@weaveprotocol/core 0.1.0

package/dist/session/agent-link.js

@@ -0,0 +1,251 @@
+/**
+ * @module session/agent-link
+ * Connecting an agent on a computer — Claude Code, Claude Desktop, Cursor —
+ * with one command the person copies from an app.
+ *
+ * The app shows `weave connect wv_…`. The code is a random secret, made for
+ * this one connection. Both sides work out a meeting room and a key from it,
+ * meet on a relay, and talk over the ordinary peer connection:
+ *
+ * 1. The terminal says who it is: its own key, made on that computer and never
+ *    sent anywhere, and a name for the person to recognise ("Agent on
+ *    leifs-macbook").
+ * 2. The app shows that and waits for a click, which opens the account home.
+ *    The person allows it there, and the home signs an agent's note for that
+ *    key — the same note an app gets, saying "agent".
+ * 3. The app hands the note back. The terminal keeps it, and from then on runs
+ *    a node of its own: the app's tab can close.
+ *
+ * Everything said is sealed with the key from the code, so the relay — which
+ * introduces the two sides and could put itself between them — learns nothing
+ * and can change nothing. It is the phone pairing's arrangement
+ * (`identity/pairing.ts`), with a secret made for the purpose instead of the
+ * seed. The code is pasted, not typed, so it can be long enough that recording
+ * the traffic and guessing it later gets nowhere; it works once, and only while
+ * the app is showing it.
+ */
+import { createNetworkManager } from '../network/network-manager.js';
+import { createMesh } from '../network/mesh.js';
+import { createP256Provider } from '../identity/crypto-p256.js';
+import { publicKeyToDid, P256_MULTICODEC } from '../identity/did.js';
+import { verifyUCAN, parseUCAN } from '../identity/ucan.js';
+import { isAgentNote } from '../identity/agent-note.js';
+import { sealPairingPayload, openPairingPayload } from '../identity/pairing.js';
+import { base64UrlDecode, base64UrlEncode, concatBytes, utf8Decode, utf8Encode } from '../utils/encoding.js';
+import { cidFromBytes } from '../utils/hash.js';
+const CODE_PREFIX = 'wv_';
+const SECRET_BYTES = 16;
+const ROOM_PREFIX = utf8Encode('weave-agent-link-room-v1');
+const KEY_INFO = utf8Encode('weave-agent-link-key-v1');
+/** Messages on the link, each sealed */
+const ASK = 'agent-link:ask';
+const HEARD = 'agent-link:heard';
+const ANSWER = 'agent-link:answer';
+const DONE = 'agent-link:done';
+/** Longest name an agent may give itself */
+const MAX_NAME = 80;
+// ─── The code ────────────────────────────────────────────────────────
+/** A new code: `wv_` and 128 random bits */
+export function newAgentCode() {
+    return CODE_PREFIX + base64UrlEncode(globalThis.crypto.getRandomValues(new Uint8Array(SECRET_BYTES)));
+}
+/**
+ * The secret in a code, for anything a person might paste — surrounding
+ * spaces, quotes, the whole command.
+ * @throws When there is no code in it
+ */
+export function readAgentCode(input) {
+    const match = /wv_([A-Za-z0-9_-]{22})(?![A-Za-z0-9_-])/.exec(input);
+    const secret = match ? base64UrlDecode(match[1]) : null;
+    if (!secret || secret.length !== SECRET_BYTES) {
+        throw new Error('That is not a connect code. Copy the whole command from “Connect an agent” in the app.');
+    }
+    return secret;
+}
+async function linkRoom(secret) {
+    return encodeURIComponent(await cidFromBytes(concatBytes(ROOM_PREFIX, secret)));
+}
+async function linkKey(secret) {
+    const material = await globalThis.crypto.subtle.importKey('raw', secret, { name: 'HKDF' }, false, ['deriveKey']);
+    return globalThis.crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: KEY_INFO }, material, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+}
+async function seal(value, key) {
+    return Array.from(await sealPairingPayload(utf8Encode(JSON.stringify(value)), key));
+}
+/** What a sealed message says, or null when it wasn't sealed with this code */
+async function unseal(message, key) {
+    if (!Array.isArray(message.payload))
+        return null;
+    try {
+        return JSON.parse(utf8Decode(await openPairingPayload(new Uint8Array(message.payload), key)));
+    }
+    catch {
+        return null;
+    }
+}
+function meet(network, room, did) {
+    if (network.transport)
+        return createNetworkManager({ did, createTransport: () => network.transport(did) });
+    return createMesh({ relays: network.relays, did, introductions: false }).join(room);
+}
+/**
+ * Starts offering a connection to an agent on a computer. Keep it running
+ * while the code is on screen; the first terminal that shows up with the code
+ * is the one asked about, and nobody after it.
+ */
+export async function offerAgentLink(network, onStage) {
+    if (network.relays.length === 0 && !network.transport)
+        throw new Error('Connecting an agent needs a relay, and none is configured.');
+    const code = newAgentCode();
+    const secret = readAgentCode(code);
+    const key = await linkKey(secret);
+    // A name for this end of the link, and nothing more: it signs nothing.
+    const provider = createP256Provider();
+    const did = publicKeyToDid(await provider.exportPublicKey((await provider.generateKeyPair()).publicKey), P256_MULTICODEC);
+    const net = meet(network, await linkRoom(secret), did);
+    let asked = null;
+    let over = false;
+    const finish = (stage) => {
+        if (over)
+            return;
+        over = true;
+        onStage(stage);
+        globalThis.setTimeout(() => net.disconnect(), 500);
+    };
+    net.on('message', (message) => {
+        if (over)
+            return;
+        void (async () => {
+            if (message.type === ASK && !asked) {
+                const said = await unseal(message, key);
+                // Not sealed with this code: someone else in the room. Ignored.
+                if (!said || typeof said.did !== 'string' || !said.did.startsWith('did:key:'))
+                    return;
+                const name = typeof said.name === 'string' && said.name.trim() ? said.name.trim().slice(0, MAX_NAME) : 'An agent';
+                const agent = { did: said.did, name };
+                asked = { peer: message.from, agent };
+                // So the terminal knows the code was right, and the person is deciding.
+                net.send(message.from, { type: HEARD, from: did, payload: await seal({ heard: true }, key) });
+                onStage({
+                    kind: 'asking',
+                    agent,
+                    allow: async (grant) => {
+                        if (parseUCAN(grant.token).payload.aud !== agent.did)
+                            throw new Error('That note is for a different key.');
+                        net.send(asked.peer, { type: ANSWER, from: did, payload: await seal({ grant }, key) });
+                    },
+                    deny: (reason = 'The person said no.') => {
+                        void seal({ denied: reason }, key).then((payload) => {
+                            net.send(asked.peer, { type: ANSWER, from: did, payload });
+                            finish({ kind: 'failed', reason: 'You said no. Make a new code to try again.' });
+                        });
+                    },
+                });
+            }
+            else if (message.type === DONE && asked && message.from === asked.peer) {
+                if (await unseal(message, key))
+                    finish({ kind: 'connected', agent: asked.agent });
+            }
+        })();
+    });
+    onStage({ kind: 'waiting' });
+    await net.connect();
+    return {
+        code,
+        stop: () => {
+            over = true;
+            net.disconnect();
+        },
+    };
+}
+// ─── The terminal's side ─────────────────────────────────────────────
+/**
+ * Checks a grant the way the terminal must: a valid agent's note, from the
+ * account it names, made out to this key.
+ * @throws When it does not check out
+ */
+export async function checkAgentGrant(grant, audience) {
+    if (!grant || grant.v !== 1 || typeof grant.token !== 'string' || typeof grant.did !== 'string') {
+        throw new Error('The app sent something that is not a grant.');
+    }
+    const verified = await verifyUCAN(grant.token, createP256Provider());
+    if (!verified.valid)
+        throw new Error(`The note does not check out: ${verified.reason ?? 'invalid'}`);
+    const { payload } = parseUCAN(grant.token);
+    if (payload.aud !== audience)
+        throw new Error('The note was made out to a different key.');
+    if (payload.iss !== grant.did)
+        throw new Error('The note was not signed by the account it names.');
+    if (!isAgentNote(grant.token))
+        throw new Error('The note is not an agent\'s. Update your account home.');
+}
+/**
+ * Connects this terminal as an agent, with the code from the app.
+ *
+ * @param params.did This agent's key — the note will be made out to it
+ * @param params.name What the person sees, e.g. "Agent on leifs-macbook"
+ * @param params.onWaiting Told once the app has heard, and the person is deciding
+ * @returns The grant, checked
+ * @throws When the code is wrong or stale, the person says no, or nothing answers in time
+ */
+export async function acceptAgentLink(params) {
+    const secret = readAgentCode(params.code);
+    const key = await linkKey(secret);
+    const net = meet(params.network, await linkRoom(secret), params.did);
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let timer;
+        const wait = (ms, reason) => {
+            clearTimeout(timer);
+            timer = setTimeout(() => finish(() => reject(new Error(reason))), ms);
+        };
+        const finish = (done) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            // A moment for the last message to leave.
+            setTimeout(() => net.disconnect(), 500);
+            done();
+        };
+        net.on('peer-connected', (peer) => {
+            void seal({ did: params.did, name: params.name.slice(0, MAX_NAME) }, key).then((payload) => {
+                net.send(peer.did, { type: ASK, from: params.did, payload });
+            });
+        });
+        let heard = false;
+        net.on('message', (message) => {
+            void (async () => {
+                if (settled)
+                    return;
+                // Once the app has the question, the person gets longer to answer it.
+                if (message.type === HEARD && !heard && (await unseal(message, key))) {
+                    heard = true;
+                    params.onWaiting?.();
+                    wait(params.decideTimeoutMs ?? 10 * 60_000, 'Nobody answered in the app. Make a new code and try again.');
+                    return;
+                }
+                if (message.type !== ANSWER)
+                    return;
+                const answer = await unseal(message, key);
+                if (!answer)
+                    return;
+                if (typeof answer.denied === 'string') {
+                    finish(() => reject(new Error(answer.denied)));
+                    return;
+                }
+                try {
+                    await checkAgentGrant(answer.grant, params.did);
+                    net.send(message.from, { type: DONE, from: params.did, payload: await seal({ ok: true }, key) });
+                    finish(() => resolve(answer.grant));
+                }
+                catch (error) {
+                    finish(() => reject(error instanceof Error ? error : new Error(String(error))));
+                }
+            })();
+        });
+        wait(params.findTimeoutMs ?? 60_000, 'The app did not answer. Check the “Connect an agent” window is still open, or make a new code there.');
+        net.connect().catch(() => finish(() => reject(new Error('Could not reach the relay.'))));
+    });
+}
+//# sourceMappingURL=agent-link.js.map

package/dist/session/agent-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-link.js","sourceRoot":"","sources":["../../src/session/agent-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,oBAAoB,EAAuB,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC7G,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIhD,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,WAAW,GAAG,UAAU,CAAC,0BAA0B,CAAC,CAAC;AAC3D,MAAM,QAAQ,GAAG,UAAU,CAAC,yBAAyB,CAAC,CAAC;AAEvD,wCAAwC;AACxC,MAAM,GAAG,GAAG,gBAAgB,CAAC;AAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC;AACjC,MAAM,MAAM,GAAG,mBAAmB,CAAC;AACnC,MAAM,IAAI,GAAG,iBAAiB,CAAC;AAE/B,4CAA4C;AAC5C,MAAM,QAAQ,GAAG,EAAE,CAAC;AAapB,wEAAwE;AAExE,4CAA4C;AAC5C,MAAM,UAAU,YAAY;IAC1B,OAAO,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,KAAK,GAAG,yCAAyC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAkB;IACxC,OAAO,kBAAkB,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAkB;IACvC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAsB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACjI,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAiB,EAAE,IAAI,EAAE,QAAwB,EAAE,EAC1G,QAAQ,EACR,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,KAAc,EAAE,GAAc;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,MAAM,CAAI,OAAuB,EAAE,GAAc;IAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,kBAAkB,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAmB,CAAC,EAAE,GAAG,CAAC,CAAC,CAAM,CAAC;IACjH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD,SAAS,IAAI,CAAC,OAAoB,EAAE,IAAY,EAAE,GAAW;IAC3D,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,oBAAoB,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5G,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtF,CAAC;AAuBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAoB,EAAE,OAAwC;IACjG,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACrI,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,uEAAuE;IACvE,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,QAAQ,CAAC,eAAe,CAAC,CAAC,MAAM,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC,CAAC;IAC1H,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAEvD,IAAI,KAAK,GAAgD,IAAI,CAAC;IAC9D,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,MAAM,GAAG,CAAC,KAAqB,EAAE,EAAE;QACvC,IAAI,IAAI;YAAE,OAAO;QACjB,IAAI,GAAG,IAAI,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,CAAC;QACf,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAuB,EAAE,EAAE;QAC5C,IAAI,IAAI;YAAE,OAAO;QACjB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAoC,OAAO,EAAE,GAAG,CAAC,CAAC;gBAC3E,gEAAgE;gBAChE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;oBAAE,OAAO;gBACtF,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;gBAClH,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBACtC,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;gBACtC,wEAAwE;gBACxE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9F,OAAO,CAAC;oBACN,IAAI,EAAE,QAAQ;oBACd,KAAK;oBACL,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;wBACrB,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;4BAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;wBAC3G,GAAG,CAAC,IAAI,CAAC,KAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAmB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC3G,CAAC;oBACD,IAAI,EAAE,CAAC,MAAM,GAAG,qBAAqB,EAAE,EAAE;wBACvC,KAAK,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAmB,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;4BACnE,GAAG,CAAC,IAAI,CAAC,KAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;4BAC5D,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC,CAAC;wBACnF,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;gBACzE,IAAI,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC;oBAAE,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;IACpB,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,GAAG,EAAE;YACT,IAAI,GAAG,IAAI,CAAC;YACZ,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAY,EAAE,QAAgB;IAClE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IACrG,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACnG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC3G,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAUrC;IACC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAErE,OAAO,IAAI,OAAO,CAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,KAAoC,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,MAAc,EAAE,EAAE;YAC1C,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,IAAgB,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,0CAA0C;YAC1C,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;YACxC,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QAEF,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,IAAc,EAAE,EAAE;YAC1C,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBACzF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAuB,EAAE,EAAE;YAC5C,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,OAAO;oBAAE,OAAO;gBACpB,sEAAsE;gBACtE,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;oBACrE,KAAK,GAAG,IAAI,CAAC;oBACb,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;oBACrB,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,GAAG,MAAM,EAAE,4DAA4D,CAAC,CAAC;oBAC1G,OAAO;gBACT,CAAC;gBACD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;oBAAE,OAAO;gBACpC,MAAM,MAAM,GAAG,MAAM,MAAM,CAA8C,OAAO,EAAE,GAAG,CAAC,CAAC;gBACvF,IAAI,CAAC,MAAM;oBAAE,OAAO;gBACpB,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACtC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAC/C,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,eAAe,CAAC,MAAM,CAAC,KAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;oBACjD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjG,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAM,CAAC,CAAC,CAAC;gBACvC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,IAAI,CACF,MAAM,CAAC,aAAa,IAAI,MAAM,EAC9B,sGAAsG,CACvG,CAAC;QACF,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/session/auth.d.ts

@@ -0,0 +1,233 @@
+import type { AccountStore, AccountSummary } from '../identity/account-store.js';
+import { type AccountVault, type DeviceWrap } from '../identity/account-vault.js';
+import type { PairingTicket } from '../identity/pairing.js';
+import type { StoreFactory } from '../node/stores.js';
+import type { NodeNetworkConfig, P2PNode } from '../node/types.js';
+import { type ProtocolErrorCode } from '../utils/errors.js';
+import { type Place, type PodContents } from './places.js';
+import { type KeyValueStore, type StaySignedIn } from './stay-signed-in.js';
+import { type CarryGrant, type ConnectRequest, type Grant } from './connect.js';
+import { type PairingOffer, type PairingStage } from './pairing.js';
+export interface WeaveAuthConfig {
+    /** What passkey prompts call this app. Default "Weave". */
+    readonly appName?: string;
+    /** Relays and always-on nodes the signed-in node connects to. Omit to stay offline. */
+    readonly network?: NodeNetworkConfig;
+    /** The site passkeys belong to. Default: this page's hostname. */
+    readonly rpId?: string;
+    /** Where small choices are remembered — which account, stay signed in. Default `localStorage`. */
+    readonly storage?: KeyValueStore | null;
+    /** Namespaces those choices, so two apps on one origin keep their own. Default "weave". */
+    readonly storageKey?: string;
+    /** The page a phone-pairing QR opens. Default: this page. */
+    readonly pairingLink?: string;
+    /**
+     * Accounts kept in this browser, and their data. Defaults to IndexedDB;
+     * swap both for tests or for a host with no IndexedDB.
+     */
+    readonly browser?: {
+        readonly accounts: () => Promise<AccountStore>;
+        readonly stores: (account: AccountSummary) => StoreFactory;
+    };
+}
+/**
+ * Which screen the flow is on.
+ *
+ * `where` — where should your data live (a pod, or this browser); asked once.
+ * `welcome` — the place holds no accounts: new here, or not?
+ * `signIn` — choose an account and unlock it.
+ * `create` — name a new account; then, with `freshCode` set, save its password.
+ * `pair` — opened from a phone-pairing QR code.
+ * `ready` — signed in; `session` is set.
+ */
+export type AuthStage = 'starting' | 'where' | 'welcome' | 'signIn' | 'create' | 'pair' | 'ready';
+/** A failure, in the shape a screen needs to explain it */
+export interface AuthError {
+    readonly message: string;
+    /** What the person can do about it, when that is known */
+    readonly hint?: string;
+    readonly code?: ProtocolErrorCode;
+}
+/** Which ways into an account exist on this site */
+export interface AccountEntry {
+    readonly summary: AccountSummary;
+    readonly vault: AccountVault;
+    /**
+     * Passkey shortcuts this device can actually use. A wrap names a key in this
+     * site's storage, so one made on another site — or before storage was
+     * cleared — is listed by the vault but unopenable here.
+     */
+    readonly shortcuts: ReadonlyArray<DeviceWrap>;
+    /** Whether a short password was set here */
+    readonly hasPassword: boolean;
+}
+/** An open account: who it is, and the node doing its work */
+export interface WeaveSession {
+    readonly account: AccountSummary;
+    /** The account's identity */
+    readonly did: string;
+    /** The session key's DID — what peers see */
+    readonly sessionDid: string;
+    readonly node: P2PNode;
+}
+/** What the last move into a pod did */
+export interface MovedToPod {
+    /** The pod already held this account, and the two copies were combined */
+    readonly merged: boolean;
+    readonly spacesAdded: number;
+    readonly recordsAdded: number;
+    /** The old pod's name, or null when the old place was this browser */
+    readonly from: string | null;
+}
+/** An app this account gave access to, as the home remembers it */
+export interface Connection {
+    /** Where the app lives — as the browser reported it, not as the app named itself */
+    readonly origin: string;
+    /** What the app called itself */
+    readonly name: string | null;
+    /** The app's key */
+    readonly audience: string;
+    /** `carry` for a carrier, which holds passes and no keys */
+    readonly access: 'read' | 'write' | 'carry';
+    /** `account` when the app was given the whole account, not chosen spaces */
+    readonly scope: 'spaces' | 'account';
+    /** A carrier's carry space — what disconnecting takes away */
+    readonly carrySpace?: string;
+    readonly spaces: ReadonlyArray<{
+        readonly id: string;
+        readonly name: string;
+    }>;
+    readonly grantedAt: string;
+    /** Unix seconds */
+    readonly expiresAt: number;
+    /** The note the app writes under — what disconnecting revokes */
+    readonly token?: string;
+    /** Present, and true, for an agent connected through the app at `origin` — its own key, kept apart from the app's own connection */
+    readonly agent?: true;
+}
+/** What the person chose on the approval screen */
+export interface GrantChoice {
+    readonly origin: string;
+    readonly request: ConnectRequest;
+    /** Existing spaces to give the app */
+    readonly spaceIds: ReadonlyArray<string>;
+    /** How long the note lasts, overriding what the request asked for. Default: the request's `days`, or 7. */
+    readonly days?: number;
+}
+export interface AuthState {
+    readonly stage: AuthStage;
+    /** Where accounts are being read from */
+    readonly place: Place | null;
+    readonly accounts: ReadonlyArray<AccountSummary>;
+    readonly selectedId: string | null;
+    /** Ways into the selected account */
+    readonly entry: AccountEntry | null;
+    readonly session: WeaveSession | null;
+    /** A new account's password, shown once until `codeSaved()` */
+    readonly freshCode: string | null;
+    /** Something is in progress; buttons should wait */
+    readonly busy: boolean;
+    readonly error: AuthError | null;
+    /** Whether this browser can open a pod at all */
+    readonly folderAvailable: boolean;
+    /** The phone-pairing link this page was opened with */
+    readonly pairing: PairingTicket | null;
+    readonly pairingStage: PairingStage | null;
+    /** A pod picked while signed in, waiting on what should happen to the data */
+    readonly podChoice: {
+        readonly pod: Place;
+        readonly contents: PodContents;
+        readonly from: Place;
+    } | null;
+    readonly moved: MovedToPod | null;
+}
+export interface WeaveAuth {
+    getState(): AuthState;
+    /** Called after every change. Returns a function that stops it. */
+    subscribe(listener: (state: AuthState) => void): () => void;
+    /** Looks for accounts and resumes a kept sign-in. Safe to call more than once. */
+    start(): Promise<void>;
+    /** Opens a pod. Needs a click. Signed in, it asks what should happen to the data first (`podChoice`). */
+    choosePod(): Promise<void>;
+    /** Keeps accounts in this browser, and stops using a pod if one was open */
+    useBrowser(): Promise<void>;
+    /** Back to the where-should-your-data-live question */
+    changeStorage(): void;
+    select(accountId: string): Promise<void>;
+    signInWithCode(code: string): Promise<void>;
+    signInWithPassword(password: string): Promise<void>;
+    signInWithPasskey(): Promise<void>;
+    startCreating(): void;
+    showSignIn(): void;
+    createAccount(name: string): Promise<void>;
+    /** The new password has been saved; carry on in */
+    codeSaved(): void;
+    acceptPairing(): Promise<void>;
+    dismissPairing(): void;
+    clearError(): void;
+    rename(name: string): Promise<boolean>;
+    addPasskey(): Promise<boolean>;
+    removeShortcut(kind: 'passkey' | 'passphrase'): Promise<boolean>;
+    confirmPod(how: 'combine' | 'switch'): Promise<void>;
+    cancelPod(): void;
+    /** Removes the copy this browser kept after a move into a pod */
+    forgetBrowserCopy(): Promise<void>;
+    dismissMoved(): void;
+    /** The account password, for handing back to a password manager. Null when signed out. */
+    accountPassword(): string | null;
+    /** Starts offering this account to a phone */
+    offerToPhone(onStage: (stage: PairingStage) => void): Promise<PairingOffer>;
+    /**
+     * Gives an app access, as the account home: makes any spaces it asked for,
+     * signs a note from the account to the app's key for these spaces, and
+     * remembers the app as connected. The seed signs here and goes nowhere.
+     */
+    grant(choice: GrantChoice): Promise<Omit<Grant, 'home'>>;
+    /**
+     * Starts using a carrier, as the account home: makes its carry space, fills
+     * it with a pass for every space, and remembers it as connected. The
+     * carrier gets no key that reads or writes a space.
+     */
+    grantCarry(choice: {
+        readonly origin: string;
+        readonly request: ConnectRequest;
+    }): Promise<Omit<CarryGrant, 'home'>>;
+    /** Apps this account is connected to from this home, newest first */
+    connections(): ReadonlyArray<Connection>;
+    /**
+     * Other accounts in this place that `origin` is connected to from this home.
+     * One browser extension carries one account, so connecting it here moves it
+     * off theirs — worth saying before it happens.
+     */
+    connectedElsewhere(origin: string): ReadonlyArray<{
+        readonly id: string;
+        readonly name: string;
+    }>;
+    /**
+     * Disconnects an app: revokes its note in every space it could write in —
+     * and, for a whole-account app, in the account registry — so nothing it
+     * writes from now on counts, and forgets it. What this home had
+     * seen it write stays. What it could already read, it keeps — reading is
+     * holding a space's key, and that is not taken back.
+     *
+     * Disconnecting an app disconnects the agents connected through it too.
+     * `{ agent: true }` disconnects only those agents; `{ audience }` only the
+     * one with that key.
+     */
+    disconnect(origin: string, options?: {
+        readonly agent?: boolean;
+        readonly audience?: string;
+    }): Promise<void>;
+    readonly staySignedIn: {
+        choice(): StaySignedIn;
+        setChoice(choice: StaySignedIn): Promise<void>;
+        until(): Date | null;
+    };
+    signOut(): Promise<void>;
+}
+/**
+ * Creates the sign-in flow for this page.
+ * @param config Where to connect once signed in, and what to call the app
+ */
+export declare function createWeaveAuth(config?: WeaveAuthConfig): WeaveAuth;
+//# sourceMappingURL=auth.d.ts.map

package/dist/session/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/session/auth.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEjF,OAAO,EAQL,KAAK,YAAY,EACjB,KAAK,UAAU,EAChB,MAAM,8BAA8B,CAAC;AAItC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAK5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAkC,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EASL,KAAK,KAAK,EACV,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAAqC,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,KAAK,KAAK,EAAqB,MAAM,cAAc,CAAC;AACtI,OAAO,EAKL,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IACrC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACxC,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;QAC/C,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,YAAY,CAAC;KAC5D,CAAC;CACH;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAElG,2DAA2D;AAC3D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;CACnC;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC9C,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oBAAoB;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IAC5C,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mBAAmB;IACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,oIAAoI;IACpI,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;CACvB;AAED,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,2GAA2G;IAC3G,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IACtC,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IACjC,iDAAiD;IACjD,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KAAE,GAAG,IAAI,CAAC;IACzG,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,IAAI,SAAS,CAAC;IACtB,mEAAmE;IACnE,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5D,kFAAkF;IAClF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAGvB,yGAAyG;IACzG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,4EAA4E;IAC5E,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,uDAAuD;IACvD,aAAa,IAAI,IAAI,CAAC;IAGtB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,aAAa,IAAI,IAAI,CAAC;IACtB,UAAU,IAAI,IAAI,CAAC;IACnB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,mDAAmD;IACnD,SAAS,IAAI,IAAI,CAAC;IAClB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,cAAc,IAAI,IAAI,CAAC;IACvB,UAAU,IAAI,IAAI,CAAC;IAGnB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,SAAS,IAAI,IAAI,CAAC;IAClB,iEAAiE;IACjE,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,YAAY,IAAI,IAAI,CAAC;IACrB,0FAA0F;IAC1F,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,8CAA8C;IAC9C,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5E;;;;OAIG;IACH,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD;;;;OAIG;IACH,UAAU,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACrH,qEAAqE;IACrE,WAAW,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC;IACzC;;;;OAIG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClG;;;;;;;;;;OAUG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9G,QAAQ,CAAC,YAAY,EAAE;QACrB,MAAM,IAAI,YAAY,CAAC;QACvB,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC;KACtB,CAAC;IACF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAeD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,GAAE,eAAoB,GAAG,SAAS,CAkyBvE"}