@econ-v1/domain 6.7.0 → 6.10.0

package/dist/services/onboarding-checkpoint-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-checkpoint-store.d.ts","sourceRoot":"","sources":["../../src/services/onboarding-checkpoint-store.js"],"names":[],"mappings":"AA8EA;;;GAGG;AACH,6DAFa,+BAA+B,CAe3C;AA9FD,0GAA0G;AAC1G;IASE;;OAEG;IACH,qBAFW,gCAAgC,EAK1C;IACD;;OAEG;IACH,SAFa,IAAI,CAIhB;IACD;;OAEG;IACH,QAFa,oBAAoB,GAAG,SAAS,CA4B5C;IACD;;;OAGG;IACH,kBAHW,oBAAoB,GAClB,IAAI,CAoBhB;;CACF;8CA5Ea,OAAO,gBAAgB,EAAE,+BAA+B;;;;;;;;;;;;;;;;;eA6IxD,MAAM;oBAEN,MAAM;YACN,MAAM;iBACN,MAAM;sBACN,MAAM;;;SAIN,MAAM,MAAM;aACZ,+BAA+B"}

package/dist/services/onboarding-flow-service.d.ts

@@ -0,0 +1,180 @@
+/** @type {readonly ["join-qr", "open-browser", "choose-network", "network-password", "handoff", "way-back", "install", "match-code", "invitation", "identity", "trusted"]} */
+export const ONBOARDING_FLOW_STEP_IDS: readonly ["join-qr", "open-browser", "choose-network", "network-password", "handoff", "way-back", "install", "match-code", "invitation", "identity", "trusted"];
+export class OnboardingFlowService {
+    /**
+     * @param {OnboardingFlowServiceOptions} options
+     */
+    constructor(options: OnboardingFlowServiceOptions);
+    /**
+     * @returns {OnboardingFlowRow}
+     */
+    view(): OnboardingFlowRow;
+    /**
+     * @returns {void}
+     */
+    start(): void;
+    /**
+     * @returns {Promise<void>}
+     */
+    advance(): Promise<void>;
+    /**
+     * @param {"continue-in-browser" | "installed"} decision
+     * @returns {Promise<void>}
+     */
+    installDecision(decision: "continue-in-browser" | "installed"): Promise<void>;
+    /**
+     * @returns {OnboardingFlowLcdScreen}
+     */
+    lcdScreen(): OnboardingFlowLcdScreen;
+    /**
+     * @param {string} componentId
+     * @returns {Promise<void>}
+     */
+    lcdTap(componentId: string): Promise<void>;
+    /**
+     * @returns {Promise<void>}
+     */
+    rescanNetworks(): Promise<void>;
+    /**
+     * @param {string} code
+     * @returns {Promise<void>}
+     */
+    redeemInvitation(code: string): Promise<void>;
+    /**
+     * @param {string} ssid
+     * @param {OnboardingFlowWifiSecurity} security
+     * @returns {Promise<void>}
+     */
+    selectNetwork(ssid: string, security: OnboardingFlowWifiSecurity): Promise<void>;
+    /**
+     * @returns {Promise<void>}
+     */
+    reselectNetwork(): Promise<void>;
+    /**
+     * @returns {Promise<void>}
+     */
+    skipInvitation(): Promise<void>;
+    /**
+     * @param {OwnerClaimIdentity} identity
+     * @returns {Promise<void>}
+     */
+    submitIdentity(identity: OwnerClaimIdentity): Promise<void>;
+    /**
+     * @param {string} secret
+     * @returns {Promise<void>}
+     */
+    submitNetworkPassword(secret: string): Promise<void>;
+    /**
+     * @returns {Promise<void>}
+     */
+    retryApproval(): Promise<void>;
+    /**
+     * @returns {void}
+     */
+    cancel(): void;
+    /**
+     * @returns {void}
+     */
+    tick(): void;
+    #private;
+}
+export type OnboardingAccessCodeStore = import("@econ-v1/ports").OnboardingAccessCodeStore;
+export type OnboardingPresencePhase = import("@econ-v1/ports").OnboardingPresencePhase;
+export type OnboardingPresencePort = import("@econ-v1/ports").OnboardingPresencePort;
+export type InviteRedemptionService = import("./invite-redemption-service.js").InviteRedemptionService;
+export type LcdDecisionService = import("./lcd-decision-service.js").LcdDecisionService;
+export type OnboardingCheckpointStore = import("./onboarding-checkpoint-store.js").OnboardingCheckpointStore;
+export type OwnerClaimIdentity = import("./owner-claim-service.js").OwnerClaimIdentity;
+export type OwnerClaimService = import("./owner-claim-service.js").OwnerClaimService;
+export type WifiProvisioningService = import("./wifi-provisioning-service.js").WifiProvisioningService;
+export type OnboardingFlowStepId = (typeof ONBOARDING_FLOW_STEP_IDS)[number];
+export type OnboardingFlowPhase = "connect" | "install" | "secure" | "identify" | "ready";
+export type OnboardingFlowLcdScreenId = "onboard_qr" | "onboard_open_browser" | "onboard_home_qr" | "onboard_wifi_setup" | "onboard_wifi_joined" | "onboard_working" | "onboard_code" | "onboard_trusted" | "onboard_rejected";
+export type OnboardingFlowWifiSecurity = "open" | "wep" | "wpa2" | "wpa3";
+export type OnboardingFlowApprovalState = "waiting" | "approved" | "rejected" | "expired" | "cancelled";
+/**
+ * Access-code rail (2026-08-10 design): `code-already-bound`/`access-code-invalid` are the
+ * node's outright refusal of this device's claim — the code is already bound to a different
+ * device, or the supplied/missing code did not match.
+ */
+export type OnboardingFlowReasonCode = "approval-expired" | "approval-rejected" | "wifi-credentials-rejected" | "wifi-scan-failed" | "wifi-unreachable" | "invitation-invalid" | "claim-failed" | "code-already-bound" | "access-code-invalid";
+export type OnboardingFlowRow = OnboardingFlowRowBase & ({
+    readonly networks: readonly OnboardingFlowNetwork[];
+    readonly scanning: boolean;
+    readonly stepId: "choose-network";
+} | {
+    readonly security: OnboardingFlowWifiSecurity;
+    readonly ssid: string;
+    readonly stepId: "network-password";
+} | {
+    readonly approvalState: OnboardingFlowApprovalState;
+    readonly digits: readonly string[];
+    readonly remainingSeconds: number;
+    readonly stepId: "match-code";
+} | {
+    readonly inviteRequired: boolean;
+    readonly stepId: "invitation";
+} | {
+    readonly displayName: string;
+    readonly displayNameLocked: boolean;
+    readonly stepId: "identity";
+    readonly submitting: boolean;
+} | {
+    readonly sessionEstablished: boolean;
+    readonly stepId: "trusted";
+} | {
+    readonly ssid: string;
+    readonly stepId: "handoff";
+} | {
+    readonly stepId: Exclude<OnboardingFlowStepId, "choose-network" | "handoff" | "identity" | "invitation" | "match-code" | "network-password" | "trusted">;
+});
+export type OnboardingFlowClaimPort = Pick<OwnerClaimService, "awaitConfirmation" | "cancel" | "completeClaim" | "prepareClaim">;
+export type OnboardingFlowInvitePort = Pick<InviteRedemptionService, "redeem">;
+export type OnboardingFlowWifiPort = Pick<WifiProvisioningService, "awaitHandoff" | "awaitReconnect" | "configure" | "scan" | "status">;
+export type OnboardingFlowLcdPort = Pick<LcdDecisionService, "confirm" | "reject">;
+export type OnboardingFlowNetwork = {
+    security: OnboardingFlowWifiSecurity;
+    signal: number;
+    ssid: string;
+};
+export type OnboardingFlowRowBase = {
+    lcdScreenId: OnboardingFlowLcdScreenId;
+    phase: OnboardingFlowPhase;
+    reasonCode?: OnboardingFlowReasonCode;
+    stepIndex: number;
+    totalSteps: number;
+};
+export type OnboardingFlowLcdScreen = {
+    awaitingNode: boolean;
+    physicalTapOnly: boolean;
+    screenId: OnboardingFlowLcdScreenId;
+    state: Readonly<Record<string, number | string>>;
+};
+export type OnboardingFlowServiceOptions = {
+    /**
+     * The onboarding access-code rail (2026-08-10 design): scanning the step-6 QR carries a short
+     * code that becomes this claim attempt's physical-presence proof, replacing the match-code
+     * screen entirely. A non-null `read()` at `start()` time LATCHES the flow into access-code
+     * mode for its whole lifetime — see `#accessCodeMode`'s own doc comment. Required, not
+     * optional: every composition must decide explicitly, even if that decision is "wire a store
+     * that never holds a code" (a headless or test composition).
+     */
+    accessCodes: OnboardingAccessCodeStore;
+    checkpoints: Pick<OnboardingCheckpointStore, "clear" | "read" | "write">;
+    claim: OnboardingFlowClaimPort;
+    invitationRequired?: () => boolean;
+    invitationsEnabled: () => boolean;
+    invites: OnboardingFlowInvitePort;
+    lcd?: OnboardingFlowLcdPort;
+    now: () => string;
+    presence?: OnboardingPresencePort;
+    publish: (stepId: OnboardingFlowStepId) => void;
+    wifi: OnboardingFlowWifiPort;
+};
+export type OnboardingFlowStep = {
+    gate?: "invitations";
+    id: OnboardingFlowStepId;
+    lcdScreenId: OnboardingFlowLcdScreenId;
+    phase: OnboardingFlowPhase;
+};
+//# sourceMappingURL=onboarding-flow-service.d.ts.map

package/dist/services/onboarding-flow-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-flow-service.d.ts","sourceRoot":"","sources":["../../src/services/onboarding-flow-service.js"],"names":[],"mappings":"AAYA,8KAA8K;AAC9K,uCADW,SAAS,CAAC,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,CAaxK;AAuDF;IA4EE;;OAEG;IACH,qBAFW,4BAA4B,EActC;IACD;;OAEG;IACH,QAFa,iBAAiB,CAiE7B;IACD;;OAEG;IACH,SAFa,IAAI,CA6EhB;IACD;;OAEG;IACH,WAFa,OAAO,CAAC,IAAI,CAAC,CAoBzB;IACD;;;OAGG;IACH,0BAHW,qBAAqB,GAAG,WAAW,GACjC,OAAO,CAAC,IAAI,CAAC,CAMzB;IACD;;OAEG;IACH,aAFa,uBAAuB,CAUnC;IACD;;;OAGG;IACH,oBAHW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAsBzB;IACD;;OAEG;IACH,kBAFa,OAAO,CAAC,IAAI,CAAC,CAKzB;IACD;;;OAGG;IACH,uBAHW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CA4BzB;IACD;;;;OAIG;IACH,oBAJW,MAAM,YACN,0BAA0B,GACxB,OAAO,CAAC,IAAI,CAAC,CAUzB;IACD;;OAEG;IACH,mBAFa,OAAO,CAAC,IAAI,CAAC,CAKzB;IACD;;OAEG;IACH,kBAFa,OAAO,CAAC,IAAI,CAAC,CAYzB;IACD;;;OAGG;IACH,yBAHW,kBAAkB,GAChB,OAAO,CAAC,IAAI,CAAC,CAiDzB;IACD;;;OAGG;IACH,8BAHW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAgCzB;IACD;;OAEG;IACH,iBAFa,OAAO,CAAC,IAAI,CAAC,CAOzB;IACD;;OAEG;IACH,UAFa,IAAI,CA4BhB;IACD;;OAEG;IACH,QAFa,IAAI,CAiBhB;;CAuUF;wCAj6Ba,OAAO,gBAAgB,EAAE,yBAAyB;sCAClD,OAAO,gBAAgB,EAAE,uBAAuB;qCAChD,OAAO,gBAAgB,EAAE,sBAAsB;sCAC/C,OAAO,gCAAgC,EAAE,uBAAuB;iCAChE,OAAO,2BAA2B,EAAE,kBAAkB;wCACtD,OAAO,kCAAkC,EAAE,yBAAyB;iCACpE,OAAO,0BAA0B,EAAE,kBAAkB;gCACrD,OAAO,0BAA0B,EAAE,iBAAiB;sCACpD,OAAO,gCAAgC,EAAE,uBAAuB;mCA86BhE,CAAC,OAAO,wBAAwB,EAAE,MAAM,CAAC;kCACzC,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO;wCAEtD,YAAY,GACpB,sBAAsB,GACtB,iBAAiB,GACjB,oBAAoB,GACpB,qBAAqB,GACrB,iBAAiB,GACjB,cAAc,GACd,iBAAiB,GACjB,kBAAkB;yCAEX,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM;0CAE/B,SAAS,GACjB,UAAU,GACV,UAAU,GACV,SAAS,GACT,WAAW;;;;;;uCAMH,kBAAkB,GAC1B,mBAAmB,GACnB,2BAA2B,GAC3B,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,cAAc,GACd,oBAAoB,GACpB,qBAAqB;gCAGf,qBAAqB,GAAG,CAAC;IACrC,QAAc,CAAC,QAAQ,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC1D,QAAc,CAAC,QAAQ,EAAE,OAAO,CAAC;IACjC,QAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,GACC;IACN,QAAc,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IACpD,QAAc,CAAC,IAAI,EAAE,MAAM,CAAC;IAC5B,QAAc,CAAC,MAAM,EAAE,kBAAkB,CAAC;CACrC,GACC;IACN,QAAc,CAAC,aAAa,EAAE,2BAA2B,CAAC;IAC1D,QAAc,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC;IACxC,QAAc,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B,GACC;IACN,QAAc,CAAC,cAAc,EAAE,OAAO,CAAC;IACvC,QAAc,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B,GACC;IACN,QAAc,CAAC,WAAW,EAAE,MAAM,CAAC;IACnC,QAAc,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAC1C,QAAc,CAAC,MAAM,EAAE,UAAU,CAAC;IAClC,QAAc,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B,GACC;IACN,QAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC;IAC3C,QAAc,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B,GACC;IACN,QAAc,CAAC,IAAI,EAAE,MAAM,CAAC;IAC5B,QAAc,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B,GACC;IACN,QAAc,CAAC,MAAM,EAAE,OAAO,CACtB,oBAAoB,EAClB,gBAAgB,GAChB,SAAS,GACT,UAAU,GACV,YAAY,GACZ,YAAY,GACZ,kBAAkB,GAClB,SAAS,CACZ,CAAC;CACH,CAAC;sCAGM,IAAI,CACZ,iBAAiB,EACrB,mBAAuB,GAAG,QAAQ,GAAG,eAAe,GAAG,cAAc,CAClE;uCAEU,IAAI,CAAC,uBAAuB,EAAE,QAAQ,CAAC;qCAExC,IAAI,CACZ,uBAAuB,EAC3B,cAAkB,GAAG,gBAAgB,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,CACpE;oCAEU,IAAI,CAAC,kBAAkB,EAAE,SAAS,GAAG,QAAQ,CAAC;;cAG9C,0BAA0B;YAC1B,MAAM;UACN,MAAM;;;iBAIN,yBAAyB;WACzB,mBAAmB;iBACnB,wBAAwB;eACxB,MAAM;gBACN,MAAM;;;kBAIN,OAAO;qBACP,OAAO;cACP,yBAAyB;WACzB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;;;;;;;;;;;iBAIzC,yBAAyB;iBAMzB,IAAI,CAAC,yBAAyB,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;WAC3D,uBAAuB;yBACvB,MAAM,OAAO;wBACb,MAAM,OAAO;aACb,wBAAwB;UACxB,qBAAqB;SACrB,MAAM,MAAM;eACZ,sBAAsB;aACtB,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI;UACtC,sBAAsB;;;WAItB,aAAa;QACb,oBAAoB;iBACpB,yBAAyB;WACzB,mBAAmB"}

package/dist/services/onboarding-status-service.d.ts

@@ -1,46 +1,29 @@
-import type { HomeNodeClient } from "@econ-v1/ports";
-/**
- * The #1815 onboarding-status coordinator (Tasks B+C). Derives which shell surface an
- * unclaimed/claimed/unreachable node should show, so onboarding can mount by default for a
- * fresh (unclaimed) node instead of only behind the `?onboarding=1` dev flag
- * (`docs/superpowers/plans/2026-07-26-client-node-onboarding-status-coordinator.md`).
- *
- * Derivation order (fail-safe: an unrecognized outcome never invents "ready" or
- * "needs-onboarding" — it falls back to `needs-pairing`, the pre-#1815 default path):
- *   1. The browser already holds a valid device session → `ready` (never calls the node).
- *   2. The node is reachable and reports `claimed: false` (no owner yet) → `needs-onboarding`,
- *      scenario `new` (first-owner setup creates the owner).
- *   3. The node is reachable and reports `claimed: true` (has an owner) → `needs-pairing`
- *      (additional-device pairing — the existing default behavior).
- *   4. The node has not been reached at all (a `TransportError` from `node.invoke`, e.g. no
- *      route/candidate promoted yet) → `bootstrap-required` (drive discovery first).
- *   5. Any other failure or an unrecognized response shape → `needs-pairing` (no regression
- *      from the pre-#1815 default — the shell still shows the pairing gate, which handles
- *      both "already paired" and "not yet paired" on its own).
- */
+export class OnboardingStatusService {
+    /** @param {OnboardingStatusServiceOptions} options */
+    constructor(options: OnboardingStatusServiceOptions);
+    /** Synchronous read of the last flag the node reported. Injected into
+     * `OnboardingFlowService` as a getter so a value arriving after boot still takes effect. */
+    /** @returns {boolean} */
+    invitationsEnabled(): boolean;
+    /** @returns {Promise<OnboardingLifecycleStatusRow>} */
+    status(): Promise<OnboardingLifecycleStatusRow>;
+    #private;
+}
 export type OnboardingLifecycleState = "bootstrap-required" | "needs-onboarding" | "needs-pairing" | "ready";
-export interface OnboardingLifecycleStatusRow {
+export type OnboardingLifecycleStatusRow = {
     readonly id: "onboarding-status";
-    /** Present only when `state === "needs-onboarding"` — always `"new"` today (first-owner
-     * setup); a future scenario would be added here, not overloaded onto this field. */
+    readonly invitationsEnabled: boolean;
     readonly scenario?: "new";
     readonly state: OnboardingLifecycleState;
-}
-/** The subset of `GET /api/auth/onboarding-status`'s wire shape this service reads. */
-export interface OnboardingStatusWire {
+};
+export type OnboardingStatusWire = {
     readonly claimed?: unknown;
-}
-export interface OnboardingStatusServiceOptions {
-    /** Synchronous read of whether the browser currently holds an established device session
-     * (`DeviceSessionClient.currentSession() !== undefined` in the composition root). Kept as
-     * a plain predicate — rather than this service depending on `DeviceSessionClient` itself —
-     * so the service stays platform-free and trivially fakeable in tests. */
+    readonly invitations_enabled?: unknown;
+};
+export type OnboardingStatusServiceOptions = {
     readonly hasActiveSession: () => boolean;
+    readonly locallyOnboarded?: () => Promise<boolean>;
     readonly node: Pick<HomeNodeClient, "invoke">;
-}
-export declare class OnboardingStatusService {
-    #private;
-    constructor(options: OnboardingStatusServiceOptions);
-    status(): Promise<OnboardingLifecycleStatusRow>;
-}
+};
+import type { HomeNodeClient } from "@econ-v1/ports";
 //# sourceMappingURL=onboarding-status-service.d.ts.map

package/dist/services/onboarding-status-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding-status-service.d.ts","sourceRoot":"","sources":["../../src/services/onboarding-status-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIrD;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,wBAAwB,GAChC,oBAAoB,GACpB,kBAAkB,GAClB,eAAe,GACf,OAAO,CAAC;AAEZ,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC;IACjC;wFACoF;IACpF,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;CAC1C;AAED,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;6EAGyE;IACzE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,OAAO,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;CAC/C;AAED,qBAAa,uBAAuB;;gBAItB,OAAO,EAAE,8BAA8B;IAK7C,MAAM,IAAI,OAAO,CAAC,4BAA4B,CAAC;CAoBtD"}
+{"version":3,"file":"onboarding-status-service.d.ts","sourceRoot":"","sources":["../../src/services/onboarding-status-service.js"],"names":[],"mappings":"AAOA;IAQI,sDAAsD;IACtD,qBADY,8BAA8B,EAKzC;IACD;gGAC4F;IAC5F,yBAAyB;IACzB,sBADc,OAAO,CAGpB;IACD,uDAAuD;IACvD,UADc,OAAO,CAAC,4BAA4B,CAAC,CAmClD;;CACJ;uCA7DgB,oBAAoB,GAAG,kBAAkB,GAAG,eAAe,GAAG,OAAO;2CACvE;IAAE,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;CAAE;mCAChJ;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAAE;6CACvE;IAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,OAAO,CAAC;IAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;CAAE;oCAJ3H,gBAAgB"}

package/dist/services/outbox-service.d.ts

@@ -1,47 +1,123 @@
-import { type OutboxEntry, type OutboxIntentInput } from "../models/outbox.js";
-export interface OutboxPersistence {
-    create(entry: OutboxEntry): Promise<void>;
-    delete(id: string): Promise<void>;
-    list(domain?: string): Promise<readonly OutboxEntry[]>;
-    read(id: string): Promise<OutboxEntry | undefined>;
-    update(entry: OutboxEntry): Promise<void>;
-}
-export interface OutboxServiceOptions {
-    readonly maxAttempts?: number;
-    readonly now?: () => string;
-}
-export interface ClaimOptions {
-    readonly leaseMs?: number;
-    readonly now?: string;
-    readonly revalidateAuthoritative?: () => Promise<boolean>;
-}
-export interface FailureOptions {
-    readonly now?: string;
-    readonly owner?: string;
-    readonly retryable: boolean;
-}
-export declare class OutboxIdempotencyConflictError extends Error {
-    readonly idempotencyKey: string;
+/**
+ * @extends {Error}
+ */
+export class OutboxIdempotencyConflictError extends Error {
+    /**
+   * @param {string} idempotencyKey
+   */
     constructor(idempotencyKey: string);
+    /**
+   * @readonly
+   * @type {string}
+   */
+    readonly idempotencyKey: string;
 }
-export declare class OutboxTransitionError extends Error {
+/**
+ * @extends {Error}
+ */
+export class OutboxTransitionError extends Error {
+    /**
+   * @param {string} message
+   */
     constructor(message: string);
 }
-export declare class OutboxRevalidationRequiredError extends OutboxTransitionError {
-    constructor(id: string);
+/**
+ * @extends {OutboxTransitionError}
+ */
+export class OutboxRevalidationRequiredError extends OutboxTransitionError {
 }
-export declare class OutboxService {
-    #private;
+export class OutboxService {
+    /**
+   * @param {OutboxPersistence} persistence
+   * @param {OutboxServiceOptions} [options]
+   */
     constructor(persistence: OutboxPersistence, options?: OutboxServiceOptions);
+    /**
+   * @param {OutboxIntentInput} input
+   * @returns {Promise<OutboxEntry>}
+   */
     enqueue(input: OutboxIntentInput): Promise<OutboxEntry>;
+    /**
+   * @param {string} domain
+   * @param {string} owner
+   * @param {ClaimOptions} [options]
+   * @returns {Promise<OutboxEntry | undefined>}
+   */
     claimNext(domain: string, owner: string, options?: ClaimOptions): Promise<OutboxEntry | undefined>;
+    /**
+   * @param {string} id
+   * @param {string} owner
+   * @returns {Promise<OutboxEntry>}
+   */
     acknowledge(id: string, owner: string, now?: string): Promise<OutboxEntry>;
+    /**
+   * @param {string} id
+   * @param {string} reason
+   * @param {FailureOptions} options
+   * @returns {Promise<OutboxEntry>}
+   */
     fail(id: string, reason: string, options: FailureOptions): Promise<OutboxEntry>;
+    /**
+   * @param {string} id
+   * @param {string} reason
+   * @param {string} [owner]
+   * @returns {Promise<OutboxEntry>}
+   */
     conflict(id: string, reason: string, owner?: string, now?: string): Promise<OutboxEntry>;
+    /**
+   * @param {string} id
+   * @returns {Promise<boolean>}
+   */
     cancel(id: string): Promise<boolean>;
+    /**
+   * @param {string} [domain]
+   * @returns {Promise<number>}
+   */
     recoverExpiredLeases(now?: string, domain?: string): Promise<number>;
+    /**
+   * @private
+   * @param {string} id
+   * @returns {Promise<OutboxEntry>}
+   */
     private requireEntry;
+    /**
+   * @private
+   * @param {OutboxEntry} entry
+   * @param {string} owner
+   * @returns {void}
+   */
     private assertInflightOwner;
+    /**
+   * @private
+   * @param {OutboxEntry} current
+   * @param {Omit<Partial<OutboxEntry>, "lease"> & { readonly lease?: OutboxEntry["lease"]; readonly state: OutboxState; }} changes
+   * @returns {Promise<OutboxEntry>}
+   */
     private save;
+    #private;
 }
+export type OutboxEntry = import("../models/outbox.js").OutboxEntry;
+export type OutboxIntentInput = import("../models/outbox.js").OutboxIntentInput;
+export type OutboxState = import("../models/outbox.js").OutboxState;
+export type OutboxPersistence = {
+    create(entry: OutboxEntry): Promise<void>;
+    delete(id: string): Promise<void>;
+    list(domain?: string): Promise<readonly OutboxEntry[]>;
+    read(id: string): Promise<OutboxEntry | undefined>;
+    update(entry: OutboxEntry): Promise<void>;
+};
+export type OutboxServiceOptions = {
+    readonly maxAttempts?: number;
+    readonly now?: () => string;
+};
+export type ClaimOptions = {
+    readonly leaseMs?: number;
+    readonly now?: string;
+    readonly revalidateAuthoritative?: () => Promise<boolean>;
+};
+export type FailureOptions = {
+    readonly now?: string;
+    readonly owner?: string;
+    readonly retryable: boolean;
+};
 //# sourceMappingURL=outbox-service.d.ts.map

package/dist/services/outbox-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"outbox-service.d.ts","sourceRoot":"","sources":["../../src/services/outbox-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EAGvB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,cAAc,EAAE,MAAM;CAKnC;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,+BAAgC,SAAQ,qBAAqB;gBAC5D,EAAE,EAAE,MAAM;CAIvB;AAED,qBAAa,aAAa;;gBAKZ,WAAW,EAAE,iBAAiB,EAAE,OAAO,GAAE,oBAAyB;IASxE,OAAO,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IAavD,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IA2BtG,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAM/E,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAW/E,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ7F,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQpC,oBAAoB,CAAC,GAAG,SAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAUjE,YAAY;IAM1B,OAAO,CAAC,mBAAmB;YAMb,IAAI;CAWnB"}
+{"version":3,"file":"outbox-service.d.ts","sourceRoot":"","sources":["../../src/services/outbox-service.js"],"names":[],"mappings":"AAwBA;;GAEG;AACH;IAMI;;KAEC;IACD,4BAFS,MAAM,EAMd;IAZD;;;KAGC;IACD,yBAFQ,MAAM,CAEC;CASlB;AACD;;GAEG;AACH;IACI;;KAEC;IACD,qBAFS,MAAM,EAKd;CACJ;AACD;;GAEG;AACH;CAQC;AACD;IAgBI;;;KAGC;IACD,yBAHS,iBAAiB,YACjB,oBAAoB,EAS5B;IACD;;;KAGC;IACD,eAHS,iBAAiB,GACf,OAAO,CAAC,WAAW,CAAC,CAY9B;IACD;;;;;KAKC;IACD,kBALS,MAAM,SACN,MAAM,YACN,YAAY,GACV,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CA8B1C;IACD;;;;KAIC;IACD,gBAJS,MAAM,SACN,MAAM,iBACJ,OAAO,CAAC,WAAW,CAAC,CAM9B;IACD;;;;;KAKC;IACD,SALS,MAAM,UACN,MAAM,WACN,cAAc,GACZ,OAAO,CAAC,WAAW,CAAC,CAa9B;IACD;;;;;KAKC;IACD,aALS,MAAM,UACN,MAAM,UACN,MAAM,iBACJ,OAAO,CAAC,WAAW,CAAC,CAU9B;IACD;;;KAGC;IACD,WAHS,MAAM,GACJ,OAAO,CAAC,OAAO,CAAC,CAU1B;IACD;;;KAGC;IACD,4CAHS,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CAWzB;IACD;;;;KAIC;IACD,qBAKC;IACD;;;;;KAKC;IACD,4BAIC;IACD;;;;;KAKC;IACD,aAIC;;CACJ;0BApPY,OAAO,qBAAqB,EAAE,WAAW;gCAGzC,OAAO,qBAAqB,EAAE,iBAAiB;0BAG/C,OAAO,qBAAqB,EAAE,WAAW;gCAGzC;IAAE,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAAE;mCAGxO;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAAE;2BAG/D;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CAAE;6BAGhH;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAAE"}

package/dist/services/owner-claim-service.d.ts

@@ -0,0 +1,187 @@
+export class OwnerClaimService {
+    /**
+     * @param {OwnerClaimServiceOptions} options
+     */
+    constructor(options: OwnerClaimServiceOptions);
+    /**
+     * Generates this attempt's ephemeral key and asks the node to start its
+     * physical-confirmation gate for it. Safe to call again after a failed `completeClaim()` or
+     * an expired code — each call replaces whatever claim was previously pending, which is
+     * exactly what step 10's "Request a new code" needs.
+     *
+     * `accessCode`, when supplied, is sent as `access_code` — the shared secret that lets the
+     * node bind and auto-confirm this operation without a physical LCD tap. It is omitted from
+     * the payload entirely (never sent as `undefined`/`null`) when not supplied, and it is never
+     * logged.
+     * @param {string} [accessCode]
+     * @returns {Promise<OwnerClaimPrepareOutcome>}
+     */
+    prepareClaim(accessCode?: string): Promise<OwnerClaimPrepareOutcome>;
+    /**
+     * Waits for the node's physical confirmation. This is the ONLY thing that can put the
+     * pending claim into a completable state — no browser click, no timer, no LCD-pane tap
+     * substitutes for the node reporting `confirmed`.
+     *
+     * The poll cadence comes from the injected `DelayPort`, so this contains no timer of its
+     * own and stays testable with a zero-wait fake.
+     * @param {string} operationHash
+     * @returns {Promise<OwnerClaimConfirmation>}
+     */
+    awaitConfirmation(operationHash: string): Promise<OwnerClaimConfirmation>;
+    /**
+     * Runs the legacy challenge -> sign -> `complete-onboarding` sequence to actually create the
+     * owner + DID, using the identity supplied HERE rather than one captured at prepare time.
+     * Resolves `"claimed"` only when the node's own completion call reported success.
+     *
+     * RETRY-SAFE BY DESIGN: neither `#pending` nor the ephemeral key is touched until the node's
+     * completion call is known to have SUCCEEDED. A thrown challenge/complete call, or an explicit
+     * `success: false`, leaves `#pending` (and the key) exactly as they were, so the caller can
+     * invoke `completeClaim()` again on this same instance — reaching the node a second time
+     * without a new `prepareClaim()` — for as long as the underlying failure might be transient
+     * (a dropped connection, a momentarily-busy node). Clearing state on failure, or in a
+     * `finally`, would turn every transient hiccup into a forced restart of the whole claim.
+     * @param {OwnerClaimIdentity} identity
+     * @returns {Promise<OwnerClaimOutcome>}
+     */
+    completeClaim(identity: OwnerClaimIdentity): Promise<OwnerClaimOutcome>;
+    /** Drops any pending claim without contacting the node — used when the person abandons or
+     * restarts the flow before `completeClaim()` runs.
+     * @returns {void}
+     */
+    cancel(): void;
+    #private;
+}
+export type DelayPort = import("@econ-v1/ports").DelayPort;
+export type HomeNodeClient = import("@econ-v1/ports").HomeNodeClient;
+export type OwnerClaimCryptoPort = import("@econ-v1/ports").OwnerClaimCryptoPort;
+export type OwnerClaimSessionPort = import("@econ-v1/ports").OwnerClaimSessionPort;
+export type OwnerClaimSessionTokens = import("@econ-v1/ports").OwnerClaimSessionTokens;
+export type OwnerClaimConfirmation = "confirmed" | "rejected" | "timed-out";
+/**
+ * `claimed-unpaired` is a SUCCESS, not a failure: the owner + DID now exist on the node. It
+ * says only that this browser did not end up holding a device session, so the shell must run
+ * its ordinary pairing flow. Collapsing it into `rejected` would tell a person their setup
+ * failed after it had already, irreversibly, succeeded.
+ */
+export type OwnerClaimOutcome = "claimed" | "claimed-unpaired" | "not-prepared" | "rejected" | "timed-out";
+/**
+ * First-owner onboarding — "claim this unclaimed node" (#1815 DID-blocker fix).
+ *
+ * The PWA's onboarding-gate walks a person through identity + physical-confirmation
+ * screens, but until this service existed nothing behind them ever created an owner or
+ * a DID on the backend (`.superpowers/sdd/did-blocker-report.md`): `core.did.onboard` —
+ * the only code path that writes `did_documents` — is called exclusively from
+ * `AuthApplicationService::complete()`, which backs the legacy, JWT-shaped
+ * `POST /api/auth/complete-onboarding` (`system/ui`-only until now).
+ *
+ * This service drives that SAME legacy contract from the PWA, reusing the existing,
+ * already-reviewed backend surface rather than inventing a parallel owner-creation
+ * path (see the blocker report §5): an ephemeral secp256k1 keypair
+ * (`OwnerClaimCryptoPort` — deliberately distinct from the Ed25519 `IdentityPort` used
+ * for client-device pairing afterwards), `POST /api/v2/node/onboarding-prepare` to
+ * start the node's physical-confirmation gate, a poll of
+ * `GET /api/v2/node/operation-status/{hash}` for that confirmation, then
+ * `POST /api/auth/{onboarding-challenge,complete-onboarding}` to actually create the
+ * owner + DID.
+ *
+ * The claim now also carries the browser's OWN pairing identity: `completeClaim()` asks the
+ * session port for an optional signed `genesis_device` descriptor and forwards it verbatim to
+ * `complete-onboarding`, so the node's genesis DID device IS this browser (not a synthetic
+ * placeholder) and the client-device pairing that follows reconciles onto that same row instead
+ * of minting a duplicate. Building or forwarding it can never turn a successful claim into a
+ * rejected one — see the inner try/catch around it below.
+ *
+ * SECURITY: this service never decides whether the claim is authorized — the node
+ * does. `completeClaim()` only ever *attempts* the completion call; the host's
+ * `validate_physical_confirmation` gate (`core/domain/src/services/
+ * auth_application_service.rs`) is the sole authority on whether a real physical
+ * confirmation happened, and refuses the request otherwise
+ * (`enforce_physical_presence`, `core/adapters-network/src/http/server/
+ * device_management/proxy.rs`, refuses browser/remote confirmation of an "onboard"
+ * operation outright when the node has a screen — only a physical LCD tap counts).
+ * A caller of this service who never gets the node's screen tapped simply never
+ * reaches "claimed": `awaitConfirmation()` resolves `"rejected"`/`"timed-out"` and
+ * `completeClaim()` then refuses, rather than reporting success.
+ *
+ * Once a client's `prepareClaim()` succeeds, the service holds exactly one pending claim —
+ * matching the legacy flow's "ONE device keypair for the whole onboarding attempt"
+ * invariant (the node's confirmation is bound to the specific public key sent to
+ * `onboarding-prepare`, and the app-did miniapp allows only one pending "onboard"
+ * operation node-wide).
+ *
+ * SEQUENCING (design §6.1) — `prepare(identity)`/`complete()` were split into
+ * `prepareClaim()` / `awaitConfirmation()` / `completeClaim(identity)` because the flow puts
+ * the match code at step 10 and identity at step 12, deliberately: nothing is written until
+ * physical access has been proven. That split is possible with NO backend change because
+ * `onboarding-prepare`'s payload is only `{ public_key_multibase }` — the identity that used
+ * to be handed to `prepare()` was stashed purely client-side and read back at completion.
+ *
+ * The security property is preserved and strengthened: `completeClaim()` refuses outright
+ * (without contacting the node) unless `awaitConfirmation()` has already observed the node's
+ * own `confirmed` for THIS claim's operation hash, so no owner record can exist until physical
+ * confirmation AND identity submission have both happened, in that order. The node's
+ * `validate_physical_confirmation` gate remains the sole authority; this client-side guard
+ * only stops a pointless, misleading round trip.
+ */
+export type OwnerClaimIdentity = {
+    displayName: string;
+    username: string;
+};
+export type OwnerClaimPrepareOutcome = {
+    /**
+     * `true` when the node already bound and auto-confirmed this operation server-side (an
+     * access code was supplied and matched) — `awaitConfirmation()` is unnecessary and
+     * `completeClaim()` proceeds straight to the challenge/complete sequence, with no LCD
+     * match-code step in between.
+     */
+    confirmed: boolean;
+    lcdHardware: boolean;
+    matchCode: string;
+    /**
+     * The handle `awaitConfirmation()` polls and `completeClaim()` echoes back as
+     * `onboarding_confirmation`. Absent when the node's confirmation gate is disabled.
+     */
+    operationHash: string | undefined;
+    requiresConfirmation: boolean;
+};
+export type OwnerClaimServiceOptions = {
+    /**
+     * The ephemeral secp256k1 identity for this onboarding attempt (see `OwnerClaimCryptoPort`'s
+     * doc comment). Named `keys`, not `crypto`, so this stays a plain interface field rather
+     * than reading as a reference to the browser's `crypto` global.
+     */
+    keys: OwnerClaimCryptoPort;
+    delay: Pick<DelayPort, "wait">;
+    node: Pick<HomeNodeClient, "invoke">;
+    /**
+     * Turns the completion response's tokens into a real device session. Required, not optional:
+     * defaulting it would make a wiring mistake look like a node that simply issued no tokens.
+     */
+    session: OwnerClaimSessionPort;
+};
+export type OnboardingPrepareWire = {
+    /**
+     * Present (and `true`) only when the node auto-confirmed this operation from a supplied
+     * access code; omitted entirely otherwise — never sent as an explicit `false`.
+     */
+    confirmed?: boolean;
+    lcd_hardware?: boolean;
+    operation_hash?: string;
+    match_code?: string;
+    requires_lcd: boolean;
+};
+export type OperationStatusWire = {
+    confirmed: boolean;
+    status?: string;
+};
+export type OnboardingChallengeWire = {
+    challenge: string;
+    challenge_id: string;
+};
+export type OnboardingCompleteWire = {
+    refresh_token?: unknown;
+    success: boolean;
+    token?: unknown;
+    token_expires_at?: unknown;
+};
+//# sourceMappingURL=owner-claim-service.d.ts.map

package/dist/services/owner-claim-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-claim-service.d.ts","sourceRoot":"","sources":["../../src/services/owner-claim-service.js"],"names":[],"mappings":"AAQA;IAmBE;;OAEG;IACH,qBAFW,wBAAwB,EAOlC;IACD;;;;;;;;;;;;OAYG;IACH,0BAHW,MAAM,GACJ,OAAO,CAAC,wBAAwB,CAAC,CAyB7C;IACD;;;;;;;;;OASG;IACH,iCAHW,MAAM,GACJ,OAAO,CAAC,sBAAsB,CAAC,CAsB3C;IACD;;;;;;;;;;;;;;OAcG;IACH,wBAHW,kBAAkB,GAChB,OAAO,CAAC,iBAAiB,CAAC,CAsEtC;IACD;;;OAGG;IACH,UAFa,IAAI,CAKhB;;CACF;wBAnMa,OAAO,gBAAgB,EAAE,SAAS;6BAClC,OAAO,gBAAgB,EAAE,cAAc;mCACvC,OAAO,gBAAgB,EAAE,oBAAoB;oCAC7C,OAAO,gBAAgB,EAAE,qBAAqB;sCAC9C,OAAO,gBAAgB,EAAE,uBAAuB;qCA2NhD,WAAW,GAAG,UAAU,GAAG,WAAW;;;;;;;gCAMrC,SAAS,GACjB,kBAAkB,GAClB,cAAc,GACd,UAAU,GACV,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6DJ,MAAM;cACN,MAAM;;;;;;;;;eAIN,OAAO;iBAIP,OAAO;eACP,MAAM;;;;;mBACN,MAAM,GAAG,SAAS;0BAElB,OAAO;;;;;;;;UAIP,oBAAoB;WAGpB,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;UACvB,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;;;;;aAC9B,qBAAqB;;;;;;;gBAKrB,OAAO;mBAEP,OAAO;qBACP,MAAM;iBACN,MAAM;kBACN,OAAO;;;eAIP,OAAO;aACP,MAAM;;;eAIN,MAAM;kBACN,MAAM;;;oBAIN,OAAO;aACP,OAAO;YACP,OAAO;uBACP,OAAO"}