@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/cli/lib/authhub.js

@@ -0,0 +1,210 @@
+/**
+ * The ixo AuthHub sign-in behind `decision-oracle login`: a PKCE (S256) OAuth-style hop against the
+ * hub's `/api/auth/login` + `/api/auth/exchange`, whose result is saved as the session every other
+ * chain command loads (session.ts). No mnemonic ever goes in an env file — the hub hands back
+ * derived session keys, and the root key never leaves it.
+ */
+import { spawn } from "node:child_process";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import http from "node:http";
+import process from "node:process";
+import readline from "node:readline";
+import { NETWORKS } from "../../networks.js";
+import { fail } from "./chain.js";
+import { saveSession } from "./session.js";
+const CALLBACK_PORT = 8976;
+const CALLBACK_PATH = "/callback";
+/**
+ * Identifies this toolchain to the person logging in (printed before the browser opens) and is
+ * stamped into the saved session file (`app`/`obtainedAt`) so the file is self-identifying. NOT
+ * something the hub itself renders: `/api/auth/login` has no free-text app-name param — its consent
+ * screen resolves branding server-side by exact-matching `redirect_uri` against a registered client
+ * (an operator action, out of this command's control), and `state` is round-tripped verbatim, never
+ * parsed or displayed by the hub. Folding this name + the network into `state` anyway (below) keeps
+ * it attached to the round trip for anyone inspecting the request/callback.
+ */
+const APP_NAME = "IXO Eval Publish CLI";
+/** `Buffer` is typed `any` in this project (the Worker runtime's global declarations win over
+ *  @types/node's), so it is only ever used as a value here, never as a type. */
+function base64url(bytes) {
+    return Buffer.from(bytes).toString("base64url");
+}
+function createPkce() {
+    const verifier = base64url(randomBytes(32));
+    const challenge = base64url(createHash("sha256").update(verifier).digest());
+    return { verifier, challenge };
+}
+/** The two loopback addresses `localhost` can resolve to, each paired with the human-readable
+ *  family name used in any diagnostic (never the raw IP — that's the whole point of saying
+ *  "localhost" everywhere user-visible, error paths included). macOS browsers (Safari in
+ *  particular) try `::1` first and don't reliably fall back to `127.0.0.1` for local addresses —
+ *  binding only one family reproduces exactly the "can't reach this page" failure a real login
+ *  hit. Two sockets on the SAME port, one per family, is the standard dual-stack fix (no port
+ *  conflict: different addresses). */
+const LOOPBACK_ADDRESSES = [
+    { address: "127.0.0.1", family: "IPv4" },
+    { address: "::1", family: "IPv6" },
+];
+/**
+ * Races a loopback HTTP callback (bound on both IPv4 and IPv6 loopback, see `LOOPBACK_ADDRESSES`)
+ * against a pasted callback URL on stdin — whichever arrives first wins. Never throws on bad input
+ * (a bogus pasted line, an empty stdin/EOF, one address family failing to bind): all are logged and
+ * waiting continues on whatever paths remain, so a real browser callback still has a chance to
+ * land. Only SIGINT ends the wait (the process exits directly — see below), so callers never
+ * observe this promise rejecting.
+ */
+function raceForCallback() {
+    return new Promise((resolve) => {
+        let settled = false;
+        let bindFailures = 0;
+        const requestHandler = (req, res) => {
+            const url = new URL(req.url ?? "/", `http://localhost:${CALLBACK_PORT}`);
+            if (url.pathname !== CALLBACK_PATH) {
+                res.writeHead(404).end();
+                return;
+            }
+            const code = url.searchParams.get("code");
+            const state = url.searchParams.get("state");
+            if (!code || !state) {
+                res.writeHead(400, { "content-type": "text/plain" }).end("missing code/state");
+                return;
+            }
+            res.writeHead(200, { "content-type": "text/html" });
+            res.end("<html><body>Login complete — you can close this tab and return to the terminal.</body></html>");
+            finish({ code, state });
+        };
+        // One array pairing each address/family with ITS OWN server — never index two parallel
+        // arrays by position (that's `T | undefined` under strict indexing, and fragile besides).
+        const listeners = LOOPBACK_ADDRESSES.map(({ address, family }) => ({
+            address,
+            family,
+            server: http.createServer(requestHandler),
+        }));
+        const rl = readline.createInterface({ input: process.stdin, terminal: false });
+        function cleanup() {
+            rl.close();
+            for (const { server } of listeners)
+                server.close();
+        }
+        function finish(cb) {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve(cb);
+        }
+        for (const { address, family, server } of listeners) {
+            server.on("error", (err) => {
+                bindFailures++;
+                console.warn(`  (loopback listener (${family}) on localhost:${CALLBACK_PORT} failed to start: ${err.message})`);
+                if (bindFailures === listeners.length) {
+                    console.warn(`  (no loopback listener could start on localhost:${CALLBACK_PORT} — paste the URL instead)`);
+                }
+            });
+            server.listen(CALLBACK_PORT, address);
+        }
+        rl.on("line", (line) => {
+            const trimmed = line.trim();
+            if (!trimmed)
+                return; // a stray blank line — keep waiting
+            let parsed;
+            try {
+                parsed = new URL(trimmed);
+            }
+            catch {
+                console.error("  that doesn't look like a URL — paste the FULL redirected URL (starting with http):");
+                return;
+            }
+            const code = parsed.searchParams.get("code");
+            const state = parsed.searchParams.get("state");
+            if (!code || !state) {
+                console.error("  pasted URL is missing ?code=/&state= — paste the FULL redirected URL:");
+                return;
+            }
+            finish({ code, state });
+        });
+        rl.on("close", () => {
+            if (!settled) {
+                console.log("  (stdin closed — still waiting for the browser callback on the loopback server)");
+            }
+        });
+        // Ctrl-C: exit directly rather than rejecting this promise — a clean, immediate exit with no
+        // unhandled-rejection noise and no stack trace.
+        process.once("SIGINT", () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            console.log("\nlogin cancelled (Ctrl-C)");
+            process.exit(130);
+        });
+    });
+}
+/**
+ * Full login flow: print the URL (best-effort `open` on darwin), wait for either the loopback
+ * callback or a pasted URL, verify `state`, exchange the code, save the session.
+ */
+export async function runLogin(network) {
+    const { verifier, challenge } = createPkce();
+    // The CSRF nonce is embedded inside `state`, alongside the app name + network — the hub treats
+    // `state` as an opaque value (round-tripped verbatim, never parsed), so this is a safe place to
+    // carry that identity without needing a second query param the hub doesn't support. Comparing the
+    // whole string back below still catches a forged/stale callback exactly as a bare UUID would.
+    const state = base64url(new TextEncoder().encode(JSON.stringify({ app: APP_NAME, network, nonce: randomUUID() })));
+    // "localhost", never the raw 127.0.0.1 loopback, in anything user-visible (the URL we send the hub,
+    // what we print, what we ask the user to watch for) — the server still BINDS to both families above.
+    const redirectUri = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
+    const authHubUrl = NETWORKS[network].authHub;
+    const loginUrl = `${authHubUrl}/api/auth/login?redirect_uri=${encodeURIComponent(redirectUri)}` +
+        `&state=${encodeURIComponent(state)}&code_challenge=${encodeURIComponent(challenge)}` +
+        "&code_challenge_method=S256";
+    console.log(`\nLogging in as: ${APP_NAME} (${network})`);
+    console.log(`\n── ixo AuthHub login (${network}) ──`);
+    console.log(`  ${loginUrl}\n`);
+    if (process.platform === "darwin") {
+        try {
+            spawn("open", [loginUrl], { stdio: "ignore", detached: true }).unref();
+        }
+        catch {
+            // non-fatal — the URL is printed above regardless
+        }
+    }
+    console.log(`  Waiting for the browser to redirect to ${redirectUri} ...`);
+    console.log("  (this terminal must stay open until the browser redirects, or you paste the URL below)");
+    console.log("\n  If the browser can't reach this machine, paste the full redirected URL here:");
+    console.log("  (the code is single-use and expires in about 3 minutes — if anything fails below, re-run login for a fresh URL)");
+    const { code, state: returnedState } = await raceForCallback();
+    if (returnedState !== state) {
+        fail("state mismatch on the AuthHub callback — possible CSRF, or a stale login attempt. Re-run login.");
+    }
+    console.log("  exchanging code for a session…");
+    let session;
+    try {
+        const res = await fetch(`${authHubUrl}/api/auth/exchange?code=${encodeURIComponent(code)}&code_verifier=${encodeURIComponent(verifier)}`);
+        if (!res.ok) {
+            const body = await res.text().catch(() => "");
+            fail(`AuthHub exchange failed: ${res.status} ${body}`);
+        }
+        session = (await res.json());
+    }
+    catch (err) {
+        fail(`AuthHub exchange failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!session.address || !session.did)
+        fail("AuthHub exchange returned no address/did");
+    // Stamped locally, not part of the hub's response — makes the on-disk file self-identifying
+    // (which tool holds this bearer key, and since when) for anyone who finds it later.
+    session.app = APP_NAME;
+    session.obtainedAt = new Date().toISOString();
+    const path = await saveSession(network, session);
+    console.log(`\n✓ logged in as ${session.address} (${network})`);
+    console.log(`  did:            ${session.did}`);
+    console.log(`  session saved:  ${path}`);
+    console.log("\n  This is a ONE-TIME step per network: every other chain command reads this saved\n" +
+        `  session automatically from now on — you will NOT be asked to log in again on ${network}\n` +
+        "  unless this file is deleted or the session is revoked.");
+    console.log("\n  WARNING: this file holds a bearer SESSION signing key (derived — your AuthHub root key\n" +
+        "  never leaves the hub). Anyone who reads it can sign transactions as you until it's revoked.\n" +
+        "  Treat it like a password: never commit it, never share it (mode 0600 is already applied).\n");
+}
+//# sourceMappingURL=authhub.js.map

package/dist/cli/lib/authhub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authhub.js","sourceRoot":"","sources":["../../../src/cli/lib/authhub.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,EAAmB,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAuB,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7D,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,WAAW,CAAC;AAElC;;;;;;;;GAQG;AACH,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAExC;gFACgF;AAChF,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAOD;;;;;;sCAMsC;AACtC,MAAM,kBAAkB,GAAG;IACzB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE;IACxC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;CAC1B,CAAC;AAEX;;;;;;;GAOG;AACH,SAAS,eAAe;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,MAAM,cAAc,GAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,aAAa,EAAE,CAAC,CAAC;YACzE,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBACnC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CACL,+FAA+F,CAChG,CAAC;YACF,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC;QAEF,uFAAuF;QACvF,0FAA0F;QAC1F,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACjE,OAAO;YACP,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC;SAC1C,CAAC,CAAC,CAAC;QACJ,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAE/E,SAAS,OAAO;YACd,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,SAAS;gBAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACrD,CAAC;QAED,SAAS,MAAM,CAAC,EAAY;YAC1B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;QAED,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YACpD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,YAAY,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CACV,yBAAyB,MAAM,kBAAkB,aAAa,qBAAsB,GAAa,CAAC,OAAO,GAAG,CAC7G,CAAC;gBACF,IAAI,YAAY,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;oBACtC,OAAO,CAAC,IAAI,CACV,oDAAoD,aAAa,2BAA2B,CAC7F,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,oCAAoC;YAC1D,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,KAAK,CACX,sFAAsF,CACvF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CACT,kFAAkF,CACnF,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,6FAA6F;QAC7F,gDAAgD;QAChD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC1B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAmB;IAChD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;IAC7C,+FAA+F;IAC/F,gGAAgG;IAChG,kGAAkG;IAClG,8FAA8F;IAC9F,MAAM,KAAK,GAAG,SAAS,CACrB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAC1F,CAAC;IACF,oGAAoG;IACpG,qGAAqG;IACrG,MAAM,WAAW,GAAG,oBAAoB,aAAa,GAAG,aAAa,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;IAC7C,MAAM,QAAQ,GACZ,GAAG,UAAU,gCAAgC,kBAAkB,CAAC,WAAW,CAAC,EAAE;QAC9E,UAAU,kBAAkB,CAAC,KAAK,CAAC,mBAAmB,kBAAkB,CAAC,SAAS,CAAC,EAAE;QACrF,6BAA6B,CAAC;IAEhC,OAAO,CAAC,GAAG,CAAC,oBAAoB,QAAQ,KAAK,OAAO,GAAG,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,2BAA2B,OAAO,MAAM,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC;IAE/B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,4CAA4C,WAAW,MAAM,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CACT,0FAA0F,CAC3F,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CACT,mHAAmH,CACpH,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAE/D,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;QAC5B,IAAI,CACF,iGAAiG,CAClG,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,UAAU,2BAA2B,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CACjH,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,4BAA4B,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAEvF,4FAA4F;IAC5F,oFAAoF;IACpF,OAAO,CAAC,GAAG,GAAG,QAAQ,CAAC;IACvB,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE9C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEjD,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,CAAC,OAAO,KAAK,OAAO,GAAG,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CACT,uFAAuF;QACrF,kFAAkF,OAAO,IAAI;QAC7F,0DAA0D,CAC7D,CAAC;IACF,OAAO,CAAC,GAAG,CACT,8FAA8F;QAC5F,iGAAiG;QACjG,+FAA+F,CAClG,CAAC;AACJ,CAAC"}

package/dist/cli/lib/chain.d.ts

@@ -0,0 +1,264 @@
+import type { EncodeObject } from "@cosmjs/proto-signing";
+import type { DeliverTxResponse, Event, StdFee } from "@cosmjs/stargate";
+import { type IxoNetwork } from "../../networks.js";
+import type { PublishSigner } from "./session.js";
+/**
+ * `network` comes ONLY from the `--network` flag, NEVER from an env file's `NETWORK` var — an env
+ * file crafted for one network must never silently redirect a run to another. Omitting the flag is
+ * the safe default (devnet); every other network must be named explicitly on the command line.
+ */
+export declare function resolveNetwork(flag: string | undefined): IxoNetwork;
+/**
+ * An expected failure: one line, no stack, exit 1. Ends the PROCESS rather than returning a code to
+ * the dispatcher because it is called from deep inside a signing sequence — every caller in between
+ * would otherwise have to thread a failure back up through half-finished chain state.
+ */
+export declare function fail(message: string): never;
+export interface LinkedResource {
+    id: string;
+    type: string;
+    description: string;
+    mediaType: string;
+    serviceEndpoint: string;
+    proof: string;
+    encrypted: string;
+    right: string;
+}
+export interface IidService {
+    id: string;
+    type: string;
+    serviceEndpoint: string;
+}
+/** An `ixo.iid.v1beta1.LinkedClaim` as blocksync reports it — a deed's edge to the claims-config doc
+ *  that names its protocols (`entityClaims[].template.id`); see `commands/create-deed.ts`. */
+export interface LinkedClaim {
+    id: string;
+    type: string;
+    description: string;
+    serviceEndpoint: string;
+    proof: string;
+    encrypted: string;
+    right: string;
+}
+export interface CollectionRow {
+    id: string;
+    admin: string | null;
+    protocol: string | null;
+    entity: string | null;
+    startDate: string | null;
+    endDate: string | null;
+    payments: unknown;
+}
+export declare function gqlFetch<T>(blocksyncUrl: string, query: string, variables: Record<string, unknown>): Promise<T>;
+/** An `ixo.iid.v1beta1.LinkedEntity` edge as blocksync reports it — the DID it points at is the
+ *  entity's own real DID (the `{id}` placeholder is expanded on chain, same as service/resource ids). */
+export interface LinkedEntity {
+    id: string;
+    type: string;
+    relationship: string;
+    service: string;
+}
+export interface ResolvedEntity {
+    owner: string | null;
+    adminAccount: string | null;
+    /** The chain `entityType` (e.g. `protocol/verifiableClaim`, `oracle`) — null when the entity doesn't
+     *  resolve at all. `oracle init` uses this to detect an unresolved `--protocol`. */
+    type: string | null;
+    linkedResources: LinkedResource[];
+    services: IidService[];
+    linkedEntities: LinkedEntity[];
+    linkedClaims: LinkedClaim[];
+}
+/** One round trip: owner, entity type, the entity-module `admin` account, every LinkedResource,
+ *  every service, every linkedEntity edge. */
+export declare function resolveEntity(blocksyncUrl: string, did: string): Promise<ResolvedEntity>;
+/** The (at most one) collection a deed holds for a protocol — how `create-collection` resumes every
+ *  phase from `--entity` + `--protocol`, with no state file. Keyed on the PAIR: one protocol backs
+ *  many deeds (each with its own collection), so `protocol` alone is not an identity. */
+export declare function resolveCollection(blocksyncUrl: string, entityDid: string, protocolDid: string): Promise<CollectionRow | null>;
+/** One collection by its numeric id — what a SUBMITTER starts from (`submit-claim`): the `entity`
+ *  whose room the body goes to and the `admin` that `MsgSubmitClaim` names. */
+export declare function resolveCollectionById(blocksyncUrl: string, collectionId: string): Promise<CollectionRow | null>;
+export interface OwnedOracleEntity {
+    id: string;
+    type: string;
+}
+/** Every oracle entity a wallet address owns. NOT "the" oracle: one AuthHub session can own the
+ *  entities of several oracles, so `oracle init` picks its own from this list by what binds an
+ *  entity to THIS oracle (`resolveOracleEntity` there). `type in [...]` covers both the plain
+ *  `oracle` entityType and the more specific `oracle/evaluation` one. */
+export declare function ownedOracleEntities(blocksyncUrl: string, ownerAddress: string): Promise<OwnedOracleEntity[]>;
+/** One flat fee for every step (1–3 msgs) — generous gas, never refused. */
+export declare const STANDARD_FEE: StdFee;
+export interface ConfirmPlan {
+    network: IxoNetwork;
+    /** The address/actor about to sign or authenticate — "n/a" only for a truly unauthenticated read. */
+    signer: string;
+    /** Short label: "MsgCreateEntity", "upload form.json + rubric.json to Matrix", … */
+    action: string;
+    /** Human-readable bullets: memo, message types, byte sizes, targets — whatever is being signed. */
+    lines: string[];
+    /** Omit for a non-chain write (e.g. a Matrix upload) — there is no fee to estimate. */
+    fee?: StdFee;
+}
+/**
+ * THE safety gate. Prints exactly what is about to be signed/sent, on which network, as whom — and
+ * REQUIRES `--yes` to proceed. Without it: print the plan and exit 0. Nothing is ever signed on the
+ * strength of this function alone; every chain write (and every other signing path — Matrix uploads,
+ * UCAN delegation minting) calls this immediately before the write.
+ *
+ * A dry run ends the PROCESS here: "stop, successfully, half way through a sequence" is not
+ * something a command's return value can say, and every caller in between is mid-sequence.
+ */
+export declare function confirm(plan: ConfirmPlan, yes: boolean, opts?: ConfirmOptions): void;
+/** For a caller that is not a chain write: where the plan goes (`console.error` keeps a `--json`
+ *  stdout pure JSON) and what the `--yes` line says it is doing instead of signing/broadcasting. */
+export interface ConfirmOptions {
+    print?: (line: string) => void;
+    proceeding?: string;
+}
+/** Signs + broadcasts `msgs` as `signer`, returns the tx hash, throws with the raw log on failure. */
+export declare function broadcast(signer: PublishSigner, msgs: EncodeObject[], memo: string, fee?: StdFee): Promise<{
+    hash: string;
+    res: DeliverTxResponse;
+}>;
+/** `MsgAddService`. Async: `@ixo/impactxclient-sdk` is lazy-imported (heavy proto/crypto deps). */
+export declare function addServiceMsg(entityDid: string, service: {
+    id: string;
+    type: string;
+    serviceEndpoint: string;
+}, signer: string): Promise<EncodeObject>;
+/**
+ * `MsgAddLinkedResource` — the one builder behind every anchored document (`#vct`/`#rub` from
+ * `publish-protocol`, `#orz`/`#pro` from `oracle init`). The caller passes the resource whole: every
+ * field is part of what the chain records permanently, so none of them gets a default here.
+ *
+ * Refused by the chain when the id already exists (`duplicated resource id`, x/iid/types/iid.go) —
+ * replacing one means `deleteLinkedResourceMsg` FIRST, same tx.
+ */
+export declare function addLinkedResourceMsg(entityDid: string, resource: LinkedResource, signer: string): Promise<EncodeObject>;
+/**
+ * `MsgDeleteLinkedResource`. `resourceId` must be the id EXACTLY as the chain stores it — which is
+ * the UNEXPANDED `{id}#rub` literal (blocksync reports it that way, and the keeper matches
+ * `s.Id == resourceID` with no expansion). Pass the id straight off the resolved entity; never
+ * rebuild it from the DID.
+ */
+export declare function deleteLinkedResourceMsg(entityDid: string, resourceId: string, signer: string): Promise<EncodeObject>;
+/**
+ * `MsgDeleteService`. The counterpart of `addServiceMsg`, and only ever broadcast in the SAME tx as
+ * the add that replaces it — qiforge's `updateOracleDomain` (`src/utils/entity.ts:199-256`) is the
+ * same pair, because an entity between the two is an entity with no API endpoint at all. `serviceId`
+ * is the `{id}#frag` form the chain stores, not the expanded DID.
+ */
+export declare function deleteServiceMsg(entityDid: string, serviceId: string, signer: string): Promise<EncodeObject>;
+/** The ed25519 key a Vault write is signed with, and the did:ixo it signs as. */
+export interface DocSigner {
+    did: string;
+    edMnemonic: string;
+}
+/** The AuthHub session as a `DocSigner` — the entity OWNER for every doc this CLI anchors. */
+export declare function sessionDocSigner(signer: PublishSigner): DocSigner;
+/**
+ * Store a public document and return where it lives, by content address: the IXO Vault first
+ * (`POST {vfs}/api/fs/files?public=true` under a one-write UCAN from `signer`'s ed25519 key, into
+ * its own namespace — served to anyone at `{vfs}/public/cid/<cid>`), else IXO's IPFS gateway
+ * (`POST {gateway}/upload`, open — `{gateway}/ipfs/<cid>`). OpenHands 2f7857a (`chain/store.ts`
+ * `uploadDoc`) is the same two doors. Nothing is written to Matrix media any more (its
+ * unauthenticated reads may stop answering one day); reading it stays supported (`readLinkedDoc`).
+ * A Vault refusal is printed, never fatal: the gateway takes the doc.
+ *
+ * `cid` is the raw-sha256 CIDv1 of `bytes` (both stores address a ≤1 MiB file that way), checked
+ * against what the store answered. The caller still picks the resource's `proof` (CLAUDE.md):
+ * sha256 hex for `#vct`/`#rub`/`#orz`, this CID for `#pro`/`#dmn`/`#acard`.
+ */
+export declare function uploadDoc(network: IxoNetwork, signer: DocSigner, bytes: Uint8Array, filename: string, contentType: string): Promise<{
+    url: string;
+    cid: string;
+}>;
+/**
+ * `MsgAddLinkedEntity` — a ~10-line port of impacts-x-web's `helpers/signX.ts`
+ * (`generateAddLinkedEntityTrx`), the portal's own builder for this exact message. `oracle init`
+ * uses it to anchor the oracle→protocol `relationship: "protocol"` edge the marketplace query reads.
+ */
+export declare function addLinkedEntityMsg(entityDid: string, linkedEntity: {
+    id: string;
+    type: string;
+    relationship: string;
+    service: string;
+}, signer: string): Promise<EncodeObject>;
+/** sha256 hex of bytes — the rubric/#vct proof convention. */
+export declare function sha256Hex(bytes: Uint8Array): Promise<string>;
+/**
+ * A Matrix access token for the AuthHub session's OWN Matrix user, minted the way the portal does on
+ * every AuthHub sign-in (impacts-x-web `hooks/useAuthHubLogin.ts` → `utils/matrix.ts`
+ * `generatePasswordFromMnemonic`): the hub hands back `matrixMnemonic` in the clear, never a token,
+ * and the account's password is `matrixPassword`'s derivation — the SAME one the oracle's own
+ * account is created with (matrix-account.ts), which is why it lives there and not here.
+ *
+ * It MUST be this user, not an oracle's bot token: the rooms-bot invites the UCAN issuer (the session
+ * DID) into a sourced room, and the claim-bot invite sets power levels — both need the entity
+ * OWNER's Matrix account (an oracle's token fails the join with `M_FORBIDDEN You are not invited to
+ * this room`). The homeserver is `NETWORKS[network].matrix`, the ONE endpoint source — asserted
+ * against the session's, so a session from another network fails here with a clear message instead
+ * of a 403 later.
+ */
+export declare function matrixLoginFromSession(signer: PublishSigner): Promise<string>;
+/** Pulls the first `did:ixo:entity:…` string out of a MsgCreateEntity tx's events. */
+export declare function entityDidFromEvents(events: readonly Event[] | undefined): string | undefined;
+/**
+ * `MsgCreateEntity` of the given `entityType` (`protocol/verifiableClaim`, `deed`, …), owned and
+ * controlled by the AuthHub session's DID. Plan-print (dry run) never needs the message built —
+ * only after the `--yes` gate returns do we touch `signer.getPubkey()` (session-mnemonic
+ * derivation), so a dry run stays wallet-free even for entity creation. See
+ * `PublishSigner.getPubkey`'s doc comment.
+ *
+ * `opts.linkedResources` is built only past the gate too (`org create` uploads its `#pro` there),
+ * and `opts.print` takes the plan and the result line where a caller's stdout must stay JSON.
+ */
+export declare function createEntity(signer: PublishSigner, entityType: string, yes: boolean, opts?: {
+    lines?: string[];
+    linkedResources?: () => Promise<LinkedResource[]>;
+    memo?: string;
+    print?: (line: string) => void;
+}): Promise<string>;
+export type MatrixBot = "stateBot" | "roomsBot" | "claimBot";
+export interface MatrixUrls extends Record<MatrixBot, string> {
+    homeServer: string;
+    /** The homeserver's bare host — the server part of a room alias. */
+    homeServerCropped: string;
+}
+/**
+ * The homeserver an entity names in its `MatrixHomeServer` service, else the network's own — and
+ * the bot hosts derived from it (`<bot>.bot.<homeserver host>`), exactly as the portal resolves them.
+ */
+export declare function matrixUrlsForDid(network: IxoNetwork, did: string): Promise<MatrixUrls>;
+/**
+ * The rooms/claim/state bots for this session, addressed by entity DID: every bot call carries a
+ * self-signed UCAN from the session's `edSigningMnemonic` (audience = the bot's own did.json, one
+ * token per bot for the run), and — when `matrixToken` is given — Matrix itself (join, invite,
+ * power levels) runs as the session's own user.
+ */
+export declare function matrixBots(signer: PublishSigner, matrixToken?: () => Promise<string>): Promise<{
+    urls: (did: string) => Promise<MatrixUrls>;
+    ucan: (did: string, bot: MatrixBot) => Promise<string>;
+    /** The entity's room, by its alias `#<did with : → ->:<homeserver host>`. */
+    roomId(did: string): Promise<string>;
+    /** One room-state value through the state bot (`queryState`). */
+    readState(did: string, roomId: string, key: string, path: string): Promise<unknown>;
+    /** Rooms-bot `sourceRoomAndJoin` (created iff missing), then the claim bot invited into it. */
+    sourceRoom(did: string): Promise<string>;
+    /** A claim body saved into `collectionId` via the claim bot — the returned `data.cid` IS the claimId. */
+    saveClaim(did: string, collectionId: string, claim: unknown): Promise<import("@ixo/matrixclient-sdk/types/claimBot/claim/v1beta1.js").SaveClaimResponse>;
+}>;
+/**
+ * Source the entity's Matrix room (idempotent — created iff missing) and invite BOTH bots into it,
+ * the way the portal's `setupMatrixRoom` does (impacts-x-webapp `storage/matrix.ts`
+ * `sourceRoomAndJoin`): the claim bot, or every submission against the entity is
+ * IXO_ROOM_NOT_FOUND; and the state bot, or nothing can read or write the room's state — which is
+ * where a deed's claims-config doc lives (`create-deed`; without it the state-bot answers "You do
+ * not have permission to edit state"). Each invite also raises the bot's power level, so both run
+ * as the session's own Matrix user — the room's creator — which is why `matrixToken` must be
+ * `matrixLoginFromSession`'s.
+ */
+export declare function sourceEntityRoom(signer: PublishSigner, entityDid: string, matrixToken: () => Promise<string>, yes: boolean): Promise<string>;
+//# sourceMappingURL=chain.d.ts.map

package/dist/cli/lib/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/chain.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAE,KAAK,UAAU,EAAY,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAMnE;AASD;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAG3C;AAID,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;8FAC8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAC9B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;yGACyG;AACzG,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;wFACoF;IACpF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B;AAOD;8CAC8C;AAC9C,wBAAsB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB9F;AAWD;;yFAEyF;AACzF,wBAAsB,iBAAiB,CACrC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAO/B;AAOD;+EAC+E;AAC/E,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAO/B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AASD;;;yEAGyE;AACzE,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAO9B;AAID,4EAA4E;AAC5E,eAAO,MAAM,YAAY,EAAE,MAG1B,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,UAAU,CAAC;IACpB,qGAAqG;IACrG,MAAM,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,GAAE,cAAmB,GAAG,IAAI,CAexF;AAED;oGACoG;AACpG,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,sGAAsG;AACtG,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,YAAY,EAAE,EACpB,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAqB,GACzB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,iBAAiB,CAAA;CAAE,CAAC,CASnD;AAID,mGAAmG;AACnG,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,EAC9D,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CAUvB;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CAUvB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CAUvB;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CAMvB;AAED,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,CAOjE;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAsCvC;AAqBD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACjF,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CAUvB;AAID,8DAA8D;AAC9D,wBAAsB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAElE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBnF;AAID,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAY5F;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,OAAO,EACZ,IAAI,GAAE;IACJ,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3B,GACL,OAAO,CAAC,MAAM,CAAC,CA6CjB;AAYD,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAS7D,MAAM,WAAW,UAAW,SAAQ,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAoB5F;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC;gBAUnE,MAAM;gBAGH,MAAM,OAAO,SAAS,KAAG,OAAO,CAAC,MAAM,CAAC;IA2B/D,6EAA6E;gBAC3D,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ1C,iEAAiE;mBAC5C,MAAM,UAAU,MAAM,OAAO,MAAM,QAAQ,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWzF,+FAA+F;oBACzE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkB9C,yGAAyG;mBACpF,MAAM,gBAAgB,MAAM,SAAS,OAAO;GAWpE;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAClC,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,MAAM,CAAC,CA0BjB"}