vana-cli 0.26.0 → 0.28.0

package/dist/personal-server/local/frpc.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The tunnel client the Personal Server runs to get its public URL. Same
+ * version the pinned server would download for itself.
+ */
+export declare const FRPC_VERSION = "0.67.0";
+/** The Apple team that signs the CLI and Vana Desktop. */
+export declare const VANA_APPLE_TEAM_ID = "G7QNBSSW44";
+interface FrpcArtifact {
+    url: string;
+    sha256: string;
+    /** The binary's path inside the archive. */
+    entry: string;
+}
+/**
+ * Pinned downloads per platform. A Mac never gets upstream's build: it is
+ * ad-hoc signed, and endpoint security on managed Macs treats an ad-hoc
+ * binary run from the home directory as persistence. Macs download the copy
+ * the sign-frpc workflow signed and notarized with Vana's Developer ID.
+ */
+export declare const FRPC_ARTIFACTS: Record<string, FrpcArtifact>;
+/** Where Vana Desktop ships its signed frpc. */
+export declare const DESKTOP_FRPC_PATHS: string[];
+export type FrpcResolution = {
+    kind: "ready";
+    path: string;
+    source: "env" | "managed" | "desktop";
+} | {
+    kind: "installable";
+} | {
+    kind: "unavailable";
+    reason: string;
+};
+export interface FrpcDeps {
+    env: NodeJS.ProcessEnv;
+    platform: NodeJS.Platform;
+    arch: string;
+    managedDir: string;
+    desktopPaths: string[];
+    /** True when `file` carries a valid signature from `teamId`. */
+    signedByTeam: (file: string, teamId: string) => Promise<boolean>;
+}
+export declare function managedFrpcDir(): string;
+export declare function signedByTeam(file: string, teamId: string): Promise<boolean>;
+/**
+ * Find a tunnel client this machine may run, without downloading anything.
+ * `VANA_FRPC_PATH` wins; then the CLI's own verified install; then, on a
+ * Mac, Vana Desktop's copy when it carries Vana's signature, which saves a
+ * download.
+ */
+export declare function resolveFrpc(overrides?: Partial<FrpcDeps>): Promise<FrpcResolution>;
+/**
+ * Download the pinned frpc for this platform, check its sha256, and install
+ * it under ~/.vana/cli/personal-server/frpc/<version>.
+ */
+export declare function installFrpc(logPath: string, overrides?: Partial<FrpcDeps> & {
+    fetchImpl?: typeof fetch;
+}): Promise<string>;
+export {};
+//# sourceMappingURL=frpc.d.ts.map

package/dist/personal-server/local/frpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frpc.d.ts","sourceRoot":"","sources":["../../../src/personal-server/local/frpc.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,eAAO,MAAM,YAAY,WAAW,CAAC;AAErC,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAE/C,UAAU,YAAY;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;CACf;AAoBD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAwBvD,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,UAM9B,CAAC;AAEF,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gEAAgE;IAChE,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAMD,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CASlB;AAqBD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,SAAS,GAAE,OAAO,CAAC,QAAQ,CAAM,GAChC,OAAO,CAAC,cAAc,CAAC,CA2CzB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CAAO,GAC/D,OAAO,CAAC,MAAM,CAAC,CAyDjB"}

package/dist/personal-server/local/frpc.js

@@ -0,0 +1,191 @@
+import crypto from "node:crypto";
+import { execFile } from "node:child_process";
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import * as tar from "tar";
+import { localServerHome } from "./config.js";
+const execFileAsync = promisify(execFile);
+/**
+ * The tunnel client the Personal Server runs to get its public URL. Same
+ * version the pinned server would download for itself.
+ */
+export const FRPC_VERSION = "0.67.0";
+/** The Apple team that signs the CLI and Vana Desktop. */
+export const VANA_APPLE_TEAM_ID = "G7QNBSSW44";
+function upstream(name, ext, sha256) {
+    const base = `frp_${FRPC_VERSION}_${name}`;
+    return {
+        url: `https://github.com/fatedier/frp/releases/download/v${FRPC_VERSION}/${base}.${ext}`,
+        sha256,
+        entry: `${base}/${name.startsWith("windows") ? "frpc.exe" : "frpc"}`,
+    };
+}
+function signed(name, sha256) {
+    const base = `frp_${FRPC_VERSION}_${name}`;
+    return {
+        url: `https://github.com/vana-com/vana-cli/releases/download/frpc-v${FRPC_VERSION}/${base}.tar.gz`,
+        sha256,
+        entry: `${base}/frpc`,
+    };
+}
+/**
+ * Pinned downloads per platform. A Mac never gets upstream's build: it is
+ * ad-hoc signed, and endpoint security on managed Macs treats an ad-hoc
+ * binary run from the home directory as persistence. Macs download the copy
+ * the sign-frpc workflow signed and notarized with Vana's Developer ID.
+ */
+export const FRPC_ARTIFACTS = {
+    "darwin-arm64": signed("darwin_arm64", "e0a45a02b8be7d2e0e3221b1e1deb242b490a1e6a685beeff04bcd96cb42a9f1"),
+    "darwin-x64": signed("darwin_amd64", "106f023c440b395cf7d21283536a87156c69f26ebf40fd0084f11fc01de8f6a4"),
+    "linux-x64": upstream("linux_amd64", "tar.gz", "f8629ca7ca56b8e7e7a9903779b8d5c47c56ad1b75b99b2d7138477acc4c7105"),
+    "linux-arm64": upstream("linux_arm64", "tar.gz", "0e9683226acdcbbb2ac8d073f35ba8be2a8b1e7584684d2073f39d337ebd6de7"),
+    "win32-x64": upstream("windows_amd64", "zip", "8baf23e3fbd486f6ba0913501372c5ff0053efa88a8b8d391f3605ced43d2af5"),
+};
+/** Where Vana Desktop ships its signed frpc. */
+export const DESKTOP_FRPC_PATHS = [
+    "/Applications/Vana.app/Contents/Resources/personal-server/dist/frpc",
+    path.join(os.homedir(), "Applications/Vana.app/Contents/Resources/personal-server/dist/frpc"),
+];
+function binaryName(platform) {
+    return platform === "win32" ? "frpc.exe" : "frpc";
+}
+export function managedFrpcDir() {
+    return path.join(localServerHome(), "frpc", FRPC_VERSION);
+}
+export async function signedByTeam(file, teamId) {
+    try {
+        await execFileAsync("codesign", ["--verify", "--strict", file]);
+        // `codesign -dv` reports on stderr.
+        const { stderr } = await execFileAsync("codesign", ["-dv", file]);
+        return new RegExp(`^TeamIdentifier=${teamId}$`, "m").test(stderr);
+    }
+    catch {
+        return false;
+    }
+}
+function defaultDeps() {
+    return {
+        env: process.env,
+        platform: process.platform,
+        arch: process.arch,
+        managedDir: managedFrpcDir(),
+        desktopPaths: DESKTOP_FRPC_PATHS,
+        signedByTeam,
+    };
+}
+function isFile(file) {
+    try {
+        return fs.statSync(file).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Find a tunnel client this machine may run, without downloading anything.
+ * `VANA_FRPC_PATH` wins; then the CLI's own verified install; then, on a
+ * Mac, Vana Desktop's copy when it carries Vana's signature, which saves a
+ * download.
+ */
+export async function resolveFrpc(overrides = {}) {
+    const deps = { ...defaultDeps(), ...overrides };
+    const fromEnv = deps.env.VANA_FRPC_PATH;
+    if (fromEnv) {
+        return isFile(fromEnv)
+            ? { kind: "ready", path: fromEnv, source: "env" }
+            : {
+                kind: "unavailable",
+                reason: `VANA_FRPC_PATH (${fromEnv}) is not a file.`,
+            };
+    }
+    const artifact = FRPC_ARTIFACTS[`${deps.platform}-${deps.arch}`];
+    const managed = path.join(deps.managedDir, binaryName(deps.platform));
+    if (artifact && isFile(managed)) {
+        try {
+            const marker = fs
+                .readFileSync(path.join(deps.managedDir, ".installed"), "utf8")
+                .trim();
+            if (marker === artifact.sha256) {
+                return { kind: "ready", path: managed, source: "managed" };
+            }
+        }
+        catch {
+            // No marker: reinstall.
+        }
+    }
+    if (deps.platform === "darwin") {
+        for (const candidate of deps.desktopPaths) {
+            if (isFile(candidate) &&
+                (await deps.signedByTeam(candidate, VANA_APPLE_TEAM_ID))) {
+                return { kind: "ready", path: candidate, source: "desktop" };
+            }
+        }
+    }
+    if (artifact)
+        return { kind: "installable" };
+    return {
+        kind: "unavailable",
+        reason: `No tunnel client is pinned for ${deps.platform}-${deps.arch}. Set VANA_FRPC_PATH.`,
+    };
+}
+/**
+ * Download the pinned frpc for this platform, check its sha256, and install
+ * it under ~/.vana/cli/personal-server/frpc/<version>.
+ */
+export async function installFrpc(logPath, overrides = {}) {
+    const deps = { ...defaultDeps(), ...overrides };
+    const key = `${deps.platform}-${deps.arch}`;
+    const artifact = FRPC_ARTIFACTS[key];
+    if (!artifact) {
+        throw new Error(`No tunnel client is pinned for ${key}.`);
+    }
+    await fsp.appendFile(logPath, `Downloading ${artifact.url}\n`, "utf8");
+    const response = await (overrides.fetchImpl ?? fetch)(artifact.url, {
+        headers: { "User-Agent": "vana-cli" },
+    });
+    if (!response.ok) {
+        throw new Error(`Could not download the tunnel client: ${response.status}`);
+    }
+    const archive = Buffer.from(await response.arrayBuffer());
+    const actual = crypto.createHash("sha256").update(archive).digest("hex");
+    if (actual !== artifact.sha256) {
+        throw new Error(`The tunnel client download failed its checksum (expected ${artifact.sha256}, got ${actual}).`);
+    }
+    const parent = path.dirname(deps.managedDir);
+    await fsp.mkdir(parent, { recursive: true });
+    const staging = await fsp.mkdtemp(path.join(parent, ".staging-"));
+    try {
+        const archivePath = path.join(staging, path.basename(artifact.url));
+        await fsp.writeFile(archivePath, archive);
+        if (artifact.url.endsWith(".zip")) {
+            // Windows 10+ ships a bsdtar that reads zip.
+            await execFileAsync("tar", ["-xf", archivePath, "-C", staging]);
+        }
+        else {
+            await tar.x({ file: archivePath, cwd: staging });
+        }
+        const installed = path.join(staging, "out");
+        await fsp.mkdir(installed);
+        const target = path.join(installed, binaryName(deps.platform));
+        await fsp.rename(path.join(staging, artifact.entry), target);
+        if (deps.platform !== "win32")
+            await fsp.chmod(target, 0o755);
+        // The hash already pins it; the signature check is what endpoint
+        // security will judge, so refuse anything it would flag.
+        if (deps.platform === "darwin" &&
+            !(await deps.signedByTeam(target, VANA_APPLE_TEAM_ID))) {
+            throw new Error("The tunnel client is not signed by Vana.");
+        }
+        await fsp.writeFile(path.join(installed, ".installed"), `${artifact.sha256}\n`);
+        await fsp.rm(deps.managedDir, { recursive: true, force: true });
+        await fsp.rename(installed, deps.managedDir);
+        return path.join(deps.managedDir, binaryName(deps.platform));
+    }
+    finally {
+        await fsp.rm(staging, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=frpc.js.map

package/dist/personal-server/local/frpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frpc.js","sourceRoot":"","sources":["../../../src/personal-server/local/frpc.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACnC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAE3B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAErC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAS/C,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAW,EAAE,MAAc;IACzD,MAAM,IAAI,GAAG,OAAO,YAAY,IAAI,IAAI,EAAE,CAAC;IAC3C,OAAO;QACL,GAAG,EAAE,sDAAsD,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE;QACxF,MAAM;QACN,KAAK,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,MAAc;IAC1C,MAAM,IAAI,GAAG,OAAO,YAAY,IAAI,IAAI,EAAE,CAAC;IAC3C,OAAO;QACL,GAAG,EAAE,gEAAgE,YAAY,IAAI,IAAI,SAAS;QAClG,MAAM;QACN,KAAK,EAAE,GAAG,IAAI,OAAO;KACtB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAiC;IAC1D,cAAc,EAAE,MAAM,CACpB,cAAc,EACd,kEAAkE,CACnE;IACD,YAAY,EAAE,MAAM,CAClB,cAAc,EACd,kEAAkE,CACnE;IACD,WAAW,EAAE,QAAQ,CACnB,aAAa,EACb,QAAQ,EACR,kEAAkE,CACnE;IACD,aAAa,EAAE,QAAQ,CACrB,aAAa,EACb,QAAQ,EACR,kEAAkE,CACnE;IACD,WAAW,EAAE,QAAQ,CACnB,eAAe,EACf,KAAK,EACL,kEAAkE,CACnE;CACF,CAAC;AAEF,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,qEAAqE;IACrE,IAAI,CAAC,IAAI,CACP,EAAE,CAAC,OAAO,EAAE,EACZ,oEAAoE,CACrE;CACF,CAAC;AAiBF,SAAS,UAAU,CAAC,QAAyB;IAC3C,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QAChE,oCAAoC;QACpC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAClE,OAAO,IAAI,MAAM,CAAC,mBAAmB,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,cAAc,EAAE;QAC5B,YAAY,EAAE,kBAAkB;QAChC,YAAY;KACb,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,YAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,EAAE,GAAG,WAAW,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,OAAO,CAAC;YACpB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;YACjD,CAAC,CAAC;gBACE,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,mBAAmB,OAAO,kBAAkB;aACrD,CAAC;IACR,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,IAAI,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE;iBACd,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC;iBAC9D,IAAI,EAAE,CAAC;YACV,IAAI,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1C,IACE,MAAM,CAAC,SAAS,CAAC;gBACjB,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,EACxD,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC/D,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7C,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,kCAAkC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,uBAAuB;KAC5F,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,YAA8D,EAAE;IAEhE,MAAM,IAAI,GAAG,EAAE,GAAG,WAAW,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,eAAe,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE;QAClE,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,4DAA4D,QAAQ,CAAC,MAAM,SAAS,MAAM,IAAI,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,6CAA6C;YAC7C,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC9D,iEAAiE;QACjE,yDAAyD;QACzD,IACE,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAC1B,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,EACtD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,GAAG,CAAC,SAAS,CACjB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAClC,GAAG,QAAQ,CAAC,MAAM,IAAI,CACvB,CAAC;QACF,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}

package/dist/personal-server/local/owner-binding.d.ts

@@ -21,13 +21,33 @@ export interface OwnerBindingDeps {
     onConfirmationUrl?: (url: string) => void;
     timeoutMs?: number;
 }
+/** What Account returns when an exchange is redeemed. */
+export interface RedeemedExchange {
+    status?: string;
+    signature?: string;
+    signerAddress?: string;
+    desktopSigningTrustToken?: string;
+    typedData?: unknown;
+}
+/**
+ * Run one Account signing exchange: the person confirms in the browser, and
+ * the result comes back to a one-time loopback listener, bound to this
+ * process by state and PKCE. `step` names the request in error messages.
+ */
+export declare function runSigningExchange(input: {
+    accountUrl: string;
+    accessToken: string;
+    intent: string;
+    payload?: Record<string, unknown>;
+    step: string;
+}, deps: OwnerBindingDeps): Promise<RedeemedExchange>;
 /**
  * Get the owner-binding signature through Account's signing exchange: Account
- * never signs silently for the CLI, so the person confirms in the browser,
- * and the result comes back to a one-time loopback listener.
+ * never signs it silently for the CLI, so the person confirms in the browser.
  */
 export declare function runOwnerBindingExchange(input: {
     accountUrl: string;
     accessToken: string;
 }, deps: OwnerBindingDeps): Promise<OwnerBinding>;
+export declare function describeFailure(step: string, response: Response): Promise<string>;
 //# sourceMappingURL=owner-binding.d.ts.map

package/dist/personal-server/local/owner-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-binding.d.ts","sourceRoot":"","sources":["../../../src/personal-server/local/owner-binding.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAC1D,eAAO,MAAM,oBAAoB,qCAAqC,CAAC;AAEvE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAmED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAClD,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,YAAY,CAAC,CA6FvB"}
+{"version":3,"file":"owner-binding.d.ts","sourceRoot":"","sources":["../../../src/personal-server/local/owner-binding.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAC1D,eAAO,MAAM,oBAAoB,qCAAqC,CAAC;AAEvE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAmED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;CACd,EACD,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAqF3B;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAClD,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,YAAY,CAAC,CAUvB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,CAkBjB"}

package/dist/personal-server/local/owner-binding.js

@@ -58,11 +58,11 @@ async function startLoopbackCallback(expectedState) {
     };
 }
 /**
- * Get the owner-binding signature through Account's signing exchange: Account
- * never signs silently for the CLI, so the person confirms in the browser,
- * and the result comes back to a one-time loopback listener.
+ * Run one Account signing exchange: the person confirms in the browser, and
+ * the result comes back to a one-time loopback listener, bound to this
+ * process by state and PKCE. `step` names the request in error messages.
  */
-export async function runOwnerBindingExchange(input, deps) {
+export async function runSigningExchange(input, deps) {
     const fetchImpl = deps.fetchImpl ?? fetch;
     const account = input.accountUrl.replace(/\/+$/, "");
     const state = base64url(crypto.randomBytes(32));
@@ -77,7 +77,8 @@ export async function runOwnerBindingExchange(input, deps) {
                 authorization: `Bearer ${input.accessToken}`,
             },
             body: JSON.stringify({
-                intent: OWNER_BINDING_INTENT,
+                intent: input.intent,
+                ...(input.payload ? { payload: input.payload } : {}),
                 redirectUri: callback.redirectUri,
                 state,
                 codeChallenge,
@@ -85,7 +86,7 @@ export async function runOwnerBindingExchange(input, deps) {
             }),
         });
         if (!created.ok) {
-            throw new Error(await describeFailure("start the owner confirmation", created));
+            throw new Error(await describeFailure(`start the ${input.step}`, created));
         }
         const { confirmationUrl } = (await created.json());
         if (!confirmationUrl) {
@@ -118,23 +119,31 @@ export async function runOwnerBindingExchange(input, deps) {
             }),
         });
         if (!redeemed.ok) {
-            throw new Error(await describeFailure("finish the owner confirmation", redeemed));
+            throw new Error(await describeFailure(`finish the ${input.step}`, redeemed));
         }
         const body = (await redeemed.json());
         if (body.status !== "signed" || !body.signature || !body.signerAddress) {
-            throw new Error("Account answered the owner confirmation without a signature.");
+            throw new Error(`Account answered the ${input.step} without a signature.`);
         }
-        return {
-            signature: body.signature,
-            signerAddress: body.signerAddress,
-            trustToken: body.desktopSigningTrustToken ?? null,
-        };
+        return body;
     }
     finally {
         callback.close();
     }
 }
-async function describeFailure(step, response) {
+/**
+ * Get the owner-binding signature through Account's signing exchange: Account
+ * never signs it silently for the CLI, so the person confirms in the browser.
+ */
+export async function runOwnerBindingExchange(input, deps) {
+    const body = await runSigningExchange({ ...input, intent: OWNER_BINDING_INTENT, step: "owner confirmation" }, deps);
+    return {
+        signature: body.signature,
+        signerAddress: body.signerAddress,
+        trustToken: body.desktopSigningTrustToken ?? null,
+    };
+}
+export async function describeFailure(step, response) {
     let code = "";
     try {
         const body = (await response.json());

package/dist/personal-server/local/owner-binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-binding.js","sourceRoot":"","sources":["../../../src/personal-server/local/owner-binding.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,kCAAkC,CAAC;AAoBvE,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,SAAS,GAAG;8HAC4G,CAAC;AAC/H,MAAM,WAAW,GAAG;4HACwG,CAAC;AAE7H;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAAC,aAAqB;IAKxD,IAAI,MAAM,GAGC,IAAI,CAAC;IAChB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YACzC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,gDAAgD;YAChD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvB,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1E,MAAM,EAAE,MAAM,CACZ,IAAI,KAAK,CACP,KAAK,KAAK,eAAe;gBACvB,CAAC,CAAC,0CAA0C;gBAC5C,CAAC,CAAC,oBAAoB,KAAK,IAAI,SAAS,GAAG,CAC9C,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,OAAO;QACL,WAAW,EAAE,oBAAoB,IAAI,mBAAmB;QACxD,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;KAC5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAkD,EAClD,IAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,SAAS,CAC7B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAC1D,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,2BAA2B,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE;aAC7C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,oBAAoB;gBAC5B,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,KAAK;gBACL,aAAa;gBACb,mBAAmB,EAAE,MAAM;aAC5B,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,MAAM,eAAe,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAC/D,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAEhD,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QAElC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACvD,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ,CAAC,IAAI;YACb,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,EACnE,SAAS,CACV,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,GAAG,OAAO,kCAAkC,EAC5C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE;aAC7C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI;gBACJ,KAAK;gBACL,YAAY;gBACZ,WAAW,EAAE,QAAQ,CAAC,WAAW;aAClC,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,MAAM,eAAe,CAAC,+BAA+B,EAAE,QAAQ,CAAC,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,wBAAwB,IAAI,IAAI;SAClD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,QAAkB;IAElB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkC,CAAC;QACtE,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,aAAa,IAAI,8DAA8D,CAAC;IACzF,CAAC;IACD,IACE,IAAI,KAAK,oBAAoB;QAC7B,IAAI,KAAK,+BAA+B,EACxC,CAAC;QACD,OAAO,aAAa,IAAI,uEAAuE,IAAI,IAAI,CAAC;IAC1G,CAAC;IACD,OAAO,aAAa,IAAI,UAAU,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;AAClF,CAAC"}
+{"version":3,"file":"owner-binding.js","sourceRoot":"","sources":["../../../src/personal-server/local/owner-binding.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,kCAAkC,CAAC;AAoBvE,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,SAAS,GAAG;8HAC4G,CAAC;AAC/H,MAAM,WAAW,GAAG;4HACwG,CAAC;AAE7H;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAAC,aAAqB;IAKxD,IAAI,MAAM,GAGC,IAAI,CAAC;IAChB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YACzC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,gDAAgD;YAChD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvB,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1E,MAAM,EAAE,MAAM,CACZ,IAAI,KAAK,CACP,KAAK,KAAK,eAAe;gBACvB,CAAC,CAAC,0CAA0C;gBAC5C,CAAC,CAAC,oBAAoB,KAAK,IAAI,SAAS,GAAG,CAC9C,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,OAAO;QACL,WAAW,EAAE,oBAAoB,IAAI,mBAAmB;QACxD,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;KAC5B,CAAC;AACJ,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAMC,EACD,IAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,SAAS,CAC7B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAC1D,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,2BAA2B,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE;aAC7C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,KAAK;gBACL,aAAa;gBACb,mBAAmB,EAAE,MAAM;aAC5B,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,MAAM,eAAe,CAAC,aAAa,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAEhD,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QAElC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACvD,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ,CAAC,IAAI;YACb,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,EACnE,SAAS,CACV,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,GAAG,OAAO,kCAAkC,EAC5C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE;aAC7C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI;gBACJ,KAAK;gBACL,YAAY;gBACZ,WAAW,EAAE,QAAQ,CAAC,WAAW;aAClC,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,MAAM,eAAe,CAAC,cAAc,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC;QACzD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,wBAAwB,KAAK,CAAC,IAAI,uBAAuB,CAC1D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAkD,EAClD,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,kBAAkB,CACnC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,oBAAoB,EAAE,EACtE,IAAI,CACL,CAAC;IACF,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAmB;QACnC,aAAa,EAAE,IAAI,CAAC,aAAuB;QAC3C,UAAU,EAAE,IAAI,CAAC,wBAAwB,IAAI,IAAI;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,QAAkB;IAElB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkC,CAAC;QACtE,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,aAAa,IAAI,8DAA8D,CAAC;IACzF,CAAC;IACD,IACE,IAAI,KAAK,oBAAoB;QAC7B,IAAI,KAAK,+BAA+B,EACxC,CAAC;QACD,OAAO,aAAa,IAAI,uEAAuE,IAAI,IAAI,CAAC;IAC1G,CAAC;IACD,OAAO,aAAa,IAAI,UAAU,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;AAClF,CAAC"}

package/dist/personal-server/local/registration.d.ts

@@ -0,0 +1,42 @@
+import { type OwnerBindingDeps } from "./owner-binding.js";
+export declare const SERVER_REGISTRATION_INTENT = "personal_server.server_registration.v1";
+/** What the server's prepareRegistration() returns; the CLI only reads the typed data. */
+export interface RegistrationRequest {
+    typedData: {
+        domain?: {
+            chainId?: number | string;
+            verifyingContract?: string;
+        };
+        message?: {
+            serverAddress?: string;
+            publicKey?: string;
+            serverUrl?: string;
+        };
+    };
+}
+/** Account needs the browser: the silent path is closed for this owner or client. */
+export declare class RegistrationNeedsBrowserError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+export interface RegistrationSignature {
+    signature: string;
+    signerAddress: string | null;
+    via: "silent" | "browser";
+}
+/** The fields Account signs, from the server's own registration request. */
+export declare function registrationPayload(request: RegistrationRequest): Record<string, unknown>;
+/**
+ * Have Account sign the server's registration as its owner. Account signs
+ * silently when the owner's wallet lives in Account and the trust token from
+ * the owner confirmation is valid, as it does for Desktop; otherwise the
+ * person confirms in the browser.
+ */
+export declare function signServerRegistration(input: {
+    accountUrl: string;
+    accessToken: string;
+    trustToken: string | null;
+    request: RegistrationRequest;
+    allowBrowser: boolean;
+}, deps: OwnerBindingDeps): Promise<RegistrationSignature>;
+//# sourceMappingURL=registration.d.ts.map

package/dist/personal-server/local/registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.d.ts","sourceRoot":"","sources":["../../../src/personal-server/local/registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,eAAO,MAAM,0BAA0B,2CACG,CAAC;AAG3C,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE;QACT,MAAM,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;YAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACnE,OAAO,CAAC,EAAE;YACR,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;KACH,CAAC;CACH;AAED,qFAAqF;AACrF,qBAAa,6BAA8B,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;CAKlC;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,GAAG,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC3B;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,mBAAmB,GAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBzB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,mBAAmB,CAAC;IAC7B,YAAY,EAAE,OAAO,CAAC;CACvB,EACD,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,qBAAqB,CAAC,CAyDhC"}

package/dist/personal-server/local/registration.js

@@ -0,0 +1,81 @@
+import { describeFailure, runSigningExchange, } from "./owner-binding.js";
+export const SERVER_REGISTRATION_INTENT = "personal_server.server_registration.v1";
+const SIGN_PATH = "/api/v1/intents/personal-server-registration/sign";
+/** Account needs the browser: the silent path is closed for this owner or client. */
+export class RegistrationNeedsBrowserError extends Error {
+    code;
+    constructor(code) {
+        super(`Registering needs you to confirm in a browser (${code}). Run without --no-input.`);
+        this.code = code;
+    }
+}
+/** The fields Account signs, from the server's own registration request. */
+export function registrationPayload(request) {
+    const message = request.typedData?.message;
+    const domain = request.typedData?.domain;
+    if (!(message?.serverAddress && message.publicKey && message.serverUrl)) {
+        throw new Error("The server's registration request is incomplete.");
+    }
+    const chainId = Number(domain?.chainId);
+    return {
+        serverAddress: message.serverAddress,
+        serverPublicKey: message.publicKey,
+        serverUrl: message.serverUrl,
+        ...(Number.isInteger(chainId) ? { chainId } : {}),
+        ...(typeof domain?.verifyingContract === "string"
+            ? { verifyingContract: domain.verifyingContract }
+            : {}),
+    };
+}
+/**
+ * Have Account sign the server's registration as its owner. Account signs
+ * silently when the owner's wallet lives in Account and the trust token from
+ * the owner confirmation is valid, as it does for Desktop; otherwise the
+ * person confirms in the browser.
+ */
+export async function signServerRegistration(input, deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const account = input.accountUrl.replace(/\/+$/, "");
+    const payload = registrationPayload(input.request);
+    const response = await fetchImpl(`${account}${SIGN_PATH}`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${input.accessToken}`,
+            ...(input.trustToken
+                ? { "x-vana-desktop-trust-token": input.trustToken }
+                : {}),
+        },
+        body: JSON.stringify({ intent: SERVER_REGISTRATION_INTENT, ...payload }),
+    });
+    if (!response.ok) {
+        throw new Error(await describeFailure("sign the registration", response));
+    }
+    const body = (await response.json());
+    if (body.status === "signed" && body.signature) {
+        return {
+            signature: body.signature,
+            signerAddress: body.signerAddress ?? null,
+            via: "silent",
+        };
+    }
+    if (body.status !== "confirmation_required") {
+        throw new Error(`Account did not sign the registration (${body.code ?? body.status ?? "unknown"}).`);
+    }
+    if (!input.allowBrowser) {
+        throw new RegistrationNeedsBrowserError(body.code ?? "confirmation_required");
+    }
+    const redeemed = await runSigningExchange({
+        accountUrl: input.accountUrl,
+        accessToken: input.accessToken,
+        intent: SERVER_REGISTRATION_INTENT,
+        payload,
+        step: "registration",
+    }, deps);
+    return {
+        signature: redeemed.signature,
+        signerAddress: redeemed.signerAddress ?? null,
+        via: "browser",
+    };
+}
+//# sourceMappingURL=registration.js.map

package/dist/personal-server/local/registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.js","sourceRoot":"","sources":["../../../src/personal-server/local/registration.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,CAAC,MAAM,0BAA0B,GACrC,wCAAwC,CAAC;AAC3C,MAAM,SAAS,GAAG,mDAAmD,CAAC;AActE,qFAAqF;AACrF,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACjC;IAArB,YAAqB,IAAY;QAC/B,KAAK,CACH,kDAAkD,IAAI,4BAA4B,CACnF,CAAC;QAHiB,SAAI,GAAJ,IAAI,CAAQ;IAIjC,CAAC;CACF;AAQD,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CACjC,OAA4B;IAE5B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,EAAE,aAAa,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO;QACL,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,eAAe,EAAE,OAAO,CAAC,SAAS;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,MAAM,EAAE,iBAAiB,KAAK,QAAQ;YAC/C,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAMC,EACD,IAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,GAAG,SAAS,EAAE,EAAE;QACzD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE;YAC5C,GAAG,CAAC,KAAK,CAAC,UAAU;gBAClB,CAAC,CAAC,EAAE,4BAA4B,EAAE,KAAK,CAAC,UAAU,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,GAAG,OAAO,EAAE,CAAC;KACzE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,MAAM,eAAe,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/C,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;YACzC,GAAG,EAAE,QAAQ;SACd,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS,IAAI,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,6BAA6B,CACrC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CACrC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC;QACE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,0BAA0B;QAClC,OAAO;QACP,IAAI,EAAE,cAAc;KACrB,EACD,IAAI,CACL,CAAC;IACF,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAmB;QACvC,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,IAAI;QAC7C,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC"}