@agentic-passport/next 0.3.0

package/dist/handler.js

@@ -0,0 +1,516 @@
+/**
+ * Framework-agnostic AgentPassport handler. Built on @agentic-passport/core verifiers.
+ *
+ * Adapters (this package's middleware.ts, or @agentic-passport/express, etc.) translate
+ * framework-native requests into NormalizedRequest, call handleAgentRequest, and
+ * translate the NormalizedResponse back into the framework's response type.
+ *
+ * State is injected via config.store. Use inMemoryStore() for tests / single-
+ * instance dev; use kvStore(env) on Workers so state survives across isolates.
+ */
+import { exportJWK, calculateJwkThumbprint } from 'jose';
+import { generateKeyPairSync, createPrivateKey, createPublicKey } from 'node:crypto';
+import { AgentPassportError, AuditLog, ErrorCode, ProtocolVersion, RegisterRequestSchema, AuthorizeRequestSchema, } from '@agentic-passport/protocol';
+import { verifyRequest, verifyMandateJwt, verifyAccessToken, verifyDpop, issueAccessToken, } from '@agentic-passport/core';
+import { inMemoryStore } from './stores.js';
+const MAX_BODY_BYTES = 1_048_576;
+const TIMESTAMP_WINDOW_SECONDS = 60;
+const ACCESS_TOKEN_TTL_SECONDS = 900;
+const RATE_LIMIT_PER_MINUTE = 10;
+function decodePem(raw) {
+    const t = raw.trim();
+    if (t.includes('-----BEGIN'))
+        return t.replace(/\\n/g, '\n');
+    try {
+        const dec = Buffer.from(t, 'base64').toString('utf8');
+        if (dec.includes('-----BEGIN'))
+            return dec;
+    }
+    catch { /* fall through */ }
+    throw new Error('tokenSigningKeyPem must be raw PEM, escaped-\\n PEM, or base64-encoded PEM');
+}
+/**
+ * Define an AgentPassport gate. Returns a cached factory — call the returned
+ * function from anywhere in your app; the gate is built once on first
+ * call and reused thereafter.
+ *
+ *   // lib/agent-gate.ts
+ *   export const getGate = agentPassport({
+ *     vendorOrigin: 'https://kwrds.ai',
+ *     trustedIssuers: ['https://issuer.example.com'],
+ *     scopes: ['keyword.search'],
+ *     hooks: { onAgentSignup: async (ctx) => {...} },
+ *   });
+ *
+ *   // route handlers:
+ *   export const POST = (req: Request) => handleAgentPassport(req, getGate);
+ *
+ * Lazy init: JWKS fetching and signing-key loading happen on the first
+ * call to the returned function, not at module load. Subsequent calls
+ * return the cached instance.
+ */
+export function agentPassport(config) {
+    let cached = null;
+    return () => {
+        if (cached)
+            return cached;
+        cached = buildInstance(config);
+        return cached;
+    };
+}
+async function buildInstance(config) {
+    let privateKey;
+    if (config.tokenSigningKeyPem) {
+        privateKey = createPrivateKey({ key: decodePem(config.tokenSigningKeyPem), format: 'pem' });
+    }
+    else {
+        privateKey = generateKeyPairSync('ed25519').privateKey;
+    }
+    const publicKey = createPublicKey(privateKey);
+    const jwk = await exportJWK(publicKey);
+    jwk.alg = 'EdDSA';
+    jwk.kid = 'agentpassport-token-signer-1';
+    jwk.use = 'sig';
+    // Auto-fetch JWKS for any trusted issuer not already in jwksByIssuer.
+    // Preserve the caller's Map reference so test harnesses (or production
+    // code) can mutate the map after gate construction to add/remove
+    // trust at runtime.
+    const jwksByIssuer = config.jwksByIssuer ?? new Map();
+    for (const issuerUrl of config.trustedIssuers) {
+        if (!jwksByIssuer.has(issuerUrl)) {
+            jwksByIssuer.set(issuerUrl, await fetchIssuerJwks(issuerUrl));
+        }
+    }
+    const resolvedConfig = { ...config, jwksByIssuer };
+    const internal = {
+        config: resolvedConfig,
+        store: config.store ?? inMemoryStore(),
+        audit: new AuditLog(),
+        tokenSigningKey: privateKey,
+        tokenVerificationJwk: jwk,
+    };
+    return {
+        config: resolvedConfig,
+        store: internal.store,
+        audit: internal.audit,
+        isAgentRequest,
+        handle: (req) => handle(internal, req),
+        authorizeApiCall: (req, scope) => authorizeApiCall(internal, req, scope),
+        discoveryDoc: () => buildDiscovery(internal),
+        auditEntries: () => internal.audit.all(),
+    };
+}
+async function fetchIssuerJwks(issuerUrl) {
+    const url = `${issuerUrl.replace(/\/$/, '')}/.well-known/jwks.json`;
+    const res = await fetch(url);
+    if (!res.ok)
+        throw new Error(`agentpassport: failed to fetch JWKS from ${url}: ${res.status}`);
+    return (await res.json());
+}
+import { isAgentRequest } from './is-agent-request.js';
+export { isAgentRequest };
+/** @deprecated Renamed to {@link agentAuth}. Will be removed in 0.1.0. */
+export const agentGate = agentPassport;
+function lc(headers) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers))
+        out[k.toLowerCase()] = v;
+    return out;
+}
+function nowMs() { return Date.now(); }
+function jsonResponse(status, body, extraHeaders) {
+    return {
+        status,
+        headers: { 'content-type': 'application/json', ...(extraHeaders ?? {}) },
+        body: Buffer.from(JSON.stringify(body)),
+    };
+}
+function markdownResponse(body) {
+    return { status: 200, headers: { 'content-type': 'text/markdown; charset=utf-8' }, body: Buffer.from(body) };
+}
+/**
+ * Agent-readable quickstart. Returned as plain markdown so an LLM agent
+ * that fetches /.well-known/agent-passport/quickstart.md can follow the steps
+ * verbatim — generate a key, mint a mandate, sign requests, call the API —
+ * without prior knowledge of AgentPassport.
+ */
+function buildQuickstart(g) {
+    const origin = g.config.vendorOrigin.replace(/\/$/, '');
+    const issuers = g.config.trustedIssuers.join(', ');
+    const scopes = g.config.scopes.length > 0 ? g.config.scopes.join(', ') : '(none advertised)';
+    return `# AgentPassport Quickstart — ${g.config.vendorName ?? origin}
+
+You are an AI agent that received a \`401\` with \`WWW-Authenticate: AgentPassport\`
+from this vendor. This document tells you exactly how to authenticate.
+
+## What this vendor speaks
+
+- **Protocol:** AgentPassport v0 (signed HTTP requests + DPoP-bound tokens + mandate JWTs)
+- **Vendor origin:** ${origin}
+- **Discovery doc:** ${origin}/.well-known/agent-passport (JSON)
+- **Trusted mandate issuers:** ${issuers}
+- **Scopes the vendor offers:** ${scopes}
+
+## How to authenticate (5 steps)
+
+1. **Generate an Ed25519 keypair.** Keep the private key in memory only.
+2. **Mint a mandate** from a trusted issuer (see list above). POST your task,
+   budget, scope hints, and the vendor origin as \`aud\` to the issuer's
+   \`/mint\` endpoint. You get back a signed JWT.
+3. **Register with the vendor.** POST \`${origin}/agent/register\` with your
+   public key + the mandate JWT. The request must be signed per RFC 9421
+   (HTTP Message Signatures, Web Bot Auth profile). You get back an
+   \`agent_id\` and the scopes the vendor granted.
+4. **Get an access token.** POST \`${origin}/agent/authorize\` (signed).
+   Returns a DPoP-bound access token.
+5. **Call the vendor's API.** Every API request must carry the access
+   token + a fresh DPoP proof + a fresh RFC 9421 signature over the
+   request line, body digest, and headers.
+
+## The easy way: use the published SDK
+
+The whole loop is ~5 lines of TypeScript:
+
+\`\`\`ts
+import { AgentClient, HostedMandateProvider, generateEd25519KeyPair } from '@agentic-passport/agent';
+
+const { publicKey, privateKey } = generateEd25519KeyPair();
+const agent = new AgentClient(
+  { keyId: 'my-agent-1', publicKey, privateKey, directoryUrl: '${origin}/.well-known/http-message-signatures-directory' },
+  new HostedMandateProvider({ issuerUrl: '${g.config.trustedIssuers[0] ?? '<issuer>'}' }),
+);
+const session = await agent.access('${origin}', {
+  task: 'describe what you want here',
+  budget: { usd: 1 },
+  scopes: [${g.config.scopes.map((s) => `'${s}'`).join(', ')}],
+});
+const res = await session.fetch('${origin}/api/<vendor-endpoint>');
+console.log(await res.json());
+\`\`\`
+
+Install: \`npm install @agentic-passport/agent\`
+
+## If you must implement from scratch
+
+The full wire-format spec is at: ${origin}/.well-known/agent-passport/spec.md
+
+You'll need to implement:
+- RFC 9421 HTTP Message Signatures (Web Bot Auth profile)
+- RFC 9449 DPoP proof generation
+- EdDSA-only JWT verification on the access token
+
+The reference TypeScript implementation in \`@agentic-passport/agent\` is the easier path.
+
+## What you should NOT do
+
+- Do not retry an unsigned request hoping for a different response.
+- Do not pretend to be a human; the vendor's human-auth flow will reject you.
+- Do not store the mandate JWT beyond its \`exp\` claim.
+- Do not reuse a DPoP \`jti\` across requests.
+`;
+}
+function buildSpecPointer(g) {
+    const origin = g.config.vendorOrigin.replace(/\/$/, '');
+    return `# AgentPassport Protocol Spec — pointer
+
+This vendor speaks AgentPassport v0. The canonical wire-format specification
+lives in the open-source protocol package:
+
+- **Repository:** https://github.com/mkotsollaris/agent-passport
+- **Spec source:** packages/protocol/spec.md
+- **npm packages:** @agentic-passport/next (vendor), @agentic-passport/agent (agent client)
+
+For a step-by-step walkthrough tailored to this vendor, see:
+${origin}/.well-known/agent-passport/quickstart.md
+`;
+}
+function errorResponse(code, g) {
+    const err = new AgentPassportError(code);
+    const extra = err.status === 401 && g ? { 'www-authenticate': buildWwwAuthenticate(g) } : undefined;
+    return jsonResponse(err.status, err.toResponseBody(), extra);
+}
+/**
+ * RFC 7235 WWW-Authenticate challenge advertising AgentPassport.
+ *
+ * An agent that lands on a 401 from this vendor can read this header,
+ * fetch the discovery doc + quickstart, and self-onboard without prior
+ * knowledge of the protocol. Format:
+ *
+ *   WWW-Authenticate: AgentPassport realm="<vendor-origin>",
+ *     discovery="<vendor>/.well-known/agent-passport",
+ *     quickstart="<vendor>/.well-known/agent-passport/quickstart.md",
+ *     spec="<vendor>/.well-known/agent-passport/spec.md"
+ */
+function buildWwwAuthenticate(g) {
+    const origin = g.config.vendorOrigin.replace(/\/$/, '');
+    return [
+        'AgentPassport',
+        `realm="${origin}"`,
+        `discovery="${origin}/.well-known/agent-passport"`,
+        `quickstart="${origin}/.well-known/agent-passport/quickstart.md"`,
+        `spec="${origin}/.well-known/agent-passport/spec.md"`,
+    ].join(' ');
+}
+function buildDiscovery(g) {
+    return {
+        protocol: ProtocolVersion,
+        vendor: { origin: g.config.vendorOrigin, name: g.config.vendorName ?? 'agentpassport-vendor' },
+        endpoints: {
+            register: '/agent/register',
+            authorize: '/agent/authorize',
+            audit: '/agent/audit',
+        },
+        identity: {
+            accepted_profiles: ['web-bot-auth'],
+            trusted_issuers: [...g.config.trustedIssuers],
+        },
+        scopes: [...g.config.scopes],
+        payment: { rails: ['free'] },
+        limits: {
+            max_body_bytes: MAX_BODY_BYTES,
+            timestamp_window_seconds: TIMESTAMP_WINDOW_SECONDS,
+            mandate_max_lifetime_seconds: 3600,
+        },
+        docs: {
+            quickstart: '/.well-known/agent-passport/quickstart.md',
+            spec: '/.well-known/agent-passport/spec.md',
+        },
+    };
+}
+async function handle(g, req) {
+    try {
+        if (req.body.byteLength > MAX_BODY_BYTES) {
+            g.audit.append({ ts: nowMs(), event: 'request', outcome: 'denied', reason: ErrorCode.REQUEST_BODY_TOO_LARGE });
+            return errorResponse(ErrorCode.REQUEST_BODY_TOO_LARGE, g);
+        }
+        const url = new URL(req.url);
+        const path = url.pathname;
+        if (req.method === 'GET' && path === '/.well-known/agent-passport')
+            return jsonResponse(200, buildDiscovery(g));
+        if (req.method === 'GET' && path === '/.well-known/agent-passport/quickstart.md')
+            return markdownResponse(buildQuickstart(g));
+        if (req.method === 'GET' && path === '/.well-known/agent-passport/spec.md')
+            return markdownResponse(buildSpecPointer(g));
+        if (req.method === 'GET' && path === '/agent/audit')
+            return jsonResponse(200, { entries: g.audit.all() });
+        if (req.method === 'GET' && path === '/health')
+            return jsonResponse(200, { ok: true, vendor: g.config.vendorOrigin });
+        if (req.method === 'POST' && path === '/agent/register')
+            return await handleRegister(g, req);
+        if (req.method === 'POST' && path === '/agent/authorize')
+            return await handleAuthorize(g, req);
+        return jsonResponse(404, { error: 'not_found' });
+    }
+    catch (err) {
+        if (err instanceof AgentPassportError)
+            return jsonResponse(err.status, err.toResponseBody());
+        return jsonResponse(500, { error: 'internal_error' });
+    }
+}
+async function verifySignedRequest(g, req) {
+    return verifyRequest({ method: req.method, url: req.url, body: req.body, headers: req.headers }, {
+        resolveKey: (keyId) => g.store.resolveKey(keyId),
+        timestampWindowSeconds: TIMESTAMP_WINDOW_SECONDS,
+        isNonceSeen: (k, n) => g.store.isNonceSeen(k, n),
+        rememberNonce: (k, n) => g.store.rememberNonce(k, n),
+        isKeyRevoked: (k) => g.store.isKeyRevoked(k),
+        now: nowMs,
+    });
+}
+async function handleRegister(g, req) {
+    let bodyJson;
+    try {
+        bodyJson = JSON.parse(req.body.toString('utf8'));
+    }
+    catch {
+        return errorResponse(ErrorCode.MALFORMED_REQUEST, g);
+    }
+    const parsed = RegisterRequestSchema.safeParse(bodyJson);
+    if (!parsed.success)
+        return errorResponse(ErrorCode.MALFORMED_REQUEST, g);
+    const attempts = await g.store.recordRegisterAttempt(parsed.data.agent.key_id);
+    if (attempts > RATE_LIMIT_PER_MINUTE) {
+        g.audit.append({ ts: nowMs(), event: 'register', outcome: 'denied', reason: ErrorCode.RATE_LIMIT_EXCEEDED, agent_id: parsed.data.agent.key_id });
+        return errorResponse(ErrorCode.RATE_LIMIT_EXCEEDED, g);
+    }
+    await g.store.registerKey(parsed.data.agent.key_id, parsed.data.agent.public_jwk);
+    const verified = await verifySignedRequest(g, req);
+    if (!verified.ok) {
+        g.audit.append({ ts: nowMs(), event: 'register', outcome: 'denied', reason: verified.code, agent_id: parsed.data.agent.key_id });
+        return errorResponse(verified.code, g);
+    }
+    const mandateJwt = req.headers['x-agent-mandate'];
+    if (!mandateJwt) {
+        g.audit.append({ ts: nowMs(), event: 'register', outcome: 'denied', reason: ErrorCode.MANDATE_MISSING, agent_id: verified.agentKeyId });
+        return errorResponse(ErrorCode.MANDATE_MISSING, g);
+    }
+    const mandateResult = await verifyMandateJwt(mandateJwt, {
+        vendorOrigin: g.config.vendorOrigin,
+        trustedIssuers: g.config.trustedIssuers,
+        jwksFor: async (iss) => g.config.jwksByIssuer?.get(iss) ?? null,
+        isJtiUsed: (jti) => g.store.isMandateJtiUsed(jti),
+        rememberJti: (jti, exp) => g.store.rememberMandateJti(jti, exp),
+        now: nowMs,
+    });
+    if (!mandateResult.ok) {
+        g.audit.append({ ts: nowMs(), event: 'register', outcome: 'denied', reason: mandateResult.code, agent_id: verified.agentKeyId });
+        return errorResponse(mandateResult.code, g);
+    }
+    const agentId = `agent:${verified.agentKeyId}`;
+    const ctx = {
+        agentId,
+        mandate: mandateResult.claims,
+        request: { method: req.method, url: req.url, headers: req.headers },
+    };
+    let hookResult;
+    try {
+        hookResult = await g.config.hooks.onAgentSignup(ctx);
+    }
+    catch (err) {
+        g.audit.append({ ts: nowMs(), event: 'register', outcome: 'denied', reason: 'hook_threw', agent_id: agentId });
+        return jsonResponse(500, { error: 'agent_passport_error', error_code: ErrorCode.INTERNAL_ERROR, detail: err instanceof Error ? err.message : 'unknown' });
+    }
+    if (!hookResult.allow) {
+        g.audit.append({ ts: nowMs(), event: 'register', outcome: 'denied', reason: hookResult.reason ?? 'rejected_by_vendor', agent_id: agentId });
+        return errorResponse(ErrorCode.SCOPE_NOT_GRANTED, g);
+    }
+    const grantedScopes = hookResult.principal?.grantedScopes ?? [];
+    const userId = hookResult.principal?.userId ?? `shadow:${agentId}`;
+    await g.store.putAgent(agentId, {
+        granted_scopes: grantedScopes,
+        mandate_jti: mandateResult.claims.jti,
+        user_id: userId,
+        ...(mandateResult.claims.actor !== undefined && { actor: mandateResult.claims.actor }),
+    });
+    g.audit.append({ ts: nowMs(), event: 'register', outcome: 'allowed', agent_id: agentId, mandate_jti: mandateResult.claims.jti });
+    const response = { agent_id: agentId, granted_scopes: grantedScopes, shadow_account: userId };
+    return jsonResponse(200, response);
+}
+async function handleAuthorize(g, req) {
+    const verified = await verifySignedRequest(g, req);
+    if (!verified.ok) {
+        g.audit.append({ ts: nowMs(), event: 'authorize', outcome: 'denied', reason: verified.code });
+        return errorResponse(verified.code, g);
+    }
+    let bodyJson;
+    try {
+        bodyJson = JSON.parse(req.body.toString('utf8'));
+    }
+    catch {
+        return errorResponse(ErrorCode.MALFORMED_REQUEST, g);
+    }
+    const parsed = AuthorizeRequestSchema.safeParse(bodyJson);
+    if (!parsed.success)
+        return errorResponse(ErrorCode.MALFORMED_REQUEST, g);
+    const agent = await g.store.getAgent(parsed.data.agent_id);
+    if (!agent) {
+        g.audit.append({ ts: nowMs(), event: 'authorize', outcome: 'denied', reason: 'unknown_agent', agent_id: parsed.data.agent_id });
+        return errorResponse(ErrorCode.SCOPE_NOT_GRANTED, g);
+    }
+    for (const s of parsed.data.requested_scopes) {
+        if (!agent.granted_scopes.includes(s)) {
+            g.audit.append({ ts: nowMs(), event: 'authorize', outcome: 'denied', reason: ErrorCode.SCOPE_NOT_GRANTED, agent_id: parsed.data.agent_id, scope: s });
+            return errorResponse(ErrorCode.SCOPE_NOT_GRANTED, g);
+        }
+    }
+    const publicKey = await g.store.resolveKey(verified.agentKeyId);
+    if (!publicKey)
+        return errorResponse(ErrorCode.SIGNATURE_INVALID, g);
+    const publicJwk = await exportJWK(publicKey);
+    const jkt = await calculateJwkThumbprint(publicJwk, 'sha256');
+    const issued = await issueAccessToken({
+        issuer: g.config.vendorOrigin,
+        vendorOrigin: g.config.vendorOrigin,
+        subject: parsed.data.agent_id,
+        scopes: parsed.data.requested_scopes,
+        mandateJti: agent.mandate_jti,
+        ...(agent.actor !== undefined && { actor: agent.actor }),
+        agentKeyThumbprint: jkt,
+        ttlSeconds: ACCESS_TOKEN_TTL_SECONDS,
+        signingKey: g.tokenSigningKey,
+        now: nowMs,
+    });
+    let vendorSession;
+    if (g.config.hooks.onAgentSessionMint) {
+        try {
+            const mint = await g.config.hooks.onAgentSessionMint({
+                agentId: parsed.data.agent_id,
+                userId: agent.user_id,
+                scopes: agent.granted_scopes,
+                mandateJti: agent.mandate_jti,
+                ...(agent.actor !== undefined && { actor: agent.actor }),
+            });
+            vendorSession = {
+                bootstrap_url: mint.bootstrap_url,
+                ...(mint.final_url !== undefined && { final_url: mint.final_url }),
+            };
+        }
+        catch (err) {
+            g.audit.append({
+                ts: nowMs(),
+                event: 'authorize',
+                outcome: 'denied',
+                reason: `session_mint_failed: ${err instanceof Error ? err.message : 'unknown'}`,
+                agent_id: parsed.data.agent_id,
+            });
+            // Note: we don't fail authorize on session-mint errors — agent still
+            // gets the DPoP access token for AgentPassport-protected routes. The
+            // vendor_session is best-effort: the agent will simply 401 on
+            // Clerk-protected routes if the mint failed, just as if the vendor
+            // hadn't implemented onAgentSessionMint at all.
+        }
+    }
+    g.audit.append({ ts: nowMs(), event: 'authorize', outcome: 'allowed', agent_id: parsed.data.agent_id });
+    const response = {
+        access_token: issued.token,
+        token_type: 'DPoP',
+        expires_in: issued.expiresIn,
+        scopes: issued.claims.scopes,
+        ...(vendorSession && { vendor_session: vendorSession }),
+    };
+    return jsonResponse(200, response);
+}
+async function authorizeApiCall(g, req, requiredScope) {
+    const verified = await verifySignedRequest(g, req);
+    if (!verified.ok)
+        return { ok: false, code: verified.code };
+    const auth = lc(req.headers).authorization;
+    if (!auth || !auth.startsWith('DPoP '))
+        return { ok: false, code: ErrorCode.ACCESS_TOKEN_MISSING };
+    const accessToken = auth.slice(5).trim();
+    const tokenResult = await verifyAccessToken(accessToken, {
+        issuer: g.config.vendorOrigin,
+        vendorOrigin: g.config.vendorOrigin,
+        verificationJwk: g.tokenVerificationJwk,
+        now: nowMs,
+    });
+    if (!tokenResult.ok)
+        return { ok: false, code: tokenResult.code };
+    const dpopHeader = lc(req.headers).dpop;
+    if (!dpopHeader)
+        return { ok: false, code: ErrorCode.DPOP_MISSING };
+    const dpopResult = await verifyDpop(dpopHeader, {
+        expectedThumbprint: tokenResult.claims.cnf.jkt,
+        htm: req.method.toUpperCase(),
+        htu: req.url,
+        isJtiSeen: (jti) => g.store.isDpopJtiSeen(jti),
+        rememberJti: (jti, exp) => g.store.rememberDpopJti(jti, exp),
+        now: nowMs,
+        windowSeconds: TIMESTAMP_WINDOW_SECONDS,
+    });
+    if (!dpopResult.ok)
+        return { ok: false, code: dpopResult.code };
+    if (requiredScope && !tokenResult.claims.scopes.includes(requiredScope)) {
+        return { ok: false, code: ErrorCode.SCOPE_NOT_GRANTED };
+    }
+    return {
+        ok: true,
+        principal: {
+            type: 'agent',
+            agentId: tokenResult.claims.sub,
+            scopes: tokenResult.claims.scopes,
+            mandateJti: tokenResult.claims.mandate_jti,
+        },
+    };
+}
+//# sourceMappingURL=handler.js.map

package/dist/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,MAAM,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AACrG,OAAO,EACL,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GAIvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AACrC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAsCjC,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,GAAG,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9B,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,MAA2B;IACvD,IAAI,MAAM,GAA0C,IAAI,CAAC;IACzD,OAAO,GAAG,EAAE;QACV,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAA2B;IACtD,IAAI,UAAqB,CAAC;IAC1B,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC9B,UAAU,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9F,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC;IACzD,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IACvC,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC;IAClB,GAAG,CAAC,GAAG,GAAG,8BAA8B,CAAC;IACzC,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC;IAEhB,sEAAsE;IACtE,uEAAuE;IACvE,iEAAiE;IACjE,oBAAoB;IACpB,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,GAAG,EAAwC,CAAC;IAC5F,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC9C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAwB,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IAExE,MAAM,QAAQ,GAAa;QACzB,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,aAAa,EAAE;QACtC,KAAK,EAAE,IAAI,QAAQ,EAAE;QACrB,eAAe,EAAE,UAAU;QAC3B,oBAAoB,EAAE,GAAG;KAC1B,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,cAAc;QACd,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC;QACtC,gBAAgB,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC;QACxE,YAAY,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QAC5C,YAAY,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE;KACzC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB;IAC9C,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;AAC5D,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B,0EAA0E;AAC1E,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CAAC;AAIvC,SAAS,EAAE,CAAC,OAAqD;IAC/D,MAAM,GAAG,GAAuC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,KAAa,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAE/C,SAAS,YAAY,CAAC,MAAc,EAAE,IAAa,EAAE,YAAqC;IACxF,OAAO;QACL,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE;QACxE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,8BAA8B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,CAAW;IAClC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAC7F,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM;;;;;;;;uBAQ/C,MAAM;uBACN,MAAM;iCACI,OAAO;kCACN,MAAM;;;;;;;;0CAQE,MAAM;;;;qCAIX,MAAM;;;;;;;;;;;;;;;iEAesB,MAAM;4CAC3B,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,UAAU;;sCAE9C,MAAM;;;aAG/B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;mCAEzB,MAAM;;;;;;;;mCAQN,MAAM;;;;;;;;;;;;;;;CAexC,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAW;IACnC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO;;;;;;;;;;EAUP,MAAM;CACP,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAAe,EAAE,CAAY;IAClD,MAAM,GAAG,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,oBAAoB,CAAC,CAAW;IACvC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO;QACL,eAAe;QACf,UAAU,MAAM,GAAG;QACnB,cAAc,MAAM,8BAA8B;QAClD,eAAe,MAAM,4CAA4C;QACjE,SAAS,MAAM,sCAAsC;KACtD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,CAAW;IACjC,OAAO;QACL,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,sBAAsB,EAAE;QAC9F,SAAS,EAAE;YACT,QAAQ,EAAE,iBAAiB;YAC3B,SAAS,EAAE,kBAAkB;YAC7B,KAAK,EAAE,cAAc;SACtB;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,CAAC,cAAc,CAAC;YACnC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;SAC9C;QACD,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE;QAC5B,MAAM,EAAE;YACN,cAAc,EAAE,cAAc;YAC9B,wBAAwB,EAAE,wBAAwB;YAClD,4BAA4B,EAAE,IAAI;SACnC;QACD,IAAI,EAAE;YACJ,UAAU,EAAE,2CAA2C;YACvD,IAAI,EAAE,qCAAqC;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,CAAW,EAAE,GAAsB;IACvD,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;YACzC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAC;YAC/G,OAAO,aAAa,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,6BAA6B;YAAE,OAAO,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QAChH,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,2CAA2C;YAAE,OAAO,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9H,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,qCAAqC;YAAE,OAAO,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QACzH,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1G,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACtH,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,iBAAiB;YAAE,OAAO,MAAM,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7F,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,kBAAkB;YAAE,OAAO,MAAM,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/F,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,kBAAkB;YAAE,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;QAC7F,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,CAAW,EAAE,GAAsB;IACpE,OAAO,aAAa,CAClB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAC1E;QACE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAChD,sBAAsB,EAAE,wBAAwB;QAChD,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;QAChD,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC;QACpD,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5C,GAAG,EAAE,KAAK;KACX,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,CAAW,EAAE,GAAsB;IAC/D,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,aAAa,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IACzH,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAE1E,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/E,IAAI,QAAQ,GAAG,qBAAqB,EAAE,CAAC;QACrC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACjJ,OAAO,aAAa,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAElF,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACjI,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,eAAe,EAAE,QAAQ,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACxI,OAAO,aAAa,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE;QACvD,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY;QACnC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc;QACvC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QAC/D,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC;QACjD,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC;QAC/D,GAAG,EAAE,KAAK;KACX,CAAC,CAAC;IACH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACjI,OAAO,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,QAAQ,CAAC,UAAU,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAuB;QAC9B,OAAO;QACP,OAAO,EAAE,aAAa,CAAC,MAAM;QAC7B,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;KACpE,CAAC;IACF,IAAI,UAA6B,CAAC;IAClC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/G,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5J,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5I,OAAO,aAAa,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC,SAAS,EAAE,aAAa,IAAI,EAAE,CAAC;IAChE,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,IAAI,UAAU,OAAO,EAAE,CAAC;IACnE,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE;QAC9B,cAAc,EAAE,aAAa;QAC7B,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG;QACrC,OAAO,EAAE,MAAM;QACf,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;KACvF,CAAC,CAAC;IAEH,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACjI,MAAM,QAAQ,GAAqB,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IAChH,OAAO,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,CAAW,EAAE,GAAsB;IAChE,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,aAAa,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IACzH,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAE1E,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChI,OAAO,aAAa,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACtJ,OAAO,aAAa,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS;QAAE,OAAO,aAAa,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY;QAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY;QACnC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;QAC7B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB;QACpC,UAAU,EAAE,KAAK,CAAC,WAAW;QAC7B,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACxD,kBAAkB,EAAE,GAAG;QACvB,UAAU,EAAE,wBAAwB;QACpC,UAAU,EAAE,CAAC,CAAC,eAAe;QAC7B,GAAG,EAAE,KAAK;KACX,CAAC,CAAC;IAEH,IAAI,aAAkD,CAAC;IACvD,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC;gBACnD,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;gBAC7B,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,MAAM,EAAE,KAAK,CAAC,cAAc;gBAC5B,UAAU,EAAE,KAAK,CAAC,WAAW;gBAC7B,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;aACzD,CAAC,CAAC;YACH,aAAa,GAAG;gBACd,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;aACnE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;gBACb,EAAE,EAAE,KAAK,EAAE;gBACX,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE;gBAChF,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;aAC/B,CAAC,CAAC;YACH,qEAAqE;YACrE,qEAAqE;YACrE,8DAA8D;YAC9D,mEAAmE;YACnE,gDAAgD;QAClD,CAAC;IACH,CAAC;IAED,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAsB;QAClC,YAAY,EAAE,MAAM,CAAC,KAAK;QAC1B,UAAU,EAAE,MAAM;QAClB,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;QAC5B,GAAG,CAAC,aAAa,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;KACxD,CAAC;IACF,OAAO,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,CAAW,EACX,GAAsB,EACtB,aAA4B;IAE5B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAE5D,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC;IAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,oBAAoB,EAAE,CAAC;IACnG,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEzC,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE;QACvD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY;QAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY;QACnC,eAAe,EAAE,CAAC,CAAC,oBAAoB;QACvC,GAAG,EAAE,KAAK;KACX,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;IAElE,MAAM,UAAU,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACxC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;IAEpE,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE;QAC9C,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;QAC9C,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE;QAC7B,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC;QAC9C,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC;QAC5D,GAAG,EAAE,KAAK;QACV,aAAa,EAAE,wBAAwB;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IAEhE,IAAI,aAAa,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS,EAAE;YACT,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG;YAC/B,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM;YACjC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,WAAW;SAC3C;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './handler.js';
+export * from './next-adapter.js';
+export * from './stores.js';
+export declare const VENDOR_SDK_NEXT_VERSION = "0.3.0";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAM5B,eAAO,MAAM,uBAAuB,UAAU,CAAC"}

package/dist/index.js

@@ -0,0 +1,10 @@
+// Full SDK (Node runtime).
+export * from './types.js';
+export * from './handler.js';
+export * from './next-adapter.js';
+export * from './stores.js';
+// NOTE: for Edge runtime (middleware), use the subpath import:
+//   import { isAgentRequest } from '@agentic-passport/next/edge';
+// That path never pulls in node:crypto.
+export const VENDOR_SDK_NEXT_VERSION = '0.3.0';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAE5B,+DAA+D;AAC/D,kEAAkE;AAClE,wCAAwC;AAExC,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC"}

package/dist/is-agent-request.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Edge-safe header sniff. NO Node-only imports anywhere in this module's
+ * transitive dep tree — vendors can call this from middleware running on the
+ * Edge runtime (Next.js middleware default, Cloudflare Workers, Deno Deploy,
+ * etc.) without webpack failing on `node:crypto`.
+ *
+ * Two headers from RFC 9421 / the AgentPassport profile uniquely identify an
+ * agent-signed request: `Signature` and `Signature-Agent`. Either header
+ * alone is ambiguous (a service might set a `Signature` header for other
+ * reasons), so we require both.
+ */
+export declare function isAgentRequest(req: {
+    headers: {
+        get?: (k: string) => string | null;
+    } | Readonly<Record<string, string | undefined>>;
+}): boolean;
+//# sourceMappingURL=is-agent-request.d.ts.map

package/dist/is-agent-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-agent-request.d.ts","sourceRoot":"","sources":["../src/is-agent-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,wBAAgB,cAAc,CAAC,GAAG,EAAE;IAAE,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;CAAE,GAAG,OAAO,CAY/I"}

package/dist/is-agent-request.js

@@ -0,0 +1,28 @@
+/**
+ * Edge-safe header sniff. NO Node-only imports anywhere in this module's
+ * transitive dep tree — vendors can call this from middleware running on the
+ * Edge runtime (Next.js middleware default, Cloudflare Workers, Deno Deploy,
+ * etc.) without webpack failing on `node:crypto`.
+ *
+ * Two headers from RFC 9421 / the AgentPassport profile uniquely identify an
+ * agent-signed request: `Signature` and `Signature-Agent`. Either header
+ * alone is ambiguous (a service might set a `Signature` header for other
+ * reasons), so we require both.
+ */
+const SIGNATURE_HEADER = 'signature';
+const SIGNATURE_AGENT_HEADER = 'signature-agent';
+export function isAgentRequest(req) {
+    const headers = req.headers;
+    if (typeof headers.get === 'function') {
+        // Headers / Request.headers
+        const h = headers;
+        return h.get(SIGNATURE_HEADER) != null && h.get(SIGNATURE_AGENT_HEADER) != null;
+    }
+    // Plain record
+    const rec = headers;
+    const lower = {};
+    for (const [k, v] of Object.entries(rec))
+        lower[k.toLowerCase()] = v;
+    return lower[SIGNATURE_HEADER] != null && lower[SIGNATURE_AGENT_HEADER] != null;
+}
+//# sourceMappingURL=is-agent-request.js.map

package/dist/is-agent-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-agent-request.js","sourceRoot":"","sources":["../src/is-agent-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,gBAAgB,GAAG,WAAW,CAAC;AACrC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEjD,MAAM,UAAU,cAAc,CAAC,GAAuG;IACpI,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7D,4BAA4B;QAC5B,MAAM,CAAC,GAAG,OAAgD,CAAC;QAC3D,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;IAClF,CAAC;IACD,eAAe;IACf,MAAM,GAAG,GAAG,OAA6C,CAAC;IAC1D,MAAM,KAAK,GAAuC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAClF,CAAC"}