@qlever-llc/trellis 0.7.0 → 0.8.0-rc.3

package/esm/device.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../src/device.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwC,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAiB/F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAIvC,KAAK,cAAc,CAAC,IAAI,SAAS,UAAU,GAAG,UAAU,IAAI;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE;QACT,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,GAAG,EAAE;QACH,OAAO,EAAE,IAAI,CAAC;KACf,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,uBAAuB,CAAC,IAAI,SAAS,UAAU,GAAG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG;IAC1F,MAAM,EAAE,aAAa,CAAC;CACvB,CAAC;AAEF,KAAK,sBAAsB,GAAG;IAC5B,OAAO,CAAC,OAAO,EAAE;QACf,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7B,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,aAAa,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjD,GAAG,IAAI,MAAM,CAAC;CACf,CAAC;AAWF,MAAM,MAAM,0BAA0B,GAAG;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,wBAAwB,CAAC,IAAI,SAAS,UAAU,GAAG,UAAU,IAAI;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/B,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC;IAChC,oBAAoB,CAAC,CAAC,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E,CAAC;AAsIF,wBAAsB,qBAAqB,CAAC,IAAI,SAAS,UAAU,EACjE,IAAI,EAAE,wBAAwB,CAAC,IAAI,CAAC,EACpC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAmLxC;AAED,eAAO,MAAM,aAAa;YAChB,IAAI,SAAS,UAAU,QACvB,wBAAwB,CAAC,IAAI,CAAC,GACnC,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;CAG1C,CAAC"}
+{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../device.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,uBAAuB,EACvB,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AAwBnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAMjD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,KAAK,6BAA6B,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AAEzB,KAAK,cAAc,CACjB,IAAI,SAAS,UAAU,GAAG,UAAU,EACpC,SAAS,SAAS;IAChB,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC7C,GAAG;IACF,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC7C,IACC;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,SAAS,GAAG;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,GAAG,EAAE;QACH,OAAO,EAAE,IAAI,CAAC;KACf,CAAC;IACF,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAC5D,CAAC;AAEF,KAAK,iBAAiB,CAAC,SAAS,SAAS,cAAc,IACrD,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;AAE9B,KAAK,aAAa,CAChB,IAAI,SAAS,UAAU,EACvB,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,IACtE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAkCpC,MAAM,MAAM,uBAAuB,CACjC,IAAI,SAAS,UAAU,GAAG,UAAU,EACpC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG,EAAE,IAC3E;IACF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC;IACzD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC;IACzD,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7D,QAAQ,CAAC,QAAQ,EAAE;QACjB,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAAC;QAC/C,CAAC,KAAK,EAAE,oBAAoB,GAAG,qBAAqB,CAAC;KACtD,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC,CAAC;AAEF,KAAK,sBAAsB,GAAG;IAC5B,OAAO,CAAC,OAAO,EAAE;QACf,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7B,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,aAAa,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjD,GAAG,IAAI,MAAM,CAAC;CACf,CAAC;AAWF,MAAM,MAAM,mCAAmC,GAAG;IAChD,MAAM,EAAE,SAAS,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG;IAClD,MAAM,EAAE,WAAW,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GACzC,mCAAmC,GACnC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,8BAA8B,CACxC,MAAM,SAAS,iCAAiC,GAC9C,iCAAiC,IACjC;IACF,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,IAAI,CAAC,EAAE;QAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAAC;IACnD,sBAAsB,CACpB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qCAAqC,CAAC,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,2BAA2B,CACrC,IAAI,SAAS,UAAU,GAAG,UAAU,EACpC,SAAS,SAAS,cAAc,CAAC,IAAI,EAAE;IACrC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC7C,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE;IACxB,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC7C,CAAC,IACA;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,iCAAiC,CAC3C,IAAI,SAAS,UAAU,GAAG,UAAU,EACpC,SAAS,SAAS,cAAc,CAAC,IAAI,EAAE;IACrC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC7C,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE;IACxB,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC7C,CAAC,IACA,2BAA2B,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG;IACjD,UAAU,EAAE,iCAAiC,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,wBAAwB,CAClC,IAAI,SAAS,UAAU,GAAG,UAAU,EACpC,SAAS,SAAS,cAAc,CAAC,IAAI,EAAE;IACrC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC7C,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE;IACxB,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC7C,CAAC,IACA;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC;IAChC,GAAG,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;CAC1B,CAAC;AAidF,wBAAsB,6BAA6B,CACjD,SAAS,SAAS,cAAc,CAAC,UAAU,EAAE;IAC3C,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC7C,CAAC,EAEF,IAAI,EAAE,2BAA2B,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,EAC1E,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,GACpC,OAAO,CACR,8BAA8B,CAAC,mCAAmC,CAAC,CACpE,CA4BA;AAED,wBAAsB,8BAA8B,CAClD,WAAW,SAAS,iCAAiC,EACrD,SAAS,SAAS,cAAc,CAAC,UAAU,EAAE;IAC3C,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC7C,CAAC,EAEF,IAAI,EACA,iCAAiC,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,GAC1E;IACA,UAAU,EAAE,WAAW,CAAC;CACzB,EACH,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,GACpC,OAAO,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC,CAUtD;AAED,wBAAsB,qBAAqB,CACzC,SAAS,SAAS,cAAc,CAAC,UAAU,EAAE;IAC3C,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC7C,CAAC,EAEF,IAAI,EAAE,wBAAwB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,EACvE,IAAI,EAAE,iBAAiB,GACtB,OAAO,CACR,uBAAuB,CACrB,iBAAiB,CAAC,SAAS,CAAC,EAC5B,6BAA6B,CAAC,SAAS,CAAC,CACzC,CACF,CA4KA;AAED,eAAO,MAAM,aAAa;YAEtB,SAAS,SAAS,cAAc,CAAC,UAAU,EAAE;QAC3C,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC7C,CAAC,QAEI,wBAAwB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAI1E,CAAC"}

package/esm/device.js

@@ -1,15 +1,24 @@
-import { jwtAuthenticator } from "@nats-io/nats-core";
-import { Buffer } from "node:buffer";
-import { createHash, createPrivateKey, sign as signBytesSync } from "node:crypto";
+import { jwtAuthenticator, } from "@nats-io/nats-core";
+import { AsyncResult, Result, UnexpectedError, } from "@qlever-llc/result";
+import { CONTRACT_STATE_METADATA, } from "./contract_support/mod.js";
 import { buildDeviceActivationPayload, deriveDeviceIdentity, signDeviceWaitRequest, startDeviceActivationRequest, verifyDeviceConfirmationCode, waitForDeviceActivation, } from "./auth/device_activation.js";
-import { importEd25519PrivateKeyFromSeedBase64url, pkcs8FromEd25519Seed, } from "./auth/keys.js";
-import { base64urlDecode, base64urlEncode, toArrayBuffer } from "./auth/utils.js";
-import { loadDefaultRuntimeTransport } from "./runtime_transport.js";
-import { selectRuntimeTransportServers } from "./runtime_transport.js";
+import { importEd25519PrivateKeyFromSeedBase64url, signEd25519SeedSha256, } from "./auth/keys.js";
+import { base64urlDecode, base64urlEncode, toArrayBuffer, } from "./auth/utils.js";
+import { correctedIatSeconds, estimateMidpointClockOffsetMs, } from "./auth/time.js";
+import { buildNatsConnectSignaturePayload } from "./auth/session_auth.js";
+import { DEFAULT_RUNTIME_MAX_RECONNECT_ATTEMPTS, loadDefaultRuntimeTransport, selectRuntimeTransportServers, } from "./runtime_transport.js";
 import { ServiceHealth } from "./health.js";
 import { Trellis } from "./trellis.js";
+import { logger as noopLogger } from "./globals.js";
+import { TransportError } from "./errors/index.js";
 import { Type } from "typebox";
 import { Value } from "typebox/value";
+import { observeNatsTrellisConnection, } from "./connection.js";
+function deviceConnectResult(promise) {
+    return AsyncResult.from(promise.then((value) => Result.ok(value), (cause) => Result.err(cause instanceof TransportError
+        ? cause
+        : new UnexpectedError({ cause }))));
+}
 const ClientTransportEndpointsSchema = Type.Object({
     natsServers: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
 });
@@ -21,7 +30,7 @@ const DeviceBootstrapReadySchema = Type.Object({
     status: Type.Literal("ready"),
     connectInfo: Type.Object({
         instanceId: Type.String({ minLength: 1 }),
-        profileId: Type.String({ minLength: 1 }),
+        deploymentId: Type.String({ minLength: 1 }),
         contractId: Type.String({ minLength: 1 }),
         contractDigest: Type.String({ minLength: 1 }),
         transports: ClientTransportsSchema,
@@ -60,15 +69,9 @@ async function signIdentityBytes(identitySeed, data) {
     return new Uint8Array(await crypto.subtle.sign("Ed25519", privateKey, toArrayBuffer(data)));
 }
 function createDeviceNatsAuthTokenAuthenticator(args) {
-    const reconnectKey = createPrivateKey({
-        key: Buffer.from(pkcs8FromEd25519Seed(args.identitySeed)),
-        format: "der",
-        type: "pkcs8",
-    });
     return () => {
-        const iat = Math.floor(args.now() / 1_000);
-        const digest = createHash("sha256").update(`nats-connect:${iat}`, "utf8").digest();
-        const sig = signBytesSync(null, digest, reconnectKey);
+        const iat = correctedIatSeconds(args.now(), args.getServerClockOffsetMs());
+        const sig = signEd25519SeedSha256(args.identitySeed, new TextEncoder().encode(`nats-connect:${buildNatsConnectSignaturePayload(iat, args.contractDigest)}`));
         return {
             auth_token: JSON.stringify({
                 v: 1,
@@ -84,157 +87,396 @@ const defaultDeps = {
     loadTransport: loadDefaultRuntimeTransport,
     now: () => Date.now(),
 };
-function activationRequiredError() {
-    return new Error("Device activation required but no activation handler was provided");
+function transportCauseContext(cause) {
+    if (cause instanceof Error) {
+        return { causeName: cause.name, causeMessage: cause.message };
+    }
+    return { cause: String(cause) };
 }
-function isConnectInfoUnavailable(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return message.includes("404") || message.includes("unknown_device") || message.includes("activation_required");
+function createTransportError(args) {
+    return new TransportError({
+        code: args.code,
+        message: args.message,
+        hint: args.hint,
+        cause: args.cause,
+        context: {
+            ...(args.context ?? {}),
+            ...(args.cause === undefined ? {} : transportCauseContext(args.cause)),
+        },
+    });
 }
-async function fetchDeviceBootstrap(args) {
-    const request = await signDeviceWaitRequest({
-        publicIdentityKey: args.publicIdentityKey,
-        nonce: "connect-info",
-        identitySeed: args.identitySeed,
-        contractDigest: args.contractDigest,
-        iat: args.iat,
+function assertBootstrapContractMatches(args) {
+    if (args.connectInfo.contractId !== args.contractId ||
+        args.connectInfo.contractDigest !== args.contractDigest) {
+        throw createTransportError({
+            code: "trellis.bootstrap.contract_mismatch",
+            message: "Trellis returned connection details for a different device contract.",
+            hint: "Retry the connection. If it keeps happening, check the requested device contract and Trellis activation state.",
+            context: {
+                requestedContractId: args.contractId,
+                requestedContractDigest: args.contractDigest,
+                returnedContractId: args.connectInfo.contractId,
+                returnedContractDigest: args.connectInfo.contractDigest,
+            },
+        });
+    }
+}
+async function readJsonResponse(response, args) {
+    try {
+        return await response.json();
+    }
+    catch (cause) {
+        throw createTransportError({
+            ...args,
+            cause,
+        });
+    }
+}
+function parseResponseRecord(text) {
+    if (text.length === 0) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function resolveDeviceLogger(log) {
+    if (log === false) {
+        return noopLogger;
+    }
+    return log ?? noopLogger;
+}
+async function readResponseReason(response) {
+    const text = await response.text();
+    if (!text) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(text);
+        if (typeof parsed.reason === "string" && parsed.reason.length > 0) {
+            return parsed.reason;
+        }
+    }
+    catch {
+        return text;
+    }
+    return text;
+}
+function createActivationRequiredTransportError(context) {
+    return createTransportError({
+        code: "trellis.bootstrap.activation_required",
+        message: "Trellis requires device activation before connecting.",
+        hint: "Start or resume device activation, then retry the runtime connection after activation completes.",
+        context,
     });
-    const bootstrapRequest = {
-        publicIdentityKey: request.publicIdentityKey,
-        contractDigest: request.contractDigest,
-        iat: request.iat,
-        sig: request.sig,
+}
+function createInvalidConfirmationCodeTransportError(context) {
+    return createTransportError({
+        code: "trellis.device.invalid_confirmation_code",
+        message: "The device confirmation code is invalid.",
+        hint: "Retry with the current confirmation code for this activation, or restart activation if the code is no longer valid.",
+        context,
+    });
+}
+function createActivatedLocalState(localState) {
+    return {
+        ...localState,
+        status: "activated",
     };
-    const response = await fetch(new URL("/bootstrap/device", args.trellisUrl), {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(bootstrapRequest),
+}
+function assertActivationStateMatchesIdentity(args) {
+    if (args.localState.publicIdentityKey !== args.publicIdentityKey) {
+        throw createTransportError({
+            code: "trellis.device.activation_state_mismatch",
+            message: "Local device activation state does not match the provided root secret.",
+            hint: "Use the activation state for the same device identity, or start a new activation for this root secret.",
+            context: {
+                statePublicIdentityKey: args.localState.publicIdentityKey,
+                publicIdentityKey: args.publicIdentityKey,
+            },
+        });
+    }
+}
+function assertActivationStateMatchesContract(args) {
+    if (args.localState.contractDigest !== args.contractDigest) {
+        throw createTransportError({
+            code: "trellis.device.activation_state_contract_mismatch",
+            message: "Local device activation state does not match the requested device contract.",
+            hint: "Use activation state for the same device contract, or start activation again for this contract digest.",
+            context: {
+                stateContractDigest: args.localState.contractDigest,
+                contractDigest: args.contractDigest,
+            },
+        });
+    }
+}
+async function createActivationSession(args) {
+    assertActivationStateMatchesIdentity({
+        localState: args.localState,
+        publicIdentityKey: args.identity.publicIdentityKey,
+    });
+    assertActivationStateMatchesContract({
+        localState: args.localState,
+        contractDigest: args.contractDigest,
     });
-    if (!response.ok) {
-        throw new Error(`Device bootstrap failed: ${response.status} ${await response.text()}`);
+    const activatedState = createActivatedLocalState(args.localState);
+    return {
+        activationUrl: args.localState.activationUrl,
+        localState: args.localState,
+        waitForOnlineApproval: async (opts) => {
+            if (args.localState.status === "activated") {
+                return activatedState;
+            }
+            await waitForDeviceActivation({
+                trellisUrl: args.trellisUrl,
+                publicIdentityKey: args.identity.publicIdentityKey,
+                nonce: args.localState.nonce,
+                identitySeed: args.identity.identitySeed,
+                contractDigest: args.contractDigest,
+                signal: opts?.signal,
+            });
+            return activatedState;
+        },
+        acceptConfirmationCode: async (code) => {
+            if (args.localState.status === "activated") {
+                return activatedState;
+            }
+            const ok = await verifyDeviceConfirmationCode({
+                activationKey: args.identity.activationKey,
+                publicIdentityKey: args.identity.publicIdentityKey,
+                nonce: args.localState.nonce,
+                confirmationCode: code,
+            });
+            if (!ok) {
+                throw createInvalidConfirmationCodeTransportError({
+                    publicIdentityKey: args.identity.publicIdentityKey,
+                    instanceId: args.localState.instanceId,
+                    deploymentId: args.localState.deploymentId,
+                });
+            }
+            return activatedState;
+        },
+    };
+}
+async function fetchDeviceBootstrap(args) {
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const requestStartedAtMs = args.now();
+        const request = await signDeviceWaitRequest({
+            publicIdentityKey: args.publicIdentityKey,
+            nonce: "connect-info",
+            identitySeed: args.identitySeed,
+            contractDigest: args.contractDigest,
+            iat: correctedIatSeconds(requestStartedAtMs, args.offsetState.serverClockOffsetMs),
+        });
+        const bootstrapRequest = {
+            publicIdentityKey: request.publicIdentityKey,
+            contractDigest: request.contractDigest,
+            iat: request.iat,
+            sig: request.sig,
+        };
+        const response = await fetch(new URL("/auth/devices/connect-info", args.trellisUrl), {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(bootstrapRequest),
+        });
+        const responseReceivedAtMs = args.now();
+        if (!response.ok) {
+            const responseText = await response.text();
+            const parsed = parseResponseRecord(responseText);
+            const reason = typeof parsed?.reason === "string"
+                ? parsed.reason
+                : responseText;
+            const serverNow = typeof parsed?.serverNow === "number"
+                ? parsed.serverNow
+                : null;
+            if (attempt === 0 &&
+                response.status === 400 &&
+                reason === "iat_out_of_range" &&
+                serverNow !== null) {
+                args.offsetState.serverClockOffsetMs = estimateMidpointClockOffsetMs({
+                    requestStartedAtMs,
+                    responseReceivedAtMs,
+                    serverNowSeconds: serverNow,
+                });
+                continue;
+            }
+            if (response.status === 404 &&
+                (reason === "unknown_device" || reason === "activation_required")) {
+                return { status: "activation_required" };
+            }
+            throw createTransportError({
+                code: "trellis.bootstrap.failed",
+                message: "Trellis could not prepare the device session.",
+                hint: "Retry the connection. If it keeps failing, check Trellis availability and device activation state.",
+                context: {
+                    trellisUrl: args.trellisUrl,
+                    status: response.status,
+                    reason,
+                },
+            });
+        }
+        const payload = await readJsonResponse(response, {
+            code: "trellis.bootstrap.invalid_response",
+            message: "Trellis returned an invalid bootstrap response.",
+            hint: "Retry the connection. If it keeps happening, check the Trellis deployment.",
+            context: { trellisUrl: args.trellisUrl },
+        });
+        if (payload && typeof payload === "object" &&
+            typeof payload.serverNow === "number") {
+            args.offsetState.serverClockOffsetMs = estimateMidpointClockOffsetMs({
+                requestStartedAtMs,
+                responseReceivedAtMs,
+                serverNowSeconds: payload.serverNow,
+            });
+        }
+        if (Value.Check(DeviceBootstrapReadySchema, payload))
+            return payload;
+        if (Value.Check(DeviceBootstrapActivationRequiredSchema, payload)) {
+            return payload;
+        }
+        if (Value.Check(DeviceBootstrapNotReadySchema, payload))
+            return payload;
+        throw createTransportError({
+            code: "trellis.bootstrap.invalid_response",
+            message: "Trellis returned an invalid bootstrap response.",
+            hint: "Retry the connection. If it keeps happening, check the Trellis deployment.",
+            context: { trellisUrl: args.trellisUrl },
+        });
     }
-    const payload = await response.json();
-    if (Value.Check(DeviceBootstrapReadySchema, payload))
-        return payload;
-    if (Value.Check(DeviceBootstrapActivationRequiredSchema, payload))
-        return payload;
-    if (Value.Check(DeviceBootstrapNotReadySchema, payload))
-        return payload;
-    throw new Error("Device bootstrap returned an invalid response");
+    throw createTransportError({
+        code: "trellis.bootstrap.time_sync_failed",
+        message: "Trellis could not confirm the device time window.",
+        hint: "Retry the connection. If it keeps happening, check the device and Trellis clocks.",
+        context: { trellisUrl: args.trellisUrl },
+    });
+}
+export async function startDeviceActivationWithDeps(args, _deps) {
+    const rootSecret = normalizeRootSecret(args.rootSecret);
+    const identity = await deriveDeviceIdentity(rootSecret);
+    const nonce = crypto.randomUUID();
+    const payload = await buildDeviceActivationPayload({
+        activationKey: identity.activationKey,
+        publicIdentityKey: identity.publicIdentityKey,
+        nonce,
+    });
+    const activation = await startDeviceActivationRequest({
+        trellisUrl: args.trellisUrl,
+        payload,
+    });
+    return await createActivationSession({
+        trellisUrl: args.trellisUrl,
+        contractDigest: args.contract.CONTRACT_DIGEST,
+        identity,
+        localState: {
+            status: "pending",
+            contractDigest: args.contract.CONTRACT_DIGEST,
+            publicIdentityKey: identity.publicIdentityKey,
+            instanceId: activation.instanceId,
+            deploymentId: activation.deploymentId,
+            nonce,
+            activationUrl: activation.activationUrl,
+        },
+    });
+}
+export async function resumeDeviceActivationWithDeps(args, _deps) {
+    const rootSecret = normalizeRootSecret(args.rootSecret);
+    const identity = await deriveDeviceIdentity(rootSecret);
+    return await createActivationSession({
+        trellisUrl: args.trellisUrl,
+        contractDigest: args.contract.CONTRACT_DIGEST,
+        identity,
+        localState: args.localState,
+    });
 }
 export async function connectDeviceWithDeps(args, deps) {
+    const log = resolveDeviceLogger(args.log);
     const rootSecret = normalizeRootSecret(args.rootSecret);
     const identity = await deriveDeviceIdentity(rootSecret);
     const contractDigest = args.contract.CONTRACT_DIGEST;
-    let connectInfo = null;
-    try {
-        const bootstrap = await fetchDeviceBootstrap({
-            trellisUrl: args.trellisUrl,
+    const offsetState = { serverClockOffsetMs: 0 };
+    const bootstrap = await fetchDeviceBootstrap({
+        trellisUrl: args.trellisUrl,
+        publicIdentityKey: identity.publicIdentityKey,
+        identitySeed: identity.identitySeed,
+        contractDigest,
+        now: deps.now,
+        offsetState,
+    });
+    if (bootstrap.status === "activation_required") {
+        throw createActivationRequiredTransportError({
             publicIdentityKey: identity.publicIdentityKey,
-            identitySeed: identity.identitySeed,
-            contractDigest,
+            contractId: args.contract.CONTRACT_ID,
         });
-        if (bootstrap.status === "ready") {
-            connectInfo = bootstrap.connectInfo;
-        }
-        else if (bootstrap.status === "not_ready") {
-            throw new Error(bootstrap.reason);
-        }
-    }
-    catch (error) {
-        if (!isConnectInfoUnavailable(error))
-            throw error;
     }
-    if (!connectInfo) {
-        if (!args.onActivationRequired)
-            throw activationRequiredError();
-        const nonce = crypto.randomUUID();
-        const payload = await buildDeviceActivationPayload({
-            activationKey: identity.activationKey,
-            publicIdentityKey: identity.publicIdentityKey,
-            nonce,
+    if (bootstrap.status === "not_ready") {
+        throw createTransportError({
+            code: "trellis.bootstrap.not_ready",
+            message: "Trellis is not ready to connect this device.",
+            hint: "Wait for the device to be activated and the requested deployment to become available, then try again.",
+            context: { reason: bootstrap.reason },
         });
-        const activationUrl = (await startDeviceActivationRequest({
-            trellisUrl: args.trellisUrl,
-            payload,
-        })).activationUrl;
-        let activationCompleted = false;
-        let onlineConnectInfo = null;
-        await args.onActivationRequired({
-            url: activationUrl,
-            waitForOnlineApproval: async (opts) => {
-                if (activationCompleted)
-                    return;
-                const activation = await waitForDeviceActivation({
-                    trellisUrl: args.trellisUrl,
+    }
+    const connectInfo = bootstrap.connectInfo;
+    assertBootstrapContractMatches({
+        contractId: args.contract.CONTRACT_ID,
+        contractDigest,
+        connectInfo,
+    });
+    const transport = await deps.loadTransport();
+    let nc;
+    try {
+        nc = await transport.connect({
+            servers: selectRuntimeTransportServers(connectInfo.transports),
+            maxReconnectAttempts: DEFAULT_RUNTIME_MAX_RECONNECT_ATTEMPTS,
+            inboxPrefix: `_INBOX.${identity.publicIdentityKey.slice(0, 16)}`,
+            authenticator: [
+                createDeviceNatsAuthTokenAuthenticator({
                     publicIdentityKey: identity.publicIdentityKey,
-                    nonce,
                     identitySeed: identity.identitySeed,
                     contractDigest,
-                    signal: opts?.signal,
-                });
-                onlineConnectInfo = activation.connectInfo;
-                activationCompleted = true;
-            },
-            acceptConfirmationCode: async (code) => {
-                if (activationCompleted)
-                    return;
-                const ok = await verifyDeviceConfirmationCode({
-                    activationKey: identity.activationKey,
-                    publicIdentityKey: identity.publicIdentityKey,
-                    nonce,
-                    confirmationCode: code,
-                });
-                if (!ok) {
-                    throw new Error("Invalid device confirmation code");
-                }
-                activationCompleted = true;
-            },
+                    now: deps.now,
+                    getServerClockOffsetMs: () => offsetState.serverClockOffsetMs,
+                }),
+                jwtAuthenticator(connectInfo.transport.sentinel.jwt, new TextEncoder().encode(connectInfo.transport.sentinel.seed)),
+            ],
         });
-        if (!activationCompleted) {
-            throw new Error("Device activation did not complete");
-        }
-        if (onlineConnectInfo) {
-            connectInfo = onlineConnectInfo;
-        }
-        else {
-            const bootstrap = await fetchDeviceBootstrap({
-                trellisUrl: args.trellisUrl,
-                publicIdentityKey: identity.publicIdentityKey,
-                identitySeed: identity.identitySeed,
-                contractDigest,
-            });
-            if (bootstrap.status !== "ready") {
-                throw new Error(`Device bootstrap is not ready: ${bootstrap.status}`);
-            }
-            connectInfo = bootstrap.connectInfo;
-        }
     }
-    if (!connectInfo) {
-        throw new Error("Device bootstrap did not return runtime connect info");
+    catch (cause) {
+        throw createTransportError({
+            code: "trellis.runtime.connect_failed",
+            message: "Trellis could not open the device runtime connection.",
+            hint: "Retry the connection. If it keeps failing, check Trellis transport availability.",
+            cause,
+            context: { contractId: args.contract.CONTRACT_ID },
+        });
     }
-    const transport = await deps.loadTransport();
-    const nc = await transport.connect({
-        servers: selectRuntimeTransportServers(connectInfo.transports),
-        inboxPrefix: `_INBOX.${identity.publicIdentityKey.slice(0, 16)}`,
-        authenticator: [
-            createDeviceNatsAuthTokenAuthenticator({
-                publicIdentityKey: identity.publicIdentityKey,
-                identitySeed: identity.identitySeed,
-                contractDigest,
-                now: deps.now,
-            }),
-            jwtAuthenticator(connectInfo.transport.sentinel.jwt, new TextEncoder().encode(connectInfo.transport.sentinel.seed)),
-        ],
+    const connection = observeNatsTrellisConnection({
+        kind: "device",
+        nc,
+        log: false,
+        lifecycleLog: {
+            log,
+            context: { contractId: args.contract.CONTRACT_ID },
+        },
     });
     const trellis = new Trellis(args.contract.CONTRACT_ID, nc, {
         sessionKey: identity.publicIdentityKey,
         sign: (data) => signIdentityBytes(identity.identitySeed, data),
     }, {
+        log,
         api: args.contract.API.trellis,
+        state: args.contract[CONTRACT_STATE_METADATA],
+        connection,
     });
     const health = new ServiceHealth({
-        serviceName: args.contract.CONTRACT?.displayName ?? args.contract.CONTRACT_ID,
+        serviceName: args.contract.CONTRACT?.displayName ??
+            args.contract.CONTRACT_ID,
         kind: "device",
         instanceId: connectInfo.instanceId,
         contractId: connectInfo.contractId,
@@ -243,7 +485,7 @@ export async function connectDeviceWithDeps(args, deps) {
     });
     health.setInfo({
         info: {
-            profileId: connectInfo.profileId,
+            deploymentId: connectInfo.deploymentId,
         },
     });
     health.add("nats", () => ({
@@ -279,10 +521,24 @@ export async function connectDeviceWithDeps(args, deps) {
         }, health.publishIntervalMs);
         void nc.closed().finally(stopHeartbeat);
     }
-    return Object.assign(trellis, { health });
+    return {
+        request: trellis.request.bind(trellis),
+        publish: trellis.publish.bind(trellis),
+        event: trellis.event.bind(trellis),
+        operation: trellis.operation.bind(trellis),
+        transfer: trellis.transfer.bind(trellis),
+        state: trellis.state,
+        name: trellis.name,
+        timeout: trellis.timeout,
+        stream: trellis.stream,
+        api: trellis.api,
+        connection: trellis.connection,
+        natsConnection: trellis.natsConnection,
+        health,
+    };
 }
 export const TrellisDevice = {
     connect(args) {
-        return connectDeviceWithDeps(args, defaultDeps);
+        return deviceConnectResult(connectDeviceWithDeps(args, defaultDeps));
     },
 };

package/esm/errors/AuthError.d.ts

@@ -1,10 +1,10 @@
 import Type, { type Static } from "typebox";
-import { TrellisError } from "./TrellisError.js";
+import { TrellisError } from "./TrellisError.ts";
 export declare const AuthErrorDataSchema: Type.TObject<{
     id: Type.TString;
     type: Type.TLiteral<"AuthError">;
     message: Type.TString;
-    reason: Type.TUnion<[Type.TLiteral<"invalid_request">, Type.TLiteral<"missing_session_key">, Type.TLiteral<"missing_proof">, Type.TLiteral<"session_not_found">, Type.TLiteral<"session_expired">, Type.TLiteral<"invalid_signature">, Type.TLiteral<"user_not_found">, Type.TLiteral<"user_inactive">, Type.TLiteral<"unknown_device">, Type.TLiteral<"device_profile_not_found">, Type.TLiteral<"device_profile_disabled">, Type.TLiteral<"device_activation_revoked">, Type.TLiteral<"unknown_service">, Type.TLiteral<"service_disabled">, Type.TLiteral<"iat_out_of_range">, Type.TLiteral<"invalid_binding_token">, Type.TLiteral<"session_corrupted">, Type.TLiteral<"session_already_bound">, Type.TLiteral<"authtoken_already_used">, Type.TLiteral<"oauth_session_key_mismatch">, Type.TLiteral<"service_role_on_user">, Type.TLiteral<"reply_subject_mismatch">, Type.TLiteral<"insufficient_permissions">, Type.TLiteral<"forbidden">, Type.TLiteral<"missing_flow_id">, Type.TLiteral<"missing_profile_id">, Type.TLiteral<"device_activation_flow_not_found">, Type.TLiteral<"device_activation_flow_expired">, Type.TLiteral<"device_activation_rejected">, Type.TLiteral<"device_identity_key_mismatch">, Type.TLiteral<"invalid_device_qr_mac">]>;
+    reason: Type.TUnion<[Type.TLiteral<"invalid_request">, Type.TLiteral<"missing_session_key">, Type.TLiteral<"missing_proof">, Type.TLiteral<"session_not_found">, Type.TLiteral<"session_expired">, Type.TLiteral<"invalid_signature">, Type.TLiteral<"user_not_found">, Type.TLiteral<"user_inactive">, Type.TLiteral<"unknown_device">, Type.TLiteral<"device_deployment_not_found">, Type.TLiteral<"device_deployment_disabled">, Type.TLiteral<"device_activation_revoked">, Type.TLiteral<"unknown_service">, Type.TLiteral<"service_disabled">, Type.TLiteral<"iat_out_of_range">, Type.TLiteral<"invalid_binding_token">, Type.TLiteral<"session_corrupted">, Type.TLiteral<"session_already_bound">, Type.TLiteral<"authtoken_already_used">, Type.TLiteral<"oauth_session_key_mismatch">, Type.TLiteral<"service_role_on_user">, Type.TLiteral<"reply_subject_mismatch">, Type.TLiteral<"insufficient_permissions">, Type.TLiteral<"forbidden">, Type.TLiteral<"missing_flow_id">, Type.TLiteral<"device_activation_flow_not_found">, Type.TLiteral<"device_activation_flow_expired">, Type.TLiteral<"device_activation_rejected">, Type.TLiteral<"device_identity_key_mismatch">, Type.TLiteral<"invalid_device_qr_mac">]>;
     context: Type.TOptional<Type.TRecord<"^.*$", Type.TUnknown>>;
     traceId: Type.TOptional<Type.TString>;
 }>;

package/esm/errors/AuthError.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthError.d.ts","sourceRoot":"","sources":["../../src/errors/AuthError.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,EAAE,EAAE,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,eAAO,MAAM,mBAAmB;;;;;;;EAuC9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE/D;;GAEG;AACH,qBAAa,SAAU,SAAQ,YAAY,CAAC,aAAa,CAAC;IACxD,SAAkB,IAAI,cAAwB;IAC9C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAGvC,OAAO,EAAE,YAAY,GAAG;QACtB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,EAAE,CAAC,EAAE,MAAM,CAAC;KACb;IAOH;;;;OAIG;IACM,cAAc,IAAI,aAAa;CAOzC"}
+{"version":3,"file":"AuthError.d.ts","sourceRoot":"","sources":["../../../errors/AuthError.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,EAAE,EAAE,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,eAAO,MAAM,mBAAmB;;;;;;;EAsC9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE/D;;GAEG;AACH,qBAAa,SAAU,SAAQ,YAAY,CAAC,aAAa,CAAC;IACxD,SAAkB,IAAI,EAAG,WAAW,CAAU;IAC9C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAGvC,OAAO,EAAE,YAAY,GAAG;QACtB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,EAAE,CAAC,EAAE,MAAM,CAAC;KACb;IAOH;;;;OAIG;IACM,cAAc,IAAI,aAAa;CAOzC"}