@feltdb/core 0.13.0 → 0.16.0

package/dist/cli/commands.js

@@ -17,14 +17,14 @@ import { applicationIsRunning, applicationUrlCandidate, detectApplication, disco
 import { resolveApplicationLifecycle, startManagedApplication, waitForManagedApplication } from './application-lifecycle.js';
 import { createDevelopmentSession, developmentSessionEnvironment, developmentSessionSummary, developmentStudioArguments, transitionDevelopmentSession } from './development-session.js';
 import { openApplication, openStudio } from './browser-opening.js';
-import { publishApplication } from './publish-engine.js';
+import { publishApplication, readApplicationContract } from './publish-engine.js';
 import { applyFlowProposalAtomic, assertProposalSourcePlan, describeProposal, loadLocalDevelopmentContract, repositoryContext, reviewFlowProposal, syncGeneratedSource } from './source-sync.js';
 import { configureAiModel, generateConfiguredFlowProposal, publicAiModelConfiguration } from './ai-model-config.js';
 import { proposalService } from './proposal-client.js';
 import { resolveManagedAuthorityEnvironment } from './managed-environment.js';
 import { readManagedProjectState } from './managed-project.js';
 import { resolveCanonicalStudioArtifact } from './studio-artifact.js';
-import { configureManagedAccount, finalizeManagedProvisioning } from '../create/index.js';
+import { configureManagedAccount, createManagedKey, finalizeManagedProvisioning, listManagedKeys, resolveManagedScopes, revokeManagedKey, setEnvironmentValue, signInManagedAccount } from '../create/index.js';
 function loadProjectEnvironment(file = path.resolve('.env.local')) {
     if (!fs.existsSync(file))
         return;
@@ -40,6 +40,27 @@ function loadProjectEnvironment(file = path.resolve('.env.local')) {
         if (!(key in process.env))
             process.env[key] = value;
     }
+    warnBrowserExposedCredentials();
+}
+/**
+ * Credentials under a `VITE_` name are inlined into the application's browser
+ * bundle by Vite, so they are no longer read as credentials anywhere. Say so,
+ * rather than silently dropping authentication a project used to have.
+ */
+function warnBrowserExposedCredentials() {
+    for (const name of Object.keys(process.env)) {
+        if (/^VITE_[A-Z0-9_]*(?:TOKEN|API_KEY|SECRET)$/.test(name) && process.env[name]) {
+            console.warn(`⚠ ${name} is ignored: VITE_* variables are inlined into browser bundles. Move the credential to FELTDB_TOKEN (server-side only).`);
+        }
+    }
+}
+/**
+ * The local `feltdb dev` Studio is an operator console on localhost. It
+ * receives the developer's server-side key at runtime (no-store), never from a
+ * bundled VITE_* value.
+ */
+function studioOperatorToken() {
+    return process.env.FELTDB_TOKEN || '';
 }
 async function availablePort(preferred, host = '127.0.0.1') {
     for (let port = preferred; port < preferred + 100; port += 1) {
@@ -64,6 +85,8 @@ export async function handleCommand(command, args) {
             return handleKeys(args);
         case 'init-managed':
             return handleInitManaged(args);
+        case 'managed':
+            return handleManaged(args);
         case 'connect':
             return handleConnect(args);
         case 'status':
@@ -620,6 +643,7 @@ async function handleManagedPublish(args) {
         yes: args.includes('--yes'),
         approveDestructive: args.includes('--approve-destructive-changes') || args.includes('--allow-destructive'),
         noBuild: args.includes('--no-build'),
+        contract: valueAfter('--contract'),
         confirm,
     });
 }
@@ -831,8 +855,8 @@ async function handleConnect(args) {
     let health;
     try {
         const response = await fetch(`${url}/health`, {
-            headers: process.env.FELTDB_TOKEN || process.env.VITE_FELTDB_API_KEY
-                ? { Authorization: `Bearer ${process.env.FELTDB_TOKEN || process.env.VITE_FELTDB_API_KEY}` }
+            headers: process.env.FELTDB_TOKEN
+                ? { Authorization: `Bearer ${process.env.FELTDB_TOKEN}` }
                 : {},
             signal: controller.signal,
         });
@@ -855,14 +879,14 @@ async function handleConnect(args) {
     fs.writeFileSync(connFile, JSON.stringify({
         url,
         connected: new Date().toISOString(),
-        authenticated: Boolean(process.env.FELTDB_TOKEN || process.env.VITE_FELTDB_API_KEY),
+        authenticated: Boolean(process.env.FELTDB_TOKEN),
         namespace: managed.namespace || project.namespace || 'default',
         runtime: project.runtime || 'self-hosted',
     }, null, 2));
     console.log('✅ Connected to FeltDB\n');
     console.log('Endpoint:     ' + url);
     console.log(`Namespace:    ${managed.namespace || project.namespace || 'default'}`);
-    console.log(`Authenticated: ${process.env.FELTDB_TOKEN || process.env.VITE_FELTDB_API_KEY ? 'yes' : 'no'}`);
+    console.log(`Authenticated: ${process.env.FELTDB_TOKEN ? 'yes' : 'no'}`);
     console.log(`Runtime:      ${project.runtime || 'self-hosted'}`);
     console.log(`Health:       ${health.status || 'healthy'}\n`);
     console.log('Use: feltdb status  (to check connection)\n');
@@ -926,6 +950,9 @@ export function ensureManagedProjectContract(projectDir) {
     return { ...created, configPath, flowPath };
 }
 async function handleInitManaged(args) {
+    const contract = flagValue(args, '--contract');
+    if (contract)
+        return initManagedWithContract(args, contract);
     loadProjectEnvironment();
     const projectDir = process.cwd();
     const initialized = ensureManagedProjectContract(projectDir);
@@ -978,10 +1005,11 @@ async function handleInitManaged(args) {
     // Prompt for credentials
     console.log('☁️  Setting up managed FeltDB for this project\n');
     const prompt = await import('node:readline/promises').then(m => m.createInterface({ input: process.stdin, output: process.stdout }));
-    const email = args[0] || await prompt.question('Email: ');
+    const [emailArgument, passwordArgument] = positionalArguments(args);
+    const email = emailArgument || await prompt.question('Email: ');
     if (!email)
         throw new Error('Email is required');
-    const password = args[1] || await promptSecret('Password (8+ characters): ');
+    const password = passwordArgument || await promptSecret('Password (8+ characters): ');
     if (password.length < 8)
         throw new Error('Password must be at least 8 characters');
     prompt.close();
@@ -1041,6 +1069,169 @@ async function handleInitManaged(args) {
         throw error;
     }
 }
+/** The value after `--flag`, if the flag is given. */
+function flagValue(args, flag) {
+    const index = args.indexOf(flag);
+    if (index < 0)
+        return undefined;
+    const value = args[index + 1];
+    if (!value || value.startsWith('--'))
+        throw new Error(`${flag} needs a value`);
+    return value;
+}
+const VALUE_FLAGS = new Set(['--contract', '--runtime-scopes', '--name', '--scopes', '--application', '--env-var', '--save-to', '--environment', '--message']);
+/** Arguments that are neither flags nor flag values. */
+function positionalArguments(args) {
+    return args.filter((value, index) => !value.startsWith('--') && !VALUE_FLAGS.has(args[index - 1] ?? ''));
+}
+/**
+ * The managed account's e-mail and password: positional arguments, else
+ * FELTDB_MANAGED_EMAIL and FELTDB_MANAGED_PASSWORD (non-interactive), else a prompt
+ * (the password is never echoed).
+ */
+async function managedAccountCredentials(args) {
+    const [emailArgument, passwordArgument] = positionalArguments(args);
+    let email = emailArgument || process.env.FELTDB_MANAGED_EMAIL || '';
+    if (!email && process.stdin.isTTY) {
+        const prompt = (await import('node:readline/promises')).createInterface({ input: process.stdin, output: process.stdout });
+        try {
+            email = await prompt.question('Email: ');
+        }
+        finally {
+            prompt.close();
+        }
+    }
+    const password = passwordArgument || process.env.FELTDB_MANAGED_PASSWORD || await promptSecret('Password (8+ characters): ');
+    if (!email || password.length < 8) {
+        throw new Error('Managed sign-in needs your FeltDB account e-mail and an 8+ character password. Non-interactively, set FELTDB_MANAGED_EMAIL and FELTDB_MANAGED_PASSWORD.');
+    }
+    return { email, password };
+}
+/**
+ * `feltdb init-managed --contract <file>`: a project whose state contract is a JSON file
+ * (generated by FeltKit, for one) rather than feltdb.flow. Creates or reuses the managed
+ * application named after the project, mints its control key and a runtime key with the
+ * scopes asked for (`minimal` unless `--runtime-scopes` says otherwise), writes `.env.local`
+ * (mode 600) and `.feltdb/managed.json`, then publishes and promotes the contract and checks
+ * that the runtime key resolves it. Re-running it on a configured project publishes again.
+ */
+async function initManagedWithContract(args, contractFile) {
+    const projectDir = process.cwd();
+    const contractPath = path.resolve(projectDir, contractFile);
+    readApplicationContract(contractPath);
+    const runtimeScopes = resolveManagedScopes(flagValue(args, '--runtime-scopes') ?? 'minimal');
+    const existing = readManagedProjectState(projectDir);
+    if (existing.applicationId) {
+        console.log(`✓ Already configured for managed FeltDB: application ${existing.applicationId}, ${existing.url}`);
+        console.log('  Its keys are unchanged. Publishing the contract again.\n');
+    }
+    else {
+        if (fs.existsSync(path.join(projectDir, '.env.local'))) {
+            throw new Error('.env.local exists. Managed setup writes the project\'s FeltDB settings and keys there; move it aside first, so nothing in it is replaced.');
+        }
+        const packageFile = path.join(projectDir, 'package.json');
+        const packageName = fs.existsSync(packageFile) ? String(JSON.parse(fs.readFileSync(packageFile, 'utf8')).name ?? '') : '';
+        const applicationName = flagValue(args, '--name') || packageName.replace(/^@[^/]+\//, '') || path.basename(projectDir);
+        if (!/^[a-z0-9][a-z0-9-]*$/.test(applicationName))
+            throw new Error(`"${applicationName}" is not an application name (lowercase letters, digits, dashes); pass --name`);
+        const { email, password } = await managedAccountCredentials(args);
+        console.log('\nProvisioning managed application...\n');
+        const managed = await configureManagedAccount({ projectDir, applicationName, namespace: applicationName, email, password, runtimeScopes });
+        console.log(`✓ Managed application: ${managed.application.name} (${managed.application.id})`);
+        console.log(`✓ Runtime key scopes: ${runtimeScopes.join(', ')}`);
+        console.log('✓ Settings and keys written to .env.local (mode 600) and .feltdb/managed.json. Never commit either.\n');
+    }
+    const result = await publishApplication({
+        cwd: projectDir,
+        contract: contractFile,
+        yes: args.includes('--yes') || !process.stdin.isTTY,
+        // A new application has no active contract to break: its first contract (policies
+        // included) is approved as `feltdb init-managed` approves a first feltdb.flow. A
+        // configured application's changes still need --approve-destructive-changes.
+        approveDestructive: args.includes('--approve-destructive-changes') || !existing.applicationId,
+        confirm: async (question) => {
+            const prompt = (await import('node:readline/promises')).createInterface({ input: process.stdin, output: process.stdout });
+            try {
+                return !/^(n|no)$/i.test((await prompt.question(`${question} [Y/n] `)).trim());
+            }
+            finally {
+                prompt.close();
+            }
+        },
+    });
+    if (result.status === 'published') {
+        const finalized = await finalizeManagedProvisioning({ projectDir });
+        console.log(`✓ Managed runtime verified at revision ${finalized.revisionId}\n`);
+    }
+}
+/** `feltdb managed keys create|list|revoke`: keys of a managed application (not local `feltdb keys`). */
+async function handleManaged(args) {
+    const [group, action, ...rest] = args;
+    if (group !== 'keys' || !['create', 'list', 'revoke'].includes(action ?? '')) {
+        console.log(`Managed FeltDB keys (an application on the managed service; local keys are \`feltdb keys\`):
+
+  feltdb managed keys create --name <key-id> [--scopes minimal|default|control|<scope,scope>]
+                             [--application <app_id>] [--env-var FELTDB_TOKEN] [--save-to .env.local | --stdout]
+  feltdb managed keys list [--application <app_id>]
+  feltdb managed keys revoke <key-id>
+
+Sign-in: your FeltDB account (prompted; or FELTDB_MANAGED_EMAIL / FELTDB_MANAGED_PASSWORD).
+The application defaults to the one in .feltdb/managed.json (or FELTDB_APPLICATION_ID).
+A new key's secret is written to the env file (mode 600), or with --stdout printed as
+NAME=secret for a pipe into a secret manager. It is never printed to a terminal.`);
+        if (group)
+            process.exitCode = 1;
+        return;
+    }
+    loadProjectEnvironment();
+    const state = readManagedProjectState();
+    const applicationId = flagValue(rest, '--application') || state.applicationId || process.env.FELTDB_APPLICATION_ID;
+    if (!applicationId && action !== 'revoke')
+        throw new Error('Which application? Pass --application <app_id>, or run this in a project set up with `feltdb init-managed`.');
+    // Key ids are the positional arguments here, so credentials come from the environment or a prompt.
+    const session = await signInManagedAccount(await managedAccountCredentials([]));
+    if (action === 'list') {
+        console.log('id\tname\tstate\tscopes');
+        for (const key of await listManagedKeys(session, applicationId)) {
+            const scopes = Array.isArray(key.scopes) ? key.scopes.join(',') : '';
+            console.log(`${String(key.id)}\t${String(key.name ?? '')}\t${key.revoked ? 'revoked' : 'active'}\t${scopes}`);
+        }
+        return;
+    }
+    if (action === 'revoke') {
+        const target = positionalArguments(rest)[0];
+        if (!target)
+            throw new Error('Usage: feltdb managed keys revoke <key-id|key-name>');
+        // The control plane assigns key ids; the name is what `create --name` gave it.
+        const keys = applicationId ? await listManagedKeys(session, applicationId) : [];
+        const byName = keys.filter(key => key.name === target && !key.revoked);
+        if (byName.length > 1)
+            throw new Error(`${byName.length} active keys are named ${target}; revoke one by id (feltdb managed keys list)`);
+        const keyId = keys.some(key => key.id === target) ? target : byName[0] ? String(byName[0].id) : target;
+        await revokeManagedKey(session, keyId);
+        console.log(`✓ Revoked ${target}${keyId !== target ? ` (${keyId})` : ''}. Requests carrying it are now refused with AUTHENTICATION_REQUIRED.`);
+        return;
+    }
+    const id = flagValue(rest, '--name');
+    if (!id)
+        throw new Error('Name the key: --name <key-id> (for example myapp-runtime-2026-10)');
+    const scopes = resolveManagedScopes(flagValue(rest, '--scopes') ?? 'minimal');
+    const envVar = flagValue(rest, '--env-var') ?? (scopes.includes('application:revision:promote') ? 'FELTDB_MANAGED_CONTROL_API_KEY' : 'FELTDB_TOKEN');
+    const toStdout = rest.includes('--stdout');
+    if (toStdout && process.stdout.isTTY)
+        throw new Error('--stdout would show the secret on this terminal. Pipe it into your secret manager instead, or write it to an env file (the default).');
+    const namespace = state.namespace || process.env.FELTDB_NAMESPACE || applicationId;
+    const key = await createManagedKey(session, { id, namespace, applicationId: applicationId, scopes });
+    if (toStdout) {
+        process.stdout.write(`${envVar}=${key.secret}\n`);
+        console.error(`✓ Created ${id} (key id ${key.id}) for ${applicationId}: ${key.scopes.join(', ')}; written to stdout as ${envVar}.`);
+        return;
+    }
+    const envFile = path.resolve(flagValue(rest, '--save-to') ?? '.env.local');
+    setEnvironmentValue(envFile, envVar, key.secret);
+    console.log(`✓ Created ${id} (key id ${key.id}) for ${applicationId}: ${key.scopes.join(', ')}`);
+    console.log(`✓ ${envVar} written to ${path.relative(process.cwd(), envFile) || envFile} (mode 600). Never commit it.`);
+}
 async function handleExplain(args) {
     const flowRef = args[0];
     if (!flowRef || !flowRef.startsWith('flow://')) {
@@ -1894,7 +2085,7 @@ async function handleStudio(args, onReady) {
                 environment: managedProject.environment || 'production',
                 publishEndpoint: '/_feltdb/publish',
             } : undefined;
-            response.end(JSON.stringify({ token: connectUrl ? process.env.VITE_FELTDB_API_KEY || '' : '', managedPublish, session, studioQuery, sourceSync: { enabled: true, webllmEnabled, previewOnly, token: studioMutationToken, aiModel: publicAiModelConfiguration() } }));
+            response.end(JSON.stringify({ token: connectUrl ? studioOperatorToken() : '', managedPublish, session, studioQuery, sourceSync: { enabled: true, webllmEnabled, previewOnly, token: studioMutationToken, aiModel: publicAiModelConfiguration() } }));
             return;
         }
         if (pathname === '/_feltdb/contract') {
@@ -1913,7 +2104,7 @@ async function handleStudio(args, onReady) {
                         endpoint.searchParams.set('application_id', applicationId);
                         endpoint.searchParams.set('environment', managedProject.environment || lastPublished?.environment || 'production');
                         const headers = {};
-                        const credential = process.env.FELTDB_MANAGED_CONTROL_API_KEY || process.env.VITE_FELTDB_API_KEY;
+                        const credential = process.env.FELTDB_MANAGED_CONTROL_API_KEY || process.env.FELTDB_TOKEN;
                         if (credential)
                             headers.authorization = `Bearer ${credential}`;
                         const discovered = await fetch(endpoint, { headers });
@@ -2245,7 +2436,9 @@ Commands:
   diff [file]           Diff FlowSpec against the last deployed model
   deploy [file]         Validate, version, and deploy FlowSpec
   publish [file]        Build and publish/update a managed application
+  publish --contract <f> Publish and promote a JSON state contract (no feltdb.flow)
   init-managed          Set up managed FeltDB for an existing project
+  managed keys          Create, list, or revoke a managed application's keys
   ai                    Open the canonical interactive local-AI workflow
   ai --dry-run          Open an ephemeral preview-only AI session
   ai model show         Show the selected local or user-provided model
@@ -2302,6 +2495,16 @@ Managed FeltDB Setup (Existing Projects):
                                           Prompts for email and password, provisions resources,
                                           and optionally publishes the initial revision
   feltdb init-managed <email> <password>  Non-interactive setup with provided credentials
+  feltdb init-managed --contract feltdb.contract.json [--runtime-scopes minimal] [--name <app>] [--yes]
+                                          A project whose state contract is a JSON file
+                                          (e.g. generated by FeltKit): provision, mint a control
+                                          key and a least-privilege runtime key, publish, verify
+
+Managed Keys (not the local keys above):
+  feltdb managed keys create --name <id> [--scopes minimal|default|control|<list>]
+                             [--env-var FELTDB_TOKEN] [--save-to .env.local | --stdout]
+  feltdb managed keys list
+  feltdb managed keys revoke <id>
 
 Development:
   dev         Start development server
@@ -2313,6 +2516,7 @@ Development:
 
 Publish:
   feltdb publish --dry-run                  Validate and preview without activation
+  feltdb publish --contract feltdb.contract.json --yes   Publish a JSON state contract
   feltdb publish --yes                      Publish to the configured environment
   feltdb publish --status                   Compare local and active cloud versions
   feltdb publish --environment staging      Override the configured environment

package/dist/cli/publish-engine.js

@@ -19,25 +19,34 @@ function loadEnv(file) {
     }
     return values;
 }
-export function discoverPublishConfiguration(cwd = process.cwd(), environmentOverride) {
+/**
+ * Where to publish, from the project's managed setup (`.env.local`, `.feltdb/managed.json`,
+ * written by `feltdb init-managed`) or the process environment (CI). A `feltdb.flow` project
+ * needs `feltdb.config.json`; a contract (`contract`) does not, and its tenant is the
+ * application's own, read from the draft.
+ */
+export function discoverPublishConfiguration(cwd = process.cwd(), environmentOverride, options = {}) {
     const configFile = path.join(cwd, 'feltdb.config.json');
-    if (!fs.existsSync(configFile))
+    if (!options.contract && !fs.existsSync(configFile))
         throw new Error('feltdb.config.json is required for publish');
-    const project = JSON.parse(fs.readFileSync(configFile, 'utf8'));
+    const project = fs.existsSync(configFile) ? JSON.parse(fs.readFileSync(configFile, 'utf8')) : {};
     const file = loadEnv(path.join(cwd, '.env.local'));
     const managedFile = path.join(cwd, '.feltdb', 'managed.json');
     const managed = fs.existsSync(managedFile) ? JSON.parse(fs.readFileSync(managedFile, 'utf8')) : {};
     const value = (name) => process.env[name] || file[name];
     const configuration = {
-        url: value('VITE_FELTDB_MANAGED_URL') || managed.url, token: value('FELTDB_MANAGED_CONTROL_API_KEY'),
-        tenantId: managed.tenantId || value('VITE_FELTDB_MANAGED_TENANT_ID'), applicationId: value('VITE_FELTDB_MANAGED_APPLICATION_ID') || managed.applicationId,
-        namespace: managed.namespace || value('VITE_FELTDB_MANAGED_NAMESPACE') || project.namespace,
-        environment: environmentOverride || managed.environment || value('VITE_FELTDB_MANAGED_ENVIRONMENT') || 'production',
+        url: value('VITE_FELTDB_MANAGED_URL') || managed.url || value('FELTDB_URL'), token: value('FELTDB_MANAGED_CONTROL_API_KEY'),
+        tenantId: managed.tenantId || value('VITE_FELTDB_MANAGED_TENANT_ID') || '',
+        applicationId: value('VITE_FELTDB_MANAGED_APPLICATION_ID') || managed.applicationId || value('FELTDB_APPLICATION_ID'),
+        namespace: managed.namespace || value('VITE_FELTDB_MANAGED_NAMESPACE') || project.namespace || value('FELTDB_NAMESPACE') || (options.contract ? path.basename(cwd) : undefined),
+        environment: environmentOverride || managed.environment || value('VITE_FELTDB_MANAGED_ENVIRONMENT') || value('FELTDB_ENVIRONMENT') || 'production',
     };
-    const missing = Object.entries(configuration).filter(([, value]) => !value).map(([name]) => name);
-    if (missing.length)
-        throw new Error(`Managed publish configuration is incomplete in .env.local: ${missing.join(', ')}`);
-    return configuration;
+    const missing = Object.entries(configuration).filter(([name, value]) => !value && !(options.contract && name === 'tenantId')).map(([name]) => name);
+    if (missing.length) {
+        throw new Error(`Managed publish configuration is incomplete: ${missing.join(', ')}. Run \`feltdb init-managed\` in this project, or set FELTDB_URL, FELTDB_APPLICATION_ID and FELTDB_MANAGED_CONTROL_API_KEY.`);
+    }
+    const runtimeToken = value('FELTDB_TOKEN');
+    return { ...configuration, ...(runtimeToken ? { runtimeToken } : {}) };
 }
 function filesBelow(root, directory) {
     const target = path.join(root, directory);
@@ -88,6 +97,86 @@ export function buildPublishBundle(cwd, configuration) {
         manifest.metadata.labels['feltdb.source_revision'] = sourceRevision;
     return { manifest, artifacts, artifactHash, sourceRevision };
 }
+const CONTRACT_KEYS = ['collections', 'indexes', 'references', 'policies'];
+export function readApplicationContract(file) {
+    if (!fs.existsSync(file))
+        throw new Error(`Contract file not found: ${file}`);
+    let contract;
+    try {
+        contract = JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`Contract file ${file} is not JSON: ${error.message}`);
+    }
+    if (!contract || typeof contract !== 'object' || Array.isArray(contract))
+        throw new Error(`Contract file ${file} must hold an object with collections and policies`);
+    const unknown = Object.keys(contract).filter(key => !CONTRACT_KEYS.includes(key));
+    if (unknown.length)
+        throw new Error(`Contract file ${file} has keys a contract cannot carry: ${unknown.join(', ')} (allowed: ${CONTRACT_KEYS.join(', ')})`);
+    if (!Array.isArray(contract.collections) || !contract.collections.length)
+        throw new Error(`Contract file ${file} declares no collections`);
+    for (const collection of contract.collections) {
+        if (!collection || typeof collection.name !== 'string' || !Array.isArray(collection.fields))
+            throw new Error(`Contract file ${file}: every collection needs a name and a fields array`);
+    }
+    if (!Array.isArray(contract.policies))
+        throw new Error(`Contract file ${file} declares no policies; without one per collection the authority refuses every read and write`);
+    for (const key of ['indexes', 'references'])
+        if (contract[key] !== undefined && !Array.isArray(contract[key]))
+            throw new Error(`Contract file ${file}: ${key} must be an array`);
+    return contract;
+}
+export function buildContractBundle(cwd, configuration, contractFile) {
+    const absolute = path.resolve(cwd, contractFile);
+    const contract = readApplicationContract(absolute);
+    const relative = path.relative(cwd, absolute).split(path.sep).join('/');
+    if (relative.startsWith('../'))
+        throw new Error(`The contract file must be inside the project: ${contractFile}`);
+    const content = Buffer.from(fs.readFileSync(absolute));
+    const artifact = { path: relative, hash: `sha256:${sha256(content)}`, bytes: content.byteLength, mediaType: 'application/json', content: content.toString('base64') };
+    const artifactHash = `sha256:${sha256(`${artifact.path}\0${artifact.hash}`)}`;
+    // The manifest defaults (environments, runtime bounds, UI) are the ones every published
+    // application carries; only the state contract comes from the file.
+    const manifest = flowSpecToManifest({ version: 1, app: configuration.namespace, collections: [], capabilities: [], agents: [], workflows: [], triggers: [], policies: [], schedules: [], modules: [] }, configuration.tenantId, configuration.applicationId);
+    manifest.collections = contract.collections;
+    manifest.indexes = contract.indexes ?? [];
+    manifest.references = contract.references ?? [];
+    manifest.policies = contract.policies;
+    const contractHash = (value) => `sha256:${sha256(Buffer.from(canonicalApplicationBytes(value)))}`;
+    manifest.metadata.labels = {
+        'feltdb.model_hash': contractHash({ collections: manifest.collections, indexes: manifest.indexes, references: manifest.references }),
+        'feltdb.authorization_hash': contractHash(manifest.policies),
+        'feltdb.contract_hash': contractHash({ contract }),
+        'feltdb.contract_file': relative,
+        'feltdb.artifact_hash': artifactHash,
+        'feltdb.namespace': configuration.namespace,
+    };
+    manifest.artifacts = [{ name: relative, uri: `artifact://${artifact.hash}`, media_type: artifact.mediaType, content: artifact.content }];
+    const git = spawnSync('git', ['rev-parse', 'HEAD'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    const sourceRevision = git.status === 0 ? git.stdout.trim() : undefined;
+    if (sourceRevision)
+        manifest.metadata.labels['feltdb.source_revision'] = sourceRevision;
+    return { manifest, artifacts: [artifact], artifactHash, sourceRevision };
+}
+/**
+ * The runtime (data) key resolves the revision just promoted: URL, key, application and
+ * environment agree. Without the key here (CI holding only the control key) it is not checked.
+ */
+async function verifyRuntimeKey(configuration, revisionId, log) {
+    if (!configuration.runtimeToken) {
+        log('• Runtime key (FELTDB_TOKEN) not available here; the application\'s own check is its health endpoint.');
+        return false;
+    }
+    const url = `${configuration.url.replace(/\/$/, '')}/v1/application?application_id=${encodeURIComponent(configuration.applicationId)}&environment=${encodeURIComponent(configuration.environment)}`;
+    const response = await fetch(url, { headers: { authorization: `Bearer ${configuration.runtimeToken}`, accept: 'application/json' } });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok)
+        throw new Error(`The runtime key (FELTDB_TOKEN) is refused for application ${configuration.applicationId} in ${configuration.environment}: HTTP ${response.status} ${String(body.code ?? '')} ${String(body.message ?? '')}`.trim());
+    if (body.revision_id !== revisionId)
+        throw new Error(`The runtime key resolves revision ${String(body.revision_id)}, not the promoted ${revisionId}`);
+    log('✓ The runtime key (FELTDB_TOKEN) resolves the promoted revision');
+    return true;
+}
 function sameDefinition(left, right) {
     return left.metadata.labels?.['feltdb.artifact_hash'] === right.metadata.labels?.['feltdb.artifact_hash'];
 }
@@ -105,8 +194,8 @@ function describeChanges(current, bundle) {
 export async function publishApplication(options = {}) {
     const cwd = options.cwd || process.cwd();
     const log = options.log || console.log;
-    const configuration = discoverPublishConfiguration(cwd, options.environment);
-    const bundle = buildPublishBundle(cwd, configuration);
+    const configuration = discoverPublishConfiguration(cwd, options.environment, { contract: Boolean(options.contract) });
+    const bundle = options.contract ? buildContractBundle(cwd, configuration, options.contract) : buildPublishBundle(cwd, configuration);
     const client = new ApplicationManifestClient(configuration.url.replace(/\/$/, ''), configuration.token);
     const cloud = await client.revisions(configuration.applicationId);
     const current = activeRevision(cloud.revisions, cloud.environment_pointers, configuration.environment);
@@ -128,7 +217,8 @@ export async function publishApplication(options = {}) {
     }
     log('Changes:');
     changes.forEach(value => log(`  ${value}`));
-    if (!options.noBuild) {
+    // A contract is the artifact itself; the application is built and deployed on its own.
+    if (!options.noBuild && !options.contract) {
         const packageFile = path.join(cwd, 'package.json');
         const packageManifest = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
         if (!packageManifest.scripts?.build)
@@ -140,6 +230,15 @@ export async function publishApplication(options = {}) {
             throw new Error(`Application build failed with exit code ${result.status}`);
     }
     const draft = await client.createDraft(configuration.applicationId, current?.revision_id);
+    if (options.contract) {
+        // The authority requires state_schema_version to increase whenever the state schema
+        // changes; an unchanged schema keeps the active one.
+        const model = (manifest) => canonicalApplicationBytes({ collections: manifest.collections, indexes: manifest.indexes ?? [], references: manifest.references ?? [] }).toString();
+        const previous = current?.manifest.state_schema_version ?? 0;
+        bundle.manifest.state_schema_version = current && model(current.manifest) === model(bundle.manifest) ? previous : previous + 1;
+        bundle.manifest.tenant_id = draft.tenant_id;
+        bundle.manifest.metadata.name = draft.manifest?.metadata?.name || bundle.manifest.metadata.name;
+    }
     const updated = await client.updateDraft(configuration.applicationId, draft, bundle.manifest);
     const validation = await client.validateDraft(configuration.applicationId, updated.draft_id);
     if (!validation.valid)
@@ -158,8 +257,9 @@ export async function publishApplication(options = {}) {
     }
     const promoted = await client.promoteEnvironment(configuration.applicationId, configuration.environment, revision.revision_id, current?.revision_id, options.message || 'Published from feltdb CLI', Boolean(options.approveDestructive));
     fs.mkdirSync(path.join(cwd, '.feltdb'), { recursive: true });
-    fs.writeFileSync(path.join(cwd, '.feltdb', 'last-published.json'), `${JSON.stringify({ applicationId: configuration.applicationId, tenantId: configuration.tenantId, namespace: configuration.namespace, environment: configuration.environment, version: revision.revision_number, revisionId: revision.revision_id, contractHash: bundle.manifest.metadata.labels?.['feltdb.contract_hash'], artifactHash: bundle.artifactHash, sourceRevision: bundle.sourceRevision, publishedAt: new Date().toISOString() }, null, 2)}\n`, { mode: 0o600 });
+    fs.writeFileSync(path.join(cwd, '.feltdb', 'last-published.json'), `${JSON.stringify({ applicationId: configuration.applicationId, tenantId: bundle.manifest.tenant_id || configuration.tenantId, namespace: configuration.namespace, environment: configuration.environment, version: revision.revision_number, revisionId: revision.revision_id, contractHash: bundle.manifest.metadata.labels?.['feltdb.contract_hash'], artifactHash: bundle.artifactHash, sourceRevision: bundle.sourceRevision, publishedAt: new Date().toISOString() }, null, 2)}\n`, { mode: 0o600 });
     log(`✓ Published immutable version ${revision.revision_number}`);
     log(`✓ Activated in ${configuration.environment}`);
-    return { status: 'published', current, bundle, revision, diff, promoted };
+    const verified = options.contract ? await verifyRuntimeKey(configuration, revision.revision_id, log) : undefined;
+    return { status: 'published', current, bundle, revision, diff, promoted, verified };
 }

package/dist/collection.d.ts

@@ -359,7 +359,9 @@ export declare class Collection<T> {
     /**
      * Refresh data from the database and notify subscribers.
      */
-    refresh(): Promise<void>;
+    refresh(options?: {
+        strict?: boolean;
+    }): Promise<void>;
 }
 /**
  * Relationship helper for loading related data.

package/dist/collection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collection.d.ts","sourceRoot":"","sources":["../src/collection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AAMxB,OAAO,KAAK,EAAE,WAAW,EAAc,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAErF,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAKD,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;AAChD,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC;AAEjD,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAqCD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IACnC,4EAA4E;IAC5E,eAAe,EAAE,OAAO,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,mCAAmC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,IAAI,CAAC,EAAE,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,UAAU,CAAC,CAAC;IACvB,OAAO,CAAC,EAAE,CAAO;IACjB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,KAAK,CAAW;IACxB,OAAO,CAAC,WAAW,CAAiC;IACpD,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,oBAAoB,CAA8B;IAC1D,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,YAAY,CAAoC;IACxD,iGAAiG;IACjG,OAAO,CAAC,eAAe,CAAkC;IACzD,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,aAAa,CAAS;IAC9B,mFAAmF;IACnF,OAAO,CAAC,eAAe,CAAK;IAC5B,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CAAM;IAC/B,OAAO,CAAC,QAAQ,CAAoC;IACpD,oEAAoE;IACpE,OAAO,CAAC,WAAW,CAA+B;IAClD,kFAAkF;IAClF,OAAO,CAAC,eAAe,CAAuB;IAC9C;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAyB;IAC/C,yEAAyE;IACzE,OAAO,CAAC,aAAa,CAA+B;gBAExC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,UAAO;IAoBxG;;OAEG;YACW,oBAAoB;IAelC;;;OAGG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAKzB,qEAAqE;IAC/D,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAI1B;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,KAAK,GAAE,OAAO,CAAC,CAAC,CAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAuFjF,6EAA6E;IACvE,KAAK,CAAC,KAAK,GAAE,OAAO,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAIjD;;;;;OAKG;IACH,aAAa,IAAI,mBAAmB,GAAG,IAAI;IAI3C,wEAAwE;IACxE,OAAO,CAAC,QAAQ;IAWhB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAiBvB;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IA0BhC;;;;;OAKG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAatC;;OAEG;IACH,WAAW,IAAI,WAAW,EAAE;IAI5B;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBrC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAazC;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAYjD;;;OAGG;IACH,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IAO7C;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,MAAM,CAAC;IAmDlG,qEAAqE;IAC/D,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlE;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBrE,8EAA8E;YAChE,cAAc;IAc5B,wGAAwG;IACxG,OAAO,CAAC,gBAAgB;IAMxB,4EAA4E;YAC9D,OAAO;IAYrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACG,eAAe,CACnB,EAAE,EAAE,MAAM,GAAG,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,aAAa,CAAC,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,EACxB,gBAAgB,CAAC,EAAE,OAAO,EAC1B,YAAY,CAAC,EAAE,CAAC,GACf,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IA6EpC;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BhD;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAK9B;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKnD;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;;;OAQG;YACW,6BAA6B;IAkC3C;;;;;OAKG;YACW,iCAAiC;IAyE/C;;;;;;;;;;;;;OAaG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,CAAC,CAAA;KAAE,CAAC;IAsClG;;;OAGG;IACH,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI;IA6CxE,mEAAmE;IACnE,KAAK,IAAI,IAAI;IASb;;;;;;;;;;;OAWG;IACH,SAAS,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAIzC;;;;;;OAMG;IACH,kBAAkB,IAAI,cAAc,GAAG,IAAI;IAI3C;;;;;;;;;OASG;YACW,eAAe;IAQ7B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CA2E/B;AAED;;GAEG;AACH,qBAAa,YAAY,CAAC,MAAM,EAAE,KAAK;IACrC,OAAO,CAAC,QAAQ,CAAO;IACvB,OAAO,CAAC,OAAO,CAAO;IACtB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,UAAU,CAAoC;gBAGpD,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,IAAI,EACb,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,GAAG,MAAM;IAQ/C;;OAEG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;CAoBxD"}
+{"version":3,"file":"collection.d.ts","sourceRoot":"","sources":["../src/collection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AAMxB,OAAO,KAAK,EAAE,WAAW,EAAc,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAErF,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAKD,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;AAChD,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC;AAEjD,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAqCD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IACnC,4EAA4E;IAC5E,eAAe,EAAE,OAAO,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,mCAAmC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,IAAI,CAAC,EAAE,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,UAAU,CAAC,CAAC;IACvB,OAAO,CAAC,EAAE,CAAO;IACjB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,KAAK,CAAW;IACxB,OAAO,CAAC,WAAW,CAAiC;IACpD,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,oBAAoB,CAA8B;IAC1D,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,YAAY,CAAoC;IACxD,iGAAiG;IACjG,OAAO,CAAC,eAAe,CAAkC;IACzD,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,aAAa,CAAS;IAC9B,mFAAmF;IACnF,OAAO,CAAC,eAAe,CAAK;IAC5B,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CAAM;IAC/B,OAAO,CAAC,QAAQ,CAAoC;IACpD,oEAAoE;IACpE,OAAO,CAAC,WAAW,CAA+B;IAClD,kFAAkF;IAClF,OAAO,CAAC,eAAe,CAAuB;IAC9C;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAyB;IAC/C,yEAAyE;IACzE,OAAO,CAAC,aAAa,CAA+B;gBAExC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,UAAO;IAoBxG;;OAEG;YACW,oBAAoB;IAelC;;;OAGG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAOzB,qEAAqE;IAC/D,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAI1B;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,KAAK,GAAE,OAAO,CAAC,CAAC,CAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IA0FjF,6EAA6E;IACvE,KAAK,CAAC,KAAK,GAAE,OAAO,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAIjD;;;;;OAKG;IACH,aAAa,IAAI,mBAAmB,GAAG,IAAI;IAI3C,wEAAwE;IACxE,OAAO,CAAC,QAAQ;IAWhB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAiBvB;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IA0BhC;;;;;OAKG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAatC;;OAEG;IACH,WAAW,IAAI,WAAW,EAAE;IAI5B;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBrC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAazC;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAYjD;;;OAGG;IACH,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IAO7C;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,MAAM,CAAC;IAmDlG,qEAAqE;IAC/D,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlE;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBrE,8EAA8E;YAChE,cAAc;IAc5B,wGAAwG;IACxG,OAAO,CAAC,gBAAgB;IAMxB,4EAA4E;YAC9D,OAAO;IAYrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACG,eAAe,CACnB,EAAE,EAAE,MAAM,GAAG,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,aAAa,CAAC,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,EACxB,gBAAgB,CAAC,EAAE,OAAO,EAC1B,YAAY,CAAC,EAAE,CAAC,GACf,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IA6EpC;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgChD;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAK9B;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKnD;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;;;OAQG;YACW,6BAA6B;IAkC3C;;;;;OAKG;YACW,iCAAiC;IAyE/C;;;;;;;;;;;;;OAaG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,CAAC,CAAA;KAAE,CAAC;IAsClG;;;OAGG;IACH,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI;IA6CxE,mEAAmE;IACnE,KAAK,IAAI,IAAI;IASb;;;;;;;;;;;OAWG;IACH,SAAS,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAIzC;;;;;;OAMG;IACH,kBAAkB,IAAI,cAAc,GAAG,IAAI;IAI3C;;;;;;;;;OASG;YACW,eAAe;IAQ7B;;OAEG;IACG,OAAO,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CA6EjE;AAgBD;;GAEG;AACH,qBAAa,YAAY,CAAC,MAAM,EAAE,KAAK;IACrC,OAAO,CAAC,QAAQ,CAAO;IACvB,OAAO,CAAC,OAAO,CAAO;IACtB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,UAAU,CAAoC;gBAGpD,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,IAAI,EACb,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,GAAG,MAAM;IAQ/C;;OAEG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;CAoBxD"}