@qlever-llc/trellis 0.7.0 → 0.8.0-rc.3

package/esm/auth/schemas.d.ts

@@ -1,14 +1,6 @@
 import type { StaticDecode } from "typebox";
 import { Type } from "typebox";
-export declare const LoginQuerySchema: Type.TObject<{
-    provider: Type.TOptional<Type.TString>;
-    redirectTo: Type.TString;
-    sessionKey: Type.TString;
-    sig: Type.TString;
-    contract: Type.TString;
-    context: Type.TOptional<Type.TString>;
-}>;
-export type LoginQuery = StaticDecode<typeof LoginQuerySchema>;
+export declare const ContractDigestSchema: Type.TString;
 export declare const SentinelCredsSchema: Type.TObject<{
     jwt: Type.TString;
     seed: Type.TString;
@@ -29,24 +21,19 @@ export declare const ClientTransportsSchema: Type.TObject<{
 export type ClientTransports = StaticDecode<typeof ClientTransportsSchema>;
 export declare const ApprovalDecisionSchema: Type.TUnion<[Type.TLiteral<"approved">, Type.TLiteral<"denied">]>;
 export type ApprovalDecision = StaticDecode<typeof ApprovalDecisionSchema>;
+export declare const UserParticipantKindSchema: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+export type UserParticipantKind = StaticDecode<typeof UserParticipantKindSchema>;
 export declare const ContractApprovalSchema: Type.TObject<{
     contractDigest: Type.TString;
     contractId: Type.TString;
     displayName: Type.TString;
     description: Type.TString;
-    kind: Type.TOptional<Type.TString>;
+    participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
     capabilities: Type.TArray<Type.TString>;
 }>;
 export type ContractApproval = StaticDecode<typeof ContractApprovalSchema>;
-export declare const BindRequestSchema: Type.TObject<{
-    authToken: Type.TString;
-    sessionKey: Type.TString;
-    sig: Type.TString;
-}>;
-export type BindRequest = StaticDecode<typeof BindRequestSchema>;
 export declare const BindSuccessResponseSchema: Type.TObject<{
     status: Type.TLiteral<"bound">;
-    bindingToken: Type.TString;
     inboxPrefix: Type.TString;
     expires: Type.TString;
     sentinel: Type.TObject<{
@@ -69,7 +56,7 @@ export declare const BindInsufficientCapabilitiesResponseSchema: Type.TObject<{
         contractId: Type.TString;
         displayName: Type.TString;
         description: Type.TString;
-        kind: Type.TOptional<Type.TString>;
+        participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
         capabilities: Type.TArray<Type.TString>;
     }>;
     missingCapabilities: Type.TArray<Type.TString>;
@@ -77,7 +64,6 @@ export declare const BindInsufficientCapabilitiesResponseSchema: Type.TObject<{
 }>;
 export declare const BindResponseSchema: Type.TUnion<[Type.TObject<{
     status: Type.TLiteral<"bound">;
-    bindingToken: Type.TString;
     inboxPrefix: Type.TString;
     expires: Type.TString;
     sentinel: Type.TObject<{
@@ -99,7 +85,7 @@ export declare const BindResponseSchema: Type.TUnion<[Type.TObject<{
         contractId: Type.TString;
         displayName: Type.TString;
         description: Type.TString;
-        kind: Type.TOptional<Type.TString>;
+        participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
         capabilities: Type.TArray<Type.TString>;
     }>;
     missingCapabilities: Type.TArray<Type.TString>;
@@ -123,7 +109,6 @@ export declare const AuthStartFlowResponseSchema: Type.TObject<{
 }>;
 export declare const AuthStartResponseSchema: Type.TUnion<[Type.TObject<{
     status: Type.TLiteral<"bound">;
-    bindingToken: Type.TString;
     inboxPrefix: Type.TString;
     expires: Type.TString;
     sentinel: Type.TObject<{
@@ -150,9 +135,8 @@ export declare const NatsAuthTokenV1Schema: Type.TObject<{
     v: Type.TLiteral<1>;
     sessionKey: Type.TString;
     sig: Type.TString;
-    bindingToken: Type.TOptional<Type.TString>;
-    iat: Type.TOptional<Type.TInteger>;
-    contractDigest: Type.TOptional<Type.TString>;
+    iat: Type.TInteger;
+    contractDigest: Type.TString;
 }>;
 export type NatsAuthTokenV1 = StaticDecode<typeof NatsAuthTokenV1Schema>;
 //# sourceMappingURL=schemas.d.ts.map

package/esm/auth/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/auth/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAU/B,eAAO,MAAM,gBAAgB;;;;;;;EAOM,CAAC;AAEpC,MAAM,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI/D,eAAO,MAAM,mBAAmB;;;EAG9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAErE,eAAO,MAAM,8BAA8B;;EAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,YAAY,CACjD,OAAO,8BAA8B,CACtC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;EAGjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB,mEAGjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB;;;;;;;EASjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,iBAAiB;;;;EAIK,CAAC;AAEpC,MAAM,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEjE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;EAOpC,CAAC;AAEH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;EAKrD,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACnE,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAC5C,OAAO,yBAAyB,CACjC,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,YAAY,CAC7D,OAAO,0CAA0C,CAClD,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;EAOA,CAAC;AAEpC,eAAO,MAAM,2BAA2B;;;;EAItC,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;IAGlC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC3E,MAAM,MAAM,qBAAqB,GAAG,YAAY,CAC9C,OAAO,2BAA2B,CACnC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE7E,eAAO,MAAM,qBAAqB;;;;;;;EAOC,CAAC;AAEpC,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../auth/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAU/B,eAAO,MAAM,oBAAoB,cAE/B,CAAC;AAIH,eAAO,MAAM,mBAAmB;;;EAG9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAErE,eAAO,MAAM,8BAA8B;;EAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,YAAY,CACjD,OAAO,8BAA8B,CACtC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;EAGjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB,mEAGjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,yBAAyB,6DAGpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAC5C,OAAO,yBAAyB,CACjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;EAOjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;EAMpC,CAAC;AAEH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;EAKrD,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACnE,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAC5C,OAAO,yBAAyB,CACjC,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,YAAY,CAC7D,OAAO,0CAA0C,CAClD,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;EAOA,CAAC;AAEpC,eAAO,MAAM,2BAA2B;;;;EAItC,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;IAGlC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC3E,MAAM,MAAM,qBAAqB,GAAG,YAAY,CAC9C,OAAO,2BAA2B,CACnC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE7E,eAAO,MAAM,qBAAqB;;;;;;EAMC,CAAC;AAEpC,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/esm/auth/schemas.js

@@ -5,14 +5,9 @@ const SessionKeySchema = Type.String({
 const SignatureSchema = Type.String({
     pattern: "^[A-Za-z0-9_-]{86}$",
 });
-export const LoginQuerySchema = Type.Object({
-    provider: Type.Optional(Type.String({ minLength: 1 })),
-    redirectTo: Type.String(),
-    sessionKey: SessionKeySchema,
-    sig: SignatureSchema,
-    contract: Type.String({ minLength: 1 }),
-    context: Type.Optional(Type.String({ minLength: 1 })),
-}, { additionalProperties: false });
+export const ContractDigestSchema = Type.String({
+    pattern: "^[A-Za-z0-9_-]+$",
+});
 const OpenObjectSchema = Type.Object({}, { additionalProperties: true });
 export const SentinelCredsSchema = Type.Object({
     jwt: Type.String(),
@@ -29,24 +24,20 @@ export const ApprovalDecisionSchema = Type.Union([
     Type.Literal("approved"),
     Type.Literal("denied"),
 ]);
+export const UserParticipantKindSchema = Type.Union([
+    Type.Literal("app"),
+    Type.Literal("agent"),
+]);
 export const ContractApprovalSchema = Type.Object({
-    contractDigest: Type.String(),
+    contractDigest: ContractDigestSchema,
     contractId: Type.String(),
     displayName: Type.String(),
     description: Type.String(),
-    // Preserve legacy persisted approval records written before `kind` was removed
-    // from the public flow state shape.
-    kind: Type.Optional(Type.String({ minLength: 1 })),
+    participantKind: UserParticipantKindSchema,
     capabilities: Type.Array(Type.String()),
 });
-export const BindRequestSchema = Type.Object({
-    authToken: Type.String(),
-    sessionKey: SessionKeySchema,
-    sig: SignatureSchema,
-}, { additionalProperties: false });
 export const BindSuccessResponseSchema = Type.Object({
     status: Type.Literal("bound"),
-    bindingToken: Type.String(),
     inboxPrefix: Type.String(),
     expires: Type.String({ format: "date-time" }),
     sentinel: SentinelCredsSchema,
@@ -83,7 +74,6 @@ export const NatsAuthTokenV1Schema = Type.Object({
     v: Type.Literal(1),
     sessionKey: SessionKeySchema,
     sig: SignatureSchema,
-    bindingToken: Type.Optional(Type.String()),
-    iat: Type.Optional(Type.Integer()),
-    contractDigest: Type.Optional(Type.String()),
+    iat: Type.Integer(),
+    contractDigest: ContractDigestSchema,
 }, { additionalProperties: false });

package/esm/auth/session_auth.d.ts

@@ -6,13 +6,20 @@ export type NatsConnectOptions = {
 export type TrellisAuth = {
     sessionKey: string;
     sign: (data: Uint8Array) => Promise<Uint8Array>;
-    oauthInitSig: (redirectTo: string, context?: unknown) => Promise<string>;
-    bindSig: (authToken: string) => Promise<string>;
-    natsConnectSigForBindingToken: (bindingToken: string) => Promise<string>;
-    natsConnectSigForIat: (iat: number) => Promise<string>;
+    currentIat: () => number;
+    setServerClockOffsetMs: (clockOffsetMs: number) => void;
+    oauthInitSig: (redirectTo: string, context?: unknown, provider?: string, contract?: Record<string, unknown>) => Promise<string>;
+    bindFlowSig: (flowId: string) => Promise<string>;
+    natsConnectSigForIat: (iat: number, contractDigest: string) => Promise<string>;
     createProof: (subject: string, payloadHash: Uint8Array) => Promise<string>;
-    natsConnectOptions: () => Promise<NatsConnectOptions>;
+    natsConnectOptions: (opts: {
+        contractDigest: string;
+    }) => Promise<NatsConnectOptions>;
 };
+/**
+ * Builds the canonical value signed for NATS runtime-auth tokens.
+ */
+export declare function buildNatsConnectSignaturePayload(iat: number, contractDigest: string): string;
 export declare function createAuth(opts: {
     sessionKeySeed: string;
 }): Promise<TrellisAuth>;

package/esm/auth/session_auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_auth.d.ts","sourceRoot":"","sources":["../../src/auth/session_auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAoBxD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAEhD,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,6BAA6B,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,oBAAoB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvD,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,kBAAkB,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACvD,CAAC;AAEF,wBAAsB,UAAU,CAC9B,IAAI,EAAE;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAC/B,OAAO,CAAC,WAAW,CAAC,CA6DtB"}
+{"version":3,"file":"session_auth.d.ts","sourceRoot":"","sources":["../../../auth/session_auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAmBxD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAChD,UAAU,EAAE,MAAM,MAAM,CAAC;IACzB,sBAAsB,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,IAAI,CAAC;IAExD,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,oBAAoB,EAAE,CACpB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,KACnB,OAAO,CAAC,MAAM,CAAC,CAAC;IAErB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,kBAAkB,EAAE,CAClB,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,KAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAClC,CAAC;AAEF;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GACrB,MAAM,CAER;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAC/B,OAAO,CAAC,WAAW,CAAC,CA+FtB"}

package/esm/auth/session_auth.js

@@ -1,17 +1,18 @@
-import { Buffer } from "node:buffer";
-import { createHash, createPrivateKey, sign as signBytesSync } from "node:crypto";
-import { importEd25519PrivateKeyFromSeedBase64url, pkcs8FromEd25519Seed, publicKeyBase64urlFromPrivateKey, } from "./keys.js";
+import { importEd25519PrivateKeyFromSeedBase64url, publicKeyBase64urlFromSeed, signEd25519SeedSha256, } from "./keys.js";
 import { createProof } from "./proof.js";
+import { correctedIatSeconds } from "./time.js";
 import { base64urlDecode, base64urlEncode, canonicalizeJsonValue, sha256, toArrayBuffer, utf8, } from "./utils.js";
+/**
+ * Builds the canonical value signed for NATS runtime-auth tokens.
+ */
+export function buildNatsConnectSignaturePayload(iat, contractDigest) {
+    return `${iat}:${contractDigest}`;
+}
 export async function createAuth(opts) {
     const seed = base64urlDecode(opts.sessionKeySeed);
     const privateKey = await importEd25519PrivateKeyFromSeedBase64url(opts.sessionKeySeed);
-    const sessionKey = await publicKeyBase64urlFromPrivateKey(privateKey);
-    const reconnectKey = createPrivateKey({
-        key: Buffer.from(pkcs8FromEd25519Seed(seed)),
-        format: "der",
-        type: "pkcs8",
-    });
+    const sessionKey = publicKeyBase64urlFromSeed(seed);
+    let serverClockOffsetMs = 0;
     const sign = async (data) => {
         const sig = await crypto.subtle.sign({ name: "Ed25519" }, privateKey, toArrayBuffer(data));
         return new Uint8Array(sig);
@@ -21,32 +22,38 @@ export async function createAuth(opts) {
         const sigBytes = await sign(digest);
         return base64urlEncode(sigBytes);
     };
-    const signOauthInit = async (redirectTo, context) => {
+    const signOauthInit = async (redirectTo, context, provider, contract) => {
         const canonicalContext = canonicalizeJsonValue(context ?? null);
-        return await signDomainHash("oauth-init", `${redirectTo}:${canonicalContext}`);
+        const payload = contract === undefined
+            ? `${redirectTo}:${canonicalContext}`
+            : `${redirectTo}:${provider ?? ""}:${canonicalizeJsonValue(contract)}:${canonicalContext}`;
+        return await signDomainHash("oauth-init", payload);
     };
-    const buildServiceNatsAuthToken = (iat) => {
-        const digest = createHash("sha256").update(`nats-connect:${iat}`, "utf8").digest();
-        const sig = signBytesSync(null, digest, reconnectKey);
+    const buildServiceNatsAuthToken = (iat, contractDigest) => {
         return {
             v: 1,
             sessionKey,
             iat,
-            sig: base64urlEncode(new Uint8Array(sig)),
+            contractDigest,
+            sig: base64urlEncode(signEd25519SeedSha256(seed, utf8(`nats-connect:${buildNatsConnectSignaturePayload(iat, contractDigest)}`))),
         };
     };
+    const currentIat = () => correctedIatSeconds(Date.now(), serverClockOffsetMs);
     return {
         sessionKey,
         sign,
+        currentIat,
+        setServerClockOffsetMs: (clockOffsetMs) => {
+            serverClockOffsetMs = clockOffsetMs;
+        },
         oauthInitSig: signOauthInit,
-        bindSig: (authToken) => signDomainHash("bind", authToken),
-        natsConnectSigForBindingToken: (bindingToken) => signDomainHash("nats-connect", bindingToken),
-        natsConnectSigForIat: (iat) => signDomainHash("nats-connect", String(iat)),
+        bindFlowSig: (flowId) => signDomainHash("bind-flow", flowId),
+        natsConnectSigForIat: (iat, contractDigest) => signDomainHash("nats-connect", buildNatsConnectSignaturePayload(iat, contractDigest)),
         createProof: (subject, payloadHash) => createProof(privateKey, { sessionKey, subject, payloadHash }),
-        natsConnectOptions: async () => {
+        natsConnectOptions: async (options) => {
             return {
                 authenticator: () => {
-                    const authToken = buildServiceNatsAuthToken(Math.floor(Date.now() / 1000));
+                    const authToken = buildServiceNatsAuthToken(currentIat(), options.contractDigest);
                     return { auth_token: JSON.stringify(authToken) };
                 },
                 inboxPrefix: `_INBOX.${sessionKey.slice(0, 16)}`,

package/esm/auth/time.d.ts

@@ -0,0 +1,7 @@
+export declare function estimateMidpointClockOffsetMs(args: {
+    requestStartedAtMs: number;
+    responseReceivedAtMs: number;
+    serverNowSeconds: number;
+}): number;
+export declare function correctedIatSeconds(nowMs?: number, clockOffsetMs?: number): number;
+//# sourceMappingURL=time.d.ts.map

package/esm/auth/time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../../../auth/time.ts"],"names":[],"mappings":"AAAA,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GAAG,MAAM,CAGT;AAED,wBAAgB,mBAAmB,CACjC,KAAK,GAAE,MAAmB,EAC1B,aAAa,GAAE,MAAU,GACxB,MAAM,CAER"}

package/esm/auth/time.js

@@ -0,0 +1,7 @@
+export function estimateMidpointClockOffsetMs(args) {
+    const midpointMs = (args.requestStartedAtMs + args.responseReceivedAtMs) / 2;
+    return args.serverNowSeconds * 1_000 - midpointMs;
+}
+export function correctedIatSeconds(nowMs = Date.now(), clockOffsetMs = 0) {
+    return Math.floor((nowMs + clockOffsetMs) / 1_000);
+}

package/esm/auth/trellis_id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trellis_id.d.ts","sourceRoot":"","sources":["../../src/auth/trellis_id.ts"],"names":[],"mappings":"AAEA,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGvF"}
+{"version":3,"file":"trellis_id.d.ts","sourceRoot":"","sources":["../../../auth/trellis_id.ts"],"names":[],"mappings":"AAEA,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,MAAM,CAAC,CAGjB"}

package/esm/auth/types.d.ts

@@ -1,8 +1,4 @@
-export type NatsAuthTokenV1 = {
-    v: 1;
-    sessionKey: string;
-    sig: string;
-    bindingToken?: string;
-    iat?: number;
-};
+import type { StaticDecode } from "typebox";
+import { NatsAuthTokenV1Schema } from "./schemas.ts";
+export type NatsAuthTokenV1 = StaticDecode<typeof NatsAuthTokenV1Schema>;
 //# sourceMappingURL=types.d.ts.map

package/esm/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/esm/auth/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/auth/utils.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEjC,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAE1C;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAWzD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAQ3D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAGxD;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAGlE;AAmBD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE5D"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../auth/utils.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEjC,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAE1C;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAezD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAQ3D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAGxD;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAGlE;AA2BD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE5D"}

package/esm/auth/utils.js

@@ -55,8 +55,9 @@ function canonicalizeUnknownJsonValue(value) {
     }
     if (typeof value === "string")
         return JSON.stringify(value);
-    if (Array.isArray(value))
+    if (Array.isArray(value)) {
         return `[${value.map(canonicalizeUnknownJsonValue).join(",")}]`;
+    }
     if (typeof value === "object") {
         const keys = Object.keys(value).sort();
         return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalizeUnknownJsonValue(value[key])}`).join(",")}}`;

package/esm/auth.d.ts

@@ -1,3 +1,2 @@
-import "./_dnt.polyfills.js";
-export * from "./auth/mod.js";
+export * from "./auth/mod.ts";
 //# sourceMappingURL=auth.d.ts.map

package/esm/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../auth.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC"}

package/esm/auth.js

@@ -1,2 +1 @@
-import "./_dnt.polyfills.js";
 export * from "./auth/mod.js";

package/esm/client.d.ts

@@ -1,8 +1,10 @@
 import type { NatsConnection } from "@nats-io/nats-core";
-import type { TrellisAPI } from "./contracts.js";
-import type { LoggerLike } from "./globals.js";
-import type { TrellisAuth } from "./trellis.js";
-import { Trellis } from "./trellis.js";
+import { CONTRACT_STATE_METADATA } from "./contract_support/mod.ts";
+import type { ContractStateMetadata } from "./contract_support/mod.ts";
+import type { TrellisAPI } from "./contracts.ts";
+import type { LoggerLike } from "./globals.ts";
+import type { RuntimeStateStoresForContract, TrellisAuth } from "./trellis.ts";
+import { Trellis } from "./trellis.ts";
 type NoResponderRetryOpts = {
     maxAttempts?: number;
     baseDelayMs?: number;
@@ -18,16 +20,41 @@ export type ClientOpts = {
     stream?: string;
     noResponderRetry?: NoResponderRetryOpts;
 };
-type ClientContract<TApi> = {
+type ClientContract<TApi, TContract> = {
+    CONTRACT: TContract;
     API: {
         owned?: TApi;
         trellis?: TApi;
     };
+    readonly [CONTRACT_STATE_METADATA]?: ContractStateMetadata;
 };
+type ClientContractManifest = {
+    state?: Readonly<Record<string, unknown>>;
+    schemas?: Readonly<Record<string, unknown>>;
+};
+type ClientContractShape = {
+    CONTRACT: ClientContractManifest;
+    API: {
+        owned?: TrellisAPI;
+        trellis?: TrellisAPI;
+    };
+    readonly [CONTRACT_STATE_METADATA]?: ContractStateMetadata;
+};
+type ClientContractForApi<TApi extends TrellisAPI> = ClientContract<TApi, ClientContractManifest>;
+type ApiForClientContract<TContract extends ClientContractShape> = TContract extends {
+    API: {
+        trellis: infer TApi;
+    };
+} ? TApi extends TrellisAPI ? TApi : never : TContract extends {
+    API: {
+        owned: infer TApi;
+    };
+} ? TApi extends TrellisAPI ? TApi : never : never;
 /**
  * Create a Trellis client typed from a contract module's derived outbound surface.
  */
-export declare function createClient<TApi extends TrellisAPI>(contract: ClientContract<TApi>, nats: NatsConnection, auth: TrellisAuth, opts?: ClientOpts): Trellis<TApi>;
+export declare function createClient<TContract extends ClientContractShape>(contract: TContract, nats: NatsConnection, auth: TrellisAuth, opts?: ClientOpts): Trellis<ApiForClientContract<TContract>, "client", RuntimeStateStoresForContract<TContract>>;
+export declare function createClient<TApi extends TrellisAPI, TContract extends ClientContractForApi<TApi> = ClientContractForApi<TApi>>(contract: TContract, nats: NatsConnection, auth: TrellisAuth, opts?: ClientOpts): Trellis<TApi, "client", RuntimeStateStoresForContract<TContract>>;
 export declare function createCoreClient(nats: NatsConnection, auth: TrellisAuth, opts?: ClientOpts): Promise<Trellis<TrellisAPI>>;
 export {};
 //# sourceMappingURL=client.d.ts.map

package/esm/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAavC,KAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;CACzC,CAAC;AAEF,KAAK,cAAc,CAAC,IAAI,IAAI;IAC1B,GAAG,EAAE;QACH,KAAK,CAAC,EAAE,IAAI,CAAC;QACb,OAAO,CAAC,EAAE,IAAI,CAAC;KAChB,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,UAAU,EAClD,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,EAC9B,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,WAAW,EACjB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,IAAI,CAAC,CAkBf;AAqBD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,WAAW,EACjB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAc9B"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,6BAA6B,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAavC,KAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;CACzC,CAAC;AAEF,KAAK,cAAc,CAAC,IAAI,EAAE,SAAS,IAAI;IACrC,QAAQ,EAAE,SAAS,CAAC;IACpB,GAAG,EAAE;QACH,KAAK,CAAC,EAAE,IAAI,CAAC;QACb,OAAO,CAAC,EAAE,IAAI,CAAC;KAChB,CAAC;IACF,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAC5D,CAAC;AAEF,KAAK,sBAAsB,GAAG;IAC5B,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC7C,CAAC;AAEF,KAAK,mBAAmB,GAAG;IACzB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,GAAG,EAAE;QACH,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,OAAO,CAAC,EAAE,UAAU,CAAC;KACtB,CAAC;IACF,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAC5D,CAAC;AAEF,KAAK,oBAAoB,CAAC,IAAI,SAAS,UAAU,IAAI,cAAc,CACjE,IAAI,EACJ,sBAAsB,CACvB,CAAC;AAEF,KAAK,oBAAoB,CAAC,SAAS,SAAS,mBAAmB,IAC7D,SAAS,SAAS;IAAE,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,IAAI,CAAA;KAAE,CAAA;CAAE,GAC9C,IAAI,SAAS,UAAU,GAAG,IAAI,GAAG,KAAK,GACtC,SAAS,SAAS;IAAE,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,IAAI,CAAA;KAAE,CAAA;CAAE,GAC9C,IAAI,SAAS,UAAU,GAAG,IAAI,GAAG,KAAK,GACxC,KAAK,CAAC;AAEZ;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,SAAS,mBAAmB,EAChE,QAAQ,EAAE,SAAS,EACnB,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,WAAW,EACjB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CACR,oBAAoB,CAAC,SAAS,CAAC,EAC/B,QAAQ,EACR,6BAA6B,CAAC,SAAS,CAAC,CACzC,CAAC;AACF,wBAAgB,YAAY,CAC1B,IAAI,SAAS,UAAU,EACvB,SAAS,SAAS,oBAAoB,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAEzE,QAAQ,EAAE,SAAS,EACnB,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,WAAW,EACjB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAC;AAoDrE,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,WAAW,EACjB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAc9B"}

package/esm/client.js

@@ -1,7 +1,5 @@
+import { CONTRACT_STATE_METADATA } from "./contract_support/mod.js";
 import { Trellis } from "./trellis.js";
-/**
- * Create a Trellis client typed from a contract module's derived outbound surface.
- */
 export function createClient(contract, nats, auth, opts) {
     const api = contract.API.trellis ?? contract.API.owned;
     if (!api) {
@@ -13,6 +11,7 @@ export function createClient(contract, nats, auth, opts) {
         stream: opts?.stream,
         noResponderRetry: opts?.noResponderRetry,
         api,
+        state: contract[CONTRACT_STATE_METADATA],
     });
 }
 async function loadCoreApi() {

package/esm/client_connect.d.ts

@@ -1,22 +1,28 @@
-import type { ClientOpts } from "./client.js";
-import type { TrellisAPI, TrellisContractV1 } from "./contracts.js";
-import { type RuntimeTransport } from "./runtime_transport.js";
-import { Trellis } from "./trellis.js";
-import { type SessionKeyHandle } from "./auth/browser/session.js";
-type ClientContract<TApi extends TrellisAPI = TrellisAPI> = {
-    CONTRACT: TrellisContractV1;
+import { CONTRACT_STATE_METADATA, type ContractStateMetadata } from "./contract_support/mod.ts";
+import type { ClientOpts } from "./client.ts";
+import type { TrellisAPI, TrellisContractV1 } from "./contracts.ts";
+import { type RuntimeTransport } from "./runtime_transport.ts";
+import { type ConnectedTrellisClient, type RuntimeStateStores, Trellis } from "./trellis.ts";
+import { TransportError } from "./errors/index.ts";
+import { AsyncResult, UnexpectedError } from "@qlever-llc/result";
+import { type SessionKeyHandle } from "./auth/browser/session.ts";
+type ClientContract<TApi extends TrellisAPI = TrellisAPI, TContract extends TrellisContractV1 = TrellisContractV1> = {
+    CONTRACT: TContract;
+    CONTRACT_DIGEST?: string;
     API: {
         trellis: TApi;
     };
+    readonly [CONTRACT_STATE_METADATA]?: ContractStateMetadata;
 };
 type BrowserClientAuthOptions = {
     mode?: "browser";
     handle?: SessionKeyHandle;
     provider?: string;
-    redirectTo?: string;
+    redirectTo?: string | (() => string);
     landingPath?: string;
     context?: unknown;
-    currentUrl?: URL | string;
+    currentUrl?: URL | string | (() => URL | string);
+    flowId?: string;
 };
 type SessionKeyClientAuthOptions = {
     mode: "session_key";
@@ -33,21 +39,33 @@ export type ClientAuthRequiredContext = {
     mode: "browser" | "session_key";
 };
 export type ClientAuthContinuation = {
+    status: "bound";
     flowId: string;
+} | {
+    status: "handled";
 } | void;
-export type TrellisClientConnectArgs<TApi extends TrellisAPI = TrellisAPI> = ClientOpts & {
+/**
+ * Error raised when client authentication was delegated to caller-owned routing.
+ */
+export declare class ClientAuthHandledError extends Error {
+    constructor();
+}
+type ClientConnectArgsFor<TContract extends ClientContract> = ClientOpts & {
     trellisUrl: string;
-    contract: ClientContract<TApi>;
+    contract: TContract;
     auth?: ClientAuthOptions;
     onAuthRequired?: (ctx: ClientAuthRequiredContext) => Promise<ClientAuthContinuation> | ClientAuthContinuation;
 };
+export type TrellisClientConnectArgs<TApi extends TrellisAPI = TrellisAPI, TContract extends ClientContract<TApi, TrellisContractV1> = ClientContract<TApi, TrellisContractV1>> = ClientConnectArgsFor<TContract>;
 type ClientConnectDeps = {
     loadTransport(): Promise<RuntimeTransport>;
     now(): number;
+    setInterval?: (handler: () => void, ms: number) => ReturnType<typeof globalThis.setInterval>;
+    clearInterval?: (id: ReturnType<typeof globalThis.setInterval>) => void;
 };
-export declare function connectClientWithDeps<TApi extends TrellisAPI>(args: TrellisClientConnectArgs<TApi>, deps: ClientConnectDeps): Promise<Trellis<TApi>>;
+export declare function connectClientWithDeps<TContract extends ClientContract<TrellisAPI, TrellisContractV1>>(args: ClientConnectArgsFor<TContract>, deps: ClientConnectDeps): Promise<Trellis<TrellisAPI, "client", RuntimeStateStores>>;
 export declare class TrellisClient {
-    static connect<TApi extends TrellisAPI>(args: TrellisClientConnectArgs<TApi>): Promise<Trellis<TApi>>;
+    static connect<TContract extends ClientContract<TrellisAPI, TrellisContractV1>>(args: ClientConnectArgsFor<TContract>): AsyncResult<ConnectedTrellisClient<TContract>, TransportError | UnexpectedError>;
 }
 export {};
 //# sourceMappingURL=client_connect.d.ts.map

package/esm/client_connect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client_connect.d.ts","sourceRoot":"","sources":["../src/client_connect.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EACL,KAAK,gBAAgB,EAItB,MAAM,2BAA2B,CAAC;AAEnC,KAAK,cAAc,CAAC,IAAI,SAAS,UAAU,GAAG,UAAU,IAAI;IAC1D,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,GAAG,EAAE;QACH,OAAO,EAAE,IAAI,CAAC;KACf,CAAC;CACH,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,2BAA2B,GAAG;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,GAAG,2BAA2B,CAAC;AAEvF,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,GAAG,aAAa,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC;AAE/D,MAAM,MAAM,wBAAwB,CAAC,IAAI,SAAS,UAAU,GAAG,UAAU,IACrE,UAAU,GACV;IACA,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,cAAc,CAAC,EAAE,CACf,GAAG,EAAE,yBAAyB,KAC3B,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC/D,CAAC;AAqBJ,KAAK,iBAAiB,GAAG;IACvB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,GAAG,IAAI,MAAM,CAAC;CACf,CAAC;AAqPF,wBAAsB,qBAAqB,CAAC,IAAI,SAAS,UAAU,EACjE,IAAI,EAAE,wBAAwB,CAAC,IAAI,CAAC,EACpC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CA6EtB;AAgFH,qBAAa,aAAa;IACxB,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,UAAU,EACpC,IAAI,EAAE,wBAAwB,CAAC,IAAI,CAAC,GACnC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;CAG1B"}
+{"version":3,"file":"client_connect.d.ts","sourceRoot":"","sources":["../../client_connect.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,uBAAuB,EACvB,KAAK,qBAAqB,EAE3B,MAAM,2BAA2B,CAAC;AA0BnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,OAAO,EAER,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAU,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1E,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,2BAA2B,CAAC;AAMnC,KAAK,cAAc,CACjB,IAAI,SAAS,UAAU,GAAG,UAAU,EACpC,SAAS,SAAS,iBAAiB,GAAG,iBAAiB,IACrD;IACF,QAAQ,EAAE,SAAS,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE;QACH,OAAO,EAAE,IAAI,CAAC;KACf,CAAC;IACF,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAC5D,CAAC;AAkDF,KAAK,wBAAwB,GAAG;IAC9B,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,KAAK,2BAA2B,GAAG;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,wBAAwB,GACxB,2BAA2B,CAAC;AAEhC,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,GAAG,aAAa,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB,IAAI,CAAC;AAET;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,KAAK,oBAAoB,CAAC,SAAS,SAAS,cAAc,IACtD,UAAU,GACV;IACA,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAC;IACpB,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,cAAc,CAAC,EAAE,CACf,GAAG,EAAE,yBAAyB,KAC3B,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC/D,CAAC;AAEJ,MAAM,MAAM,wBAAwB,CAClC,IAAI,SAAS,UAAU,GAAG,UAAU,EACpC,SAAS,SAAS,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,GAAG,cAAc,CACxE,IAAI,EACJ,iBAAiB,CAClB,IACC,oBAAoB,CAAC,SAAS,CAAC,CAAC;AA2BpC,KAAK,iBAAiB,GAAG;IACvB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,GAAG,IAAI,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,CACZ,OAAO,EAAE,MAAM,IAAI,EACnB,EAAE,EAAE,MAAM,KACP,UAAU,CAAC,OAAO,UAAU,CAAC,WAAW,CAAC,CAAC;IAC/C,aAAa,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;CACzE,CAAC;AAwsBF,wBAAsB,qBAAqB,CACzC,SAAS,SAAS,cAAc,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAE/D,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,EACrC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAwM5D;AA6FD,qBAAa,aAAa;IACxB,MAAM,CAAC,OAAO,CACZ,SAAS,SAAS,cAAc,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAE/D,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACpC,WAAW,CACZ,sBAAsB,CAAC,SAAS,CAAC,EACjC,cAAc,GAAG,eAAe,CACjC;CAMF"}