@hediet/linkrpc 0.0.1

package/dist/chunks/hub.interfaces-BzWfsVT2.js

@@ -0,0 +1,526 @@
+/*---------------------------------------------------------------------------------------------
+*  Copyright (c) Microsoft Corporation. All rights reserved.
+*  Licensed under the MIT License. See License.txt in the project root for license information.
+*--------------------------------------------------------------------------------------------*/
+import { C as defineInterface, N as requestType } from "./boundedTrafficSubscription-1L592xc7.js";
+import { array, boolean, discriminatedUnion, enum as enum$1, extend, literal, minLength, number, object, optional, record, string, union, unknown } from "zod/mini";
+//#region src/hub/common/hub.interfaces.ts
+const zMemberPattern = union([object({ exact: string() }), object({ prefix: string() })]);
+/**
+* Optional per-permission invocation preview the requester suggests for
+* "Allow once" consent UX. When present, the user can bind the resulting
+* capability to this exact (method, params, interfaceHash) tuple.
+*
+* `nonce` and `signedAtMs` are consumer-chosen and identify the exact call
+* attempt the cap will authorise. The host hashes the same canonical
+* bytes the consumer will sign; the gate re-derives the hash from the
+* inbound call and compares. The consumer MUST use the same
+* nonce+signedAtMs when it actually issues the call (`@hediet/linkrpc`'s
+* {@link JsonRpcChannel.setCapProvider} hook does this automatically).
+*
+* Everything in `params` is shown to the user verbatim.
+*/
+const zCallIntent = object({
+	/** Fully-qualified method name the requester intends to call. */
+	method: string(),
+	/** Exact params the requester intends to send. */
+	params: optional(unknown()),
+	/** Optional schema hash assertion the call carries inside the signed payload. */
+	interfaceHash: optional(string()),
+	/** base64url-encoded nonce bytes the consumer will sign with. */
+	nonce: string(),
+	/** Unix milliseconds the consumer will sign with. */
+	signedAtMs: number(),
+	/** Optional one-line summary the shell displays next to params. */
+	summary: optional(string()),
+	/** Requester's preferred default action (`once` if omitted). */
+	suggestion: optional(enum$1([
+		"once",
+		"shortLived",
+		"longLived",
+		"persistent"
+	]))
+});
+const zParamMatcher = union([
+	object({ exact: unknown() }),
+	object({ enum: array(unknown()) }),
+	object({ prefix: string() }),
+	object({ subsetOf: array(string()) }),
+	object({ any: literal(true) })
+]);
+const zCallBindHash = object({
+	alg: literal("sha256"),
+	payloadHash: string()
+});
+/** Wire shape of `TargetPattern` from `@hediet/linkrpc`. */
+const zTargetPattern = object({
+	serviceId: zMemberPattern,
+	interfaceId: zMemberPattern,
+	interfaceHash: optional(string()),
+	members: array(zMemberPattern)
+});
+/**
+* Wire shape of `Permission` from `@hediet/linkrpc/identity/capability`.
+* Used by `hubAccess::requestAccess` so the consumer can describe exactly
+* what authority it wants — including wildcard service ids
+* (`target.serviceId: { prefix: "" }`). `canInvoke`/`canDelegate` default
+* to `false` (fail closed).
+*/
+const zPermission = object({
+	target: zTargetPattern,
+	canInvoke: optional(boolean()),
+	canDelegate: optional(boolean()),
+	params: optional(record(string(), zParamMatcher)),
+	callBind: optional(zCallBindHash)
+});
+/**
+* A `requestAccess` permission carrying the consent-only {@link zCallIntent}
+* preview alongside the authority it requests. The host strips `callIntent`
+* before minting the signed capability.
+*/
+const zRequestPermission = extend(zPermission, { callIntent: optional(zCallIntent) });
+/**
+* Who is asking, plus the `principal` that becomes the minted capability's
+* `audience`/target. The hub uses `principal` directly (it is no longer derived
+* from the call's verified signer): a cap minted for a `principal` is only usable
+* by the holder of that principal's key, enforced at call time
+* (`permits` checks `audience === call.signer`).
+*/
+const zConsumer = object({
+	name: string(),
+	/** Capability audience/target — the consumer's own PrincipalId. */
+	principal: string(),
+	origin: optional(string()),
+	purpose: optional(string())
+});
+/**
+* Wire shape of `SignedCapability` from `@hediet/linkrpc`. Mirrors the
+* structural type without pulling zod into the identity package. Keep in
+* sync with `Capability` / `SignedCapability` there.
+*
+* A capability is now a flat object (its fields) plus a `$hubrpcSignature`
+* map carrying the issuer's `capability` signature. Delegation links to a
+* single `parentHash` (the parent's `signedHash("capability", ...)`).
+*/
+const zSignedCapability = object({
+	issuer: string(),
+	audience: string(),
+	permissions: array(zPermission),
+	expiresAtMs: optional(number()),
+	parentHash: optional(string()),
+	nonce: string(),
+	$hubrpcSignature: object({
+		capability: optional(object({
+			keyId: string(),
+			sig: string()
+		})),
+		call: optional(object({
+			keyId: string(),
+			sig: string()
+		}))
+	})
+});
+/** Lifetime hint for a minted capability. Shared across hubAccess + the manifest. */
+const zDuration = enum$1([
+	"once",
+	"shortLived",
+	"longLived",
+	"persistent"
+]);
+/** One interface a slot's chosen service must implement. */
+const zInterfaceRef = object({
+	id: string(),
+	hash: optional(string()),
+	/** Default true. */
+	required: optional(boolean())
+});
+/** One member (method) the consumer intends to call on a slot's interface. */
+const zMemberRequest = object({
+	interfaceId: string(),
+	member: zMemberPattern,
+	/** Default true. */
+	required: optional(boolean())
+});
+/**
+* A consumer's need for ONE service: the interfaces it must speak and the
+* members it intends to call. The discovery side of both `hubAccess::request`
+* (sent as a call param) and `hubAccessManifest` (published as state).
+*/
+const zSlotRequest = object({
+	interfaces: array(zInterfaceRef),
+	members: optional(array(zMemberRequest))
+});
+/** The resolution of one slot: exactly one chosen service. */
+const zResolvedSlot = object({
+	serviceId: string(),
+	satisfiedInterfaces: array(string())
+});
+/**
+* Minimal JSON-document patch op, addressed by an RFC 6901 JSON Pointer.
+* `path: ""` targets the whole document; a pointer like `/granted/secretStore`
+* targets one entry. Used by `hubAccessManifest::setCurrent` to replace the
+* entire granted document or a single entry.
+*/
+const zManifestPatch = discriminatedUnion("op", [object({
+	op: literal("set"),
+	path: string(),
+	value: unknown()
+}), object({
+	op: literal("remove"),
+	path: string()
+})]);
+/**
+* `hubServiceIdRegistry::registerServiceId` — a participant claims a prefix
+* **outside** its provenance-granted namespace.
+*
+* Reached under the hub's own service id (form-3
+* `<hubServiceId>::hubServiceIdRegistry::registerServiceId`) and gated by an
+* admin-rooted capability. For claims **within** the connection's granted
+* namespace, use the cheaper, capability-free `hubGrantedServiceId::register`
+* instead.
+*/
+const hubServiceIdRegistryInterface = defineInterface({
+	id: "hubServiceIdRegistry",
+	description: "Claim a serviceId prefix on the hub."
+}, { registerServiceId: requestType(object({ requestedPrefix: string().check(minLength(1)) }), object({})) });
+/**
+* `hubGrantedServiceId` — the ungated connection surface, served at the
+* connection root on each participant's overlay (so it is reachable directly,
+* never forwarded, and needs no capability of its own). Two jobs:
+*
+*  - `get` (unsigned) reports the topology facts the hub decided for this
+*    connection — where it is and what it may claim.
+*  - `register` (provenance-gated) claims a prefix **within**
+*    this connection's granted namespace — the capability-free claim path.
+*    Claims outside the namespace go through the admin-gated
+*    `<hubServiceId>::hubServiceIdRegistry::registerServiceId` door instead.
+*  - `getHubServiceId` (unsigned) reports the serviceId prefix the hub mounts
+*    its own global services under — the prefix to address the admin-gated
+*    registry and reflection endpoints through. Served at the connection root
+*    so a participant can discover it **before** it knows where the hub lives.
+*
+* The hub's consent front door (`hubAccess::*`) is served at the connection
+* root too, so it needs no bootstrap capability and is reached directly.
+*/
+const hubGrantedServiceIdInterface = defineInterface({
+	id: "hubGrantedServiceId",
+	description: "Connection facts and capability-free serviceId claims."
+}, {
+	/**
+	* Connection facts (unsigned). The participant pulls, on each
+	* (re)connect, the topology facts the hub has decided for this
+	* connection:
+	*
+	*  - `grantedServiceIdNamespace` — the absolute serviceId region this
+	*    connection's provenance may claim (anything at/under it). May be
+	*    the empty string, meaning "claim nothing freely".
+	*/
+	get: requestType(object({}), object({ grantedServiceIdNamespace: string() })),
+	/**
+	* The serviceId prefix the hub mounts its own global services under
+	* (default `'hub'`). Use it to address the admin-gated
+	* `<hubServiceId>::hubServiceIdRegistry::registerServiceId` door and the
+	* hub's reflection endpoints. Served at the connection root (unsigned),
+	* so a participant can learn it without first knowing where the hub
+	* lives.
+	*/
+	getHubServiceId: requestType(object({}), object({ hubServiceId: string() })),
+	/**
+	* Claim a serviceId prefix **within** this connection's provenance-
+	* granted namespace (see `get().grantedServiceIdNamespace`). No
+	* capability needed — the grant already happened out-of-band at attach
+	* time. The requested `serviceId` must equal the granted namespace or be
+	* nested beneath it; anything else is rejected (claim it through the
+	* admin-gated `<hubServiceId>::hubServiceIdRegistry::registerServiceId`
+	* door instead).
+	*/
+	register: requestType(object({ serviceId: string().check(minLength(1)) }), object({}))
+});
+/**
+* `hubAccess::request` — a consumer (e.g. a sandboxed web editor) asks the
+* hub for scoped access to one or more services.
+*
+* Consumers describe their needs as named *dependencies* ("slots"): each
+* slot lists the interfaces the chosen service must implement and the
+* methods the consumer wants to call. The hub resolves candidate services
+* from its participant directory, then forwards the bundle to a host-
+* supplied handler (see `Hub` options) that shows the user a single
+* prompt. The handler picks a concrete service per slot and approves a
+* subset of the requested methods.
+*
+* In v1 the response carries only the resolution (which serviceId was
+* chosen per slot). Once the hub holds a signing identity it will also
+* return a `SignedCapability` the consumer attaches to subsequent calls.
+* Until then, dispatch is not gated on the grant — see plan-access.md.
+*/
+const hubAccessInterface = defineInterface({
+	id: "hubAccess",
+	description: "Consumer requests scoped access to services on the hub."
+}, {
+	request: requestType(object({
+		consumer: zConsumer,
+		dependencies: record(string(), zSlotRequest),
+		duration: optional(zDuration)
+	}), discriminatedUnion("status", [
+		object({
+			status: literal("granted"),
+			slots: record(string(), zResolvedSlot),
+			/**
+			* One or more `SignedCapability`s issued by the hub
+			* (audience = consumer NodeId). Consumers attach them
+			* via `$hubrpc.capabilities` on subsequent calls. Empty
+			* array is legal (hub with no signing identity / tests).
+			*
+			* Plural so a handler can return per-slot caps with
+			* different `exp`/caveats; typical handlers return a
+			* single cap covering every granted member.
+			*/
+			capabilities: array(zSignedCapability)
+		}),
+		object({
+			status: literal("denied"),
+			reason: optional(string())
+		}),
+		object({
+			status: literal("noCandidates"),
+			/** Slot ids that have zero matching candidates. */
+			slots: array(string())
+		})
+	])),
+	/**
+	* Service-pinned widening of an existing grant. The consumer asks
+	* the hub for additional members on a `serviceId` they already
+	* deal with — same audience (their NodeId) and (intended) same
+	* `rootIssuer` as the prior grant. The hub never picks the service
+	* for the consumer here: `serviceId` is an input, not a result.
+	*
+	* On grant the response carries a fresh `SignedCapability` whose
+	* attenuations cover **only** the granted delta. Bag-compatible
+	* with the prior cap; combine via `merge` (when it exists) or
+	* just keep both in `$hubrpc.capabilities`.
+	*
+	* Distinguished from `request` so the consent UI can render a
+	* different affordance ("X already has read access on `github`,
+	* grant `update` as well?" instead of from-zero selection).
+	*
+	* TODO(hub-ledger): enforce "consumer has prior history on this
+	* service" — see `hub.ts:_handleAccessExtend`. v1 forwards
+	* directly to the host's `onAccessExtend` without consulting the
+	* `_grants` ledger; this is by design while we settle on the
+	* persistence model.
+	*/
+	extend: requestType(object({
+		consumer: zConsumer,
+		/**
+		* Service to widen the grant on. MUST equal the
+		* `serviceId` of a previously-issued attenuation for this
+		* consumer NodeId. v1 does not validate this.
+		*/
+		serviceId: string(),
+		/**
+		* The delta. Same shape as `request`'s slot.members. Each
+		* entry MUST refer to an interface the consumer has been
+		* introduced to on `serviceId` via a prior `request`.
+		*/
+		added: array(zMemberRequest),
+		duration: optional(zDuration)
+	}), discriminatedUnion("status", [object({
+		status: literal("granted"),
+		serviceId: string(),
+		/** Members actually granted (handler may approve a subset). */
+		granted: array(object({
+			interfaceId: string(),
+			member: zMemberPattern
+		})),
+		/**
+		* Capability covering only the granted delta. Audience
+		* = consumer NodeId. Bag-compatible with the prior
+		* cap on this service.
+		*/
+		capabilities: optional(array(zSignedCapability))
+	}), object({
+		status: literal("denied"),
+		reason: optional(string())
+	})])),
+	/**
+	* `hubAccess::requestAccess` — direct capability request. The
+	* consumer specifies the exact attenuations it wants. No
+	* service-discovery, no candidate resolution: the consumer
+	* already knows which `(serviceId, interfaceId, members)` it
+	* needs, including wildcards (e.g. `serviceId: { prefix: "" }`
+	* to ask for an interface anywhere).
+	*
+	* Compared to `request`:
+	*   - `request` does directory-based discovery, picks one service
+	*     per slot, and returns a cap pinned to that service. Use
+	*     when the consumer says "give me SOME service that does X".
+	*   - `requestAccess` is verbatim. Use when the consumer says
+	*     "give me exactly these attenuations". Especially useful for
+	*     reflection (`hubrpc.directory::list` on any service) and
+	*     for on-demand per-method grants from an explorer-style UI.
+	*
+	* The user prompt shows the exact `Capability` the hub will sign
+	* on Allow, same byte-equality guarantee as `request`/`extend`.
+	*/
+	requestAccess: requestType(object({
+		consumer: zConsumer,
+		permissions: array(zRequestPermission).check(minLength(1)),
+		duration: optional(zDuration)
+	}), discriminatedUnion("status", [object({
+		status: literal("granted"),
+		capabilities: array(zSignedCapability)
+	}), object({
+		status: literal("denied"),
+		reason: optional(string())
+	})]))
+});
+/**
+* The root issuer(s) whose signature the participant will accept on the minted
+* capability. A capability is only usable by its holder if it chains to a root
+* that the *target* service trusts — and not every service trusts every root.
+* So the participant declares, per entry, which minting root(s) would produce a
+* cap it can actually use; the admin must mint with one of them (or decline).
+*
+* Tri-state, by design:
+*  - **omitted** (`undefined`) — unspecified. The participant doesn't know /
+*    doesn't constrain the root; the admin picks. (The common, lenient default.)
+*  - **non-empty** (`["id:abc", …]`) — mint with one of *these* roots; a cap
+*    rooted elsewhere is useless to the participant.
+*  - **empty** (`[]`) — "no root is acceptable", i.e. nothing can satisfy this.
+*    Almost certainly a bug (it can never be granted); kept representable so a
+*    tool can detect and flag it rather than silently treating it as "any".
+*/
+const zAcceptableRootIds = array(string());
+/**
+* A desired access entry the participant publishes. Two kinds, mirroring the
+* two discovery-vs-verbatim halves of `hubAccess`:
+*
+*  - `discover` — "find me a service implementing X" (same shape as a
+*    `hubAccess::request` slot). The admin resolves one concrete service.
+*  - `direct`   — "grant exactly these permissions" (same shape as
+*    `hubAccess::requestAccess`). The serviceId is already in each permission's
+*    target; no discovery.
+*/
+const zManifestRequest = discriminatedUnion("kind", [extend(zSlotRequest, {
+	kind: literal("discover"),
+	/** Who is asking; `principal` is the audience minted caps must target. */
+	consumer: zConsumer,
+	/** Human rationale shown to the admin ("seal tokens at rest"). */
+	reason: optional(string()),
+	duration: optional(zDuration),
+	/** Root issuer(s) that must mint this cap. See {@link zAcceptableRootIds}. */
+	acceptableRootIds: optional(zAcceptableRootIds),
+	/**
+	* Host-authored provenance bag, stamped at `registerHubAccessAtRoot`
+	* (NOT taken from the consumer's request params — so it cannot be
+	* spoofed). An open `record<string, unknown>` so a host can attach
+	* whatever origin info it observed about the requesting transport (e.g.
+	* `{ sourceTransportId }` to route a local consent UI). Meaningful only
+	* to a consumer that KNOWS this manifest is local; an aggregating
+	* manifest MUST re-scope or omit it.
+	*/
+	origin: optional(record(string(), unknown()))
+}), object({
+	kind: literal("direct"),
+	/** Who is asking; `principal` is the audience minted caps must target. */
+	consumer: zConsumer,
+	reason: optional(string()),
+	permissions: array(zRequestPermission).check(minLength(1)),
+	duration: optional(zDuration),
+	/** Root issuer(s) that must mint this cap. See {@link zAcceptableRootIds}. */
+	acceptableRootIds: optional(zAcceptableRootIds),
+	/** Host-authored provenance bag. See the `discover` variant. */
+	origin: optional(record(string(), unknown()))
+})]);
+/**
+* The current (granted) value of one entry. For `discover` it carries the single
+* chosen service (mirroring `hubAccess::request`'s resolved slot) plus the caps;
+* for `direct` just the caps (the serviceId is in each permission's target).
+*/
+const zGrantedEntry = discriminatedUnion("kind", [extend(zResolvedSlot, {
+	kind: literal("discover"),
+	capabilities: array(zSignedCapability)
+}), object({
+	kind: literal("direct"),
+	capabilities: array(zSignedCapability)
+})]);
+/**
+* The current value of one entry: `granted` (caps, plus the chosen service for
+* `discover`) or `denied` (with an optional reason). An entry *absent* from the
+* current document is **undecided** — distinct from a terminal `denied`, which
+* lets an approver say "no" (and why) instead of silently withholding.
+*/
+const zCurrentEntry = discriminatedUnion("status", [object({
+	status: literal("granted"),
+	granted: zGrantedEntry
+}), object({
+	status: literal("denied"),
+	reason: optional(string())
+})]);
+/**
+* `hubAccessManifest` — the declarative twin of {@link hubAccessInterface}.
+*
+* Where `hubAccess` is the imperative, just-in-time door a consumer *calls* (and
+* the hub serves at the connection root), `hubAccessManifest` is **served by the
+* participant** under its own serviceId, so it appears in `hubrpc.directory::list`
+* — its very presence is the request. A participant publishes its DESIRED access
+* entries (keyed by id, like `request`'s `dependencies`); an admin discovers
+* them via the directory, mints capabilities **with its own identity** (a
+* configured hub capability root), and writes the CURRENT/granted state back via
+* patches. The participant reads the granted entries and attaches the caps to
+* its later calls.
+*
+* Reconcile model (desired vs. current), aligned with the hub's other surfaces:
+*  - `getDesired` / `watchDesired` — the participant's declared needs.
+*  - `getCurrent` / `setCurrent` / `watchCurrent` — the admin-written grants.
+*
+* `watch*` follows the coarse empty-tick convention of `hubrpc.directory::watch`:
+* a tick means "re-`get` now", keeping the server stateless (no per-item deltas).
+*/
+const hubAccessManifestInterface = defineInterface({
+	id: "hubAccessManifest",
+	description: "Participant-served declarative access: publish DESIRED access entries (discover | direct), an admin mints capabilities and writes the CURRENT granted state back. The reconcile twin of hubAccess::{request,requestAccess}."
+}, {
+	/** The full desired document: who is asking and the entries it wants. */
+	getDesired: requestType(object({}), object({
+		/**
+		* entryId → desired entry, each carrying its own `consumer`. A
+		* per-participant manifest's entries all share one consumer; a hub
+		* broker aggregates entries from many consumers in one flat map.
+		*/
+		requested: record(string(), zManifestRequest),
+		/** Bumped whenever `requested` changes; lets watchers dedupe ticks. */
+		revision: number()
+	})).withStream({ client: object({}) }),
+	/**
+	* Coarse change tap on the desired document. Emits an empty tick when
+	* `requested` may have changed; the caller re-`getDesired`. Resolves when
+	* the caller cancels. Mirrors `hubrpc.directory::watch`.
+	*/
+	watchDesired: requestType(object({}), object({})).withStream({ server: object({}) }),
+	/** The full current document: entryId → granted/denied (absent ⇒ undecided). */
+	getCurrent: requestType(object({}), object({
+		/** entryId → current value (granted | denied). */
+		current: record(string(), zCurrentEntry),
+		/** Bumped on every successful `setCurrent`. */
+		revision: number()
+	})),
+	/**
+	* Apply patches to the current document. Replace the whole document with
+	* `{ op: 'set', path: '', value }`, or a single entry with
+	* `{ op: 'set', path: '/current/<entryId>', value }` (a `zCurrentEntry`:
+	* granted or denied). Admin-only in practice (gated by a capability
+	* rooted at an accepted issuer).
+	*/
+	setCurrent: requestType(object({ patches: array(zManifestPatch) }), object({ revision: number() })).withStream({ client: object({}) }),
+	/**
+	* Coarse change tap on the current document. Emits an empty tick when
+	* `current` may have changed; the participant re-`getCurrent` and applies
+	* any new capabilities. Resolves when the caller cancels.
+	*/
+	watchCurrent: requestType(object({}), object({})).withStream({ server: object({}) })
+});
+//#endregion
+export { hubServiceIdRegistryInterface as i, hubAccessManifestInterface as n, hubGrantedServiceIdInterface as r, hubAccessInterface as t };
+
+//# sourceMappingURL=hub.interfaces-BzWfsVT2.js.map

package/dist/chunks/hub.interfaces-BzWfsVT2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub.interfaces-BzWfsVT2.js","names":["zEnum"],"sources":["../../src/hub/common/hub.interfaces.ts"],"sourcesContent":["import { array, boolean, discriminatedUnion, enum as zEnum, extend, literal, minLength, number, object, optional, record, string, union, unknown } from 'zod/mini';\nimport { defineInterface, requestType, type InterfaceClient } from '../../index';\n\nconst zMemberPattern = union([\n    object({ exact: string() }),\n    object({ prefix: string() }),\n]);\n\n/**\n * Optional per-permission invocation preview the requester suggests for\n * \"Allow once\" consent UX. When present, the user can bind the resulting\n * capability to this exact (method, params, interfaceHash) tuple.\n *\n * `nonce` and `signedAtMs` are consumer-chosen and identify the exact call\n * attempt the cap will authorise. The host hashes the same canonical\n * bytes the consumer will sign; the gate re-derives the hash from the\n * inbound call and compares. The consumer MUST use the same\n * nonce+signedAtMs when it actually issues the call (`@hediet/linkrpc`'s\n * {@link JsonRpcChannel.setCapProvider} hook does this automatically).\n *\n * Everything in `params` is shown to the user verbatim.\n */\nconst zCallIntent = object({\n    /** Fully-qualified method name the requester intends to call. */\n    method: string(),\n    /** Exact params the requester intends to send. */\n    params: optional(unknown()),\n    /** Optional schema hash assertion the call carries inside the signed payload. */\n    interfaceHash: optional(string()),\n    /** base64url-encoded nonce bytes the consumer will sign with. */\n    nonce: string(),\n    /** Unix milliseconds the consumer will sign with. */\n    signedAtMs: number(),\n    /** Optional one-line summary the shell displays next to params. */\n    summary: optional(string()),\n    /** Requester's preferred default action (`once` if omitted). */\n    suggestion: optional(zEnum(['once', 'shortLived', 'longLived', 'persistent'])),\n});\n\nconst zParamMatcher = union([\n    object({ exact: unknown() }),\n    object({ enum: array(unknown()) }),\n    object({ prefix: string() }),\n    object({ subsetOf: array(string()) }),\n    object({ any: literal(true) }),\n]);\n\nconst zCallBindHash = object({\n    alg: literal('sha256'),\n    payloadHash: string(),\n});\n\n/** Wire shape of `TargetPattern` from `@hediet/linkrpc`. */\nconst zTargetPattern = object({\n    serviceId: zMemberPattern,\n    interfaceId: zMemberPattern,\n    interfaceHash: optional(string()),\n    members: array(zMemberPattern),\n});\n\n/**\n * Wire shape of `Permission` from `@hediet/linkrpc/identity/capability`.\n * Used by `hubAccess::requestAccess` so the consumer can describe exactly\n * what authority it wants — including wildcard service ids\n * (`target.serviceId: { prefix: \"\" }`). `canInvoke`/`canDelegate` default\n * to `false` (fail closed).\n */\nconst zPermission = object({\n    target: zTargetPattern,\n    canInvoke: optional(boolean()),\n    canDelegate: optional(boolean()),\n    params: optional(record(string(), zParamMatcher)),\n    callBind: optional(zCallBindHash),\n});\n\n/**\n * A `requestAccess` permission carrying the consent-only {@link zCallIntent}\n * preview alongside the authority it requests. The host strips `callIntent`\n * before minting the signed capability.\n */\nconst zRequestPermission = extend(zPermission, {\n    callIntent: optional(zCallIntent),\n});\n\n/**\n * Who is asking, plus the `principal` that becomes the minted capability's\n * `audience`/target. The hub uses `principal` directly (it is no longer derived\n * from the call's verified signer): a cap minted for a `principal` is only usable\n * by the holder of that principal's key, enforced at call time\n * (`permits` checks `audience === call.signer`).\n */\nconst zConsumer = object({\n    name: string(),\n    /** Capability audience/target — the consumer's own PrincipalId. */\n    principal: string(),\n    origin: optional(string()),\n    purpose: optional(string()),\n});\n\n/**\n * Wire shape of `SignedCapability` from `@hediet/linkrpc`. Mirrors the\n * structural type without pulling zod into the identity package. Keep in\n * sync with `Capability` / `SignedCapability` there.\n *\n * A capability is now a flat object (its fields) plus a `$hubrpcSignature`\n * map carrying the issuer's `capability` signature. Delegation links to a\n * single `parentHash` (the parent's `signedHash(\"capability\", ...)`).\n */\nconst zSignedCapability = object({\n    issuer: string(),\n    audience: string(),\n    permissions: array(zPermission),\n    expiresAtMs: optional(number()),\n    parentHash: optional(string()),\n    nonce: string(),\n    $hubrpcSignature: object({\n        capability: optional(object({ keyId: string(), sig: string() })),\n        call: optional(object({ keyId: string(), sig: string() })),\n    }),\n});\n\n/** Lifetime hint for a minted capability. Shared across hubAccess + the manifest. */\nconst zDuration = zEnum(['once', 'shortLived', 'longLived', 'persistent']);\n\n// ---- discovery slot shapes (shared by hubAccess.request and hubAccessManifest) ----\n\n/** One interface a slot's chosen service must implement. */\nconst zInterfaceRef = object({\n    id: string(),\n    hash: optional(string()),\n    /** Default true. */\n    required: optional(boolean()),\n});\n\n/** One member (method) the consumer intends to call on a slot's interface. */\nconst zMemberRequest = object({\n    interfaceId: string(),\n    member: zMemberPattern,\n    /** Default true. */\n    required: optional(boolean()),\n});\n\n/**\n * A consumer's need for ONE service: the interfaces it must speak and the\n * members it intends to call. The discovery side of both `hubAccess::request`\n * (sent as a call param) and `hubAccessManifest` (published as state).\n */\nconst zSlotRequest = object({\n    interfaces: array(zInterfaceRef),\n    members: optional(array(zMemberRequest)),\n});\n\n/** The resolution of one slot: exactly one chosen service. */\nconst zResolvedSlot = object({\n    serviceId: string(),\n    satisfiedInterfaces: array(string()),\n});\n\n/**\n * Minimal JSON-document patch op, addressed by an RFC 6901 JSON Pointer.\n * `path: \"\"` targets the whole document; a pointer like `/granted/secretStore`\n * targets one entry. Used by `hubAccessManifest::setCurrent` to replace the\n * entire granted document or a single entry.\n */\nconst zManifestPatch = discriminatedUnion('op', [\n    object({ op: literal('set'), path: string(), value: unknown() }),\n    object({ op: literal('remove'), path: string() }),\n]);\n\n/**\n * `hubServiceIdRegistry::registerServiceId` — a participant claims a prefix\n * **outside** its provenance-granted namespace.\n *\n * Reached under the hub's own service id (form-3\n * `<hubServiceId>::hubServiceIdRegistry::registerServiceId`) and gated by an\n * admin-rooted capability. For claims **within** the connection's granted\n * namespace, use the cheaper, capability-free `hubGrantedServiceId::register`\n * instead.\n */\nexport const hubServiceIdRegistryInterface = defineInterface(\n    {\n        id: 'hubServiceIdRegistry',\n        description: 'Claim a serviceId prefix on the hub.',\n    },\n    {\n        registerServiceId: requestType(\n            object({\n                requestedPrefix: string().check(minLength(1)),\n            }),\n            object({}),\n        ),\n    },\n);\n\n\n/**\n * `hubGrantedServiceId` — the ungated connection surface, served at the\n * connection root on each participant's overlay (so it is reachable directly,\n * never forwarded, and needs no capability of its own). Two jobs:\n *\n *  - `get` (unsigned) reports the topology facts the hub decided for this\n *    connection — where it is and what it may claim.\n *  - `register` (provenance-gated) claims a prefix **within**\n *    this connection's granted namespace — the capability-free claim path.\n *    Claims outside the namespace go through the admin-gated\n *    `<hubServiceId>::hubServiceIdRegistry::registerServiceId` door instead.\n *  - `getHubServiceId` (unsigned) reports the serviceId prefix the hub mounts\n *    its own global services under — the prefix to address the admin-gated\n *    registry and reflection endpoints through. Served at the connection root\n *    so a participant can discover it **before** it knows where the hub lives.\n *\n * The hub's consent front door (`hubAccess::*`) is served at the connection\n * root too, so it needs no bootstrap capability and is reached directly.\n */\nexport const hubGrantedServiceIdInterface = defineInterface(\n    {\n        id: 'hubGrantedServiceId',\n        description: 'Connection facts and capability-free serviceId claims.',\n    },\n    {\n        /**\n         * Connection facts (unsigned). The participant pulls, on each\n         * (re)connect, the topology facts the hub has decided for this\n         * connection:\n         *\n         *  - `grantedServiceIdNamespace` — the absolute serviceId region this\n         *    connection's provenance may claim (anything at/under it). May be\n         *    the empty string, meaning \"claim nothing freely\".\n         */\n        get: requestType(\n            object({}),\n            object({\n                grantedServiceIdNamespace: string(),\n            }),\n        ),\n\n        /**\n         * The serviceId prefix the hub mounts its own global services under\n         * (default `'hub'`). Use it to address the admin-gated\n         * `<hubServiceId>::hubServiceIdRegistry::registerServiceId` door and the\n         * hub's reflection endpoints. Served at the connection root (unsigned),\n         * so a participant can learn it without first knowing where the hub\n         * lives.\n         */\n        getHubServiceId: requestType(\n            object({}),\n            object({\n                hubServiceId: string(),\n            }),\n        ),\n\n        /**\n         * Claim a serviceId prefix **within** this connection's provenance-\n         * granted namespace (see `get().grantedServiceIdNamespace`). No\n         * capability needed — the grant already happened out-of-band at attach\n         * time. The requested `serviceId` must equal the granted namespace or be\n         * nested beneath it; anything else is rejected (claim it through the\n         * admin-gated `<hubServiceId>::hubServiceIdRegistry::registerServiceId`\n         * door instead).\n         */\n        register: requestType(\n            object({ serviceId: string().check(minLength(1)) }),\n            object({}),\n        ),\n    },\n);\n\n/**\n * `hubAccess::request` — a consumer (e.g. a sandboxed web editor) asks the\n * hub for scoped access to one or more services.\n *\n * Consumers describe their needs as named *dependencies* (\"slots\"): each\n * slot lists the interfaces the chosen service must implement and the\n * methods the consumer wants to call. The hub resolves candidate services\n * from its participant directory, then forwards the bundle to a host-\n * supplied handler (see `Hub` options) that shows the user a single\n * prompt. The handler picks a concrete service per slot and approves a\n * subset of the requested methods.\n *\n * In v1 the response carries only the resolution (which serviceId was\n * chosen per slot). Once the hub holds a signing identity it will also\n * return a `SignedCapability` the consumer attaches to subsequent calls.\n * Until then, dispatch is not gated on the grant — see plan-access.md.\n */\nexport const hubAccessInterface = defineInterface(\n    {\n        id: 'hubAccess',\n        description: 'Consumer requests scoped access to services on the hub.',\n    },\n    {\n        request: requestType(\n            object({\n                consumer: zConsumer,\n                dependencies: record(string(), zSlotRequest),\n                duration: optional(zDuration),\n            }),\n            discriminatedUnion('status', [\n                object({\n                    status: literal('granted'),\n                    slots: record(string(), zResolvedSlot),\n                    /**\n                     * One or more `SignedCapability`s issued by the hub\n                     * (audience = consumer NodeId). Consumers attach them\n                     * via `$hubrpc.capabilities` on subsequent calls. Empty\n                     * array is legal (hub with no signing identity / tests).\n                     *\n                     * Plural so a handler can return per-slot caps with\n                     * different `exp`/caveats; typical handlers return a\n                     * single cap covering every granted member.\n                     */\n                    capabilities: array(zSignedCapability),\n                }),\n                object({\n                    status: literal('denied'),\n                    reason: optional(string()),\n                }),\n                object({\n                    status: literal('noCandidates'),\n                    /** Slot ids that have zero matching candidates. */\n                    slots: array(string()),\n                }),\n            ]),\n        ),\n\n        /**\n         * Service-pinned widening of an existing grant. The consumer asks\n         * the hub for additional members on a `serviceId` they already\n         * deal with — same audience (their NodeId) and (intended) same\n         * `rootIssuer` as the prior grant. The hub never picks the service\n         * for the consumer here: `serviceId` is an input, not a result.\n         *\n         * On grant the response carries a fresh `SignedCapability` whose\n         * attenuations cover **only** the granted delta. Bag-compatible\n         * with the prior cap; combine via `merge` (when it exists) or\n         * just keep both in `$hubrpc.capabilities`.\n         *\n         * Distinguished from `request` so the consent UI can render a\n         * different affordance (\"X already has read access on `github`,\n         * grant `update` as well?\" instead of from-zero selection).\n         *\n         * TODO(hub-ledger): enforce \"consumer has prior history on this\n         * service\" — see `hub.ts:_handleAccessExtend`. v1 forwards\n         * directly to the host's `onAccessExtend` without consulting the\n         * `_grants` ledger; this is by design while we settle on the\n         * persistence model.\n         */\n        extend: requestType(\n            object({\n                consumer: zConsumer,\n                /**\n                 * Service to widen the grant on. MUST equal the\n                 * `serviceId` of a previously-issued attenuation for this\n                 * consumer NodeId. v1 does not validate this.\n                 */\n                serviceId: string(),\n                /**\n                 * The delta. Same shape as `request`'s slot.members. Each\n                 * entry MUST refer to an interface the consumer has been\n                 * introduced to on `serviceId` via a prior `request`.\n                 */\n                added: array(zMemberRequest),\n                duration: optional(zDuration),\n            }),\n            discriminatedUnion('status', [\n                object({\n                    status: literal('granted'),\n                    serviceId: string(),\n                    /** Members actually granted (handler may approve a subset). */\n                    granted: array(\n                        object({\n                            interfaceId: string(),\n                            member: zMemberPattern,\n                        }),\n                    ),\n                    /**\n                     * Capability covering only the granted delta. Audience\n                     * = consumer NodeId. Bag-compatible with the prior\n                     * cap on this service.\n                     */\n                    capabilities: optional(array(zSignedCapability)),\n                }),\n                object({\n                    status: literal('denied'),\n                    reason: optional(string()),\n                }),\n                // TODO(hub-ledger): additional variants once the host's\n                // grant ledger is persisted:\n                //   - { status: \"unknownService\", serviceId }\n                //   - { status: \"unknownInterface\", serviceId, interfaceIds }\n                // Reject without ever prompting the user when the consumer\n                // is asking to widen a service it has no prior grant on.\n            ]),\n        ),\n\n        /**\n         * `hubAccess::requestAccess` — direct capability request. The\n         * consumer specifies the exact attenuations it wants. No\n         * service-discovery, no candidate resolution: the consumer\n         * already knows which `(serviceId, interfaceId, members)` it\n         * needs, including wildcards (e.g. `serviceId: { prefix: \"\" }`\n         * to ask for an interface anywhere).\n         *\n         * Compared to `request`:\n         *   - `request` does directory-based discovery, picks one service\n         *     per slot, and returns a cap pinned to that service. Use\n         *     when the consumer says \"give me SOME service that does X\".\n         *   - `requestAccess` is verbatim. Use when the consumer says\n         *     \"give me exactly these attenuations\". Especially useful for\n         *     reflection (`hubrpc.directory::list` on any service) and\n         *     for on-demand per-method grants from an explorer-style UI.\n         *\n         * The user prompt shows the exact `Capability` the hub will sign\n         * on Allow, same byte-equality guarantee as `request`/`extend`.\n         */\n        requestAccess: requestType(\n            object({\n                consumer: zConsumer,\n                permissions: array(zRequestPermission).check(minLength(1)),\n                duration: optional(zDuration),\n            }),\n            discriminatedUnion('status', [\n                object({\n                    status: literal('granted'),\n                    capabilities: array(zSignedCapability),\n                }),\n                object({\n                    status: literal('denied'),\n                    reason: optional(string()),\n                }),\n            ]),\n        ),\n    },\n);\n\n// ════════════════════════════════════════════════════════════════════════\n// hubAccessManifest — the declarative twin of `hubAccess`.\n// ════════════════════════════════════════════════════════════════════════\n\n/**\n * The root issuer(s) whose signature the participant will accept on the minted\n * capability. A capability is only usable by its holder if it chains to a root\n * that the *target* service trusts — and not every service trusts every root.\n * So the participant declares, per entry, which minting root(s) would produce a\n * cap it can actually use; the admin must mint with one of them (or decline).\n *\n * Tri-state, by design:\n *  - **omitted** (`undefined`) — unspecified. The participant doesn't know /\n *    doesn't constrain the root; the admin picks. (The common, lenient default.)\n *  - **non-empty** (`[\"id:abc\", …]`) — mint with one of *these* roots; a cap\n *    rooted elsewhere is useless to the participant.\n *  - **empty** (`[]`) — \"no root is acceptable\", i.e. nothing can satisfy this.\n *    Almost certainly a bug (it can never be granted); kept representable so a\n *    tool can detect and flag it rather than silently treating it as \"any\".\n */\nconst zAcceptableRootIds = array(string());\n\n/**\n * A desired access entry the participant publishes. Two kinds, mirroring the\n * two discovery-vs-verbatim halves of `hubAccess`:\n *\n *  - `discover` — \"find me a service implementing X\" (same shape as a\n *    `hubAccess::request` slot). The admin resolves one concrete service.\n *  - `direct`   — \"grant exactly these permissions\" (same shape as\n *    `hubAccess::requestAccess`). The serviceId is already in each permission's\n *    target; no discovery.\n */\nconst zManifestRequest = discriminatedUnion('kind', [\n    extend(zSlotRequest, {\n        kind: literal('discover'),\n        /** Who is asking; `principal` is the audience minted caps must target. */\n        consumer: zConsumer,\n        /** Human rationale shown to the admin (\"seal tokens at rest\"). */\n        reason: optional(string()),\n        duration: optional(zDuration),\n        /** Root issuer(s) that must mint this cap. See {@link zAcceptableRootIds}. */\n        acceptableRootIds: optional(zAcceptableRootIds),\n        /**\n         * Host-authored provenance bag, stamped at `registerHubAccessAtRoot`\n         * (NOT taken from the consumer's request params — so it cannot be\n         * spoofed). An open `record<string, unknown>` so a host can attach\n         * whatever origin info it observed about the requesting transport (e.g.\n         * `{ sourceTransportId }` to route a local consent UI). Meaningful only\n         * to a consumer that KNOWS this manifest is local; an aggregating\n         * manifest MUST re-scope or omit it.\n         */\n        origin: optional(record(string(), unknown())),\n    }),\n    object({\n        kind: literal('direct'),\n        /** Who is asking; `principal` is the audience minted caps must target. */\n        consumer: zConsumer,\n        reason: optional(string()),\n        permissions: array(zRequestPermission).check(minLength(1)),\n        duration: optional(zDuration),\n        /** Root issuer(s) that must mint this cap. See {@link zAcceptableRootIds}. */\n        acceptableRootIds: optional(zAcceptableRootIds),\n        /** Host-authored provenance bag. See the `discover` variant. */\n        origin: optional(record(string(), unknown())),\n    }),\n]);\n\n/**\n * The current (granted) value of one entry. For `discover` it carries the single\n * chosen service (mirroring `hubAccess::request`'s resolved slot) plus the caps;\n * for `direct` just the caps (the serviceId is in each permission's target).\n */\nconst zGrantedEntry = discriminatedUnion('kind', [\n    extend(zResolvedSlot, {\n        kind: literal('discover'),\n        capabilities: array(zSignedCapability),\n    }),\n    object({\n        kind: literal('direct'),\n        capabilities: array(zSignedCapability),\n    }),\n]);\n\n/**\n * The current value of one entry: `granted` (caps, plus the chosen service for\n * `discover`) or `denied` (with an optional reason). An entry *absent* from the\n * current document is **undecided** — distinct from a terminal `denied`, which\n * lets an approver say \"no\" (and why) instead of silently withholding.\n */\nconst zCurrentEntry = discriminatedUnion('status', [\n    object({ status: literal('granted'), granted: zGrantedEntry }),\n    object({ status: literal('denied'), reason: optional(string()) }),\n]);\n\n/**\n * `hubAccessManifest` — the declarative twin of {@link hubAccessInterface}.\n *\n * Where `hubAccess` is the imperative, just-in-time door a consumer *calls* (and\n * the hub serves at the connection root), `hubAccessManifest` is **served by the\n * participant** under its own serviceId, so it appears in `hubrpc.directory::list`\n * — its very presence is the request. A participant publishes its DESIRED access\n * entries (keyed by id, like `request`'s `dependencies`); an admin discovers\n * them via the directory, mints capabilities **with its own identity** (a\n * configured hub capability root), and writes the CURRENT/granted state back via\n * patches. The participant reads the granted entries and attaches the caps to\n * its later calls.\n *\n * Reconcile model (desired vs. current), aligned with the hub's other surfaces:\n *  - `getDesired` / `watchDesired` — the participant's declared needs.\n *  - `getCurrent` / `setCurrent` / `watchCurrent` — the admin-written grants.\n *\n * `watch*` follows the coarse empty-tick convention of `hubrpc.directory::watch`:\n * a tick means \"re-`get` now\", keeping the server stateless (no per-item deltas).\n */\nexport const hubAccessManifestInterface = defineInterface(\n    {\n        id: 'hubAccessManifest',\n        description:\n            'Participant-served declarative access: publish DESIRED access entries '\n            + '(discover | direct), an admin mints capabilities and writes the CURRENT '\n            + 'granted state back. The reconcile twin of hubAccess::{request,requestAccess}.',\n    },\n    {\n        // ---- desired (participant-authored; the admin reads) ----------------\n        /** The full desired document: who is asking and the entries it wants. */\n        getDesired: requestType(\n            object({}),\n            object({\n                /**\n                 * entryId → desired entry, each carrying its own `consumer`. A\n                 * per-participant manifest's entries all share one consumer; a hub\n                 * broker aggregates entries from many consumers in one flat map.\n                 */\n                requested: record(string(), zManifestRequest),\n                /** Bumped whenever `requested` changes; lets watchers dedupe ticks. */\n                revision: number(),\n            }),\n        ).withStream({ client: object({}) }),\n        /**\n         * Coarse change tap on the desired document. Emits an empty tick when\n         * `requested` may have changed; the caller re-`getDesired`. Resolves when\n         * the caller cancels. Mirrors `hubrpc.directory::watch`.\n         */\n        watchDesired: requestType(\n            object({}),\n            object({}),\n        ).withStream({ server: object({}) }),\n\n        // ---- current / granted (admin-authored; the participant reads) ------\n        /** The full current document: entryId → granted/denied (absent ⇒ undecided). */\n        getCurrent: requestType(\n            object({}),\n            object({\n                /** entryId → current value (granted | denied). */\n                current: record(string(), zCurrentEntry),\n                /** Bumped on every successful `setCurrent`. */\n                revision: number(),\n            }),\n        ),\n        /**\n         * Apply patches to the current document. Replace the whole document with\n         * `{ op: 'set', path: '', value }`, or a single entry with\n         * `{ op: 'set', path: '/current/<entryId>', value }` (a `zCurrentEntry`:\n         * granted or denied). Admin-only in practice (gated by a capability\n         * rooted at an accepted issuer).\n         */\n        setCurrent: requestType(\n            object({ patches: array(zManifestPatch) }),\n            object({ revision: number() }),\n        ).withStream({ client: object({}) }),\n        /**\n         * Coarse change tap on the current document. Emits an empty tick when\n         * `current` may have changed; the participant re-`getCurrent` and applies\n         * any new capabilities. Resolves when the caller cancels.\n         */\n        watchCurrent: requestType(\n            object({}),\n            object({}),\n        ).withStream({ server: object({}) }),\n    },\n);\n\n/**\n * The typed client shape of {@link hubAccessManifestInterface} — the exact\n * object `connection.get(hubAccessManifestInterface)` (or\n * `connection.service(id).get(...)`) returns. Approvers depend on this contract,\n * not on a concrete connection: the same approver runs against a local in-memory\n * host (loopback connection), a remote hub's served manifest, or a future\n * aggregating implementation with no code change.\n */\nexport type IHubAccessManifest = InterfaceClient<typeof hubAccessManifestInterface>;\n\n/** One typed entry from `hubAccessManifest::getDesired().requested`. */\nexport type HubAccessManifestRequest =\n    Awaited<ReturnType<IHubAccessManifest['getDesired']>>['requested'][string];\n\n/** One typed value accepted at `/current/<entryId>` by `setCurrent`. */\nexport type HubAccessManifestDecision =\n    Awaited<ReturnType<IHubAccessManifest['getCurrent']>>['current'][string];\n"],"mappings":";;;;;;;AAGA,MAAM,iBAAiB,MAAM,CACzB,OAAO,EAAE,OAAO,OAAO,EAAE,CAAC,GAC1B,OAAO,EAAE,QAAQ,OAAO,EAAE,CAAC,CAC/B,CAAC;;;;;;;;;;;;;;;AAgBD,MAAM,cAAc,OAAO;;CAEvB,QAAQ,OAAO;;CAEf,QAAQ,SAAS,QAAQ,CAAC;;CAE1B,eAAe,SAAS,OAAO,CAAC;;CAEhC,OAAO,OAAO;;CAEd,YAAY,OAAO;;CAEnB,SAAS,SAAS,OAAO,CAAC;;CAE1B,YAAY,SAASA,OAAM;EAAC;EAAQ;EAAc;EAAa;CAAY,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,gBAAgB,MAAM;CACxB,OAAO,EAAE,OAAO,QAAQ,EAAE,CAAC;CAC3B,OAAO,EAAE,MAAM,MAAM,QAAQ,CAAC,EAAE,CAAC;CACjC,OAAO,EAAE,QAAQ,OAAO,EAAE,CAAC;CAC3B,OAAO,EAAE,UAAU,MAAM,OAAO,CAAC,EAAE,CAAC;CACpC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,gBAAgB,OAAO;CACzB,KAAK,QAAQ,QAAQ;CACrB,aAAa,OAAO;AACxB,CAAC;;AAGD,MAAM,iBAAiB,OAAO;CAC1B,WAAW;CACX,aAAa;CACb,eAAe,SAAS,OAAO,CAAC;CAChC,SAAS,MAAM,cAAc;AACjC,CAAC;;;;;;;;AASD,MAAM,cAAc,OAAO;CACvB,QAAQ;CACR,WAAW,SAAS,QAAQ,CAAC;CAC7B,aAAa,SAAS,QAAQ,CAAC;CAC/B,QAAQ,SAAS,OAAO,OAAO,GAAG,aAAa,CAAC;CAChD,UAAU,SAAS,aAAa;AACpC,CAAC;;;;;;AAOD,MAAM,qBAAqB,OAAO,aAAa,EAC3C,YAAY,SAAS,WAAW,EACpC,CAAC;;;;;;;;AASD,MAAM,YAAY,OAAO;CACrB,MAAM,OAAO;;CAEb,WAAW,OAAO;CAClB,QAAQ,SAAS,OAAO,CAAC;CACzB,SAAS,SAAS,OAAO,CAAC;AAC9B,CAAC;;;;;;;;;;AAWD,MAAM,oBAAoB,OAAO;CAC7B,QAAQ,OAAO;CACf,UAAU,OAAO;CACjB,aAAa,MAAM,WAAW;CAC9B,aAAa,SAAS,OAAO,CAAC;CAC9B,YAAY,SAAS,OAAO,CAAC;CAC7B,OAAO,OAAO;CACd,kBAAkB,OAAO;EACrB,YAAY,SAAS,OAAO;GAAE,OAAO,OAAO;GAAG,KAAK,OAAO;EAAE,CAAC,CAAC;EAC/D,MAAM,SAAS,OAAO;GAAE,OAAO,OAAO;GAAG,KAAK,OAAO;EAAE,CAAC,CAAC;CAC7D,CAAC;AACL,CAAC;;AAGD,MAAM,YAAYA,OAAM;CAAC;CAAQ;CAAc;CAAa;AAAY,CAAC;;AAKzE,MAAM,gBAAgB,OAAO;CACzB,IAAI,OAAO;CACX,MAAM,SAAS,OAAO,CAAC;;CAEvB,UAAU,SAAS,QAAQ,CAAC;AAChC,CAAC;;AAGD,MAAM,iBAAiB,OAAO;CAC1B,aAAa,OAAO;CACpB,QAAQ;;CAER,UAAU,SAAS,QAAQ,CAAC;AAChC,CAAC;;;;;;AAOD,MAAM,eAAe,OAAO;CACxB,YAAY,MAAM,aAAa;CAC/B,SAAS,SAAS,MAAM,cAAc,CAAC;AAC3C,CAAC;;AAGD,MAAM,gBAAgB,OAAO;CACzB,WAAW,OAAO;CAClB,qBAAqB,MAAM,OAAO,CAAC;AACvC,CAAC;;;;;;;AAQD,MAAM,iBAAiB,mBAAmB,MAAM,CAC5C,OAAO;CAAE,IAAI,QAAQ,KAAK;CAAG,MAAM,OAAO;CAAG,OAAO,QAAQ;AAAE,CAAC,GAC/D,OAAO;CAAE,IAAI,QAAQ,QAAQ;CAAG,MAAM,OAAO;AAAE,CAAC,CACpD,CAAC;;;;;;;;;;;AAYD,MAAa,gCAAgC,gBACzC;CACI,IAAI;CACJ,aAAa;AACjB,GACA,EACI,mBAAmB,YACf,OAAO,EACH,iBAAiB,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,EAChD,CAAC,GACD,OAAO,CAAC,CAAC,CACb,EACJ,CACJ;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,+BAA+B,gBACxC;CACI,IAAI;CACJ,aAAa;AACjB,GACA;;;;;;;;;;CAUI,KAAK,YACD,OAAO,CAAC,CAAC,GACT,OAAO,EACH,2BAA2B,OAAO,EACtC,CAAC,CACL;;;;;;;;;CAUA,iBAAiB,YACb,OAAO,CAAC,CAAC,GACT,OAAO,EACH,cAAc,OAAO,EACzB,CAAC,CACL;;;;;;;;;;CAWA,UAAU,YACN,OAAO,EAAE,WAAW,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,GAClD,OAAO,CAAC,CAAC,CACb;AACJ,CACJ;;;;;;;;;;;;;;;;;;AAmBA,MAAa,qBAAqB,gBAC9B;CACI,IAAI;CACJ,aAAa;AACjB,GACA;CACI,SAAS,YACL,OAAO;EACH,UAAU;EACV,cAAc,OAAO,OAAO,GAAG,YAAY;EAC3C,UAAU,SAAS,SAAS;CAChC,CAAC,GACD,mBAAmB,UAAU;EACzB,OAAO;GACH,QAAQ,QAAQ,SAAS;GACzB,OAAO,OAAO,OAAO,GAAG,aAAa;;;;;;;;;;;GAWrC,cAAc,MAAM,iBAAiB;EACzC,CAAC;EACD,OAAO;GACH,QAAQ,QAAQ,QAAQ;GACxB,QAAQ,SAAS,OAAO,CAAC;EAC7B,CAAC;EACD,OAAO;GACH,QAAQ,QAAQ,cAAc;;GAE9B,OAAO,MAAM,OAAO,CAAC;EACzB,CAAC;CACL,CAAC,CACL;;;;;;;;;;;;;;;;;;;;;;;CAwBA,QAAQ,YACJ,OAAO;EACH,UAAU;;;;;;EAMV,WAAW,OAAO;;;;;;EAMlB,OAAO,MAAM,cAAc;EAC3B,UAAU,SAAS,SAAS;CAChC,CAAC,GACD,mBAAmB,UAAU,CACzB,OAAO;EACH,QAAQ,QAAQ,SAAS;EACzB,WAAW,OAAO;;EAElB,SAAS,MACL,OAAO;GACH,aAAa,OAAO;GACpB,QAAQ;EACZ,CAAC,CACL;;;;;;EAMA,cAAc,SAAS,MAAM,iBAAiB,CAAC;CACnD,CAAC,GACD,OAAO;EACH,QAAQ,QAAQ,QAAQ;EACxB,QAAQ,SAAS,OAAO,CAAC;CAC7B,CAAC,CAOL,CAAC,CACL;;;;;;;;;;;;;;;;;;;;;CAsBA,eAAe,YACX,OAAO;EACH,UAAU;EACV,aAAa,MAAM,kBAAkB,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC;EACzD,UAAU,SAAS,SAAS;CAChC,CAAC,GACD,mBAAmB,UAAU,CACzB,OAAO;EACH,QAAQ,QAAQ,SAAS;EACzB,cAAc,MAAM,iBAAiB;CACzC,CAAC,GACD,OAAO;EACH,QAAQ,QAAQ,QAAQ;EACxB,QAAQ,SAAS,OAAO,CAAC;CAC7B,CAAC,CACL,CAAC,CACL;AACJ,CACJ;;;;;;;;;;;;;;;;;AAsBA,MAAM,qBAAqB,MAAM,OAAO,CAAC;;;;;;;;;;;AAYzC,MAAM,mBAAmB,mBAAmB,QAAQ,CAChD,OAAO,cAAc;CACjB,MAAM,QAAQ,UAAU;;CAExB,UAAU;;CAEV,QAAQ,SAAS,OAAO,CAAC;CACzB,UAAU,SAAS,SAAS;;CAE5B,mBAAmB,SAAS,kBAAkB;;;;;;;;;;CAU9C,QAAQ,SAAS,OAAO,OAAO,GAAG,QAAQ,CAAC,CAAC;AAChD,CAAC,GACD,OAAO;CACH,MAAM,QAAQ,QAAQ;;CAEtB,UAAU;CACV,QAAQ,SAAS,OAAO,CAAC;CACzB,aAAa,MAAM,kBAAkB,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC;CACzD,UAAU,SAAS,SAAS;;CAE5B,mBAAmB,SAAS,kBAAkB;;CAE9C,QAAQ,SAAS,OAAO,OAAO,GAAG,QAAQ,CAAC,CAAC;AAChD,CAAC,CACL,CAAC;;;;;;AAOD,MAAM,gBAAgB,mBAAmB,QAAQ,CAC7C,OAAO,eAAe;CAClB,MAAM,QAAQ,UAAU;CACxB,cAAc,MAAM,iBAAiB;AACzC,CAAC,GACD,OAAO;CACH,MAAM,QAAQ,QAAQ;CACtB,cAAc,MAAM,iBAAiB;AACzC,CAAC,CACL,CAAC;;;;;;;AAQD,MAAM,gBAAgB,mBAAmB,UAAU,CAC/C,OAAO;CAAE,QAAQ,QAAQ,SAAS;CAAG,SAAS;AAAc,CAAC,GAC7D,OAAO;CAAE,QAAQ,QAAQ,QAAQ;CAAG,QAAQ,SAAS,OAAO,CAAC;AAAE,CAAC,CACpE,CAAC;;;;;;;;;;;;;;;;;;;;;AAsBD,MAAa,6BAA6B,gBACtC;CACI,IAAI;CACJ,aACI;AAGR,GACA;;CAGI,YAAY,YACR,OAAO,CAAC,CAAC,GACT,OAAO;;;;;;EAMH,WAAW,OAAO,OAAO,GAAG,gBAAgB;;EAE5C,UAAU,OAAO;CACrB,CAAC,CACL,CAAC,CAAC,WAAW,EAAE,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC;;;;;;CAMnC,cAAc,YACV,OAAO,CAAC,CAAC,GACT,OAAO,CAAC,CAAC,CACb,CAAC,CAAC,WAAW,EAAE,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC;;CAInC,YAAY,YACR,OAAO,CAAC,CAAC,GACT,OAAO;;EAEH,SAAS,OAAO,OAAO,GAAG,aAAa;;EAEvC,UAAU,OAAO;CACrB,CAAC,CACL;;;;;;;;CAQA,YAAY,YACR,OAAO,EAAE,SAAS,MAAM,cAAc,EAAE,CAAC,GACzC,OAAO,EAAE,UAAU,OAAO,EAAE,CAAC,CACjC,CAAC,CAAC,WAAW,EAAE,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC;;;;;;CAMnC,cAAc,YACV,OAAO,CAAC,CAAC,GACT,OAAO,CAAC,CAAC,CACb,CAAC,CAAC,WAAW,EAAE,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC;AACvC,CACJ"}