@maudecode/talaria-web-contracts 0.0.0

package/dist/routes/core.d.ts

@@ -0,0 +1,400 @@
+import { z } from 'zod';
+export declare const ErrorBodySchema: z.ZodObject<{
+    error: z.ZodString;
+}, z.core.$catchall<z.ZodUnknown>>;
+export type ErrorBody = z.infer<typeof ErrorBodySchema>;
+export declare const AuthStatusSchema: z.ZodObject<{
+    auth_enabled: z.ZodBoolean;
+    logged_in: z.ZodBoolean;
+    oidc_enabled: z.ZodBoolean;
+    oidc_native_handoff_enabled: z.ZodBoolean;
+    password_auth_enabled: z.ZodBoolean;
+    passwordless_enabled: z.ZodBoolean;
+    passkeys_enabled: z.ZodBoolean;
+    passkeys_count: z.ZodNumber;
+    passkey_feature_flag: z.ZodBoolean;
+    auth_disabled_acknowledged: z.ZodBoolean;
+    can_manage_server: z.ZodBoolean;
+    trusted_auth_enabled: z.ZodOptional<z.ZodBoolean>;
+    auth_type: z.ZodOptional<z.ZodString>;
+    user: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    bound_profile: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type AuthStatus = z.infer<typeof AuthStatusSchema>;
+export declare const BootstrapFeaturesSchema: z.ZodObject<{
+    dashboard: z.ZodBoolean;
+    terminal_remote_backend: z.ZodBoolean;
+    extensions: z.ZodBoolean;
+    single_profile_mode: z.ZodBoolean;
+}, z.core.$strip>;
+export type BootstrapFeatures = z.infer<typeof BootstrapFeaturesSchema>;
+export declare const BootstrapSchema: z.ZodObject<{
+    webui_version: z.ZodString;
+    max_upload_bytes: z.ZodNumber;
+    csrf_token: z.ZodString;
+    language: z.ZodString;
+    bot_name: z.ZodString;
+    auth: z.ZodObject<{
+        auth_enabled: z.ZodBoolean;
+        logged_in: z.ZodBoolean;
+        oidc_enabled: z.ZodBoolean;
+        oidc_native_handoff_enabled: z.ZodBoolean;
+        password_auth_enabled: z.ZodBoolean;
+        passwordless_enabled: z.ZodBoolean;
+        passkeys_enabled: z.ZodBoolean;
+        passkeys_count: z.ZodNumber;
+        passkey_feature_flag: z.ZodBoolean;
+        auth_disabled_acknowledged: z.ZodBoolean;
+        can_manage_server: z.ZodBoolean;
+        trusted_auth_enabled: z.ZodOptional<z.ZodBoolean>;
+        auth_type: z.ZodOptional<z.ZodString>;
+        user: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        bound_profile: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>;
+    profile: z.ZodNullable<z.ZodObject<{
+        name: z.ZodString;
+        is_default: z.ZodBoolean;
+    }, z.core.$strip>>;
+    onboarding: z.ZodNullable<z.ZodObject<{
+        completed: z.ZodBoolean;
+    }, z.core.$strip>>;
+    features: z.ZodObject<{
+        dashboard: z.ZodBoolean;
+        terminal_remote_backend: z.ZodBoolean;
+        extensions: z.ZodBoolean;
+        single_profile_mode: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type Bootstrap = z.infer<typeof BootstrapSchema>;
+/** `<webRoot>/_release.json` as written by `scripts/stamp-release.py`; a development checkout reports nulls. */
+export declare const ReleaseInfoSchema: z.ZodObject<{
+    tag: z.ZodNullable<z.ZodString>;
+    version: z.ZodString;
+    sourceRevision: z.ZodNullable<z.ZodString>;
+    releaseSet: z.ZodNullable<z.ZodString>;
+    contracts: z.ZodObject<{
+        appWeb: z.ZodArray<z.ZodNumber>;
+        webRelay: z.ZodArray<z.ZodNumber>;
+    }, z.core.$strip>;
+    compatibleAgent: z.ZodObject<{
+        sourceRevision: z.ZodString;
+        version: z.ZodString;
+        image: z.ZodString;
+    }, z.core.$catchall<z.ZodUnknown>>;
+}, z.core.$strip>;
+export type ReleaseInfo = z.infer<typeof ReleaseInfoSchema>;
+export declare const HealthSchema: z.ZodObject<{
+    release: z.ZodObject<{
+        tag: z.ZodNullable<z.ZodString>;
+        version: z.ZodString;
+        sourceRevision: z.ZodNullable<z.ZodString>;
+        releaseSet: z.ZodNullable<z.ZodString>;
+        contracts: z.ZodObject<{
+            appWeb: z.ZodArray<z.ZodNumber>;
+            webRelay: z.ZodArray<z.ZodNumber>;
+        }, z.core.$strip>;
+        compatibleAgent: z.ZodObject<{
+            sourceRevision: z.ZodString;
+            version: z.ZodString;
+            image: z.ZodString;
+        }, z.core.$catchall<z.ZodUnknown>>;
+    }, z.core.$strip>;
+    status: z.ZodEnum<{
+        ok: "ok";
+        degraded: "degraded";
+        starting: "starting";
+    }>;
+    phase: z.ZodOptional<z.ZodString>;
+    sessions: z.ZodNumber;
+    active_streams: z.ZodNumber;
+    active_runs: z.ZodNumber;
+    runs: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    last_run_finished_at: z.ZodNullable<z.ZodNumber>;
+    server_started_at: z.ZodNumber;
+    uptime_seconds: z.ZodNumber;
+    accept_loop: z.ZodObject<{
+        requests_total: z.ZodNumber;
+        last_request_at: z.ZodNumber;
+    }, z.core.$strip>;
+    checks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type Health = z.infer<typeof HealthSchema>;
+export declare const LoginRequestSchema: z.ZodObject<{
+    password: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const LogoutResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    trusted_logout_url: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const OidcNativeStartRequestSchema: z.ZodObject<{
+    callback_url: z.ZodString;
+    state: z.ZodString;
+    code_challenge: z.ZodString;
+    code_challenge_method: z.ZodString;
+}, z.core.$strip>;
+export declare const OidcNativeStartResponseSchema: z.ZodObject<{
+    flow_id: z.ZodString;
+    authorization_url: z.ZodString;
+    server_id: z.ZodString;
+    expires_in: z.ZodNumber;
+}, z.core.$strip>;
+export declare const OidcNativeExchangeRequestSchema: z.ZodObject<{
+    flow_id: z.ZodString;
+    code: z.ZodString;
+    state: z.ZodString;
+    code_verifier: z.ZodString;
+}, z.core.$strip>;
+export declare const OidcNativeCancelRequestSchema: z.ZodObject<{
+    flow_id: z.ZodString;
+    state: z.ZodString;
+}, z.core.$strip>;
+/** WebAuthn options are handed to the browser verbatim (`PublicKeyCredentialCreationOptions` / `RequestOptions` with base64url binaries). */
+export declare const PasskeyOptionsResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+export declare const PasskeyCredentialSchema: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    created_at: z.ZodNumber;
+    last_used_at: z.ZodNullable<z.ZodNumber>;
+    sign_count: z.ZodNumber;
+}, z.core.$strip>;
+export type PasskeyCredential = z.infer<typeof PasskeyCredentialSchema>;
+/** A serialised `PublicKeyCredential` (`id`, `rawId`, `type`, `response.{clientDataJSON,attestationObject|authenticatorData,signature}`), plus an optional `label` on register (the Python field; the frontend's `name` is reconciled in checkpoint 8). */
+export declare const PasskeyAssertionSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    rawId: z.ZodOptional<z.ZodString>;
+    type: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    response: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$catchall<z.ZodUnknown>>;
+export declare const PasskeyRegisterResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    credential: z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+    }, z.core.$strip>;
+    credentials: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        created_at: z.ZodNumber;
+        last_used_at: z.ZodNullable<z.ZodNumber>;
+        sign_count: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const PasskeyLoginResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export declare const PasskeyDeleteRequestSchema: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const PasskeyDeleteResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    credentials: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        created_at: z.ZodNumber;
+        last_used_at: z.ZodNullable<z.ZodNumber>;
+        sign_count: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const PasskeysListSchema: z.ZodObject<{
+    credentials: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        created_at: z.ZodNumber;
+        last_used_at: z.ZodNullable<z.ZodNumber>;
+        sign_count: z.ZodNumber;
+    }, z.core.$strip>>;
+    disabled: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const coreContract: {
+    health: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        deep: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        release: z.ZodObject<{
+            tag: z.ZodNullable<z.ZodString>;
+            version: z.ZodString;
+            sourceRevision: z.ZodNullable<z.ZodString>;
+            releaseSet: z.ZodNullable<z.ZodString>;
+            contracts: z.ZodObject<{
+                appWeb: z.ZodArray<z.ZodNumber>;
+                webRelay: z.ZodArray<z.ZodNumber>;
+            }, z.core.$strip>;
+            compatibleAgent: z.ZodObject<{
+                sourceRevision: z.ZodString;
+                version: z.ZodString;
+                image: z.ZodString;
+            }, z.core.$catchall<z.ZodUnknown>>;
+        }, z.core.$strip>;
+        status: z.ZodEnum<{
+            ok: "ok";
+            degraded: "degraded";
+            starting: "starting";
+        }>;
+        phase: z.ZodOptional<z.ZodString>;
+        sessions: z.ZodNumber;
+        active_streams: z.ZodNumber;
+        active_runs: z.ZodNumber;
+        runs: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        last_run_finished_at: z.ZodNullable<z.ZodNumber>;
+        server_started_at: z.ZodNumber;
+        uptime_seconds: z.ZodNumber;
+        accept_loop: z.ZodObject<{
+            requests_total: z.ZodNumber;
+            last_request_at: z.ZodNumber;
+        }, z.core.$strip>;
+        checks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    bootstrap: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, z.ZodObject<{
+        webui_version: z.ZodString;
+        max_upload_bytes: z.ZodNumber;
+        csrf_token: z.ZodString;
+        language: z.ZodString;
+        bot_name: z.ZodString;
+        auth: z.ZodObject<{
+            auth_enabled: z.ZodBoolean;
+            logged_in: z.ZodBoolean;
+            oidc_enabled: z.ZodBoolean;
+            oidc_native_handoff_enabled: z.ZodBoolean;
+            password_auth_enabled: z.ZodBoolean;
+            passwordless_enabled: z.ZodBoolean;
+            passkeys_enabled: z.ZodBoolean;
+            passkeys_count: z.ZodNumber;
+            passkey_feature_flag: z.ZodBoolean;
+            auth_disabled_acknowledged: z.ZodBoolean;
+            can_manage_server: z.ZodBoolean;
+            trusted_auth_enabled: z.ZodOptional<z.ZodBoolean>;
+            auth_type: z.ZodOptional<z.ZodString>;
+            user: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            bound_profile: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>;
+        profile: z.ZodNullable<z.ZodObject<{
+            name: z.ZodString;
+            is_default: z.ZodBoolean;
+        }, z.core.$strip>>;
+        onboarding: z.ZodNullable<z.ZodObject<{
+            completed: z.ZodBoolean;
+        }, z.core.$strip>>;
+        features: z.ZodObject<{
+            dashboard: z.ZodBoolean;
+            terminal_remote_backend: z.ZodBoolean;
+            extensions: z.ZodBoolean;
+            single_profile_mode: z.ZodBoolean;
+        }, z.core.$strip>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    auth: {
+        status: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, z.ZodObject<{
+            auth_enabled: z.ZodBoolean;
+            logged_in: z.ZodBoolean;
+            oidc_enabled: z.ZodBoolean;
+            oidc_native_handoff_enabled: z.ZodBoolean;
+            password_auth_enabled: z.ZodBoolean;
+            passwordless_enabled: z.ZodBoolean;
+            passkeys_enabled: z.ZodBoolean;
+            passkeys_count: z.ZodNumber;
+            passkey_feature_flag: z.ZodBoolean;
+            auth_disabled_acknowledged: z.ZodBoolean;
+            can_manage_server: z.ZodBoolean;
+            trusted_auth_enabled: z.ZodOptional<z.ZodBoolean>;
+            auth_type: z.ZodOptional<z.ZodString>;
+            user: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            bound_profile: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+        login: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            password: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>, z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            message: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>, Record<never, never>, Record<never, never>>;
+        logout: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            trusted_logout_url: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+        oidcNativeStart: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            callback_url: z.ZodString;
+            state: z.ZodString;
+            code_challenge: z.ZodString;
+            code_challenge_method: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            flow_id: z.ZodString;
+            authorization_url: z.ZodString;
+            server_id: z.ZodString;
+            expires_in: z.ZodNumber;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+        oidcNativeExchange: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            flow_id: z.ZodString;
+            code: z.ZodString;
+            state: z.ZodString;
+            code_verifier: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+        oidcNativeCancel: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            flow_id: z.ZodString;
+            state: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            ok: z.ZodBoolean;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+        passkeyOptions: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+        passkeyLogin: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            id: z.ZodOptional<z.ZodString>;
+            rawId: z.ZodOptional<z.ZodString>;
+            type: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+            response: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$catchall<z.ZodUnknown>>, z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+        passkeyRegisterOptions: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+        passkeyRegister: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            id: z.ZodOptional<z.ZodString>;
+            rawId: z.ZodOptional<z.ZodString>;
+            type: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+            response: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$catchall<z.ZodUnknown>>, z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            credential: z.ZodObject<{
+                id: z.ZodString;
+                label: z.ZodString;
+            }, z.core.$strip>;
+            credentials: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                label: z.ZodString;
+                created_at: z.ZodNumber;
+                last_used_at: z.ZodNullable<z.ZodNumber>;
+                sign_count: z.ZodNumber;
+            }, z.core.$strip>>;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+        passkeyDelete: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            credentials: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                label: z.ZodString;
+                created_at: z.ZodNumber;
+                last_used_at: z.ZodNullable<z.ZodNumber>;
+                sign_count: z.ZodNumber;
+            }, z.core.$strip>>;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+        passkeys: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, z.ZodObject<{
+            credentials: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                label: z.ZodString;
+                created_at: z.ZodNumber;
+                last_used_at: z.ZodNullable<z.ZodNumber>;
+                sign_count: z.ZodNumber;
+            }, z.core.$strip>>;
+            disabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    };
+};

package/dist/routes/core.js

@@ -0,0 +1,128 @@
+import { oc } from '@orpc/contract';
+import { z } from 'zod';
+import { LoginResponseSchema } from '../views.js';
+/**
+ * Core routes: liveness, the public bootstrap document, and password
+ * sessions. Shapes mirror the Python backend byte for byte where a consumer
+ * (frontend `BootstrapSchema`, iOS app, `ctl` scripts) reads them.
+ */
+const NullableString = z.string().nullable();
+export const ErrorBodySchema = z.object({ error: z.string() }).catchall(z.unknown());
+export const AuthStatusSchema = z.object({
+    auth_enabled: z.boolean(),
+    logged_in: z.boolean(),
+    oidc_enabled: z.boolean(),
+    oidc_native_handoff_enabled: z.boolean(),
+    password_auth_enabled: z.boolean(),
+    passwordless_enabled: z.boolean(),
+    passkeys_enabled: z.boolean(),
+    passkeys_count: z.number().int(),
+    passkey_feature_flag: z.boolean(),
+    auth_disabled_acknowledged: z.boolean(),
+    can_manage_server: z.boolean(),
+    trusted_auth_enabled: z.boolean().optional(),
+    auth_type: z.string().optional(),
+    user: NullableString.optional(),
+    bound_profile: NullableString.optional(),
+});
+export const BootstrapFeaturesSchema = z.object({
+    dashboard: z.boolean(),
+    terminal_remote_backend: z.boolean(),
+    extensions: z.boolean(),
+    single_profile_mode: z.boolean(),
+});
+export const BootstrapSchema = z.object({
+    webui_version: z.string(),
+    max_upload_bytes: z.number().int().positive(),
+    csrf_token: z.string(),
+    language: z.string(),
+    bot_name: z.string(),
+    auth: AuthStatusSchema,
+    profile: z.object({ name: z.string(), is_default: z.boolean() }).nullable(),
+    onboarding: z.object({ completed: z.boolean() }).nullable(),
+    features: BootstrapFeaturesSchema,
+});
+const Sha1 = z.string().regex(/^[a-f0-9]{40}$/);
+/** `<webRoot>/_release.json` as written by `scripts/stamp-release.py`; a development checkout reports nulls. */
+export const ReleaseInfoSchema = z.object({
+    tag: z.string().nullable(),
+    version: z.string(),
+    sourceRevision: Sha1.nullable(),
+    releaseSet: Sha1.nullable(),
+    contracts: z.object({ appWeb: z.array(z.number().int()), webRelay: z.array(z.number().int()) }),
+    compatibleAgent: z.object({ sourceRevision: Sha1, version: z.string(), image: z.string() }).catchall(z.unknown()),
+});
+export const HealthSchema = z.object({
+    release: ReleaseInfoSchema,
+    status: z.enum(['ok', 'degraded', 'starting']),
+    phase: z.string().optional(),
+    sessions: z.number().int(),
+    active_streams: z.number().int(),
+    active_runs: z.number().int(),
+    runs: z.array(z.record(z.string(), z.unknown())),
+    last_run_finished_at: z.number().nullable(),
+    server_started_at: z.number(),
+    uptime_seconds: z.number(),
+    accept_loop: z.object({ requests_total: z.number().int(), last_request_at: z.number() }),
+    checks: z.record(z.string(), z.unknown()).optional(),
+});
+export const LoginRequestSchema = z.object({ password: z.string().optional() });
+export const LogoutResponseSchema = z.object({ ok: z.literal(true), trusted_logout_url: z.string().optional() });
+export const OidcNativeStartRequestSchema = z.object({ callback_url: z.string(), state: z.string(), code_challenge: z.string(), code_challenge_method: z.string() });
+export const OidcNativeStartResponseSchema = z.object({ flow_id: z.string(), authorization_url: z.string(), server_id: z.string(), expires_in: z.number().int() });
+export const OidcNativeExchangeRequestSchema = z.object({ flow_id: z.string(), code: z.string(), state: z.string(), code_verifier: z.string() });
+export const OidcNativeCancelRequestSchema = z.object({ flow_id: z.string(), state: z.string() });
+const AuthOkSchema = z.object({ ok: z.literal(true) });
+const OkFlagSchema = z.object({ ok: z.boolean() });
+/** WebAuthn options are handed to the browser verbatim (`PublicKeyCredentialCreationOptions` / `RequestOptions` with base64url binaries). */
+export const PasskeyOptionsResponseSchema = z.object({ ok: z.literal(true), publicKey: z.record(z.string(), z.unknown()) });
+export const PasskeyCredentialSchema = z.object({ id: z.string(), label: z.string(), created_at: z.number(), last_used_at: z.number().nullable(), sign_count: z.number().int() });
+/** A serialised `PublicKeyCredential` (`id`, `rawId`, `type`, `response.{clientDataJSON,attestationObject|authenticatorData,signature}`), plus an optional `label` on register (the Python field; the frontend's `name` is reconciled in checkpoint 8). */
+export const PasskeyAssertionSchema = z.object({ id: z.string().optional(), rawId: z.string().optional(), type: z.string().optional(), name: z.string().optional(), response: z.record(z.string(), z.unknown()).optional() }).catchall(z.unknown());
+export const PasskeyRegisterResponseSchema = z.object({ ok: z.literal(true), credential: z.object({ id: z.string(), label: z.string() }), credentials: z.array(PasskeyCredentialSchema) });
+export const PasskeyLoginResponseSchema = z.object({ ok: z.literal(true) });
+export const PasskeyDeleteRequestSchema = z.object({ id: z.string() });
+export const PasskeyDeleteResponseSchema = z.object({ ok: z.literal(true), credentials: z.array(PasskeyCredentialSchema) });
+export const PasskeysListSchema = z.object({ credentials: z.array(PasskeyCredentialSchema), disabled: z.boolean().optional() });
+export const coreContract = {
+    health: oc
+        .route({ method: 'GET', path: '/health', tags: ['core'], summary: 'Liveness and release identity; `deep=1` adds startup and store probes.' })
+        .input(z.object({ deep: z.string().optional() }))
+        .output(HealthSchema),
+    bootstrap: oc
+        .route({ method: 'GET', path: '/api/bootstrap', tags: ['core'], summary: 'Public runtime configuration and initial state for the shell.' })
+        .output(BootstrapSchema),
+    auth: {
+        status: oc.route({ method: 'GET', path: '/api/auth/status', tags: ['auth'] }).output(AuthStatusSchema),
+        login: oc.route({ method: 'POST', path: '/api/auth/login', tags: ['auth'] }).input(LoginRequestSchema).output(LoginResponseSchema),
+        logout: oc.route({ method: 'POST', path: '/api/auth/logout', tags: ['auth'] }).output(LogoutResponseSchema),
+        oidcNativeStart: oc
+            .route({ method: 'POST', path: '/api/auth/oidc/native/start', tags: ['auth'], summary: 'Begin a native-app OIDC handoff (S256 PKCE, rate limited per client IP).' })
+            .input(OidcNativeStartRequestSchema).output(OidcNativeStartResponseSchema),
+        oidcNativeExchange: oc
+            .route({ method: 'POST', path: '/api/auth/oidc/native/exchange', tags: ['auth'], summary: 'Redeem the one-time native handoff code for a session cookie.' })
+            .input(OidcNativeExchangeRequestSchema).output(AuthOkSchema),
+        oidcNativeCancel: oc
+            .route({ method: 'POST', path: '/api/auth/oidc/native/cancel', tags: ['auth'], summary: 'Abandon a pending native handoff.' })
+            .input(OidcNativeCancelRequestSchema).output(OkFlagSchema),
+        passkeyOptions: oc
+            .route({ method: 'POST', path: '/api/auth/passkey/options', tags: ['auth'], summary: 'WebAuthn assertion options for login (public; CSRF exempt).' })
+            .output(PasskeyOptionsResponseSchema),
+        passkeyLogin: oc
+            .route({ method: 'POST', path: '/api/auth/passkey/login', tags: ['auth'], summary: 'Verify a passkey assertion and start a session (public; CSRF exempt).' })
+            .input(PasskeyAssertionSchema).output(PasskeyLoginResponseSchema),
+        passkeyRegisterOptions: oc
+            .route({ method: 'POST', path: '/api/auth/passkey/register/options', tags: ['auth'], summary: 'WebAuthn creation options (owner session or local first-run bootstrap).' })
+            .output(PasskeyOptionsResponseSchema),
+        passkeyRegister: oc
+            .route({ method: 'POST', path: '/api/auth/passkey/register', tags: ['auth'], summary: 'Store a new ES256 passkey credential.' })
+            .input(PasskeyAssertionSchema).output(PasskeyRegisterResponseSchema),
+        passkeyDelete: oc
+            .route({ method: 'POST', path: '/api/auth/passkey/delete', tags: ['auth'], summary: 'Remove a passkey; the last one is kept while no password is set (409).' })
+            .input(PasskeyDeleteRequestSchema).output(PasskeyDeleteResponseSchema),
+        passkeys: oc
+            .route({ method: 'GET', path: '/api/auth/passkeys', tags: ['auth'], summary: 'Registered passkey metadata (`disabled: true` when the feature flag is off).' })
+            .output(PasskeysListSchema),
+    },
+};
+//# sourceMappingURL=core.js.map

package/dist/routes/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/routes/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEjD;;;;GAIG;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAA;AAE5C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AAGpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,2BAA2B,EAAE,CAAC,CAAC,OAAO,EAAE;IACxC,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE;IAClC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE;IACjC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAChC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE;IACjC,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE;IACvC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC/B,aAAa,EAAE,cAAc,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;CACjC,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,QAAQ,EAAE,uBAAuB;CAClC,CAAC,CAAA;AAGF,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;AAE/C,gHAAgH;AAChH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;IAC/F,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAClH,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,iBAAiB;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAChD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACxF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;AAEhH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACpK,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;AAClK,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAChJ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACjG,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACtD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AAElD,6IAA6I;AAC7I,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;AAC3H,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;AAEjL,2PAA2P;AAC3P,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AACnP,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAA;AAC1L,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAA;AAC3H,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;AAE/H,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE,EAAE;SACP,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC;SAC5I,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SAChD,MAAM,CAAC,YAAY,CAAC;IACvB,SAAS,EAAE,EAAE;SACV,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC;SAC1I,MAAM,CAAC,eAAe,CAAC;IAC1B,IAAI,EAAE;QACJ,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACtG,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAClI,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC3G,eAAe,EAAE,EAAE;aAChB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,0EAA0E,EAAE,CAAC;aACnK,KAAK,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,6BAA6B,CAAC;QAC5E,kBAAkB,EAAE,EAAE;aACnB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC;aAC3J,KAAK,CAAC,+BAA+B,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9D,gBAAgB,EAAE,EAAE;aACjB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;aAC7H,KAAK,CAAC,6BAA6B,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QAC5D,cAAc,EAAE,EAAE;aACf,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,6DAA6D,EAAE,CAAC;aACpJ,MAAM,CAAC,4BAA4B,CAAC;QACvC,YAAY,EAAE,EAAE;aACb,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,uEAAuE,EAAE,CAAC;aAC5J,KAAK,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,0BAA0B,CAAC;QACnE,sBAAsB,EAAE,EAAE;aACvB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,yEAAyE,EAAE,CAAC;aACzK,MAAM,CAAC,4BAA4B,CAAC;QACvC,eAAe,EAAE,EAAE;aAChB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;aAC/H,KAAK,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,6BAA6B,CAAC;QACtE,aAAa,EAAE,EAAE;aACd,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC;aAC9J,KAAK,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,2BAA2B,CAAC;QACxE,QAAQ,EAAE,EAAE;aACT,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC;aAC7J,MAAM,CAAC,kBAAkB,CAAC;KAC9B;CACF,CAAA"}