@astrale-os/sdk 0.4.19 → 0.5.0-beta.2

package/dist/dispatch/errors.js

@@ -1,76 +0,0 @@
-/**
- * Errors thrown by the dispatch pipeline.
- *
- * Each implements `KernelErrorClassifiable` so `kernel-api/dispatch` can
- * convert them into typed `KernelErrorPayload` values automatically.
- */
-import { KERNEL_ERROR_CODES } from '@astrale-os/kernel-api';
-/** Shape Zod issues into the `data.errors` array of a `KernelErrorPayload`. */
-function toPayloadErrors(issues) {
-    return issues.map((i) => ({ path: i.path, code: 'INVALID', message: i.message }));
-}
-export class MethodNotFoundError extends Error {
-    constructor(method) {
-        super(`Method not found: ${method}`);
-        this.name = 'MethodNotFoundError';
-    }
-    toKernelErrorPayload() {
-        return { code: KERNEL_ERROR_CODES.METHOD_NOT_FOUND, message: this.message };
-    }
-}
-export class SdkValidationError extends Error {
-    issues;
-    constructor(issues, message) {
-        super(message ?? 'Invalid params');
-        this.issues = issues;
-        this.name = 'SdkValidationError';
-    }
-    toKernelErrorPayload() {
-        return {
-            code: KERNEL_ERROR_CODES.VALIDATION_ERROR,
-            message: this.message,
-            data: { errors: toPayloadErrors(this.issues) },
-        };
-    }
-}
-/**
- * Thrown when a handler's return value (or a stream chunk) fails validation
- * against its `outputSchema`. This is a server/handler fault — the author's
- * code produced data that violates its own declared contract — so it maps to
- * `INTERNAL_ERROR` (→ HTTP 500), NOT the `VALIDATION_ERROR` (422) used for
- * bad caller input. Mirrors the kernel's `ResultValidationError`.
- */
-export class SdkResultValidationError extends Error {
-    issues;
-    ref;
-    constructor(issues, ref) {
-        super(`Function${ref ? ` "${ref}"` : ''} returned an invalid result`);
-        this.issues = issues;
-        this.ref = ref;
-        this.name = 'SdkResultValidationError';
-    }
-    toKernelErrorPayload() {
-        return {
-            code: KERNEL_ERROR_CODES.INTERNAL_ERROR,
-            message: this.message,
-            data: { errors: toPayloadErrors(this.issues) },
-        };
-    }
-}
-/**
- * Thrown by a `RemoteHandler.authorize` hook to deny a call.
- *
- * Wraps any error the hook throws — handlers can throw a plain `Error` and
- * the dispatcher converts it. Already-typed `AuthorizationDeniedError`
- * instances are passed through unchanged so callers can attach hints.
- */
-export class AuthorizationDeniedError extends Error {
-    constructor(message, cause) {
-        super(message, { cause });
-        this.name = 'AuthorizationDeniedError';
-    }
-    toKernelErrorPayload() {
-        return { code: KERNEL_ERROR_CODES.PERMISSION_DENIED, message: this.message };
-    }
-}
-//# sourceMappingURL=errors.js.map

package/dist/dispatch/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/dispatch/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAK3D,+EAA+E;AAC/E,SAAS,eAAe,CAAC,MAAyB;IAKhD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;AACnF,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,MAAc;QACxB,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;IAED,oBAAoB;QAClB,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IAC7E,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEhC,MAAM;IADjB,YACW,MAAyB,EAClC,OAAgB;QAEhB,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAA;sBAHzB,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;IAED,oBAAoB;QAClB,OAAO;YACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;YACzC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;SAC/C,CAAA;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAEtC,MAAM;IACN,GAAG;IAFd,YACW,MAAyB,EACzB,GAAY;QAErB,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAA;sBAH5D,MAAM;mBACN,GAAG;QAGZ,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;IAED,oBAAoB;QAClB,OAAO;YACL,IAAI,EAAE,kBAAkB,CAAC,cAAc;YACvC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;SAC/C,CAAA;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;IAED,oBAAoB;QAClB,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IAC9E,CAAC;CACF"}

package/dist/dispatch/execute.d.ts

@@ -1,44 +0,0 @@
-/**
- * Handler execution — pipeline step 4.
- *
- * Calls the resolved handler's `execute` with a fully assembled
- * `RemoteContext`: validated params, auth context, optional bound self,
- * typed deps, and a kernel `BoundClientSessionView`. The handler may return a
- * value, a Promise, or an async generator (for `output: 'stream'`).
- */
-import type { FnMap } from '@astrale-os/kernel-client';
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
-import type { AuthContext } from '@astrale-os/kernel-core';
-import type { Defer, Sleep } from '@astrale-os/kernel-server';
-import type { FunctionContextApi } from '../auth/function-context.js';
-import type { DomainAuthority } from '../auth/issuer-mint.js';
-import type { CallerContext, RemoteEnv } from '../method/context.js';
-import type { Step } from '../step/index.js';
-import type { SelfResult, TypedSelf } from './self.js';
-type HandlerFn = (...args: any[]) => any;
-export type ExecuteParams = {
-    /** Handler may omit `execute` when authored as a stub (spec-only binding). */
-    handler: {
-        execute?: HandlerFn;
-    };
-    /** Namespaced ref of the dispatched method — names the offending method in the
-     *  stub-leak diagnostic below (the dispatcher passes `bound.ref`). */
-    ref?: string;
-    params: Record<string, unknown>;
-    auth: AuthContext | null;
-    /** Untyped fallback ({@link withNode}) or the rich typed self ({@link withBoundNode}). */
-    self: SelfResult | TypedSelf<unknown> | undefined;
-    deps: unknown;
-    env: RemoteEnv;
-    kernel: BoundClientSessionView<FnMap> | null;
-    caller?: CallerContext;
-    /** Mint seam for identities this domain issues. */
-    domain: DomainAuthority;
-    fn: FunctionContextApi;
-    step: Step;
-    defer: Defer;
-    sleep: Sleep;
-};
-export declare function executeHandler(ctx: ExecuteParams): Promise<unknown>;
-export {};
-//# sourceMappingURL=execute.d.ts.map

package/dist/dispatch/execute.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/dispatch/execute.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAE7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACpE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAGtD,KAAK,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;AAExC,MAAM,MAAM,aAAa,GAAG;IAC1B,8EAA8E;IAC9E,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,SAAS,CAAA;KAAE,CAAA;IAChC;0EACsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;IACxB,0FAA0F;IAC1F,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;IACjD,IAAI,EAAE,OAAO,CAAA;IACb,GAAG,EAAE,SAAS,CAAA;IACd,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;IAC5C,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,mDAAmD;IACnD,MAAM,EAAE,eAAe,CAAA;IACvB,EAAE,EAAE,kBAAkB,CAAA;IACtB,IAAI,EAAE,IAAI,CAAA;IACV,KAAK,EAAE,KAAK,CAAA;IACZ,KAAK,EAAE,KAAK,CAAA;CACb,CAAA;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBzE"}

package/dist/dispatch/execute.js

@@ -1,29 +0,0 @@
-/**
- * Handler execution — pipeline step 4.
- *
- * Calls the resolved handler's `execute` with a fully assembled
- * `RemoteContext`: validated params, auth context, optional bound self,
- * typed deps, and a kernel `BoundClientSessionView`. The handler may return a
- * value, a Promise, or an async generator (for `output: 'stream'`).
- */
-export async function executeHandler(ctx) {
-    if (typeof ctx.handler.execute !== 'function') {
-        throw new Error(`executeHandler: handler${ctx.ref ? ` for "${ctx.ref}"` : ''} has no \`execute\` body — ` +
-            `this is a binding stub that should have been resolved to a remote redirect upstream.`);
-    }
-    return ctx.handler.execute({
-        params: ctx.params,
-        auth: ctx.auth,
-        self: ctx.self,
-        deps: ctx.deps,
-        env: ctx.env,
-        kernel: ctx.kernel,
-        ...(ctx.caller !== undefined ? { caller: ctx.caller } : {}),
-        domain: ctx.domain,
-        fn: ctx.fn,
-        step: ctx.step,
-        defer: ctx.defer,
-        sleep: ctx.sleep,
-    });
-}
-//# sourceMappingURL=execute.js.map

package/dist/dispatch/execute.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../src/dispatch/execute.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAsCH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAkB;IACrD,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,6BAA6B;YACvF,sFAAsF,CACzF,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;QACzB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;KACjB,CAAC,CAAA;AACJ,CAAC"}

package/dist/dispatch/identity.d.ts

@@ -1,75 +0,0 @@
-/**
- * Per-callable identity — dispatcher runtime + install-time wiring.
- *
- * Three flavors of callable get an identity per the install-time identity
- * binding, each keyed by its mount-stable semantic sub: Methods on
- * classes/interfaces (sub = MethodPath), standalone-function MEMBERS
- * (sub = FunctionPath `/:<origin>:function.<slug>`), and view MEMBERS
- * (sub = ViewPath `/:<origin>:view.<slug>`).
- *
- * At server startup the method dispatcher and the View / RemoteFunction
- * route mounter pre-compute, for every materialized callable, the
- * `RemoteIdentityConfig` they sign outbound kernel calls with. The kernel
- * then matches an existing function identity instead of provisioning a
- * generic one.
- *
- * **Single source of truth:** every helper here is a thin lens over the
- * canonical `resolveCallables` from `@astrale-os/kernel-core/domain`. The
- * kernel validates install subs against the SAME function — drift = 0
- * by construction. This closes the previous SDK-side gap where
- * `collectMethodPaths` filtered to `own|override` and silently dropped
- * `sealed`/`default` interface methods (which DO materialize as nodes).
- */
-import type { BoundMethod, CompiledDomain } from '@astrale-os/kernel-core/domain';
-import type { RemoteIdentityConfig } from '../auth/identity.js';
-import type { AnyRemoteHandler } from '../method/single.js';
-/**
- * For each materialized method node, emit its `MethodPath` (semantic,
- * layout-independent) keyed by the method's namespaced ref. Used to
- * build the install `subs` claim and to look up runtime per-method
- * subjects in `buildIdentityMap`.
- *
- * Includes every method node the kernel materializes — class own/override
- * AND interface own (sealed/default/override). Inherited (non-overriding)
- * class methods reuse the interface's node via a `method_of` edge and
- * are correctly absent here.
- */
-export declare function collectMethodPaths(compiled: CompiledDomain): Record<string, string>;
-/** `{ views, remoteFunctions }` buckets keyed by slug — the shared shape
- *  for every per-aux-callable map (paths, identity configs). */
-export type AuxBuckets<T> = {
-    views: Record<string, T>;
-    remoteFunctions: Record<string, T>;
-};
-/**
- * slug → mount-stable semantic `sub` for each aux callable MEMBER node:
- *   - standalone-function members (`kind: 'function'`) → FunctionPath;
- *   - view members (`kind: 'view'`) → ViewPath (plus any hand-authored/legacy
- *     core `View` nodes, `kind: 'core'` className `View`, keyed by their AbsolutePath).
- * The value is `resolveCallables(...).sub` — the exact subject the kernel stamped on
- * the node at install, so an outbound-signing worker matches its own function identity.
- */
-export type AuxIdentityPaths = AuxBuckets<string>;
-export declare function collectAuxIdentityPaths(compiled: CompiledDomain): AuxIdentityPaths;
-/**
- * slug → `RemoteIdentityConfig` for each auto-materialized View /
- * RemoteFunction. Built once at server startup; consumed by
- * `mountAuxiliaryRoutes` so each handler signs outbound `kernel.call(...)`
- * with its own `sub` (its FunctionPath/ViewPath). Mirrors `buildIdentityMap`.
- */
-export type AuxIdentityMap = AuxBuckets<RemoteIdentityConfig>;
-export declare function buildAuxIdentityMap(compiled: CompiledDomain, privateKey: JsonWebKey, issuer: string): AuxIdentityMap;
-/**
- * Pre-resolve per-method identity configs. Lookup is by BoundMethod instance,
- * so the dispatcher pays O(1) per call instead of re-constructing the config.
- *
- * `iss` = the worker's own **serving URL** (`issuer` arg, e.g.
- * `https://crm.test.com`) — its cryptographic identity, DECOUPLED from the
- * domain's addressing `origin` (a graph slug). The kernel stamps the same
- * value on each function node at install (it pins `iss` to the URL it fetched
- * the domain at) and verifies inbound credentials against that issuer's JWKS
- * (OIDC discovery). The function `sub` stays the origin-addressed MethodPath —
- * `sub` = which function, `iss` = who signs.
- */
-export declare function buildIdentityMap(compiled: CompiledDomain, methods: BoundMethod<AnyRemoteHandler>[], privateKey: JsonWebKey, issuer: string): Map<BoundMethod<AnyRemoteHandler>, RemoteIdentityConfig>;
-//# sourceMappingURL=identity.d.ts.map

package/dist/dispatch/identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/dispatch/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAIjF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnF;AAED;gEACgE;AAChE,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI;IAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACxB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;CACnC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;AAEjD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,cAAc,GAAG,gBAAgB,CAalF;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,oBAAoB,CAAC,CAAA;AAE7D,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,cAAc,CAWhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,WAAW,CAAC,gBAAgB,CAAC,EAAE,EACxC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC,CAmB1D"}

package/dist/dispatch/identity.js

@@ -1,101 +0,0 @@
-/**
- * Per-callable identity — dispatcher runtime + install-time wiring.
- *
- * Three flavors of callable get an identity per the install-time identity
- * binding, each keyed by its mount-stable semantic sub: Methods on
- * classes/interfaces (sub = MethodPath), standalone-function MEMBERS
- * (sub = FunctionPath `/:<origin>:function.<slug>`), and view MEMBERS
- * (sub = ViewPath `/:<origin>:view.<slug>`).
- *
- * At server startup the method dispatcher and the View / RemoteFunction
- * route mounter pre-compute, for every materialized callable, the
- * `RemoteIdentityConfig` they sign outbound kernel calls with. The kernel
- * then matches an existing function identity instead of provisioning a
- * generic one.
- *
- * **Single source of truth:** every helper here is a thin lens over the
- * canonical `resolveCallables` from `@astrale-os/kernel-core/domain`. The
- * kernel validates install subs against the SAME function — drift = 0
- * by construction. This closes the previous SDK-side gap where
- * `collectMethodPaths` filtered to `own|override` and silently dropped
- * `sealed`/`default` interface methods (which DO materialize as nodes).
- */
-import { resolveCallables } from '@astrale-os/kernel-core/domain';
-/**
- * For each materialized method node, emit its `MethodPath` (semantic,
- * layout-independent) keyed by the method's namespaced ref. Used to
- * build the install `subs` claim and to look up runtime per-method
- * subjects in `buildIdentityMap`.
- *
- * Includes every method node the kernel materializes — class own/override
- * AND interface own (sealed/default/override). Inherited (non-overriding)
- * class methods reuse the interface's node via a `method_of` edge and
- * are correctly absent here.
- */
-export function collectMethodPaths(compiled) {
-    const out = {};
-    for (const c of resolveCallables(compiled)) {
-        if (c.kind === 'method')
-            out[c.ref] = c.sub;
-    }
-    return out;
-}
-export function collectAuxIdentityPaths(compiled) {
-    const views = {};
-    const remoteFunctions = {};
-    for (const c of resolveCallables(compiled)) {
-        if (!c.slug)
-            continue;
-        if (c.kind === 'function') {
-            remoteFunctions[c.slug] = c.sub;
-        }
-        else if (c.kind === 'view' || (c.kind === 'core' && c.className === 'View')) {
-            views[c.slug] = c.sub;
-        }
-        // Methods (`kind: 'method'`) get their identity via `collectMethodPaths`.
-    }
-    return { views, remoteFunctions };
-}
-export function buildAuxIdentityMap(compiled, privateKey, issuer) {
-    const paths = collectAuxIdentityPaths(compiled);
-    const views = {};
-    for (const [slug, subject] of Object.entries(paths.views)) {
-        views[slug] = { issuer, subject, privateKey };
-    }
-    const remoteFunctions = {};
-    for (const [slug, subject] of Object.entries(paths.remoteFunctions)) {
-        remoteFunctions[slug] = { issuer, subject, privateKey };
-    }
-    return { views, remoteFunctions };
-}
-/**
- * Pre-resolve per-method identity configs. Lookup is by BoundMethod instance,
- * so the dispatcher pays O(1) per call instead of re-constructing the config.
- *
- * `iss` = the worker's own **serving URL** (`issuer` arg, e.g.
- * `https://crm.test.com`) — its cryptographic identity, DECOUPLED from the
- * domain's addressing `origin` (a graph slug). The kernel stamps the same
- * value on each function node at install (it pins `iss` to the URL it fetched
- * the domain at) and verifies inbound credentials against that issuer's JWKS
- * (OIDC discovery). The function `sub` stays the origin-addressed MethodPath —
- * `sub` = which function, `iss` = who signs.
- */
-export function buildIdentityMap(compiled, methods, privateKey, issuer) {
-    const paths = collectMethodPaths(compiled);
-    const out = new Map();
-    for (const bound of methods) {
-        const subject = paths[bound.ref];
-        if (!subject) {
-            // Under the "drift = 0" invariant every dispatched method's ref is a key
-            // in `paths`. A miss means an install/index drift — fail loudly at boot
-            // rather than signing with `bound.ref` (a namespaced ref, NOT a
-            // MethodPath sub), which would silently fail kernel identity matching at
-            // call time. Mirrors `identityFor` / `requireAuxIdentity`.
-            throw new Error(`buildIdentityMap: method "${bound.ref}" is in the dispatch index but absent ` +
-                `from resolveCallables(compiled) — no identity subject to sign with.`);
-        }
-        out.set(bound, { issuer, subject, privateKey });
-    }
-    return out;
-}
-//# sourceMappingURL=identity.js.map

package/dist/dispatch/identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/dispatch/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAKjE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAwB;IACzD,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAA;IAC7C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAmBD,MAAM,UAAU,uBAAuB,CAAC,QAAwB;IAC9D,MAAM,KAAK,GAA2B,EAAE,CAAA;IACxC,MAAM,eAAe,GAA2B,EAAE,CAAA;IAClD,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,SAAQ;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC1B,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAA;QACjC,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,CAAC;YAC9E,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAA;QACvB,CAAC;QACD,0EAA0E;IAC5E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;AACnC,CAAC;AAUD,MAAM,UAAU,mBAAmB,CACjC,QAAwB,EACxB,UAAsB,EACtB,MAAc;IAEd,MAAM,KAAK,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAyC,EAAE,CAAA;IACtD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;IAC/C,CAAC;IACD,MAAM,eAAe,GAAyC,EAAE,CAAA;IAChE,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACpE,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAwB,EACxB,OAAwC,EACxC,UAAsB,EACtB,MAAc;IAEd,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuD,CAAA;IAC1E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,yEAAyE;YACzE,wEAAwE;YACxE,gEAAgE;YAChE,yEAAyE;YACzE,2DAA2D;YAC3D,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,CAAC,GAAG,wCAAwC;gBAC5E,qEAAqE,CACxE,CAAA;QACH,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/dispatch/index.d.ts

@@ -1,7 +0,0 @@
-export { SdkDispatcher, type SdkDispatcherConfig } from './dispatcher.js';
-export { resolveMethod, buildMethodIndex, type MethodIndex } from './resolve.js';
-export { validateParams, validateResult, type ValidationResult, type ResultValidationResult, } from './validate.js';
-export { resolveSelf, withBoundNode, type SelfResult, type TypedSelf } from './self.js';
-export { executeHandler, type ExecuteParams } from './execute.js';
-export { AuthorizationDeniedError, MethodNotFoundError, SdkValidationError, SdkResultValidationError, } from './errors.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/dispatch/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dispatch/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AAChF,OAAO,EACL,cAAc,EACd,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAA;AACvF,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,aAAa,CAAA"}

package/dist/dispatch/index.js

@@ -1,7 +0,0 @@
-export { SdkDispatcher } from './dispatcher.js';
-export { resolveMethod, buildMethodIndex } from './resolve.js';
-export { validateParams, validateResult, } from './validate.js';
-export { resolveSelf, withBoundNode } from './self.js';
-export { executeHandler } from './execute.js';
-export { AuthorizationDeniedError, MethodNotFoundError, SdkValidationError, SdkResultValidationError, } from './errors.js';
-//# sourceMappingURL=index.js.map

package/dist/dispatch/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/dispatch/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4B,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAoB,MAAM,cAAc,CAAA;AAChF,OAAO,EACL,cAAc,EACd,cAAc,GAGf,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAmC,MAAM,WAAW,CAAA;AACvF,OAAO,EAAE,cAAc,EAAsB,MAAM,cAAc,CAAA;AACjE,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,aAAa,CAAA"}

package/dist/dispatch/resolve.d.ts

@@ -1,27 +0,0 @@
-/**
- * Method resolution — the index the dispatcher queries on every call.
- *
- * Owns both the index's construction and its lookup contract:
- * - `buildMethodIndex` is called once at server startup.
- * - `resolveMethod` is called once per inbound call.
- *
- * Each method is indexed under its `BoundMethod.ref`
- * (`namespace.Owner.method.name`) and under a short alias `Owner.name`.
- * The short alias is only registered when it is unambiguous — two methods
- * whose owners live in different namespaces (e.g. class vs interface) and
- * share the same local name would collide, and we refuse to register the
- * ambiguous key rather than silently overwriting.
- *
- * Inbound names may arrive as `Path`, full `ref`, short alias, a tree path
- * `/<domain>/<namespace.Owner>/<method>`, or the typed colon-form MethodPath
- * `/:<domain>:<namespace.Owner>:<method>` (what the kernel forwards when a
- * caller addresses the method in `:`-delimited form). All shapes normalize to
- * the same lookup key.
- */
-import type { Path } from '@astrale-os/kernel-core';
-import type { BoundMethod } from '@astrale-os/kernel-core/domain';
-import type { AnyRemoteHandler } from '../method/single.js';
-export type MethodIndex = Map<string, BoundMethod<AnyRemoteHandler>>;
-export declare function buildMethodIndex(methods: BoundMethod<AnyRemoteHandler>[]): MethodIndex;
-export declare function resolveMethod(index: MethodIndex, name: Path | string): BoundMethod<AnyRemoteHandler> | null;
-//# sourceMappingURL=resolve.d.ts.map

package/dist/dispatch/resolve.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/dispatch/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAE3D,MAAM,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAA;AAKpE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,gBAAgB,CAAC,EAAE,GAAG,WAAW,CAmBtF;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,IAAI,GAAG,MAAM,GAClB,WAAW,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAEtC"}

package/dist/dispatch/resolve.js

@@ -1,65 +0,0 @@
-/**
- * Method resolution — the index the dispatcher queries on every call.
- *
- * Owns both the index's construction and its lookup contract:
- * - `buildMethodIndex` is called once at server startup.
- * - `resolveMethod` is called once per inbound call.
- *
- * Each method is indexed under its `BoundMethod.ref`
- * (`namespace.Owner.method.name`) and under a short alias `Owner.name`.
- * The short alias is only registered when it is unambiguous — two methods
- * whose owners live in different namespaces (e.g. class vs interface) and
- * share the same local name would collide, and we refuse to register the
- * ambiguous key rather than silently overwriting.
- *
- * Inbound names may arrive as `Path`, full `ref`, short alias, a tree path
- * `/<domain>/<namespace.Owner>/<method>`, or the typed colon-form MethodPath
- * `/:<domain>:<namespace.Owner>:<method>` (what the kernel forwards when a
- * caller addresses the method in `:`-delimited form). All shapes normalize to
- * the same lookup key.
- */
-const NAMESPACE_PREFIXES = ['class.', 'interface.'];
-const METHOD_INFIX = 'method';
-export function buildMethodIndex(methods) {
-    const index = new Map();
-    const shortFormAmbiguous = new Set();
-    for (const m of methods) {
-        index.set(m.ref, m);
-        const shortForm = `${m.owner}.${m.method}`;
-        if (shortFormAmbiguous.has(shortForm))
-            continue;
-        const existing = index.get(shortForm);
-        if (existing && existing !== m) {
-            index.delete(shortForm);
-            shortFormAmbiguous.add(shortForm);
-            continue;
-        }
-        index.set(shortForm, m);
-    }
-    return index;
-}
-export function resolveMethod(index, name) {
-    return index.get(normalizeMethod(name)) ?? null;
-}
-function normalizeMethod(name) {
-    const raw = typeof name === 'string' ? name : name.raw;
-    if (!raw.startsWith('/'))
-        return raw;
-    // Typed colon-form MethodPath (`/:<domain>:<owner>:<method>`) vs. tree
-    // slash-form (`/<domain>/<owner>/<method>`). The owner segment carries its own
-    // `.` (e.g. `interface.NoteOps`), so the path separator is unambiguous.
-    const separator = raw.startsWith('/:') ? ':' : '/';
-    const segments = raw
-        .replace(/^\/+/, '')
-        .split(separator)
-        .filter((s) => s.length > 0);
-    if (segments.length < 3)
-        return raw;
-    const owner = segments[segments.length - 2];
-    const method = segments[segments.length - 1];
-    if (NAMESPACE_PREFIXES.some((p) => owner.startsWith(p))) {
-        return `${owner}.${METHOD_INFIX}.${method}`;
-    }
-    return `${owner}.${method}`;
-}
-//# sourceMappingURL=resolve.js.map

package/dist/dispatch/resolve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/dispatch/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,MAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAU,CAAA;AAC5D,MAAM,YAAY,GAAG,QAAQ,CAAA;AAE7B,MAAM,UAAU,gBAAgB,CAAC,OAAwC;IACvE,MAAM,KAAK,GAAgB,IAAI,GAAG,EAAE,CAAA;IACpC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAA;IAE5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAEnB,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;QAC1C,IAAI,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAQ;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACrC,IAAI,QAAQ,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC/B,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACvB,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACjC,SAAQ;QACV,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IACzB,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAkB,EAClB,IAAmB;IAEnB,OAAO,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAA;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,IAAmB;IAC1C,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;IACtD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAA;IACpC,uEAAuE;IACvE,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;IAClD,MAAM,QAAQ,GAAG,GAAG;SACjB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,KAAK,CAAC,SAAS,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC9B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAA;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;IAC7C,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO,GAAG,KAAK,IAAI,YAAY,IAAI,MAAM,EAAE,CAAA;IAC7C,CAAC;IACD,OAAO,GAAG,KAAK,IAAI,MAAM,EAAE,CAAA;AAC7B,CAAC"}

package/dist/dispatch/self.d.ts

@@ -1,51 +0,0 @@
-/**
- * Self resolution stays parse-only: `_self` becomes a Path/IdPath with no graph
- * read. The dispatcher later attaches lazy node()/call helpers once it has a kernel.
- */
-import type { BoundNode, InstanceDispatch, NodeBinder } from '@astrale-os/kernel-client/schema';
-import type { Node } from '@astrale-os/kernel-core/graph';
-import type { Schema } from '@astrale-os/kernel-dsl';
-import { Path, type NodeId } from '@astrale-os/kernel-core';
-import type { Kernel } from '../method/context.js';
-/** The node a non-static method runs on — its full record, id guaranteed. */
-export type ResolvedSelfNode = Node & {
-    id: NodeId;
-};
-/** The bare parse of a self target — no kernel, no fetch. */
-export type ParsedSelf = {
-    path: Path;
-    /** Set when `path` is an `IdPath` (i.e. `@<id>::method` calls). */
-    id?: NodeId;
-};
-export type SelfResult = ParsedSelf & {
-    /**
-     * Lazy point-in-time self read. Memoized per dispatch; `{ reload: true }`
-     * forces a fresh `function.get`.
-     */
-    node(opts?: {
-        reload?: boolean;
-    }): Promise<ResolvedSelfNode>;
-};
-/** Schema-typed self: short-keyed props and typed same-instance call proxy. */
-export type TypedSelf<D, S extends Schema = Schema> = ParsedSelf & {
-    /**
-     * Fetch THIS node as a typed `BoundNode<D>`. Memoized exactly like
-     * {@link SelfResult.node} — one in-flight `function.get`, rejection-clearing,
-     * `{ reload: true }` refetches — so the zero-extra-graph-read dispatch
-     * invariant holds: nothing is read until called, then at most once.
-     */
-    node(opts?: {
-        reload?: boolean;
-    }): Promise<BoundNode<D, S>>;
-    /** Own instance methods — typed, address-only (`<selfPath>::method`), no read. */
-    readonly call: InstanceDispatch<D>;
-};
-export declare function resolveSelf(ref: string): ParsedSelf;
-/** Attach memoized node(); unauthenticated contexts reject instead of reading. */
-export declare function withNode(parsed: ParsedSelf, kernel: Kernel | null): SelfResult;
-/**
- * Schema-typed self helper: lazy BoundNode plus address-only call proxy. With no
- * kernel, both node() and call thunks fail loudly.
- */
-export declare function withBoundNode<S extends Schema>(parsed: ParsedSelf, kernel: Kernel | null, binder: NodeBinder<S>, typeName: string): TypedSelf<unknown, S>;
-//# sourceMappingURL=self.d.ts.map

package/dist/dispatch/self.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"self.d.ts","sourceRoot":"","sources":["../../src/dispatch/self.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAEV,SAAS,EACT,gBAAgB,EAChB,UAAU,EAIX,MAAM,kCAAkC,CAAA;AACzC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAA;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAOpD,OAAO,EAAa,IAAI,EAAE,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAKtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAElD,6EAA6E;AAC7E,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpD,6DAA6D;AAC7D,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,IAAI,CAAA;IACV,mEAAmE;IACnE,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG;IACpC;;;OAGG;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAC7D,CAAA;AAED,+EAA+E;AAC/E,MAAM,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,UAAU,GAAG;IACjE;;;;;OAKG;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3D,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAA;CACnC,CAAA;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAGnD;AAED,kFAAkF;AAClF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,UAAU,CAa9E;AA6BD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,EAC5C,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EACrB,QAAQ,EAAE,MAAM,GACf,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAiCvB"}