@qlever-llc/trellis 0.7.0-rc.5 → 0.7.0

package/script/auth/browser/login.d.ts

@@ -1,27 +0,0 @@
-import { type BindResponse, type BindSuccessResponse } from "../schemas.ts";
-import type { SessionKeyHandle } from "./session.ts";
-export type { BindResponse, BindSuccessResponse, ContractApproval, SentinelCreds, } from "../schemas.ts";
-export type AuthConfig = {
-    authUrl: string;
-};
-export declare function buildLoginUrl(config: AuthConfig, provider: string | undefined, redirectTo: string, handle: SessionKeyHandle, contract: Record<string, unknown>, context?: unknown): Promise<string>;
-export declare function buildLoginUrl(args: {
-    authUrl: string;
-    provider?: string;
-    redirectTo: string;
-    handle: SessionKeyHandle;
-    contract: Record<string, unknown>;
-    context?: unknown;
-}): Promise<string>;
-export declare function buildLoginUrl(args: {
-    config: AuthConfig;
-    provider?: string;
-    redirectTo: string;
-    handle: SessionKeyHandle;
-    contract: Record<string, unknown>;
-    context?: unknown;
-}): Promise<string>;
-export declare function isBindSuccessResponse(response: BindResponse): response is BindSuccessResponse;
-export declare function bindFlow(config: AuthConfig, handle: SessionKeyHandle, flowId: string): Promise<BindResponse>;
-export declare function bindSession(config: AuthConfig, handle: SessionKeyHandle, authToken: string): Promise<BindResponse>;
-//# sourceMappingURL=login.d.ts.map

package/script/auth/browser/login.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../../../auth/browser/login.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,YAAY,EAEjB,KAAK,mBAAmB,EAEzB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AA4BF,wBAAsB,aAAa,CACjC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,MAAM,CAAC,CAAC;AACnB,wBAAsB,aAAa,CACjC,IAAI,EAAE;IACJ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,MAAM,CAAC,CAAC;AACnB,wBAAsB,aAAa,CACjC,IAAI,EAAE;IACJ,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,MAAM,CAAC,CAAC;AAwEnB,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,YAAY,GAAG,QAAQ,IAAI,mBAAmB,CAE7F;AAED,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CAmBvB;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,gBAAgB,EACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,CAAC,CAoBvB"}

package/script/auth/browser/login.js

@@ -1,100 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildLoginUrl = buildLoginUrl;
-exports.isBindSuccessResponse = isBindSuccessResponse;
-exports.bindFlow = bindFlow;
-exports.bindSession = bindSession;
-const utils_ts_1 = require("../utils.ts");
-const value_1 = require("typebox/value");
-const schemas_ts_1 = require("../schemas.ts");
-const session_ts_1 = require("./session.ts");
-function encodeJsonForQuery(value) {
-    const json = (0, utils_ts_1.canonicalizeJsonValue)(value);
-    const bytes = new TextEncoder().encode(json);
-    let binary = "";
-    for (const byte of bytes)
-        binary += String.fromCharCode(byte);
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-async function buildLoginUrl(argsOrConfig, provider, redirectTo, handle, contract, context) {
-    const resolved = isNestedBuildLoginUrlArgs(argsOrConfig)
-        ? argsOrConfig
-        : isFlatBuildLoginUrlArgs(argsOrConfig)
-            ? {
-                config: { authUrl: argsOrConfig.authUrl },
-                provider: argsOrConfig.provider,
-                redirectTo: argsOrConfig.redirectTo,
-                handle: argsOrConfig.handle,
-                contract: argsOrConfig.contract,
-                context: argsOrConfig.context,
-            }
-            : buildLoginUrlArgsFromPositional(argsOrConfig, provider, redirectTo, handle, contract, context);
-    const sessionKey = (0, session_ts_1.getPublicSessionKey)(resolved.handle);
-    const sig = await (0, session_ts_1.oauthInitSig)(resolved.handle, resolved.redirectTo, resolved.context);
-    const url = new URL(`${resolved.config.authUrl}/auth/login`);
-    url.searchParams.set("redirectTo", resolved.redirectTo);
-    url.searchParams.set("sessionKey", sessionKey);
-    url.searchParams.set("sig", sig);
-    url.searchParams.set("contract", encodeJsonForQuery(resolved.contract));
-    if (resolved.provider) {
-        url.searchParams.set("provider", resolved.provider);
-    }
-    if (resolved.context !== undefined) {
-        url.searchParams.set("context", encodeJsonForQuery(resolved.context));
-    }
-    return url.href;
-}
-function buildLoginUrlArgsFromPositional(config, provider, redirectTo, handle, contract, context) {
-    if (redirectTo === undefined || handle === undefined || contract === undefined) {
-        throw new TypeError("buildLoginUrl requires redirectTo, handle, and contract");
-    }
-    return {
-        config,
-        provider,
-        redirectTo,
-        handle,
-        contract,
-        context,
-    };
-}
-function isNestedBuildLoginUrlArgs(value) {
-    return "config" in value;
-}
-function isFlatBuildLoginUrlArgs(value) {
-    return "authUrl" in value && "redirectTo" in value && "handle" in value && "contract" in value;
-}
-function isBindSuccessResponse(response) {
-    return response.status === "bound";
-}
-async function bindFlow(config, handle, flowId) {
-    const sessionKey = (0, session_ts_1.getPublicSessionKey)(handle);
-    const sig = await (0, session_ts_1.bindFlowSig)(handle, flowId);
-    const response = await fetch(`${config.authUrl}/auth/flow/${encodeURIComponent(flowId)}/bind`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ sessionKey, sig }),
-    });
-    if (!response.ok) {
-        const text = await response.text();
-        throw new Error(`Bind failed: ${response.status} ${text}`);
-    }
-    return value_1.Value.Parse(schemas_ts_1.BindResponseSchema, await response.json());
-}
-async function bindSession(config, handle, authToken) {
-    const sessionKey = (0, session_ts_1.getPublicSessionKey)(handle);
-    const sig = await (0, session_ts_1.bindSig)(handle, authToken);
-    const response = await fetch(`${config.authUrl}/auth/bind`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-            authToken,
-            sessionKey,
-            sig,
-        }),
-    });
-    if (!response.ok) {
-        const text = await response.text();
-        throw new Error(`Bind failed: ${response.status} ${text}`);
-    }
-    return value_1.Value.Parse(schemas_ts_1.BindResponseSchema, await response.json());
-}

package/script/auth/browser/portal.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../../../auth/browser/portal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAyB,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMtD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAO1B;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,MAAM,CAGR;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAe1B;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAEnF"}

package/script/auth/browser/portal.js

@@ -1,40 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.portalFlowIdFromUrl = portalFlowIdFromUrl;
-exports.fetchPortalFlowState = fetchPortalFlowState;
-exports.portalProviderLoginUrl = portalProviderLoginUrl;
-exports.submitPortalApproval = submitPortalApproval;
-exports.portalRedirectLocation = portalRedirectLocation;
-const protocol_ts_1 = require("../protocol.ts");
-const value_1 = require("typebox/value");
-function authBaseUrl(config) {
-    return config.authUrl.replace(/\/$/, "");
-}
-function portalFlowIdFromUrl(url) {
-    return url.searchParams.get("flowId");
-}
-async function fetchPortalFlowState(config, flowId) {
-    const response = await fetch(`${authBaseUrl(config)}/auth/flow/${encodeURIComponent(flowId)}`);
-    if (!response.ok) {
-        throw new Error(`Failed to load portal flow (${response.status})`);
-    }
-    return value_1.Value.Parse(protocol_ts_1.PortalFlowStateSchema, await response.json());
-}
-function portalProviderLoginUrl(config, providerId, flowId) {
-    const base = `${authBaseUrl(config)}/auth/login/${encodeURIComponent(providerId)}`;
-    return `${base}?flowId=${encodeURIComponent(flowId)}`;
-}
-async function submitPortalApproval(config, flowId, decision) {
-    const response = await fetch(`${authBaseUrl(config)}/auth/flow/${encodeURIComponent(flowId)}/approval`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ decision }),
-    });
-    if (!response.ok) {
-        throw new Error(`Approval request failed (${response.status})`);
-    }
-    return value_1.Value.Parse(protocol_ts_1.PortalFlowStateSchema, await response.json());
-}
-function portalRedirectLocation(state) {
-    return state?.status === "redirect" ? state.location : null;
-}

package/script/auth/browser/session.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../../auth/browser/session.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,UAAU,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAapE;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CASvE;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAIvE;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAO/F;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAEpE;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI1F;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI3F;AAED,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,gBAAgB,EACxB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAEtD"}

package/script/auth/browser/session.js

@@ -1,79 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateSessionKey = generateSessionKey;
-exports.loadSessionKey = loadSessionKey;
-exports.getOrCreateSessionKey = getOrCreateSessionKey;
-exports.signBytes = signBytes;
-exports.getPublicSessionKey = getPublicSessionKey;
-exports.oauthInitSig = oauthInitSig;
-exports.bindSig = bindSig;
-exports.bindFlowSig = bindFlowSig;
-exports.natsConnectSigForBindingToken = natsConnectSigForBindingToken;
-exports.createRpcProof = createRpcProof;
-exports.clearSessionKey = clearSessionKey;
-exports.hasSessionKey = hasSessionKey;
-const utils_ts_1 = require("../utils.ts");
-const proof_ts_1 = require("../proof.ts");
-const storage_ts_1 = require("./storage.ts");
-async function generateSessionKey() {
-    const keyPair = await crypto.subtle.generateKey({ name: "Ed25519" }, false, ["sign", "verify"]);
-    const publicKeyRaw = new Uint8Array(await crypto.subtle.exportKey("raw", keyPair.publicKey));
-    const sessionKey = (0, utils_ts_1.base64urlEncode)(publicKeyRaw);
-    await (0, storage_ts_1.storeKeyPair)(keyPair, publicKeyRaw);
-    return { privateKey: keyPair.privateKey, publicKey: keyPair.publicKey, publicKeyRaw, sessionKey };
-}
-async function loadSessionKey() {
-    const stored = await (0, storage_ts_1.loadKeyPair)();
-    if (!stored)
-        return null;
-    return {
-        privateKey: stored.privateKey,
-        publicKey: stored.publicKey,
-        publicKeyRaw: stored.publicKeyRaw,
-        sessionKey: (0, utils_ts_1.base64urlEncode)(stored.publicKeyRaw),
-    };
-}
-async function getOrCreateSessionKey() {
-    const existing = await loadSessionKey();
-    if (existing)
-        return existing;
-    return await generateSessionKey();
-}
-async function signBytes(handle, data) {
-    const sig = await crypto.subtle.sign({ name: "Ed25519" }, handle.privateKey, (0, utils_ts_1.toArrayBuffer)(data));
-    return new Uint8Array(sig);
-}
-function getPublicSessionKey(handle) {
-    return handle.sessionKey;
-}
-async function oauthInitSig(handle, redirectTo, context) {
-    const canonicalContext = (0, utils_ts_1.canonicalizeJsonValue)(context ?? null);
-    const digest = await (0, utils_ts_1.sha256)((0, utils_ts_1.utf8)(`oauth-init:${redirectTo}:${canonicalContext}`));
-    const sig = await signBytes(handle, digest);
-    return (0, utils_ts_1.base64urlEncode)(sig);
-}
-async function bindSig(handle, authToken) {
-    const digest = await (0, utils_ts_1.sha256)((0, utils_ts_1.utf8)(`bind:${authToken}`));
-    const sig = await signBytes(handle, digest);
-    return (0, utils_ts_1.base64urlEncode)(sig);
-}
-async function bindFlowSig(handle, flowId) {
-    const digest = await (0, utils_ts_1.sha256)((0, utils_ts_1.utf8)(`bind-flow:${flowId}`));
-    const sig = await signBytes(handle, digest);
-    return (0, utils_ts_1.base64urlEncode)(sig);
-}
-async function natsConnectSigForBindingToken(handle, bindingToken) {
-    const digest = await (0, utils_ts_1.sha256)((0, utils_ts_1.utf8)(`nats-connect:${bindingToken}`));
-    const sig = await signBytes(handle, digest);
-    return (0, utils_ts_1.base64urlEncode)(sig);
-}
-async function createRpcProof(handle, subject, payload) {
-    const payloadHash = await (0, utils_ts_1.sha256)(payload);
-    return await (0, proof_ts_1.createProof)(handle.privateKey, { sessionKey: handle.sessionKey, subject, payloadHash });
-}
-async function clearSessionKey() {
-    await (0, storage_ts_1.deleteKeyPair)();
-}
-async function hasSessionKey() {
-    return await (0, storage_ts_1.hasKeyPair)();
-}

package/script/auth/browser/storage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../../../auth/browser/storage.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,UAAU,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAsB,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBlG;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAYjE;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAYnD;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAGnD"}

package/script/auth/browser.d.ts

@@ -1,13 +0,0 @@
-/**
- * @module
- * Browser-based authentication utilities for session-key based authentication.
- * Uses WebCrypto API and IndexedDB for secure key storage.
- */
-export { type AuthConfig, type BindResponse, type BindSuccessResponse, bindFlow, bindSession, buildLoginUrl, isBindSuccessResponse, type SentinelCreds, } from "./browser/login.ts";
-export { fetchPortalFlowState, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, submitPortalApproval, type ApprovalDecision, type PortalFlowState as BrowserPortalFlowState, } from "./browser/portal.ts";
-export { bindFlowSig, clearSessionKey, createRpcProof, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, loadSessionKey, natsConnectSigForBindingToken, type SessionKeyHandle, signBytes, } from "./browser/session.ts";
-export { deleteKeyPair, hasKeyPair } from "./browser/storage.ts";
-export { type BindResponse as BindResponseData, BindResponseSchema, type BindSuccessResponse as BindSuccessResponseData, BindSuccessResponseSchema, type ContractApproval as ContractApprovalData, ContractApprovalSchema, type NatsAuthTokenV1 as NatsAuthTokenV1Data, NatsAuthTokenV1Schema, type ApprovalDecision as ApprovalDecisionData, ApprovalDecisionSchema, type SentinelCreds as SentinelCredsData, SentinelCredsSchema, } from "./schemas.ts";
-export type { NatsAuthTokenV1 } from "./types.ts";
-export { base64urlDecode, base64urlEncode, sha256, toArrayBuffer, utf8, } from "./utils.ts";
-//# sourceMappingURL=browser.d.ts.map

package/script/auth/browser.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../../auth/browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,QAAQ,EACR,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,IAAI,sBAAsB,GAC/C,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,6BAA6B,EAC7B,KAAK,gBAAgB,EACrB,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EACL,KAAK,YAAY,IAAI,gBAAgB,EACrC,kBAAkB,EAClB,KAAK,mBAAmB,IAAI,uBAAuB,EACnD,yBAAyB,EACzB,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,eAAe,IAAI,mBAAmB,EAC3C,qBAAqB,EACrB,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,aAAa,IAAI,iBAAiB,EACvC,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EACL,eAAe,EACf,eAAe,EACf,MAAM,EACN,aAAa,EACb,IAAI,GACL,MAAM,YAAY,CAAC"}

package/script/auth/browser.js

@@ -1,46 +0,0 @@
-"use strict";
-/**
- * @module
- * Browser-based authentication utilities for session-key based authentication.
- * Uses WebCrypto API and IndexedDB for secure key storage.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.utf8 = exports.toArrayBuffer = exports.sha256 = exports.base64urlEncode = exports.base64urlDecode = exports.SentinelCredsSchema = exports.ApprovalDecisionSchema = exports.NatsAuthTokenV1Schema = exports.ContractApprovalSchema = exports.BindSuccessResponseSchema = exports.BindResponseSchema = exports.hasKeyPair = exports.deleteKeyPair = exports.signBytes = exports.natsConnectSigForBindingToken = exports.loadSessionKey = exports.hasSessionKey = exports.getPublicSessionKey = exports.getOrCreateSessionKey = exports.generateSessionKey = exports.createRpcProof = exports.clearSessionKey = exports.bindFlowSig = exports.submitPortalApproval = exports.portalRedirectLocation = exports.portalProviderLoginUrl = exports.portalFlowIdFromUrl = exports.fetchPortalFlowState = exports.isBindSuccessResponse = exports.buildLoginUrl = exports.bindSession = exports.bindFlow = void 0;
-var login_ts_1 = require("./browser/login.ts");
-Object.defineProperty(exports, "bindFlow", { enumerable: true, get: function () { return login_ts_1.bindFlow; } });
-Object.defineProperty(exports, "bindSession", { enumerable: true, get: function () { return login_ts_1.bindSession; } });
-Object.defineProperty(exports, "buildLoginUrl", { enumerable: true, get: function () { return login_ts_1.buildLoginUrl; } });
-Object.defineProperty(exports, "isBindSuccessResponse", { enumerable: true, get: function () { return login_ts_1.isBindSuccessResponse; } });
-var portal_ts_1 = require("./browser/portal.ts");
-Object.defineProperty(exports, "fetchPortalFlowState", { enumerable: true, get: function () { return portal_ts_1.fetchPortalFlowState; } });
-Object.defineProperty(exports, "portalFlowIdFromUrl", { enumerable: true, get: function () { return portal_ts_1.portalFlowIdFromUrl; } });
-Object.defineProperty(exports, "portalProviderLoginUrl", { enumerable: true, get: function () { return portal_ts_1.portalProviderLoginUrl; } });
-Object.defineProperty(exports, "portalRedirectLocation", { enumerable: true, get: function () { return portal_ts_1.portalRedirectLocation; } });
-Object.defineProperty(exports, "submitPortalApproval", { enumerable: true, get: function () { return portal_ts_1.submitPortalApproval; } });
-var session_ts_1 = require("./browser/session.ts");
-Object.defineProperty(exports, "bindFlowSig", { enumerable: true, get: function () { return session_ts_1.bindFlowSig; } });
-Object.defineProperty(exports, "clearSessionKey", { enumerable: true, get: function () { return session_ts_1.clearSessionKey; } });
-Object.defineProperty(exports, "createRpcProof", { enumerable: true, get: function () { return session_ts_1.createRpcProof; } });
-Object.defineProperty(exports, "generateSessionKey", { enumerable: true, get: function () { return session_ts_1.generateSessionKey; } });
-Object.defineProperty(exports, "getOrCreateSessionKey", { enumerable: true, get: function () { return session_ts_1.getOrCreateSessionKey; } });
-Object.defineProperty(exports, "getPublicSessionKey", { enumerable: true, get: function () { return session_ts_1.getPublicSessionKey; } });
-Object.defineProperty(exports, "hasSessionKey", { enumerable: true, get: function () { return session_ts_1.hasSessionKey; } });
-Object.defineProperty(exports, "loadSessionKey", { enumerable: true, get: function () { return session_ts_1.loadSessionKey; } });
-Object.defineProperty(exports, "natsConnectSigForBindingToken", { enumerable: true, get: function () { return session_ts_1.natsConnectSigForBindingToken; } });
-Object.defineProperty(exports, "signBytes", { enumerable: true, get: function () { return session_ts_1.signBytes; } });
-var storage_ts_1 = require("./browser/storage.ts");
-Object.defineProperty(exports, "deleteKeyPair", { enumerable: true, get: function () { return storage_ts_1.deleteKeyPair; } });
-Object.defineProperty(exports, "hasKeyPair", { enumerable: true, get: function () { return storage_ts_1.hasKeyPair; } });
-var schemas_ts_1 = require("./schemas.ts");
-Object.defineProperty(exports, "BindResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.BindResponseSchema; } });
-Object.defineProperty(exports, "BindSuccessResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.BindSuccessResponseSchema; } });
-Object.defineProperty(exports, "ContractApprovalSchema", { enumerable: true, get: function () { return schemas_ts_1.ContractApprovalSchema; } });
-Object.defineProperty(exports, "NatsAuthTokenV1Schema", { enumerable: true, get: function () { return schemas_ts_1.NatsAuthTokenV1Schema; } });
-Object.defineProperty(exports, "ApprovalDecisionSchema", { enumerable: true, get: function () { return schemas_ts_1.ApprovalDecisionSchema; } });
-Object.defineProperty(exports, "SentinelCredsSchema", { enumerable: true, get: function () { return schemas_ts_1.SentinelCredsSchema; } });
-var utils_ts_1 = require("./utils.ts");
-Object.defineProperty(exports, "base64urlDecode", { enumerable: true, get: function () { return utils_ts_1.base64urlDecode; } });
-Object.defineProperty(exports, "base64urlEncode", { enumerable: true, get: function () { return utils_ts_1.base64urlEncode; } });
-Object.defineProperty(exports, "sha256", { enumerable: true, get: function () { return utils_ts_1.sha256; } });
-Object.defineProperty(exports, "toArrayBuffer", { enumerable: true, get: function () { return utils_ts_1.toArrayBuffer; } });
-Object.defineProperty(exports, "utf8", { enumerable: true, get: function () { return utils_ts_1.utf8; } });

package/script/auth/device_activation.d.ts

@@ -1,194 +0,0 @@
-import type { StaticDecode } from "typebox";
-import { Type } from "typebox";
-import type { NatsAuthTokenV1 } from "./schemas.ts";
-import { AuthActivateDeviceResponseSchema, AuthActivateDeviceSchema, AuthGetDeviceActivationStatusResponseSchema, AuthGetDeviceActivationStatusSchema, AuthGetDeviceConnectInfoResponseSchema, AuthGetDeviceConnectInfoSchema, AuthListDeviceActivationsResponseSchema, AuthListDeviceActivationsSchema, AuthRevokeDeviceActivationResponseSchema, AuthRevokeDeviceActivationSchema, WaitForDeviceActivationResponseSchema } from "./protocol.ts";
-export declare const DeviceActivationPayloadSchema: Type.TObject<{
-    v: Type.TLiteral<1>;
-    publicIdentityKey: Type.TString;
-    nonce: Type.TString;
-    qrMac: Type.TString;
-}>;
-export declare const DeviceActivationWaitRequestSchema: Type.TObject<{
-    publicIdentityKey: Type.TString;
-    nonce: Type.TString;
-    contractDigest: Type.TOptional<Type.TString>;
-    iat: Type.TNumber;
-    sig: Type.TString;
-}>;
-export type DeviceActivationPayload = StaticDecode<typeof DeviceActivationPayloadSchema>;
-export type DeviceActivationWaitRequest = StaticDecode<typeof DeviceActivationWaitRequestSchema>;
-export type WaitForDeviceActivationResponse = StaticDecode<typeof WaitForDeviceActivationResponseSchema>;
-export type AuthActivateDeviceInput = StaticDecode<typeof AuthActivateDeviceSchema>;
-export type AuthActivateDeviceOutput = StaticDecode<typeof AuthActivateDeviceResponseSchema>;
-export type AuthGetDeviceActivationStatusInput = StaticDecode<typeof AuthGetDeviceActivationStatusSchema>;
-export type AuthGetDeviceActivationStatusOutput = StaticDecode<typeof AuthGetDeviceActivationStatusResponseSchema>;
-export type AuthListDeviceActivationsInput = StaticDecode<typeof AuthListDeviceActivationsSchema>;
-export type AuthListDeviceActivationsOutput = StaticDecode<typeof AuthListDeviceActivationsResponseSchema>;
-export type AuthRevokeDeviceActivationInput = StaticDecode<typeof AuthRevokeDeviceActivationSchema>;
-export type AuthRevokeDeviceActivationResponse = StaticDecode<typeof AuthRevokeDeviceActivationResponseSchema>;
-export type GetDeviceConnectInfoInput = StaticDecode<typeof AuthGetDeviceConnectInfoSchema>;
-export type GetDeviceConnectInfoOutput = StaticDecode<typeof AuthGetDeviceConnectInfoResponseSchema>;
-export type DeviceIdentity = {
-    identitySeed: Uint8Array;
-    identitySeedBase64url: string;
-    publicIdentityKey: string;
-    activationKey: Uint8Array;
-    activationKeyBase64url: string;
-};
-type DeviceActivationRpcMethod = "Auth.ActivateDevice" | "Auth.GetDeviceActivationStatus" | "Auth.ListDeviceActivations" | "Auth.RevokeDeviceActivation" | "Auth.GetDeviceConnectInfo";
-type DeviceActivationRpcInputMap = {
-    "Auth.ActivateDevice": AuthActivateDeviceInput;
-    "Auth.GetDeviceActivationStatus": AuthGetDeviceActivationStatusInput;
-    "Auth.ListDeviceActivations": AuthListDeviceActivationsInput;
-    "Auth.RevokeDeviceActivation": AuthRevokeDeviceActivationInput;
-    "Auth.GetDeviceConnectInfo": GetDeviceConnectInfoInput;
-};
-type DeviceActivationRpcOutputMap = {
-    "Auth.ActivateDevice": AuthActivateDeviceOutput;
-    "Auth.GetDeviceActivationStatus": AuthGetDeviceActivationStatusOutput;
-    "Auth.ListDeviceActivations": AuthListDeviceActivationsOutput;
-    "Auth.RevokeDeviceActivation": AuthRevokeDeviceActivationResponse;
-    "Auth.GetDeviceConnectInfo": GetDeviceConnectInfoOutput;
-};
-type RequestClient = {
-    requestOrThrow<M extends DeviceActivationRpcMethod>(method: M, input: DeviceActivationRpcInputMap[M], opts?: unknown): Promise<DeviceActivationRpcOutputMap[M]>;
-};
-export type DeviceActivationTransport = RequestClient;
-export declare function deriveDeviceIdentity(deviceRootSecret: Uint8Array): Promise<DeviceIdentity>;
-export declare function deriveDeviceQrMac(input: {
-    activationKey: Uint8Array | string;
-    publicIdentityKey: string;
-    nonce: string;
-}): Promise<string>;
-export declare function buildDeviceActivationPayload(input: {
-    activationKey: Uint8Array | string;
-    publicIdentityKey: string;
-    nonce: string;
-}): Promise<DeviceActivationPayload>;
-export declare function encodeDeviceActivationPayload(payload: DeviceActivationPayload): string;
-export declare function parseDeviceActivationPayload(value: string): DeviceActivationPayload;
-export declare function buildDeviceActivationUrl(args: {
-    trellisUrl: string;
-    payload: DeviceActivationPayload | string;
-}): string;
-export declare function deriveDeviceConfirmationCode(input: {
-    activationKey: Uint8Array | string;
-    publicIdentityKey: string;
-    nonce: string;
-}): Promise<string>;
-export declare function verifyDeviceConfirmationCode(input: {
-    activationKey: Uint8Array | string;
-    publicIdentityKey: string;
-    nonce: string;
-    confirmationCode: string;
-}): Promise<boolean>;
-export declare function buildDeviceWaitProofInput(publicIdentityKey: string, nonce: string, iat: number): Uint8Array;
-export declare function signDeviceWaitRequest(args: {
-    publicIdentityKey: string;
-    nonce: string;
-    identitySeed: Uint8Array | string;
-    contractDigest?: string;
-    iat?: number;
-}): Promise<DeviceActivationWaitRequest>;
-export declare function createDeviceNatsAuthToken(args: {
-    publicIdentityKey: string;
-    identitySeed: Uint8Array | string;
-    contractDigest: string;
-    iat?: number;
-}): Promise<NatsAuthTokenV1 & {
-    contractDigest: string;
-}>;
-export declare function waitForDeviceActivation(args: {
-    trellisUrl: string;
-    publicIdentityKey: string;
-    nonce: string;
-    identitySeed: Uint8Array | string;
-    contractDigest: string;
-    signal?: AbortSignal;
-    pollIntervalMs?: number;
-}): Promise<Extract<WaitForDeviceActivationResponse, {
-    status: "activated";
-}>>;
-export declare function getDeviceConnectInfo(args: {
-    trellisUrl: string;
-    publicIdentityKey: string;
-    identitySeed: Uint8Array | string;
-    contractDigest: string;
-    iat?: number;
-}): Promise<GetDeviceConnectInfoOutput>;
-export declare function createDeviceActivationClient(client: DeviceActivationTransport): {
-    activateDevice(input: AuthActivateDeviceInput): Promise<{
-        confirmationCode?: string | undefined;
-        status: "activated";
-        profileId: string;
-        instanceId: string;
-        activatedAt: string;
-    } | {
-        status: "pending_review";
-        profileId: string;
-        instanceId: string;
-        reviewId: string;
-        linkRequestId: string;
-        requestedAt: string;
-    } | {
-        reason?: string | undefined;
-        status: "rejected";
-    }>;
-    getDeviceActivationStatus(input: AuthGetDeviceActivationStatusInput): Promise<{
-        confirmationCode?: string | undefined;
-        status: "activated";
-        profileId: string;
-        instanceId: string;
-        activatedAt: string;
-    } | {
-        status: "pending_review";
-        profileId: string;
-        instanceId: string;
-        reviewId: string;
-        linkRequestId: string;
-        requestedAt: string;
-    } | {
-        reason?: string | undefined;
-        status: "rejected";
-    }>;
-    listDeviceActivations(input?: AuthListDeviceActivationsInput): Promise<{
-        activations: {
-            activatedBy?: {
-                origin: string;
-                id: string;
-            } | undefined;
-            profileId: string;
-            instanceId: string;
-            publicIdentityKey: string;
-            state: "activated" | "revoked";
-            activatedAt: string;
-            revokedAt: string | null;
-        }[];
-    }>;
-    revokeDeviceActivation(input: AuthRevokeDeviceActivationInput): Promise<{
-        success: boolean;
-    }>;
-    getDeviceConnectInfo(input: GetDeviceConnectInfoInput): Promise<{
-        status: "ready";
-        connectInfo: {
-            contractDigest: string;
-            contractId: string;
-            profileId: string;
-            instanceId: string;
-            transport: {
-                sentinel: {
-                    jwt: string;
-                    seed: string;
-                };
-                natsServers: string[];
-            };
-            auth: {
-                mode: "device_identity";
-                iatSkewSeconds: number;
-            };
-        };
-    }>;
-};
-export declare function verifyDeviceWaitSignature(input: DeviceActivationWaitRequest): Promise<boolean>;
-export {};
-//# sourceMappingURL=device_activation.d.ts.map

package/script/auth/device_activation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"device_activation.d.ts","sourceRoot":"","sources":["../../../../auth/device_activation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAQ/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,2CAA2C,EAC3C,mCAAmC,EACnC,sCAAsC,EACtC,8BAA8B,EAC9B,uCAAuC,EACvC,+BAA+B,EAC/B,wCAAwC,EACxC,gCAAgC,EAChC,qCAAqC,EACtC,MAAM,eAAe,CAAC;AAgBvB,eAAO,MAAM,6BAA6B;;;;;EAKP,CAAC;AAEpC,eAAO,MAAM,iCAAiC;;;;;;EAMX,CAAC;AAEpC,MAAM,MAAM,uBAAuB,GAAG,YAAY,CAChD,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,YAAY,CACpD,OAAO,iCAAiC,CACzC,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,YAAY,CACxD,OAAO,qCAAqC,CAC7C,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,YAAY,CAChD,OAAO,wBAAwB,CAChC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,YAAY,CACjD,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,YAAY,CAC3D,OAAO,mCAAmC,CAC3C,CAAC;AACF,MAAM,MAAM,mCAAmC,GAAG,YAAY,CAC5D,OAAO,2CAA2C,CACnD,CAAC;AACF,MAAM,MAAM,8BAA8B,GAAG,YAAY,CACvD,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,YAAY,CACxD,OAAO,uCAAuC,CAC/C,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,YAAY,CACxD,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,YAAY,CAC3D,OAAO,wCAAwC,CAChD,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,YAAY,CAClD,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,YAAY,CACnD,OAAO,sCAAsC,CAC9C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,UAAU,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,UAAU,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,KAAK,yBAAyB,GAC1B,qBAAqB,GACrB,gCAAgC,GAChC,4BAA4B,GAC5B,6BAA6B,GAC7B,2BAA2B,CAAC;AAEhC,KAAK,2BAA2B,GAAG;IACjC,qBAAqB,EAAE,uBAAuB,CAAC;IAC/C,gCAAgC,EAAE,kCAAkC,CAAC;IACrE,4BAA4B,EAAE,8BAA8B,CAAC;IAC7D,6BAA6B,EAAE,+BAA+B,CAAC;IAC/D,2BAA2B,EAAE,yBAAyB,CAAC;CACxD,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAClC,qBAAqB,EAAE,wBAAwB,CAAC;IAChD,gCAAgC,EAAE,mCAAmC,CAAC;IACtE,4BAA4B,EAAE,+BAA+B,CAAC;IAC9D,6BAA6B,EAAE,kCAAkC,CAAC;IAClE,2BAA2B,EAAE,0BAA0B,CAAC;CACzD,CAAC;AAEF,KAAK,aAAa,GAAG;IACnB,cAAc,CAAC,CAAC,SAAS,yBAAyB,EAChD,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,2BAA2B,CAAC,CAAC,CAAC,EACrC,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,aAAa,CAAC;AA6HtD,wBAAsB,oBAAoB,CACxC,gBAAgB,EAAE,UAAU,GAC3B,OAAO,CAAC,cAAc,CAAC,CA8BzB;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAQnC;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CAER;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,GACZ,uBAAuB,CAOzB;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAAC;CAC3C,GAAG,MAAM,CAUT;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAInB;AAED,wBAAgB,yBAAyB,CACvC,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,UAAU,CAwBZ;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA0BvC;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,eAAe,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBxD;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CACT,OAAO,CAAC,+BAA+B,EAAE;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAClE,CAoCA;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA8BtC;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,yBAAyB;0BAGT,uBAAuB;;;;;;;;;;;;;;;;;qCAGZ,kCAAkC;;;;;;;;;;;;;;;;;kCAGtC,8BAA8B;;;;;;;;;;;;;;kCAG7B,+BAA+B;;;gCAGjC,yBAAyB;;;;;;;;;;;;;;;;;;;;EAIxD;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC,CAiBlB"}