@qlever-llc/trellis 0.8.3 → 0.9.0-rc.2

package/script/auth/schemas.d.ts

@@ -23,15 +23,27 @@ export declare const ApprovalDecisionSchema: Type.TUnion<[Type.TLiteral<"approve
 export type ApprovalDecision = StaticDecode<typeof ApprovalDecisionSchema>;
 export declare const UserParticipantKindSchema: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
 export type UserParticipantKind = StaticDecode<typeof UserParticipantKindSchema>;
+export declare const ContractApprovalCapabilitySchema: Type.TObject<{
+    displayName: Type.TString;
+    description: Type.TString;
+    consequence: Type.TOptional<Type.TString>;
+}>;
+export type ContractApprovalCapability = StaticDecode<typeof ContractApprovalCapabilitySchema>;
 export declare const ContractApprovalSchema: Type.TObject<{
     contractDigest: Type.TString;
     contractId: Type.TString;
     displayName: Type.TString;
     description: Type.TString;
     participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
-    capabilities: Type.TArray<Type.TString>;
+    capabilities: Type.TRecord<"^.*$", Type.TObject<{
+        displayName: Type.TString;
+        description: Type.TString;
+        consequence: Type.TOptional<Type.TString>;
+    }>>;
 }>;
 export type ContractApproval = StaticDecode<typeof ContractApprovalSchema>;
+/** Returns the raw global capability keys required by an approval. */
+export declare function approvalCapabilityKeys(approval: ContractApproval): string[];
 export declare const BindSuccessResponseSchema: Type.TObject<{
     status: Type.TLiteral<"bound">;
     inboxPrefix: Type.TString;
@@ -57,7 +69,11 @@ export declare const BindInsufficientCapabilitiesResponseSchema: Type.TObject<{
         displayName: Type.TString;
         description: Type.TString;
         participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
-        capabilities: Type.TArray<Type.TString>;
+        capabilities: Type.TRecord<"^.*$", Type.TObject<{
+            displayName: Type.TString;
+            description: Type.TString;
+            consequence: Type.TOptional<Type.TString>;
+        }>>;
     }>;
     missingCapabilities: Type.TArray<Type.TString>;
     userCapabilities: Type.TArray<Type.TString>;
@@ -86,7 +102,11 @@ export declare const BindResponseSchema: Type.TUnion<[Type.TObject<{
         displayName: Type.TString;
         description: Type.TString;
         participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
-        capabilities: Type.TArray<Type.TString>;
+        capabilities: Type.TRecord<"^.*$", Type.TObject<{
+            displayName: Type.TString;
+            description: Type.TString;
+            consequence: Type.TOptional<Type.TString>;
+        }>>;
     }>;
     missingCapabilities: Type.TArray<Type.TString>;
     userCapabilities: Type.TArray<Type.TString>;
@@ -99,7 +119,8 @@ export declare const AuthStartRequestSchema: Type.TObject<{
     redirectTo: Type.TString;
     sessionKey: Type.TString;
     sig: Type.TString;
-    contract: Type.TObject<{}>;
+    contractDigest: Type.TOptional<Type.TString>;
+    contract: Type.TOptional<Type.TObject<{}>>;
     context: Type.TOptional<Type.TObject<{}>>;
 }>;
 export declare const AuthStartFlowResponseSchema: Type.TObject<{

package/script/auth/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../auth/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAU/B,eAAO,MAAM,oBAAoB,cAE/B,CAAC;AAIH,eAAO,MAAM,mBAAmB;;;EAG9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAErE,eAAO,MAAM,8BAA8B;;EAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,YAAY,CACjD,OAAO,8BAA8B,CACtC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;EAGjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB,mEAGjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,yBAAyB,6DAGpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAC5C,OAAO,yBAAyB,CACjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;EAOjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;EAMpC,CAAC;AAEH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;EAKrD,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACnE,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAC5C,OAAO,yBAAyB,CACjC,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,YAAY,CAC7D,OAAO,0CAA0C,CAClD,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;EAOA,CAAC;AAEpC,eAAO,MAAM,2BAA2B;;;;EAItC,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;IAGlC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC3E,MAAM,MAAM,qBAAqB,GAAG,YAAY,CAC9C,OAAO,2BAA2B,CACnC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE7E,eAAO,MAAM,qBAAqB;;;;;;EAMC,CAAC;AAEpC,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../auth/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAU/B,eAAO,MAAM,oBAAoB,cAE/B,CAAC;AAIH,eAAO,MAAM,mBAAmB;;;EAG9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAErE,eAAO,MAAM,8BAA8B;;EAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,YAAY,CACjD,OAAO,8BAA8B,CACtC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;EAGjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB,mEAGjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,yBAAyB,6DAGpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAC5C,OAAO,yBAAyB,CACjC,CAAC;AAEF,eAAO,MAAM,gCAAgC;;;;EAI3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,YAAY,CACnD,OAAO,gCAAgC,CACxC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;EAOjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,sEAAsE;AACtE,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAE3E;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;EAMpC,CAAC;AAEH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;EAKrD,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACnE,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAC5C,OAAO,yBAAyB,CACjC,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,YAAY,CAC7D,OAAO,0CAA0C,CAClD,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;EAQjC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;EAItC,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;IAGlC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC3E,MAAM,MAAM,qBAAqB,GAAG,YAAY,CAC9C,OAAO,2BAA2B,CACnC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE7E,eAAO,MAAM,qBAAqB;;;;;;EAMhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/script/auth/schemas.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NatsAuthTokenV1Schema = exports.AuthStartResponseSchema = exports.AuthStartFlowResponseSchema = exports.AuthStartRequestSchema = exports.BindResponseSchema = exports.BindInsufficientCapabilitiesResponseSchema = exports.BindSuccessResponseSchema = exports.ContractApprovalSchema = exports.UserParticipantKindSchema = exports.ApprovalDecisionSchema = exports.ClientTransportsSchema = exports.ClientTransportEndpointsSchema = exports.SentinelCredsSchema = exports.ContractDigestSchema = void 0;
+exports.NatsAuthTokenV1Schema = exports.AuthStartResponseSchema = exports.AuthStartFlowResponseSchema = exports.AuthStartRequestSchema = exports.BindResponseSchema = exports.BindInsufficientCapabilitiesResponseSchema = exports.BindSuccessResponseSchema = exports.ContractApprovalSchema = exports.ContractApprovalCapabilitySchema = exports.UserParticipantKindSchema = exports.ApprovalDecisionSchema = exports.ClientTransportsSchema = exports.ClientTransportEndpointsSchema = exports.SentinelCredsSchema = exports.ContractDigestSchema = void 0;
+exports.approvalCapabilityKeys = approvalCapabilityKeys;
 const typebox_1 = require("typebox");
 const SessionKeySchema = typebox_1.Type.String({
     pattern: "^[A-Za-z0-9_-]{43}$",
@@ -31,14 +32,23 @@ exports.UserParticipantKindSchema = typebox_1.Type.Union([
     typebox_1.Type.Literal("app"),
     typebox_1.Type.Literal("agent"),
 ]);
+exports.ContractApprovalCapabilitySchema = typebox_1.Type.Object({
+    displayName: typebox_1.Type.String(),
+    description: typebox_1.Type.String(),
+    consequence: typebox_1.Type.Optional(typebox_1.Type.String()),
+});
 exports.ContractApprovalSchema = typebox_1.Type.Object({
     contractDigest: exports.ContractDigestSchema,
     contractId: typebox_1.Type.String(),
     displayName: typebox_1.Type.String(),
     description: typebox_1.Type.String(),
     participantKind: exports.UserParticipantKindSchema,
-    capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+    capabilities: typebox_1.Type.Record(typebox_1.Type.String(), exports.ContractApprovalCapabilitySchema),
 });
+/** Returns the raw global capability keys required by an approval. */
+function approvalCapabilityKeys(approval) {
+    return Object.keys(approval.capabilities);
+}
 exports.BindSuccessResponseSchema = typebox_1.Type.Object({
     status: typebox_1.Type.Literal("bound"),
     inboxPrefix: typebox_1.Type.String(),
@@ -61,9 +71,10 @@ exports.AuthStartRequestSchema = typebox_1.Type.Object({
     redirectTo: typebox_1.Type.String(),
     sessionKey: SessionKeySchema,
     sig: SignatureSchema,
-    contract: OpenObjectSchema,
+    contractDigest: typebox_1.Type.Optional(exports.ContractDigestSchema),
+    contract: typebox_1.Type.Optional(OpenObjectSchema),
     context: typebox_1.Type.Optional(OpenObjectSchema),
-}, { additionalProperties: false });
+});
 exports.AuthStartFlowResponseSchema = typebox_1.Type.Object({
     status: typebox_1.Type.Literal("flow_started"),
     flowId: typebox_1.Type.String({ minLength: 1 }),
@@ -79,4 +90,4 @@ exports.NatsAuthTokenV1Schema = typebox_1.Type.Object({
     sig: SignatureSchema,
     iat: typebox_1.Type.Integer(),
     contractDigest: exports.ContractDigestSchema,
-}, { additionalProperties: false });
+});

package/script/auth/session_auth.d.ts

@@ -11,7 +11,7 @@ export type TrellisAuth = {
     oauthInitSig: (redirectTo: string, context?: unknown, provider?: string, contract?: Record<string, unknown>) => Promise<string>;
     bindFlowSig: (flowId: string) => Promise<string>;
     natsConnectSigForIat: (iat: number, contractDigest: string) => Promise<string>;
-    createProof: (subject: string, payloadHash: Uint8Array) => Promise<string>;
+    createProof: (subject: string, payloadHash: Uint8Array, requestId?: string, iat?: number) => Promise<string>;
     natsConnectOptions: (opts: {
         contractDigest: string;
     }) => Promise<NatsConnectOptions>;

package/script/auth/session_auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_auth.d.ts","sourceRoot":"","sources":["../../../auth/session_auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAmBxD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAChD,UAAU,EAAE,MAAM,MAAM,CAAC;IACzB,sBAAsB,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,IAAI,CAAC;IAExD,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,oBAAoB,EAAE,CACpB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,KACnB,OAAO,CAAC,MAAM,CAAC,CAAC;IAErB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,kBAAkB,EAAE,CAClB,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,KAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAClC,CAAC;AAEF;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GACrB,MAAM,CAER;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAC/B,OAAO,CAAC,WAAW,CAAC,CA+FtB"}
+{"version":3,"file":"session_auth.d.ts","sourceRoot":"","sources":["../../../auth/session_auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAmBxD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAChD,UAAU,EAAE,MAAM,MAAM,CAAC;IACzB,sBAAsB,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,IAAI,CAAC;IAExD,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,oBAAoB,EAAE,CACpB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,KACnB,OAAO,CAAC,MAAM,CAAC,CAAC;IAErB,WAAW,EAAE,CACX,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,UAAU,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,MAAM,KACT,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,kBAAkB,EAAE,CAClB,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,KAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAClC,CAAC;AAEF;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GACrB,MAAM,CAER;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAC/B,OAAO,CAAC,WAAW,CAAC,CAqGtB"}

package/script/auth/session_auth.js

@@ -53,7 +53,13 @@ async function createAuth(opts) {
         oauthInitSig: signOauthInit,
         bindFlowSig: (flowId) => signDomainHash("bind-flow", flowId),
         natsConnectSigForIat: (iat, contractDigest) => signDomainHash("nats-connect", buildNatsConnectSignaturePayload(iat, contractDigest)),
-        createProof: (subject, payloadHash) => (0, proof_ts_1.createProof)(privateKey, { sessionKey, subject, payloadHash }),
+        createProof: (subject, payloadHash, requestId = crypto.randomUUID(), iat) => (0, proof_ts_1.createProof)(privateKey, {
+            sessionKey,
+            subject,
+            payloadHash,
+            iat: iat ?? currentIat(),
+            requestId,
+        }),
         natsConnectOptions: async (options) => {
             return {
                 authenticator: () => {

package/script/client_connect.d.ts

@@ -1,4 +1,5 @@
 import { CONTRACT_STATE_METADATA, type ContractStateMetadata } from "./contract_support/mod.ts";
+import { type SessionKeyOptions } from "./auth/browser.ts";
 import type { ClientOpts } from "./client.ts";
 import type { TrellisAPI, TrellisContractV1 } from "./contracts.ts";
 import { type RuntimeTransport } from "./runtime_transport.ts";
@@ -23,6 +24,7 @@ type BrowserClientAuthOptions = {
     context?: unknown;
     currentUrl?: URL | string | (() => URL | string);
     flowId?: string;
+    sessionKey?: SessionKeyOptions;
 };
 type SessionKeyClientAuthOptions = {
     mode: "session_key";

package/script/client_connect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client_connect.d.ts","sourceRoot":"","sources":["../../client_connect.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,uBAAuB,EACvB,KAAK,qBAAqB,EAE3B,MAAM,2BAA2B,CAAC;AA0BnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,OAAO,EAER,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAU,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1E,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,2BAA2B,CAAC;AAMnC,KAAK,cAAc,CACjB,IAAI,SAAS,UAAU,GAAG,UAAU,EACpC,SAAS,SAAS,iBAAiB,GAAG,iBAAiB,IACrD;IACF,QAAQ,EAAE,SAAS,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE;QACH,OAAO,EAAE,IAAI,CAAC;KACf,CAAC;IACF,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAC5D,CAAC;AAkDF,KAAK,wBAAwB,GAAG;IAC9B,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,KAAK,2BAA2B,GAAG;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,wBAAwB,GACxB,2BAA2B,CAAC;AAEhC,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,GAAG,aAAa,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB,IAAI,CAAC;AAET;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,KAAK,oBAAoB,CAAC,SAAS,SAAS,cAAc,IACtD,UAAU,GACV;IACA,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAC;IACpB,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,cAAc,CAAC,EAAE,CACf,GAAG,EAAE,yBAAyB,KAC3B,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC/D,CAAC;AAEJ,MAAM,MAAM,wBAAwB,CAClC,IAAI,SAAS,UAAU,GAAG,UAAU,EACpC,SAAS,SAAS,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,GAAG,cAAc,CACxE,IAAI,EACJ,iBAAiB,CAClB,IACC,oBAAoB,CAAC,SAAS,CAAC,CAAC;AA2BpC,KAAK,iBAAiB,GAAG;IACvB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,GAAG,IAAI,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,CACZ,OAAO,EAAE,MAAM,IAAI,EACnB,EAAE,EAAE,MAAM,KACP,UAAU,CAAC,OAAO,UAAU,CAAC,WAAW,CAAC,CAAC;IAC/C,aAAa,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;CACzE,CAAC;AAwsBF,wBAAsB,qBAAqB,CACzC,SAAS,SAAS,cAAc,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAE/D,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,EACrC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAwM5D;AA6FD,qBAAa,aAAa;IACxB,MAAM,CAAC,OAAO,CACZ,SAAS,SAAS,cAAc,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAE/D,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACpC,WAAW,CACZ,sBAAsB,CAAC,SAAS,CAAC,EACjC,cAAc,GAAG,eAAe,CACjC;CAMF"}
+{"version":3,"file":"client_connect.d.ts","sourceRoot":"","sources":["../../client_connect.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,uBAAuB,EACvB,KAAK,qBAAqB,EAE3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAML,KAAK,iBAAiB,EAEvB,MAAM,mBAAmB,CAAC;AAkB3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,OAAO,EAER,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAU,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1E,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,2BAA2B,CAAC;AAMnC,KAAK,cAAc,CACjB,IAAI,SAAS,UAAU,GAAG,UAAU,EACpC,SAAS,SAAS,iBAAiB,GAAG,iBAAiB,IACrD;IACF,QAAQ,EAAE,SAAS,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE;QACH,OAAO,EAAE,IAAI,CAAC;KACf,CAAC;IACF,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAC5D,CAAC;AAkDF,KAAK,wBAAwB,GAAG;IAC9B,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC,CAAC;AAEF,KAAK,2BAA2B,GAAG;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,wBAAwB,GACxB,2BAA2B,CAAC;AAEhC,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,GAAG,aAAa,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB,IAAI,CAAC;AAET;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,KAAK,oBAAoB,CAAC,SAAS,SAAS,cAAc,IACtD,UAAU,GACV;IACA,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAC;IACpB,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,cAAc,CAAC,EAAE,CACf,GAAG,EAAE,yBAAyB,KAC3B,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC/D,CAAC;AAEJ,MAAM,MAAM,wBAAwB,CAClC,IAAI,SAAS,UAAU,GAAG,UAAU,EACpC,SAAS,SAAS,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,GAAG,cAAc,CACxE,IAAI,EACJ,iBAAiB,CAClB,IACC,oBAAoB,CAAC,SAAS,CAAC,CAAC;AA2BpC,KAAK,iBAAiB,GAAG;IACvB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,GAAG,IAAI,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,CACZ,OAAO,EAAE,MAAM,IAAI,EACnB,EAAE,EAAE,MAAM,KACP,UAAU,CAAC,OAAO,UAAU,CAAC,WAAW,CAAC,CAAC;IAC/C,aAAa,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;CACzE,CAAC;AA+vBF,wBAAsB,qBAAqB,CACzC,SAAS,SAAS,cAAc,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAE/D,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,EACrC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAqN5D;AAwGD,qBAAa,aAAa;IACxB,MAAM,CAAC,OAAO,CACZ,SAAS,SAAS,cAAc,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAE/D,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACpC,WAAW,CACZ,sBAAsB,CAAC,SAAS,CAAC,EACjC,cAAc,GAAG,eAAe,CACjC;CAMF"}

package/script/client_connect.js

@@ -196,7 +196,7 @@ async function resolveClientIdentity(auth) {
     if (auth?.mode === "session_key") {
         return await createSessionKeyRuntimeIdentity(auth.sessionKeySeed);
     }
-    const handle = auth?.handle ?? await (0, browser_ts_1.getOrCreateSessionKey)();
+    const handle = auth?.handle ?? await (0, browser_ts_1.getOrCreateSessionKey)(auth?.sessionKey);
     return {
         mode: "browser",
         sessionKey: (0, browser_ts_1.getPublicSessionKey)(handle),
@@ -250,12 +250,18 @@ async function bindClientFlow(args) {
             context: { flowId: args.flowId },
         });
     }
-    if (parsed.status !== "bound") {
+    if (parsed.status === "insufficient_capabilities") {
         throw createTransportError({
-            code: "trellis.auth.bind_invalid_response",
-            message: "Trellis returned an invalid sign-in response.",
-            hint: "Start the sign-in flow again.",
-            context: { flowId: args.flowId, status: parsed.status },
+            code: "trellis.auth.insufficient_capabilities",
+            message: "The signed-in Trellis account lacks required capabilities.",
+            hint: "Ask an administrator to grant the missing capabilities or sign in with a different account.",
+            context: {
+                flowId: args.flowId,
+                contractId: parsed.approval.contractId,
+                contractDigest: parsed.approval.contractDigest,
+                missingCapabilities: parsed.missingCapabilities,
+                userCapabilities: parsed.userCapabilities,
+            },
         });
     }
 }
@@ -372,6 +378,13 @@ async function createRuntimeUserAuthenticator(args) {
     let latestPreparedIat = 0;
     let refreshInFlight = null;
     let recoveryInFlight = null;
+    const refreshCurrentToken = async () => {
+        const currentIat = (0, time_ts_1.correctedIatSeconds)(args.deps.now(), args.offsetState.serverClockOffsetMs);
+        const nextToken = await buildRuntimeAuthToken(currentIat);
+        precomputedTokens.set(currentIat, nextToken);
+        latestPreparedIat = Math.max(latestPreparedIat, currentIat);
+        currentToken = nextToken;
+    };
     const refresh = () => {
         if (refreshInFlight)
             return refreshInFlight;
@@ -410,7 +423,7 @@ async function createRuntimeUserAuthenticator(args) {
                 precomputedTokens.clear();
                 latestPreparedIat = 0;
             }
-            await refresh();
+            await refreshCurrentToken();
         })().finally(() => {
             recoveryInFlight = null;
         });
@@ -432,16 +445,13 @@ async function createRuntimeUserAuthenticator(args) {
                 const nextToken = precomputedTokens.get(currentIat);
                 if (nextToken) {
                     currentToken = nextToken;
-                    if (currentIat >= latestPreparedIat - 60) {
-                        void refresh();
-                    }
                     return { auth_token: currentToken };
                 }
                 if (args.recoverBrowserAuth) {
                     void recover();
                     return { auth_token: currentToken };
                 }
-                void refresh();
+                void refreshCurrentToken();
                 return { auth_token: currentToken };
             },
         ],
@@ -480,18 +490,33 @@ function bootstrapTargetsRequestedContract(bootstrap, args) {
 }
 async function buildSessionKeyLoginUrl(args) {
     const context = authRequestContextRecord(args.context);
-    const response = await fetch(`${args.trellisUrl}/auth/requests`, {
+    let response = await fetch(`${args.trellisUrl}/auth/requests`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
             redirectTo: args.redirectTo,
             sessionKey: args.sessionKey,
             sig: args.oauthInitSig,
-            contract: args.contract,
+            contractDigest: args.contractDigest,
             ...(args.provider ? { provider: args.provider } : {}),
             ...(context ? { context } : {}),
         }),
     });
+    if (await authStartNeedsManifest(response)) {
+        response = await fetch(`${args.trellisUrl}/auth/requests`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                redirectTo: args.redirectTo,
+                sessionKey: args.sessionKey,
+                sig: args.fullOauthInitSig,
+                contractDigest: args.contractDigest,
+                contract: args.contract,
+                ...(args.provider ? { provider: args.provider } : {}),
+                ...(context ? { context } : {}),
+            }),
+        });
+    }
     if (!response.ok) {
         const reason = await response.text();
         throw createTransportError({
@@ -526,6 +551,25 @@ async function buildSessionKeyLoginUrl(args) {
         context: { trellisUrl: args.trellisUrl },
     });
 }
+async function authStartNeedsManifest(response) {
+    if (response.ok || response.status !== 409)
+        return false;
+    let payload;
+    try {
+        payload = await response.clone().json();
+    }
+    catch {
+        payload = undefined;
+    }
+    if (payload && typeof payload === "object") {
+        const record = payload;
+        return record.reason === "manifest_required" ||
+            record.code === "manifest_required" ||
+            record.error === "manifest_required" ||
+            record.message === "manifest_required";
+    }
+    return (await response.clone().text()).includes("manifest_required");
+}
 async function connectClientWithDeps(args, deps) {
     const trellisUrl = normalizeTrellisUrl(args.trellisUrl);
     const identity = await resolveClientIdentity(args.auth);
@@ -537,7 +581,20 @@ async function connectClientWithDeps(args, deps) {
         ? args.auth.flowId
         : browserAuth?.flowId ?? currentUrl?.searchParams.get("flowId") ??
             undefined;
+    const callbackAuthError = args.auth?.mode === "session_key"
+        ? undefined
+        : currentUrl?.searchParams.get("authError") ?? undefined;
     const offsetState = { serverClockOffsetMs: 0 };
+    if (callbackAuthError) {
+        if (currentUrl)
+            cleanupBrowserCallbackUrl(currentUrl);
+        throw createTransportError({
+            code: `trellis.auth.${callbackAuthError}`,
+            message: "Trellis sign-in did not complete.",
+            hint: "Start sign-in again if you want to approve access.",
+            context: { reason: callbackAuthError, trellisUrl },
+        });
+    }
     if (callbackFlowId) {
         try {
             await bindClientFlow({
@@ -721,14 +778,18 @@ async function resolveAuthRequired(args, identity, currentUrl, deps, offsetState
             redirectTo,
             sessionKey: identity.sessionKey,
             contract: args.contract.CONTRACT,
+            contractDigest: args.contract.CONTRACT_DIGEST ??
+                (0, mod_ts_1.digestContractManifest)(args.contract.CONTRACT),
             provider: args.auth.provider,
             context: args.auth.context,
-            oauthInitSig: await identity.oauthInitSig(redirectTo, authRequestContextRecord(args.auth.context), args.auth.provider, args.contract.CONTRACT),
+            oauthInitSig: await identity.oauthInitSig(redirectTo, authRequestContextRecord(args.auth.context), args.auth.provider, args.contract.CONTRACT_DIGEST ??
+                (0, mod_ts_1.digestContractManifest)(args.contract.CONTRACT)),
+            fullOauthInitSig: await identity.oauthInitSig(redirectTo, authRequestContextRecord(args.auth.context), args.auth.provider, args.contract.CONTRACT),
         })
         : await (0, browser_ts_1.startAuthRequest)({
             authUrl: normalizeTrellisUrl(args.trellisUrl),
             redirectTo,
-            handle: browserAuth.handle ?? await (0, browser_ts_1.getOrCreateSessionKey)(),
+            handle: browserAuth.handle ?? await (0, browser_ts_1.getOrCreateSessionKey)(browserAuth.sessionKey),
             provider: browserAuth.provider,
             contract: args.contract.CONTRACT,
             context: browserAuth.context,

package/script/contract.d.ts

@@ -3,16 +3,19 @@ export type DefinedContract<TOwnedApi extends {
     rpc: Record<string, unknown>;
     operations: Record<string, unknown>;
     events: Record<string, unknown>;
+    feeds?: Record<string, unknown>;
     subjects: Record<string, unknown>;
 }, TUsedApi extends {
     rpc: Record<string, unknown>;
     operations: Record<string, unknown>;
     events: Record<string, unknown>;
+    feeds?: Record<string, unknown>;
     subjects: Record<string, unknown>;
 }, TTrellisApi extends {
     rpc: Record<string, unknown>;
     operations: Record<string, unknown>;
     events: Record<string, unknown>;
+    feeds?: Record<string, unknown>;
     subjects: Record<string, unknown>;
 }, TContractId extends string = string, TJobs extends ContractJobsMetadata = {}, TState extends ContractStateMetadata = {}> = BaseDefinedContract<TOwnedApi, TUsedApi, TTrellisApi, TContractId, TJobs, TState>;
 export { defineAgentContract, defineAppContract, defineDeviceContract, defineServiceContract, } from "./contract_support/mod.ts";

package/script/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../contract.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,IAAI,mBAAmB,EAC3C,KAAK,QAAQ,EACb,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACb,MAAM,2BAA2B,CAAC;AASnC,MAAM,MAAM,eAAe,CACzB,SAAS,SAAS;IAChB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,EACD,QAAQ,SAAS;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,EACD,WAAW,SAAS;IAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,EACD,WAAW,SAAS,MAAM,GAAG,MAAM,EACnC,KAAK,SAAS,oBAAoB,GAAG,EAAE,EACvC,MAAM,SAAS,qBAAqB,GAAG,EAAE,IACvC,mBAAmB,CACrB,SAAS,EACT,QAAQ,EACR,WAAW,EACX,WAAW,EACX,KAAK,EACL,MAAM,CACP,CAAC;AAEF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,OAAO,GACR,CAAC"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../contract.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,IAAI,mBAAmB,EAC3C,KAAK,QAAQ,EACb,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACb,MAAM,2BAA2B,CAAC;AASnC,MAAM,MAAM,eAAe,CACzB,SAAS,SAAS;IAChB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,EACD,QAAQ,SAAS;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,EACD,WAAW,SAAS;IAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,EACD,WAAW,SAAS,MAAM,GAAG,MAAM,EACnC,KAAK,SAAS,oBAAoB,GAAG,EAAE,EACvC,MAAM,SAAS,qBAAqB,GAAG,EAAE,IACvC,mBAAmB,CACrB,SAAS,EACT,QAAQ,EACR,WAAW,EACX,WAAW,EACX,KAAK,EACL,MAAM,CACP,CAAC;AAEF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,OAAO,GACR,CAAC"}