@abloatai/transaction 0.57.0 → 0.58.0

package/dist/auth/runtime.d.ts

@@ -0,0 +1,218 @@
+/**
+ * Authentication runtime: exchanges, session minting, identity resolution,
+ * and refresh scheduling.
+ *
+ * The `Ablo({...})` factory calls this during startup when you provide an
+ * `apiKey` but no explicit capability token, organization, or user identity. It
+ * sends one `POST /v1/capabilities` request; the server responds with the
+ * granted scope and any user metadata, which the client uses to populate its
+ * session state. The API key is the only credential you handle directly — this
+ * exchange happens automatically behind it.
+ */
+import { type EphemeralKeyResponse, type IdentityResolveResponse } from './schemas.js';
+import type { ParticipantKind } from '../types/participant.js';
+import type { CapabilityMintResponse, GrantedOperation } from './capability.js';
+export { ABLO_DEFAULT_BASE_URL, ABLO_DOCS_BASE_URL, ABLO_HOSTED_API_DOMAIN, ABLO_HOSTED_HTTP_BASE_URL, ABLO_SITE_BASE_URL, } from './hostedEndpoints.js';
+export { normalizeAbloBaseUrl } from './baseUrl.js';
+export type { EphemeralKeyResponse, IdentityResolveResponse, SessionCredentialMetadata, SessionCredentialRevocationRequest, } from './schemas.js';
+export { buildSessionIssuanceMacMessage, canonicalizeSessionIssuanceBody, opaqueSessionFingerprintSchema, sha256HexSchema, SESSION_ISSUANCE_HEADERS, SESSION_ISSUANCE_MAC_VERSION, SESSION_ISSUANCE_PATHS, SESSION_ISSUANCE_SLOT_VERSION, sessionIssuanceMacHeadersSchema, sessionIssuanceMacMessageSchema, type SessionIssuanceMacHeaders, type SessionIssuanceMacMessage, } from './sessionIssuanceProtocol.js';
+export { SessionCredentialMetadataSchema, SessionCredentialRevocationRequestSchema, } from './schemas.js';
+export { parseCapabilityMintResponse } from './schemas.js';
+export { credentialEndpointErrorSchema, credentialEndpointKindSchema, credentialEndpointSuccessSchema, credentialEndpointErrorCode, parseCredentialEndpointSuccess, } from './credentialEndpointProtocol.js';
+export type { CredentialEndpointError, CredentialEndpointSuccess, } from './credentialEndpointProtocol.js';
+export type { CredentialProvider, CredentialProviderResult, } from './credentialResult.js';
+export { capabilityRotationRequestSchema, capabilityRotationResponseSchema, sessionRevocationResponseSchema, revokeCapability, rotateCapability, } from './capabilityLifecycle.js';
+export type { RevokeCapabilityRequest, RotateCapabilityRequest, } from './capabilityLifecycle.js';
+export { capabilityOperationSchema, capabilityCanSchema, capabilityCanSchemaFor, effectiveAuthoritySchema, capabilityScopeSchema, capabilityRequestSchema, capabilityMintResponseSchema, grantedOperationSchema, grantedOperations, expandReadYourWrites, modelWireNames, capabilityModelAliases, unresolvableOperations, } from './capability.js';
+export type { CapabilityOperation, CapabilityCan, CapabilityGrant, EffectiveAuthority, CapabilityScope, CapabilityMintResponse, CapabilityRequest, CapabilityModelShape, GrantedOperation, } from './capability.js';
+import type { CapabilityOperation } from './capability.js';
+import { type EphemeralKeyRequest } from '../wire/auth.js';
+export interface ExchangeApiKeyRequest {
+    readonly apiKey: string;
+    readonly baseUrl: string;
+    readonly participantKind: ParticipantKind;
+    readonly participantId?: string;
+    readonly onBehalfOf?: {
+        readonly user: {
+            readonly id: string;
+        };
+    };
+    readonly organizationId?: string;
+    readonly syncGroups?: readonly string[];
+    /** The grant's verb axis, already in wire form. Build it with
+     *  `grantedOperations(can)` rather than assembling `model.verb` by hand. */
+    readonly operations?: readonly GrantedOperation[];
+    /**
+     * Grants a wider scope than the narrow-by-default behavior. This is an internal
+     * escalation used only by the startup exchange; it is stripped from the
+     * published type declarations and is not meant to be set by application code.
+     * @internal
+     */
+    readonly wideScope?: boolean;
+    readonly ttlSeconds: number;
+    readonly label?: string;
+    readonly userMeta?: Record<string, unknown>;
+    readonly fetch?: typeof fetch;
+    readonly timeoutMs?: number;
+}
+export declare function exchangeApiKey(options: ExchangeApiKeyRequest): Promise<CapabilityMintResponse>;
+interface MintUserSessionBase {
+    /** Your secret API key (an `sk_` key). Minting a session is a server-side
+     *  operation, so it always presents the secret key, never a token derived
+     *  from it. */
+    readonly apiKey: string;
+    readonly baseUrl: string;
+    /** The end user's identifier in your identity provider. It becomes the
+     *  session's `participantId`. */
+    readonly userId: string;
+    /** The organization to mint the session into, for a platform that manages many
+     *  organizations. Requires the secret key to carry the `organization:act-as`
+     *  capability. Omit to mint into the key's own organization. */
+    readonly organizationId?: string;
+    /** Points this session's schema at a shared project while its data stays scoped
+     *  to `organizationId`. Use this when each customer has its own organization but
+     *  they all share one schema: keep a single schema project, and every customer's
+     *  session resolves its schema from it instead of pushing the schema into each
+     *  organization separately. Requires the secret key to carry the
+     *  `organization:act-as` capability. Cross-organization mints default to
+     *  the secret key's own project; pass this only to override that binding.
+     *  Same-organization mints continue to resolve the session's own project. */
+    readonly schemaProject?: {
+        /** The organization that owns the shared schema project. */
+        readonly organizationId: string;
+        /** The project the schema was pushed under. */
+        readonly projectId: string;
+    };
+    readonly syncGroups?: readonly string[];
+    readonly ttlSeconds: number;
+    readonly label?: string;
+    readonly fetch?: typeof fetch;
+    readonly timeoutMs?: number;
+}
+/**
+ * Exactly one grant form. Name the models when you know the schema the session
+ * will resolve; send verbs alone when you cannot — an identity service minting
+ * for organizations whose schemas it does not own has no way to name their
+ * models, and a grant is checked against the session's schema at mint time. The
+ * server expands the verbs across that schema and stores the same enumerated
+ * `model.verb` allowlist either way. The third form grants no data operations
+ * at all, for a session that only proves identity to control-plane surfaces —
+ * it involves no schema, so it mints even for an organization that has not
+ * pushed one yet.
+ */
+export type MintUserSessionRequest = MintUserSessionBase & {
+    /** The allowlist, named model by model. Provide exactly one grant form. */
+    readonly operations?: readonly GrantedOperation[];
+    /**
+     * The allowlist as verbs alone, expanded by the server across the models in
+     * the session's active schema. Provide exactly one grant form.
+     */
+    readonly activeSchemaOperations?: readonly CapabilityOperation[];
+    /**
+     * No data operations: the session proves who the user is to control-plane
+     * surfaces (the dashboard, credential provisioning) and can touch no
+     * application data. Provide exactly one grant form.
+     */
+    readonly controlPlaneOnly?: true;
+};
+/** Canonical wire projection shared by the SDK and first-party issuer. */
+export declare function buildMintUserSessionRequest(options: MintUserSessionRequest): EphemeralKeyRequest;
+/**
+ * Mints an end-user session key (an `ek_` key) by calling
+ * `POST /v1/ephemeral_keys`, using your secret key as authorization. Your
+ * backend calls this to issue a session that a browser can present as its bearer
+ * credential; the server trusts the resulting key because a secret key minted it.
+ *
+ * This is a distinct endpoint from `/v1/capabilities`, which exchanges keys for
+ * agents and systems and cannot mint sessions for human users.
+ */
+export declare function mintUserSessionKey(options: MintUserSessionRequest): Promise<EphemeralKeyResponse>;
+export interface ResolveIdentityRequest {
+    readonly baseUrl: string;
+    readonly authToken?: string;
+    readonly fetch?: typeof fetch;
+    readonly timeoutMs?: number;
+}
+/**
+ * Resolves the caller's identity from an authenticated request by calling
+ * `GET /auth/identity`. This lets browser and session flows learn who the
+ * current user is without requiring the application to pass a user id up front —
+ * for example, to key local storage.
+ */
+export declare function resolveIdentity(options: ResolveIdentityRequest): Promise<IdentityResolveResponse>;
+/**
+ * Keeps a capability token fresh so a long-lived client never disconnects when
+ * its token expires.
+ *
+ * A capability token has a shorter lifetime — one hour by default — than a
+ * typical browser session. Without a refresh, the WebSocket is force-closed at
+ * expiry (close code 1008) or the next reconnect fails with a 401, and either way
+ * the user sees a mid-session disconnect. The scheduler prevents that by
+ * re-minting the token ahead of time.
+ *
+ * Three triggers share one refresh path:
+ *
+ *   1. Proactive  — a timer set for `expiresAtMs - bufferMs - now`.
+ *   2. Visibility — when a hidden tab becomes visible and the token is already
+ *                   within the buffer window, refresh immediately. This covers a
+ *                   background tab whose timers were throttled while it was idle.
+ *   3. Reactive   — the caller invokes {@link RefreshScheduler.refreshNow} after
+ *                   observing an auth failure, such as a WebSocket close 1008 or
+ *                   4001.
+ *
+ * All three await the same in-flight promise, so concurrent triggers mint the
+ * token only once. Each successful refresh records the new expiry and reschedules
+ * the proactive timer.
+ *
+ * The refresh margin is `max(60s, ttl/10)` — six minutes for a one-hour token,
+ * and it scales down for shorter lifetimes.
+ */
+export interface RefreshSchedulerOptions {
+    /** Initial absolute expiry, ms since epoch (server-supplied). */
+    readonly initialExpiresAtMs: number;
+    /**
+     * Performs the token exchange and returns the new expiry. Errors propagate to
+     * `onError`; the scheduler stays alive and retries on its next trigger. It does
+     * not back off between retries, since the common failure here is a revoked API
+     * key, for which retrying would not help.
+     */
+    readonly refresh: () => Promise<{
+        expiresAtMs: number;
+    }>;
+    /** Called on every successful refresh. */
+    readonly onRefreshed?: (info: {
+        expiresAtMs: number;
+    }) => void;
+    /** Called on every refresh failure. */
+    readonly onError?: (error: Error) => void;
+    /**
+     * Override the buffer (ms ahead of expiry to refresh). Defaults to
+     * `max(60_000, ttlMs * 0.1)`. Tests use a tiny value to exercise
+     * scheduling without burning real time.
+     */
+    readonly bufferMs?: number;
+    /**
+     * If true, install a `visibilitychange` listener on `document` that
+     * triggers a refresh when the tab becomes visible and the token is
+     * within the buffer window. No-op if `document` is undefined (Node).
+     * Default: true in browser environments.
+     */
+    readonly attachVisibilityListener?: boolean;
+    /** Time source. Override in tests; defaults to `Date.now`. */
+    readonly now?: () => number;
+    /** Timer pair. Override in tests. */
+    readonly setTimer?: (fn: () => void, ms: number) => ReturnType<typeof setTimeout>;
+    readonly clearTimer?: (handle: ReturnType<typeof setTimeout>) => void;
+}
+export interface RefreshScheduler {
+    /** Force a refresh now. Idempotent — concurrent calls share one promise. */
+    refreshNow(): Promise<{
+        expiresAtMs: number;
+    }>;
+    /** Stop scheduling. Safe to call multiple times. */
+    dispose(): void;
+    /** Current absolute expiry. Updated after each successful refresh. */
+    readonly expiresAtMs: number;
+}
+export declare function createRefreshScheduler(options: RefreshSchedulerOptions): RefreshScheduler;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/auth/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/auth/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAM7B,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,EAC/B,8BAA8B,EAC9B,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,+BAA+B,EAC/B,+BAA+B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,+BAA+B,EAC/B,wCAAwC,GACzC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,EAChC,+BAA+B,EAC/B,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;gFAC4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CA2EjC;AAID,UAAU,mBAAmB;IAC3B;;mBAEe;IACf,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;qCACiC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;oEAEgE;IAChE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;iFAO6E;IAC7E,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,4DAA4D;QAC5D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,+CAA+C;QAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB,GAAG,mBAAmB,GAAG;IACzD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjE;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC;CAClC,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,sBAAsB,GAC9B,mBAAmB,CAmBrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CA2E/B;AAID,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,uBAAuB,CAAC,CAuDlC;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,uBAAuB;IACtC,iEAAiE;IACjE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAEpC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEzD,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAE/D,uCAAuC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAE1C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAE5C,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAE5B,qCAAqC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,CAAC;CACvE;AAED,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,UAAU,IAAI,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE/C,oDAAoD;IACpD,OAAO,IAAI,IAAI,CAAC;IAEhB,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAKD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,gBAAgB,CAwGlB"}

package/dist/auth/runtime.js

@@ -0,0 +1,336 @@
+/**
+ * Authentication runtime: exchanges, session minting, identity resolution,
+ * and refresh scheduling.
+ *
+ * The `Ablo({...})` factory calls this during startup when you provide an
+ * `apiKey` but no explicit capability token, organization, or user identity. It
+ * sends one `POST /v1/capabilities` request; the server responds with the
+ * granted scope and any user metadata, which the client uses to populate its
+ * session state. The API key is the only credential you handle directly — this
+ * exchange happens automatically behind it.
+ */
+import { parseCapabilityMintResponse, parseEphemeralKeyResponse, parseIdentityResolveResponse, } from './schemas.js';
+import { AbloAuthenticationError, hasWireCode, translateHttpError } from '../errors.js';
+export { ABLO_DEFAULT_BASE_URL, ABLO_DOCS_BASE_URL, ABLO_HOSTED_API_DOMAIN, ABLO_HOSTED_HTTP_BASE_URL, ABLO_SITE_BASE_URL, } from './hostedEndpoints.js';
+export { normalizeAbloBaseUrl } from './baseUrl.js';
+export { buildSessionIssuanceMacMessage, canonicalizeSessionIssuanceBody, opaqueSessionFingerprintSchema, sha256HexSchema, SESSION_ISSUANCE_HEADERS, SESSION_ISSUANCE_MAC_VERSION, SESSION_ISSUANCE_PATHS, SESSION_ISSUANCE_SLOT_VERSION, sessionIssuanceMacHeadersSchema, sessionIssuanceMacMessageSchema, } from './sessionIssuanceProtocol.js';
+export { SessionCredentialMetadataSchema, SessionCredentialRevocationRequestSchema, } from './schemas.js';
+export { parseCapabilityMintResponse } from './schemas.js';
+export { credentialEndpointErrorSchema, credentialEndpointKindSchema, credentialEndpointSuccessSchema, credentialEndpointErrorCode, parseCredentialEndpointSuccess, } from './credentialEndpointProtocol.js';
+export { capabilityRotationRequestSchema, capabilityRotationResponseSchema, sessionRevocationResponseSchema, revokeCapability, rotateCapability, } from './capabilityLifecycle.js';
+// The capability vocabulary — what a grant is, on both axes, in one place.
+// Served from this barrel so every minter reaches it through one import.
+export { capabilityOperationSchema, capabilityCanSchema, capabilityCanSchemaFor, effectiveAuthoritySchema, capabilityScopeSchema, capabilityRequestSchema, capabilityMintResponseSchema, grantedOperationSchema, grantedOperations, expandReadYourWrites, modelWireNames, capabilityModelAliases, unresolvableOperations, } from './capability.js';
+import { ephemeralKeyRequestSchema, } from '../wire/auth.js';
+export async function exchangeApiKey(options) {
+    if (!options.apiKey) {
+        throw new AbloAuthenticationError('No API key found. Set ABLO_API_KEY in your environment — `npx ablo login` ' +
+            'then `npx ablo dev` writes it into .env.local for you — or pass ' +
+            '`apiKey` to Ablo({ ... }) directly.', { code: 'apikey_missing' });
+    }
+    if (!options.baseUrl) {
+        throw new AbloAuthenticationError('baseUrl is required for capability exchange', { code: 'base_url_missing' });
+    }
+    const fetcher = options.fetch ?? fetch;
+    const url = `${options.baseUrl.replace(/\/+$/, '')}/v1/capabilities`;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    const controller = new AbortController();
+    const timer = setTimeout(() => { controller.abort(); }, timeoutMs);
+    let response;
+    try {
+        response = await fetcher(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${options.apiKey}`,
+            },
+            body: JSON.stringify({
+                participantKind: options.participantKind,
+                ...(options.participantId ? { participantId: options.participantId } : {}),
+                ...(options.onBehalfOf ? { onBehalfOf: options.onBehalfOf } : {}),
+                ...(options.organizationId ? { organizationId: options.organizationId } : {}),
+                syncGroups: options.syncGroups,
+                operations: options.operations,
+                wideScope: options.wideScope,
+                ttlSeconds: options.ttlSeconds,
+                label: options.label,
+                userMeta: options.userMeta,
+            }),
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        throw new AbloAuthenticationError(`apiKey exchange failed: ${err instanceof Error ? err.message : String(err)}`, { code: 'exchange_network_error', cause: err });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok) {
+        let body = null;
+        try {
+            body = await response.json();
+        }
+        catch {
+            // ignore — server returned non-JSON error
+        }
+        // Route the error through the wire-error translator so the server's envelope
+        // (`code`, `message`, `doc_url`) is preserved and mapped to the matching
+        // AbloError subclass. Fall back to `exchange_failed` only when the body
+        // carried no recognizable error code.
+        const requestId = response.headers.get('x-request-id') ?? undefined;
+        throw hasWireCode(body)
+            ? translateHttpError(response.status, body, requestId)
+            : new AbloAuthenticationError(`apiKey exchange rejected (${response.status})`, { code: 'exchange_failed', httpStatus: response.status });
+    }
+    return parseCapabilityMintResponse(await response.json());
+}
+/** Canonical wire projection shared by the SDK and first-party issuer. */
+export function buildMintUserSessionRequest(options) {
+    return ephemeralKeyRequestSchema.parse({
+        user: { id: options.userId },
+        ...(options.organizationId ? { organizationId: options.organizationId } : {}),
+        ...(options.schemaProject
+            ? {
+                schemaProjectId: options.schemaProject.projectId,
+                schemaOwnerOrgId: options.schemaProject.organizationId,
+            }
+            : {}),
+        ...(options.syncGroups ? { syncGroups: options.syncGroups } : {}),
+        ...(options.controlPlaneOnly
+            ? { controlPlaneOnly: true }
+            : options.operations
+                ? { operations: options.operations }
+                : { activeSchemaOperations: options.activeSchemaOperations }),
+        ttlSeconds: options.ttlSeconds,
+        ...(options.label ? { label: options.label } : {}),
+    });
+}
+/**
+ * Mints an end-user session key (an `ek_` key) by calling
+ * `POST /v1/ephemeral_keys`, using your secret key as authorization. Your
+ * backend calls this to issue a session that a browser can present as its bearer
+ * credential; the server trusts the resulting key because a secret key minted it.
+ *
+ * This is a distinct endpoint from `/v1/capabilities`, which exchanges keys for
+ * agents and systems and cannot mint sessions for human users.
+ */
+export async function mintUserSessionKey(options) {
+    if (!options.apiKey) {
+        throw new AbloAuthenticationError('No API key found. Set ABLO_API_KEY in your environment or pass `apiKey` ' +
+            'to Ablo({ ... }) directly — user sessions are minted by your backend.', { code: 'apikey_missing' });
+    }
+    if (!options.baseUrl) {
+        throw new AbloAuthenticationError('baseUrl is required for user-session mint', { code: 'base_url_missing' });
+    }
+    // Exactly one grant form. Several would be two answers to one question; none
+    // would send an empty allowlist, and an empty allowlist is read as
+    // unrestricted rather than as nothing. The server refuses either way; this
+    // says so before the round trip, where the caller can see which call did it.
+    const grantForms = [
+        options.operations,
+        options.activeSchemaOperations,
+        options.controlPlaneOnly,
+    ].filter((form) => form !== undefined).length;
+    if (grantForms !== 1) {
+        throw new AbloAuthenticationError('Provide exactly one of operations, activeSchemaOperations, or controlPlaneOnly ' +
+            'for a user-session mint.', { code: 'invalid_body' });
+    }
+    const fetcher = options.fetch ?? fetch;
+    const url = `${options.baseUrl.replace(/\/+$/, '')}/v1/ephemeral_keys`;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    const controller = new AbortController();
+    const timer = setTimeout(() => { controller.abort(); }, timeoutMs);
+    let response;
+    try {
+        response = await fetcher(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${options.apiKey}`,
+            },
+            body: JSON.stringify(buildMintUserSessionRequest(options)),
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        throw new AbloAuthenticationError(`user-session mint failed: ${err instanceof Error ? err.message : String(err)}`, { code: 'exchange_network_error', cause: err });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok) {
+        let body = null;
+        try {
+            body = await response.json();
+        }
+        catch {
+            // ignore — server returned non-JSON error
+        }
+        const requestId = response.headers.get('x-request-id') ?? undefined;
+        throw hasWireCode(body)
+            ? translateHttpError(response.status, body, requestId)
+            : new AbloAuthenticationError(`user-session mint rejected (${response.status})`, { code: 'exchange_failed', httpStatus: response.status });
+    }
+    return parseEphemeralKeyResponse(await response.json());
+}
+/**
+ * Resolves the caller's identity from an authenticated request by calling
+ * `GET /auth/identity`. This lets browser and session flows learn who the
+ * current user is without requiring the application to pass a user id up front —
+ * for example, to key local storage.
+ */
+export async function resolveIdentity(options) {
+    if (!options.baseUrl) {
+        throw new AbloAuthenticationError('baseUrl is required for identity resolve', {
+            code: 'base_url_missing',
+        });
+    }
+    const fetcher = options.fetch ?? fetch;
+    const url = `${options.baseUrl.replace(/\/+$/, '')}/auth/identity`;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    const controller = new AbortController();
+    const timer = setTimeout(() => { controller.abort(); }, timeoutMs);
+    let response;
+    try {
+        const headers = { Accept: 'application/json' };
+        if (options.authToken) {
+            headers.Authorization = `Bearer ${options.authToken}`;
+        }
+        response = await fetcher(url, {
+            method: 'GET',
+            headers,
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        throw new AbloAuthenticationError(`identity resolve failed: ${err instanceof Error ? err.message : String(err)}`, { code: 'identity_network_error', cause: err });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok) {
+        let body = null;
+        try {
+            body = await response.json();
+        }
+        catch {
+            // ignore non-JSON auth errors
+        }
+        // Translate the error envelope the same way `exchangeApiKey` does, so the
+        // server's precise auth diagnosis (for example `jwt_issuer_untrusted` with
+        // its full message) reaches the caller instead of collapsing every 401 to a
+        // generic `identity_resolve_failed`.
+        const requestId = response.headers.get('x-request-id') ?? undefined;
+        throw hasWireCode(body)
+            ? translateHttpError(response.status, body, requestId)
+            : new AbloAuthenticationError(`identity resolve rejected (${response.status})`, { code: 'identity_resolve_failed', httpStatus: response.status });
+    }
+    return parseIdentityResolveResponse(await response.json());
+}
+const DEFAULT_BUFFER_FLOOR_MS = 60_000;
+const DEFAULT_BUFFER_RATIO = 0.1;
+export function createRefreshScheduler(options) {
+    const now = options.now ?? Date.now;
+    const setTimer = options.setTimer ?? setTimeout;
+    const clearTimer = options.clearTimer ?? clearTimeout;
+    let expiresAtMs = options.initialExpiresAtMs;
+    let timer = null;
+    let inFlight = null;
+    let disposed = false;
+    // Attach the visibility listener only in a browser-like environment. A
+    // non-browser runtime has no `document`, so the default behaves correctly
+    // without an explicit opt-out.
+    const wantsVisibility = options.attachVisibilityListener ?? true;
+    const hasDocument = typeof document !== 'undefined';
+    const visibilityActive = wantsVisibility && hasDocument;
+    function bufferFor(currentExpiresAtMs) {
+        if (typeof options.bufferMs === 'number')
+            return options.bufferMs;
+        const ttl = currentExpiresAtMs - now();
+        return Math.max(DEFAULT_BUFFER_FLOOR_MS, Math.floor(ttl * DEFAULT_BUFFER_RATIO));
+    }
+    function clearTimerIfAny() {
+        if (timer !== null) {
+            clearTimer(timer);
+            timer = null;
+        }
+    }
+    function schedule() {
+        if (disposed)
+            return;
+        clearTimerIfAny();
+        const buffer = bufferFor(expiresAtMs);
+        const delay = Math.max(0, expiresAtMs - buffer - now());
+        timer = setTimer(() => {
+            void refreshNow().catch(() => {
+                // onError already fired inside refreshNow; swallow here so
+                // the timer callback doesn't surface as an unhandled rejection.
+            });
+        }, delay);
+    }
+    function refreshNow() {
+        if (disposed) {
+            return Promise.reject(new Error('refreshScheduler: disposed'));
+        }
+        if (inFlight)
+            return inFlight;
+        inFlight = (async () => {
+            try {
+                const result = await options.refresh();
+                if (disposed)
+                    return result;
+                expiresAtMs = result.expiresAtMs;
+                options.onRefreshed?.({ expiresAtMs });
+                schedule();
+                return result;
+            }
+            catch (err) {
+                const error = err instanceof Error ? err : new Error(String(err));
+                options.onError?.(error);
+                // Reschedule even on failure so the next window still triggers.
+                // The user's apiKey may have been temporarily unreachable.
+                if (!disposed)
+                    schedule();
+                throw error;
+            }
+            finally {
+                inFlight = null;
+            }
+        })();
+        return inFlight;
+    }
+    function onVisibilityChange() {
+        if (disposed)
+            return;
+        if (typeof document === 'undefined')
+            return;
+        if (document.visibilityState !== 'visible')
+            return;
+        const buffer = bufferFor(expiresAtMs);
+        if (expiresAtMs - now() <= buffer) {
+            void refreshNow().catch(() => {
+                // already routed through onError
+            });
+        }
+    }
+    if (visibilityActive) {
+        document.addEventListener('visibilitychange', onVisibilityChange);
+    }
+    schedule();
+    return {
+        refreshNow,
+        dispose() {
+            if (disposed)
+                return;
+            disposed = true;
+            clearTimerIfAny();
+            if (visibilityActive) {
+                document.removeEventListener('visibilitychange', onVisibilityChange);
+            }
+        },
+        get expiresAtMs() {
+            return expiresAtMs;
+        },
+    };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/auth/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/auth/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAKL,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAMxF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAQpD,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,EAC/B,8BAA8B,EAC9B,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,+BAA+B,EAC/B,+BAA+B,GAGhC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,+BAA+B,EAC/B,wCAAwC,GACzC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AASzC,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,EAChC,+BAA+B,EAC/B,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAMlC,2EAA2E;AAC3E,yEAAyE;AACzE,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAezB,OAAO,EACL,yBAAyB,GAE1B,MAAM,iBAAiB,CAAC;AA2BzB,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA8B;IAE9B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,4EAA4E;YAC1E,kEAAkE;YAClE,qCAAqC,EACvC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,6CAA6C,EAC7C,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAC7B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAEnE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;aAC1C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC7E,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,CAC/C,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QACD,6EAA6E;QAC7E,yEAAyE;QACzE,wEAAwE;QACxE,sCAAsC;QACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QACpE,MAAM,WAAW,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC;YACtD,CAAC,CAAC,IAAI,uBAAuB,CACzB,6BAA6B,QAAQ,CAAC,MAAM,GAAG,EAC/C,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CACzD,CAAC;IACR,CAAC;IAED,OAAO,2BAA2B,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAiED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CACzC,OAA+B;IAE/B,OAAO,yBAAyB,CAAC,KAAK,CAAC;QACrC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE;QAC5B,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,OAAO,CAAC,aAAa;YACvB,CAAC,CAAC;gBACE,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS;gBAChD,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,cAAc;aACvD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,gBAAgB;YAC1B,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE;YAC5B,CAAC,CAAC,OAAO,CAAC,UAAU;gBAClB,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE;gBACpC,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC;QACjE,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA+B;IAE/B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,0EAA0E;YACxE,uEAAuE,EACzE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,2CAA2C,EAC3C,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAC7B,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,mEAAmE;IACnE,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,UAAU,GAAG;QACjB,OAAO,CAAC,UAAU;QAClB,OAAO,CAAC,sBAAsB;QAC9B,OAAO,CAAC,gBAAgB;KACzB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,iFAAiF;YAC/E,0BAA0B,EAC5B,EAAE,IAAI,EAAE,cAAc,EAAE,CACzB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAEnE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;aAC1C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;YAC1D,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC/E,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,CAC/C,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QACpE,MAAM,WAAW,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC;YACtD,CAAC,CAAC,IAAI,uBAAuB,CACzB,+BAA+B,QAAQ,CAAC,MAAM,GAAG,EACjD,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CACzD,CAAC;IACR,CAAC;IAED,OAAO,yBAAyB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA+B;IAE/B,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAAC,0CAA0C,EAAE;YAC5E,IAAI,EAAE,kBAAkB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAEnE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACvE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,OAAO,CAAC,aAAa,GAAG,UAAU,OAAO,CAAC,SAAS,EAAE,CAAC;QACxD,CAAC;QACD,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,KAAK;YACb,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC9E,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,CAC/C,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,qCAAqC;QACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QACpE,MAAM,WAAW,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC;YACtD,CAAC,CAAC,IAAI,uBAAuB,CACzB,8BAA8B,QAAQ,CAAC,MAAM,GAAG,EAChD,EAAE,IAAI,EAAE,yBAAyB,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;IACR,CAAC;IAED,OAAO,4BAA4B,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAoFD,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,MAAM,UAAU,sBAAsB,CACpC,OAAgC;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;IAEtD,IAAI,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAC7C,IAAI,KAAK,GAAyC,IAAI,CAAC;IACvD,IAAI,QAAQ,GAA4C,IAAI,CAAC;IAC7D,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,uEAAuE;IACvE,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,IAAI,IAAI,CAAC;IACjE,MAAM,WAAW,GAAG,OAAO,QAAQ,KAAK,WAAW,CAAC;IACpD,MAAM,gBAAgB,GAAG,eAAe,IAAI,WAAW,CAAC;IAExD,SAAS,SAAS,CAAC,kBAA0B;QAC3C,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;QAClE,MAAM,GAAG,GAAG,kBAAkB,GAAG,GAAG,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,SAAS,eAAe;QACtB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,UAAU,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IAED,SAAS,QAAQ;QACf,IAAI,QAAQ;YAAE,OAAO;QACrB,eAAe,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;QACxD,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE;YACpB,KAAK,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3B,2DAA2D;gBAC3D,gEAAgE;YAClE,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED,SAAS,UAAU;QACjB,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YACrB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACvC,IAAI,QAAQ;oBAAE,OAAO,MAAM,CAAC;gBAC5B,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBACjC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;gBACvC,QAAQ,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClE,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;gBACzB,gEAAgE;gBAChE,2DAA2D;gBAC3D,IAAI,CAAC,QAAQ;oBAAE,QAAQ,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,kBAAkB;QACzB,IAAI,QAAQ;YAAE,OAAO;QACrB,IAAI,OAAO,QAAQ,KAAK,WAAW;YAAE,OAAO;QAC5C,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,WAAW,GAAG,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;YAClC,KAAK,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3B,iCAAiC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IACpE,CAAC;IAED,QAAQ,EAAE,CAAC;IAEX,OAAO;QACL,UAAU;QACV,OAAO;YACL,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,IAAI,gBAAgB,EAAE,CAAC;gBACrB,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,IAAI,WAAW;YACb,OAAO,WAAW,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/sessionMint.d.ts

@@ -1,5 +1,5 @@
 import type { SchemaRecord } from '../schema/schema.js';
-import type { AbloSession, CreateSessionParams } from '../resources/httpResources.js';
+import type { AbloSession, CreateSessionParams } from '../client/resources/httpResources.js';
 /**
  * The resolved control-plane details a mint needs: a secret key, a base URL,
  * and an optional `fetch`. When `fetch` is omitted, the auth helpers fall back

package/dist/auth/sessionMint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionMint.d.ts","sourceRoot":"","sources":["../../src/auth/sessionMint.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEtF;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,CAAC,SAAS,YAAY,EACtD,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAC9B,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,WAAW,CAAC,CAiEtB"}
+{"version":3,"file":"sessionMint.d.ts","sourceRoot":"","sources":["../../src/auth/sessionMint.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE7F;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,CAAC,SAAS,YAAY,EACtD,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAC9B,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,WAAW,CAAC,CAkEtB"}

package/dist/auth/sessionMint.js

@@ -22,7 +22,7 @@
  * key, not a derived key that an earlier exchange may have produced — is the
  * caller's responsibility.
  */
-import { exchangeApiKey, mintUserSessionKey, } from '../auth/index.js';
+import { exchangeApiKey, mintUserSessionKey, } from './runtime.js';
 import { capabilityCanSchemaFor, grantedOperations, } from './capability.js';
 /**
  * Mints a session token from an already-resolved secret key and base URL.
@@ -77,6 +77,7 @@ export async function mintSession(params, ctx) {
         baseUrl,
         participantKind: 'agent',
         participantId: params.agent.id,
+        ...(params.onBehalfOf ? { onBehalfOf: params.onBehalfOf } : {}),
         ...(params.syncGroups ? { syncGroups: [...params.syncGroups] } : {}),
         operations,
         ttlSeconds: params.ttlSeconds ?? 900,

package/dist/auth/sessionMint.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionMint.js","sourceRoot":"","sources":["../../src/auth/sessionMint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,cAAc,EACd,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAyBzB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAA8B,EAC9B,GAAuB;IAEvB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAChC,2EAA2E;IAC3E,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEzE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC;YACnC,MAAM;YACN,OAAO;YACP,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;YACtB,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,UAAU;YACV,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;YACpC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,mEAAmE;YACnE,oDAAoD;YACpD,KAAK,EAAE;gBACL,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,eAAe,EAAE,MAAM;gBACvB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;aACzC;YACD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,aAAa,EAAE;SACvD,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;QAC/B,MAAM;QACN,OAAO;QACP,eAAe,EAAE,OAAO;QACxB,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;QAC9B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;QACpC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,GAAG,CAAC,YAAY;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sessionMint.js","sourceRoot":"","sources":["../../src/auth/sessionMint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,cAAc,EACd,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAyBzB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAA8B,EAC9B,GAAuB;IAEvB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAChC,2EAA2E;IAC3E,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEzE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC;YACnC,MAAM;YACN,OAAO;YACP,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;YACtB,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,UAAU;YACV,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;YACpC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,mEAAmE;YACnE,oDAAoD;YACpD,KAAK,EAAE;gBACL,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,eAAe,EAAE,MAAM;gBACvB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;aACzC;YACD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,aAAa,EAAE;SACvD,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;QAC/B,MAAM;QACN,OAAO;QACP,eAAe,EAAE,OAAO;QACxB,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;QAC9B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;QACpC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,GAAG,CAAC,YAAY;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;AACJ,CAAC"}