline, never
-        // worse. An empty set means self-issued — refetching can't help, rethrow.
-        const staleKeySuspect = error instanceof SigningKeyNotFoundError || error instanceof SignatureVerificationError;
-        if (!staleKeySuspect || resolvedJwksUrls.size === 0)
-            throw error;
-        for (const url of resolvedJwksUrls)
-            remoteResolvers.delete(url);
-        verified = await verifyCredential(deps, credential);
-    }
-    // Validate audience matches this function's issuer (its serving URL).
-    // kernel-core's verifyAudience compares canonically.
-    verifyAudience(verified, (config.audience ?? config.issuer));
-    // Extract attestation and delegation from claims
-    const attestation = verified.claims.attestation;
-    if (!attestation?.expr) {
-        throw new Error('Credential missing attestation');
-    }
-    const delegation = verified.claims.delegation;
-    if (!delegation?.credential) {
-        throw new Error('Credential missing delegation');
-    }
-    return {
-        verified,
-        issuer: verified.iss,
-        attestation,
-        delegation,
-    };
-}
-//# sourceMappingURL=verify.js.map

package/dist/auth/verify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/auth/verify.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,0BAA0B,EAC1B,uBAAuB,EACvB,cAAc,EACd,gBAAgB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAY,MAAM,MAAM,CAAA;AAItE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAajE,MAAM,cAAc,GAAG,IAAI,wBAAwB,CAAC,IAAI,cAAc,EAAE,CAAC,CAAA;AAEzE,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,6DAA6D;AAC7D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAiD,CAAA;AAEhF,yEAAyE;AACzE,6EAA6E;AAC7E,uDAAuD;AACvD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAgD,CAAA;AAE9E,oFAAoF;AACpF,MAAM,UAAU,cAAc;IAC5B,eAAe,CAAC,KAAK,EAAE,CAAA;IACvB,cAAc,CAAC,KAAK,EAAE,CAAA;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAA;IAC7E,OAAO,GAAG,UAAU,wBAAwB,CAAA;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;QAC/C,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAkB,EAClB,UAA8C;IAE9C,IAAI,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,UAAU,CAAQ,CAAC,EAAE,CAAC,CAAA;QAC5E,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,MAA4B,EAAE,gBAA6B;IAClF,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,mCAAmC;IACnC,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAExD,OAAO,KAAK,EAAE,MAAgB,EAAE,OAAe,EAAE,IAAa,EAAE,EAAE;QAChE,MAAM,GAAG,GAAG,MAAgB,CAAA;QAE5B,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,SAA6B,CAAA;YACjC,IAAI,CAAC;gBACH,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,SAAS,CAAA;YACvB,CAAC;YACD,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;gBAC7B,OAAO,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;YACxD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC/B,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7B,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAA2B,EAC3B,MAA4B;IAE5B,8DAA8D;IAC9D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC1C,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,CAAA;IACvF,IAAI,QAA4B,CAAA;IAChC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,+BAA+B;QAC/B,yEAAyE;QACzE,mEAAmE;QACnE,mCAAmC;QACnC,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,eAAe,GACnB,KAAK,YAAY,uBAAuB,IAAI,KAAK,YAAY,0BAA0B,CAAA;QACzF,IAAI,CAAC,eAAe,IAAI,gBAAgB,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,KAAK,CAAA;QAChE,KAAK,MAAM,GAAG,IAAI,gBAAgB;YAAE,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC/D,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACrD,CAAC;IAED,sEAAsE;IACtE,qDAAqD;IACrD,cAAc,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAa,CAAC,CAAA;IAExE,iDAAiD;IACjD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAsC,CAAA;IAC1E,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAoC,CAAA;IACvE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IAED,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,QAAQ,CAAC,GAAa;QAC9B,WAAW;QACX,UAAU;KACX,CAAA;AACH,CAAC"}

package/dist/cli/spec.d.ts

@@ -1,19 +0,0 @@
-/**
- * Build a diagnostic spec (wire graph + schema hash) from the project's
- * `defineDomain` definition. This mirrors what the codegen'd worker assembles —
- * but only for inspection / `/meta` provenance. The live install bundle is
- * always produced by the worker at request time, so a failure here is non-fatal
- * for dev/deploy (the CLI logs and continues) and fatal only for
- * `astrale-domain build`, where the spec IS the product.
- *
- * The modules (`schema` / `methods` / `views` / `functions`) come straight off
- * the definition — the SAME values the author wired into `defineDomain`, which
- * the adapter codegen also assembles. One source, no second filesystem probe to
- * drift from it.
- */
-import type { DomainDefinition } from '../config/define-domain.js';
-export declare function buildProjectSpec(def: DomainDefinition, url: string): Promise<{
-    wire: Record<string, unknown>;
-    schemaHash: string;
-}>;
-//# sourceMappingURL=spec.d.ts.map

package/dist/cli/spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../src/cli/spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAKlE,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,gBAAgB,EACrB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBhE"}

package/dist/cli/spec.js

@@ -1,33 +0,0 @@
-/**
- * Build a diagnostic spec (wire graph + schema hash) from the project's
- * `defineDomain` definition. This mirrors what the codegen'd worker assembles —
- * but only for inspection / `/meta` provenance. The live install bundle is
- * always produced by the worker at request time, so a failure here is non-fatal
- * for dev/deploy (the CLI logs and continues) and fatal only for
- * `astrale-domain build`, where the spec IS the product.
- *
- * The modules (`schema` / `methods` / `views` / `functions`) come straight off
- * the definition — the SAME values the author wired into `defineDomain`, which
- * the adapter codegen also assembles. One source, no second filesystem probe to
- * drift from it.
- */
-import { hashInstallGraph } from '@astrale-os/kernel-core/domain';
-import { buildInstallGraph, defineRemoteDomain } from '../domain/index.js';
-export async function buildProjectSpec(def, url) {
-    // The definition's module values are untyped against `RemoteDomainConfig` by
-    // nature (deps/schema generics erased on `DomainDefinition`); funnel them
-    // through ONE cast into the config shape `defineRemoteDomain` validates.
-    const config = {
-        schema: def.schema,
-        methods: def.methods,
-        ...(def.core ? { core: def.core } : {}),
-        ...(def.views ? { views: def.views } : {}),
-        ...(def.functions ? { remoteFunctions: def.functions } : {}),
-        ...(def.path ? { path: def.path } : {}),
-    };
-    const domain = defineRemoteDomain()(config);
-    const wire = buildInstallGraph(domain, url);
-    const schemaHash = await hashInstallGraph(wire);
-    return { wire: wire, schemaHash };
-}
-//# sourceMappingURL=spec.js.map

package/dist/cli/spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../src/cli/spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAKjE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE1E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAqB,EACrB,GAAW;IAEX,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,MAAM,GAAG;QACb,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACD,CAAA;IAExC,MAAM,MAAM,GAAG,kBAAkB,EAAW,CAAC,MAAM,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAC/C,OAAO,EAAE,IAAI,EAAE,IAA0C,EAAE,UAAU,EAAE,CAAA;AACzE,CAAC"}

package/dist/config/adapter.d.ts

@@ -1,148 +0,0 @@
-/**
- * The deployment-adapter contract.
- *
- * A deployment target = one npm package implementing `DomainAdapter<Params>`.
- * The adapter is GENERIC over its own `Params` so envs AND provider settings
- * stay 100% adapter-specific (a Cloudflare adapter's `{ route, secrets }` is
- * nothing like a Node adapter's `{ port }`). The CLI resolves
- * `envs[<env>] → Params` via `adapter.params(env)` and then drives the adapter
- * with the resolved params — install of the resulting URL and the `requires`
- * check are generic and live in the CLI, never in the adapter.
- *
- * The central guarantee: `watch()` and `deploy()` both return a `url` — that's
- * what the CLI prints, what `astrale domain install <url>` consumes, and
- * the worker's `iss` identity. The URL is an OUTPUT of watch/deploy; nothing
- * in the contract asks an adapter to predict it ahead of time.
- */
-/**
- * Generic, target-independent domain metadata the CLI hands every adapter so
- * it can codegen the worker entry. (Extends the bare `WatchCtx`/`DeployCtx` of
- * the spec with the fields a real codegen needs.)
- */
-export interface DomainInfo {
-    /**
-     * The domain's addressing name — the graph slug it mounts under (e.g.
-     * `'crm.acme.dev'`). NOT the cryptographic identity: the JWT `iss` is the
-     * worker's serving URL, pinned by the kernel at install time.
-     */
-    origin: string;
-    /** Cross-domain deps by origin — verified at install (CLI/kernel), not here. */
-    requires: readonly string[];
-    /** Optional Astrale Path called by the kernel after install (as __SYSTEM__). */
-    postInstall?: string;
-    /**
-     * Whether the domain declares Views / standalone Functions — read from the
-     * `defineDomain` definition, NOT probed from the filesystem. The adapter
-     * codegen imports the corresponding module only when true.
-     */
-    hasViews: boolean;
-    hasFunctions: boolean;
-    /**
-     * Views whose binding is backed by a worker-relative SPA mount. This is domain
-     * contract metadata (`defineView({ mount })`), not a frontend source folder:
-     * adapters decide, per env, which client assets serve these mounts.
-     */
-    mountedViews: Array<{
-        slug: string;
-        mount: string;
-    }>;
-    /**
-     * Whether the domain declares a `deps` mapper (`defineDomain({ deps })`).
-     * When true the adapter codegen imports it from the domain's fixed `deps`
-     * module and passes it to the worker entry; when false the worker passes the
-     * raw env straight through as `ctx.deps`. Read from the definition, never
-     * probed from the filesystem.
-     */
-    hasDeps: boolean;
-}
-export interface WatchCtx {
-    /** Absolute path to the domain project root. */
-    projectDir: string;
-    /** Absolute path where the CLI writes the diagnostic `spec.json`. */
-    specPath: string;
-    /** Flat secret map loaded from the env's `secrets` file — injected locally in dev. */
-    secrets: Record<string, string>;
-    /** Domain metadata for codegen. */
-    domain: DomainInfo;
-    /** The env key being watched (e.g. 'dev'). */
-    env: string;
-    /** Invoked by the adapter on every hot-reload so the CLI can re-log. */
-    onReload(): void;
-}
-export interface DeployCtx {
-    projectDir: string;
-    specPath: string;
-    /** Flat secret map loaded from the env's `secrets` file (gitignored). */
-    secrets: Record<string, string>;
-    domain: DomainInfo;
-    /** The env key being deployed (e.g. 'dev' | 'prod' | 'canary'). */
-    env: string;
-    /**
-     * Build the expected install-graph hash for a concrete serving URL from the
-     * current domain definition. Adapters that must verify live drift during
-     * deploy should use this instead of reading `.astrale/spec.json`, which is a
-     * post-deploy diagnostic artifact and may be stale.
-     */
-    schemaHashForUrl?(url: string): Promise<string | undefined>;
-}
-/** A running local watch — exposes its URL and a stop handle. */
-export interface WatchHandle {
-    /** Local URL the worker is reachable at (e.g. http://localhost:8787). */
-    url: string;
-    stop(): Promise<void>;
-}
-/** A completed deploy — the authoritative public URL. */
-export interface DeployResult {
-    url: string;
-    /**
-     * Adapter-specific next-steps block printed INSTEAD of the CLI's default
-     * "install on an instance" footer — managed deploys already installed the
-     * domain, so the default hint is wrong there. Pre-indented plain lines.
-     */
-    nextSteps?: string;
-}
-export interface DomainAdapter<Params> {
-    /** 'astrale-host' | 'cloudflare' | 'node' | … */
-    name: string;
-    /** Resolve an env key to this adapter's typed params. Throws on unknown key. */
-    params(env: string): Params;
-    /** Local + hot-reload (watch) → controllable handle. Orthogonal to env. */
-    watch(params: Params, ctx: WatchCtx): Promise<WatchHandle>;
-    /**
-     * Optional: re-run codegen for an ALREADY-RUNNING `watch` after
-     * `astrale.config.ts` changed — same shape as `watch` but it must NOT spawn
-     * anything: it only rewrites the generated files, and the running dev server
-     * (which watches them, e.g. `wrangler dev` on its `--config`) picks them up.
-     * Adapters without it fall back to "restart to apply config changes".
-     */
-    regenerate?(params: Params, ctx: WatchCtx): Promise<void>;
-    /** Build + bundle + ship (the adapter owns ITS build) → authoritative URL. */
-    deploy(params: Params, ctx: DeployCtx): Promise<DeployResult>;
-    /**
-     * Optional: the path (relative to the project root) of the gitignored secrets
-     * file for these params. The CLI loads it and passes the parsed map as
-     * `ctx.secrets` — keeping secret-file loading generic while the path stays
-     * provider-typed. Return `undefined` for "no secrets file".
-     */
-    secretsFile?(params: Params): string | undefined;
-}
-/**
- * Spec passed to `defineAdapter` — identical to `DomainAdapter` minus the
- * `params(env)` resolver, which the helper attaches from `envs`. Custom adapter
- * authors use this so they never re-implement env→params resolution.
- */
-export interface AdapterSpec<Params> {
-    name: string;
-    /** The provider-typed env map (`{ dev: {...}, prod: {...}, … }`). */
-    envs: Record<string, Params>;
-    watch(params: Params, ctx: WatchCtx): Promise<WatchHandle>;
-    regenerate?(params: Params, ctx: WatchCtx): Promise<void>;
-    deploy(params: Params, ctx: DeployCtx): Promise<DeployResult>;
-    secretsFile?(params: Params): string | undefined;
-}
-/**
- * Build a `DomainAdapter` from a spec + an env map, attaching a `params(env)`
- * resolver that throws a clear error on an unknown key (listing the valid ones).
- */
-export declare function defineAdapter<Params>(spec: AdapterSpec<Params>): DomainAdapter<Params>;
-//# sourceMappingURL=adapter.d.ts.map

package/dist/config/adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/config/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAA;IACjB,YAAY,EAAE,OAAO,CAAA;IACrB;;;;OAIG;IACH,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpD;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAA;IAChB,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,mCAAmC;IACnC,MAAM,EAAE,UAAU,CAAA;IAClB,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAA;IACX,wEAAwE;IACxE,QAAQ,IAAI,IAAI,CAAA;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,MAAM,EAAE,UAAU,CAAA;IAClB,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAA;IACX;;;;;OAKG;IACH,gBAAgB,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAC5D;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa,CAAC,MAAM;IACnC,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAA;IAEZ,gFAAgF;IAChF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;IAE3B,2EAA2E;IAC3E,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAE1D;;;;;;OAMG;IACH,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzD,8EAA8E;IAC9E,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAE7D;;;;;OAKG;IACH,WAAW,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW,CAAC,MAAM;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC1D,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC7D,WAAW,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CACjD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAoBtF"}

package/dist/config/adapter.js

@@ -1,40 +0,0 @@
-/**
- * The deployment-adapter contract.
- *
- * A deployment target = one npm package implementing `DomainAdapter<Params>`.
- * The adapter is GENERIC over its own `Params` so envs AND provider settings
- * stay 100% adapter-specific (a Cloudflare adapter's `{ route, secrets }` is
- * nothing like a Node adapter's `{ port }`). The CLI resolves
- * `envs[<env>] → Params` via `adapter.params(env)` and then drives the adapter
- * with the resolved params — install of the resulting URL and the `requires`
- * check are generic and live in the CLI, never in the adapter.
- *
- * The central guarantee: `watch()` and `deploy()` both return a `url` — that's
- * what the CLI prints, what `astrale domain install <url>` consumes, and
- * the worker's `iss` identity. The URL is an OUTPUT of watch/deploy; nothing
- * in the contract asks an adapter to predict it ahead of time.
- */
-/**
- * Build a `DomainAdapter` from a spec + an env map, attaching a `params(env)`
- * resolver that throws a clear error on an unknown key (listing the valid ones).
- */
-export function defineAdapter(spec) {
-    const keys = Object.keys(spec.envs);
-    return {
-        name: spec.name,
-        params(env) {
-            const params = spec.envs[env];
-            if (params === undefined) {
-                const known = keys.length ? keys.join(', ') : '(none)';
-                throw new Error(`Adapter "${spec.name}": unknown env "${env}". Known envs: ${known}. ` +
-                    `Add it to the adapter's env map in astrale.config.ts.`);
-            }
-            return params;
-        },
-        watch: spec.watch,
-        deploy: spec.deploy,
-        ...(spec.regenerate ? { regenerate: spec.regenerate } : {}),
-        ...(spec.secretsFile ? { secretsFile: spec.secretsFile } : {}),
-    };
-}
-//# sourceMappingURL=adapter.js.map

package/dist/config/adapter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../src/config/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAyIH;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAS,IAAyB;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,CAAC,GAAW;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;gBACtD,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,CAAC,IAAI,mBAAmB,GAAG,kBAAkB,KAAK,IAAI;oBACpE,uDAAuD,CAC1D,CAAA;YACH,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QACD,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAA;AACH,CAAC"}

package/dist/config/define-domain.d.ts

@@ -1,177 +0,0 @@
-/**
- * `defineDomain` — the WORKER-SAFE definition of a domain: what the domain *is*
- * (its `schema`, `methods`, `deps`, `views`, standalone `functions`) plus its
- * addressing identity (`origin`, `requires`, `postInstall`). It
- * deliberately carries NO deployment adapter — the adapter (`cloudflare(...)`,
- * `astrale(...)`) is node-only code (filesystem, wrangler) that must never enter
- * the worker bundle. The author wires this in a `domain.ts` the generated worker
- * imports directly, then attaches the adapter separately with `deploy(domain,
- * adapter)` in `astrale.config.ts` (see `./deploy`).
- *
- * The modules are wired EXPLICITLY here — imported and passed in — not
- * discovered from magic folder names. A renamed or mistyped module is a compile
- * error at this call site, never a silently-missing worker route. The adapter
- * reads this one definition for domain-side codegen; frontend source folders
- * live in adapter env config. `defineDomain` itself builds no server and boots
- * no kernel — it validates and packages the declaration.
- */
-import type { Core, Schema } from '@astrale-os/kernel-dsl';
-import type { AnyRemoteFunctionDef, ViewDef } from '../define/index.js';
-import type { SchemaMethodsImpl } from '../method/index.js';
-type AnyViewDef = ViewDef<any>;
-type AnyFunctionDef = AnyRemoteFunctionDef;
-/**
- * Optional presentation metadata for the domain, served verbatim on the
- * worker's `/meta` endpoint (see `../deploy/meta`) so a host UI can brand a
- * freshly-installed domain. Both the block and every field are optional.
- */
-export interface DomainManifest {
-    /** Domain logo — an inline SVG string or a `data:` URL (no extra validation). */
-    logo?: string;
-    /**
-     * Slug of one of THIS domain's own views to open first — the domain's entry
-     * surface. This is the SERVED form: a plain slug, stamped verbatim onto
-     * `/meta`. Authors don't write the slug directly — they pass the view OBJECT
-     * to `defineDomain` (see {@link DomainManifestConfig.entrypoint}), which
-     * resolves it to this slug. Pinned at app install to the `View` node at
-     * `/<origin>/views/<slug>` via the app's `entrypoint` edge.
-     */
-    entrypoint?: string;
-    /**
-     * The ROLES this domain declares — named capability identities a workspace
-     * registers when an app for this domain is installed, then assigns to users
-     * (`default: true` roles are auto-assigned to the installing user). The
-     * domain itself grants each role its resource permissions (typically in its
-     * `postInstall`); declaring a role here only names it. Slugs are validated
-     * (lowercase slug charset, unique) at `defineDomain`.
-     */
-    roles?: readonly DomainRoleDecl[];
-}
-/** One declared role of the domain (see {@link DomainManifest.roles}). */
-export interface DomainRoleDecl {
-    /** Stable role slug, unique within the domain (e.g. `"editor"`). */
-    slug: string;
-    /** Display name; defaults to the slug. */
-    name?: string;
-    /** What holding this role means — shown in permission UIs. */
-    description?: string;
-    /** Auto-assign this role to the user installing an app for this domain. */
-    default?: boolean;
-}
-/**
- * The author-facing manifest accepted by {@link defineDomain} — identical to the
- * served {@link DomainManifest} except `entrypoint` is the view OBJECT (a value
- * of the `views` map) rather than its slug. `defineDomain` resolves it to the
- * slug by identity, so a renamed or dropped view is a compile error at the
- * reference site, never a stale string (the same guarantee `postInstall` gives
- * for functions).
- */
-export interface DomainManifestConfig extends Omit<DomainManifest, 'entrypoint'> {
-    /**
-     * The view to open first — the domain's entry surface. Pass the view OBJECT
-     * from this domain's own `views` map (e.g. `entrypoint: views.welcome`).
-     * Resolved to its slug here and served as {@link DomainManifest.entrypoint}.
-     */
-    entrypoint?: AnyViewDef;
-}
-export interface DefineDomainConfig<S extends Schema, TDeps, TEnv = unknown> {
-    /** The domain schema (from `schema/`). Its `.domain` seeds the default origin. */
-    schema: S;
-    /**
-     * The domain's method implementations (from `methods/`), one per schema
-     * method. Typed against `schema` — an unimplemented or misnamed method is a
-     * compile error here.
-     */
-    methods: SchemaMethodsImpl<S, TDeps>;
-    /** Declarative genesis nodes and edges materialized with the domain at install time. */
-    core?: Core<S>;
-    /**
-     * Map the worker `env` to the handler dependency container (`ctx.deps`).
-     * Run ONCE per cold isolate per serving URL (the built app is cached), NOT
-     * per request — so it's the place to construct ports/clients once instead of
-     * re-deriving them in every handler. Its return type IS `TDeps`: type it the
-     * shape your `methods` read (e.g. `(env) => ({ platform: buildPlatform(env) })`)
-     * and the methods get the rich container, not raw env. The same value reaches
-     * view/function handlers and the `install.authorize` hook.
-     *
-     * Omit for the common case: `env` is passed straight through (`TDeps = TEnv`),
-     * so existing domains are unaffected. The function itself is imported by the
-     * generated worker from a fixed `deps` module, mirroring `methods` — wire it
-     * here so the type check binds `env → TDeps` and the adapter knows to emit it.
-     */
-    deps?: (env: TEnv, url: string) => TDeps;
-    /**
-     * The domain's Views (iframe-mountable UIs), keyed by slug. Omit when the
-     * domain has none. Each becomes a `View` node + a worker route.
-     */
-    views?: Record<string, AnyViewDef>;
-    /**
-     * The domain's standalone Functions (callables not bound to a class), keyed
-     * by slug. Omit when the domain has none.
-     */
-    functions?: Record<string, AnyFunctionDef>;
-    /**
-     * Optional presentation metadata stamped onto `/meta`. When `manifest.entrypoint`
-     * is set it MUST be a view from this domain's own `views` map — passed as the
-     * OBJECT (`entrypoint: views.welcome`), resolved to its slug here. A view that
-     * isn't in `views` is a compile error at the reference site, and the
-     * resolution throws loudly if it's somehow absent — so a typo can never dangle
-     * to a NOT_FOUND view path at install.
-     */
-    manifest?: DomainManifestConfig;
-    /**
-     * The domain's **addressing name** (the graph slug it mounts under, e.g.
-     * `'crm.acme.dev'`). Defaults to `schema.domain`. Must be a name, never a
-     * URL. This is **NOT** the cryptographic identity: the `iss` is the worker's
-     * **serving URL**, pinned by the kernel to the URL it fetched the domain at
-     * during install (and verified against that URL's JWKS). `origin` is a free
-     * addressing label, only required to be unique in the graph.
-     */
-    origin?: string;
-    /** Cross-domain deps, by origin. Verified present on the instance at install. */
-    requires?: readonly string[];
-    /**
-     * Where the Domain node physically lives in the graph TREE — an absolute tree
-     * path whose LAST segment is the origin (e.g. `'/domains/crm.acme.dev'`).
-     * Optional; defaults to `/domains/<origin>`. This moves ONLY the physical
-     * `has_parent` position: the domain's `installed_in` edge and EVERY typed
-     * address (`/:<origin>`, `/:<origin>:Class`, …) stay ROOT-mounted, so
-     * addressing is unchanged. A platform domain that must stay top-level sets its
-     * own origin path (e.g. `'/shell.astrale.ai'`).
-     */
-    path?: string;
-    /**
-     * The function the kernel runs once after install, as __SYSTEM__ — where the
-     * domain seeds itself / posts its own grants. Reference it from the `functions`
-     * map: `postInstall: functions.seed`. The SDK derives its path by identity, so a
-     * typo or a renamed key is a compile error here, never a stale string. It is
-     * always a standalone function (a domain bootstrap belongs to the domain, not to
-     * a class) under THIS domain — you never write the origin, and the kernel
-     * resolves it relative to wherever the domain is installed.
-     */
-    postInstall?: AnyFunctionDef;
-}
-export interface DomainDefinition {
-    schema: Schema;
-    methods: SchemaMethodsImpl<Schema, any>;
-    /** Declarative genesis nodes and edges, preserved through codegen and diagnostic builds. */
-    core?: Core<Schema>;
-    /**
-     * env → deps mapper, when the author supplied one. Held loosely (the worker
-     * imports the real function from its own `deps` module); the CLI reads only
-     * its PRESENCE to set `DomainInfo.hasDeps`, the codegen signal.
-     */
-    deps?: (env: any, url: string) => any;
-    views?: Record<string, ViewDef>;
-    functions?: Record<string, AnyFunctionDef>;
-    /** Presentation metadata for `/meta`, validated at definition time. */
-    manifest?: DomainManifest;
-    origin: string;
-    requires: readonly string[];
-    postInstall?: string;
-    /** Physical tree path for the Domain node; default `/domains/<origin>`. */
-    path?: string;
-}
-export declare function defineDomain<S extends Schema, TDeps, TEnv = unknown>(config: DefineDomainConfig<S, TDeps, TEnv>): DomainDefinition;
-export {};
-//# sourceMappingURL=define-domain.d.ts.map

package/dist/config/define-domain.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"define-domain.d.ts","sourceRoot":"","sources":["../../src/config/define-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAI1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAQ3D,KAAK,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;AAI9B,KAAK,cAAc,GAAG,oBAAoB,CAAA;AAE1C;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;CAClC;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC;IAC9E;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO;IACzE,kFAAkF;IAClF,MAAM,EAAE,CAAC,CAAA;IACT;;;;OAIG;IACH,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACpC,wFAAwF;IACxF,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACd;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,KAAK,KAAK,CAAA;IACxC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAClC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IAC/B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,iFAAiF;IACjF,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,cAAc,CAAA;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IAEd,OAAO,EAAE,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACnB;;;;OAIG;IAEH,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,KAAK,GAAG,CAAA;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IAC1C,uEAAuE;IACvE,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,EAClE,MAAM,EAAE,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GACzC,gBAAgB,CAoGlB"}