@agents24/client 0.2.0 → 0.2.1

package/dist/index.js

@@ -1,558 +1,6 @@
-export { createAgents24Client } from './chunk-QAIOKNUK.js';
-import { defaultClock, defaultIds, resolveEncoder, canonicalHtu, Agents24ClientError, missingCapability, normalizeBaseUrl, resolveFetch, dpopTokenRequest, absoluteUrl, encodePath, responseError, responseJson, AuthenticatedHttp } from './chunk-SCZMUBXD.js';
-export { Agents24ClientError, createByteMultipartEncoder } from './chunk-SCZMUBXD.js';
-import './chunk-NGZUJ3YT.js';
-
-// src/base64url.ts
-function base64UrlEncode(bytes) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-  let output = "";
-  for (let index = 0; index < bytes.length; index += 3) {
-    const first = bytes[index] ?? 0;
-    const second = bytes[index + 1];
-    const third = bytes[index + 2];
-    const packed = first << 16 | (second ?? 0) << 8 | (third ?? 0);
-    output += alphabet[packed >>> 18 & 63];
-    output += alphabet[packed >>> 12 & 63];
-    output += second === void 0 ? "=" : alphabet[packed >>> 6 & 63];
-    output += third === void 0 ? "=" : alphabet[packed & 63];
-  }
-  return output.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
-}
-
-// src/dpop.ts
-function resolveCrypto(injected) {
-  const value = injected ?? globalThis.crypto;
-  if (!value?.subtle) throw missingCapability("crypto.subtle");
-  return value;
-}
-function publicJwkOnly(jwk) {
-  if (jwk.kty !== "EC" || jwk.crv !== "P-256" || !jwk.x || !jwk.y) {
-    throw new Agents24ClientError("DPoP requires a P-256 public key.", {
-      kind: "configuration",
-      code: "INVALID_DPOP_KEY"
-    });
-  }
-  return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
-}
-async function hash(subtle, encoder, input) {
-  return base64UrlEncode(new Uint8Array(await subtle.digest("SHA-256", encoder.encode(input))));
-}
-function createWebCryptoDpopKeyProvider(options = {}) {
-  const crypto = resolveCrypto(options.crypto);
-  const clock = options.clock ?? defaultClock();
-  const ids = options.ids ?? defaultIds();
-  const encoder = resolveEncoder(options.encoder);
-  let handlePromise;
-  let jwkPromise;
-  const getHandle = () => {
-    if (!handlePromise) {
-      handlePromise = (async () => {
-        const stored = await options.storage?.load();
-        if (stored) return stored;
-        const generated = await crypto.subtle.generateKey(
-          { name: "ECDSA", namedCurve: "P-256" },
-          false,
-          ["sign", "verify"]
-        );
-        await options.storage?.save(generated);
-        return generated;
-      })();
-    }
-    return handlePromise;
-  };
-  const getPublicJwk = () => {
-    if (!jwkPromise) {
-      jwkPromise = getHandle().then(async (handle) => publicJwkOnly(await crypto.subtle.exportKey("jwk", handle.publicKey)));
-    }
-    return jwkPromise;
-  };
-  return {
-    getPublicJwk,
-    async getThumbprint() {
-      const jwk = await getPublicJwk();
-      return hash(crypto.subtle, encoder, JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }));
-    },
-    async signProof(input) {
-      const jwk = await getPublicJwk();
-      const header = base64UrlEncode(encoder.encode(JSON.stringify({ typ: "dpop+jwt", alg: "ES256", jwk })));
-      const claims = {
-        jti: ids.createId(),
-        htm: input.method.toUpperCase(),
-        htu: canonicalHtu(input.url),
-        iat: Math.floor(clock.now() / 1e3)
-      };
-      if (input.accessToken) claims.ath = await hash(crypto.subtle, encoder, input.accessToken);
-      if (input.nonce) claims.nonce = input.nonce;
-      const payload = base64UrlEncode(encoder.encode(JSON.stringify(claims)));
-      const signingInput = `${header}.${payload}`;
-      const handle = await getHandle();
-      const signature = new Uint8Array(
-        await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, handle.privateKey, encoder.encode(signingInput))
-      );
-      if (signature.byteLength !== 64) {
-        throw new Agents24ClientError("The WebCrypto provider returned a non-JOSE ECDSA signature.", {
-          kind: "configuration",
-          code: "INVALID_DPOP_SIGNATURE"
-        });
-      }
-      return `${signingInput}.${base64UrlEncode(signature)}`;
-    }
-  };
-}
-async function createPkcePair(cryptoInput, encoderInput) {
-  const crypto = resolveCrypto(cryptoInput);
-  const encoder = resolveEncoder(encoderInput);
-  const random = new Uint8Array(32);
-  const getRandomValues = crypto.getRandomValues?.bind(crypto);
-  if (!getRandomValues) throw missingCapability("crypto.getRandomValues");
-  getRandomValues(random);
-  const verifier = base64UrlEncode(random);
-  return { verifier, challenge: await hash(crypto.subtle, encoder, verifier) };
-}
-
-// src/sessions.ts
-function parseSessionToken(value, options) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Agents24ClientError("The session endpoint returned an invalid response.", {
-      kind: "protocol",
-      code: "INVALID_SESSION_RESPONSE"
-    });
-  }
-  const body = value;
-  if (typeof body.access_token !== "string" || !body.access_token || /[\r\n\0]/.test(body.access_token)) {
-    throw new Agents24ClientError("The session endpoint returned an invalid access token.", {
-      kind: "protocol",
-      code: "INVALID_SESSION_RESPONSE"
-    });
-  }
-  const tokenType = body.token_type === "DPoP" ? "DPoP" : body.token_type === "Bearer" ? "Bearer" : void 0;
-  if (!tokenType || tokenType === "DPoP" && !options.dpopKeyProvider) {
-    throw new Agents24ClientError("The session endpoint returned an unsupported token profile.", {
-      kind: "protocol",
-      code: "INVALID_TOKEN_PROFILE"
-    });
-  }
-  const parsedExpiresAt = typeof body.expires_at === "string" ? Date.parse(body.expires_at) : Number.NaN;
-  const expiresIn = typeof body.expires_in === "number" && Number.isFinite(body.expires_in) ? body.expires_in : 0;
-  const expiresAt = Number.isFinite(parsedExpiresAt) ? parsedExpiresAt : options.clock.now() + expiresIn * 1e3;
-  if (!Number.isFinite(expiresAt) || expiresAt <= options.clock.now()) {
-    throw new Agents24ClientError("The session endpoint returned an expired access token.", {
-      kind: "protocol",
-      code: "INVALID_SESSION_EXPIRY"
-    });
-  }
-  const refreshGrant = typeof body.refresh_grant === "string" && body.refresh_grant && !/[\r\n\0]/.test(body.refresh_grant) ? body.refresh_grant : void 0;
-  if (body.refresh_grant !== void 0 && !refreshGrant) {
-    throw new Agents24ClientError("The session endpoint returned an invalid refresh grant.", {
-      kind: "protocol",
-      code: "INVALID_SESSION_RESPONSE"
-    });
-  }
-  if (refreshGrant && (tokenType !== "DPoP" || !options.dpopKeyProvider)) {
-    throw new Agents24ClientError("Persistent sessions require a DPoP-bound token profile.", {
-      kind: "protocol",
-      code: "INVALID_TOKEN_PROFILE"
-    });
-  }
-  return {
-    access: {
-      accessToken: body.access_token,
-      tokenType,
-      expiresAt,
-      ...typeof body.session_id === "string" ? { sessionId: body.session_id } : {},
-      ...Array.isArray(body.capabilities) && body.capabilities.every((item) => typeof item === "string") ? { capabilities: body.capabilities } : {},
-      ...options.dpopKeyProvider ? { dpopKeyProvider: options.dpopKeyProvider } : {},
-      ...typeof body.dpop_nonce === "string" ? { dpopNonce: body.dpop_nonce } : {}
-    },
-    ...refreshGrant ? { refreshGrant } : {},
-    ...typeof (body.refresh_expires_at ?? body.refresh_grant_absolute_expires_at) === "string" ? { absoluteExpiresAt: body.refresh_expires_at ?? body.refresh_grant_absolute_expires_at } : {}
-  };
-}
-function refreshFenceLost() {
-  return new Agents24ClientError("Refresh coordination ownership changed before completion.", {
-    kind: "conflict",
-    code: "REFRESH_FENCE_LOST",
-    retryable: true
-  });
-}
-function defaultWait(milliseconds) {
-  const schedule = globalThis.setTimeout;
-  if (!schedule) {
-    throw new Agents24ClientError("Cross-runtime refresh coordination requires a wait capability.", {
-      kind: "missing_capability",
-      code: "MISSING_WAIT_CAPABILITY"
-    });
-  }
-  return new Promise((resolve) => schedule(resolve, milliseconds));
-}
-function createFencedRefreshCoordinator(options) {
-  const clock = options.clock ?? defaultClock();
-  const ids = options.ids ?? defaultIds();
-  const ownerId = options.ownerId ?? ids.createId();
-  const leaseDurationMs = Math.max(1e3, options.leaseDurationMs ?? 6e4);
-  const pollIntervalMs = Math.max(10, options.pollIntervalMs ?? 100);
-  const wait = options.wait ?? defaultWait;
-  let local;
-  const assertActive = async (record) => {
-    const current = await options.storage.load();
-    if (!current?.active || current.fence !== record.fence || current.operationId !== record.operationId || current.ownerId !== ownerId || current.expiresAt <= clock.now()) {
-      throw refreshFenceLost();
-    }
-  };
-  const acquire = async () => {
-    while (true) {
-      const current = await options.storage.load();
-      const now = clock.now();
-      if (current?.active && current.expiresAt > now) {
-        await wait(Math.max(1, Math.min(pollIntervalMs, current.expiresAt - now)));
-        continue;
-      }
-      const next = {
-        active: true,
-        expiresAt: now + leaseDurationMs,
-        fence: (current?.fence ?? 0) + 1,
-        operationId: current?.active ? current.operationId : ids.createId(),
-        ownerId
-      };
-      if (await options.storage.compareAndSwap(current?.fence ?? null, next)) return next;
-    }
-  };
-  return {
-    async runExclusive(operation) {
-      if (local) return local;
-      const pending = (async () => {
-        const record = await acquire();
-        const lease = {
-          fence: record.fence,
-          operationId: record.operationId,
-          assertActive: () => assertActive(record)
-        };
-        try {
-          return await operation(lease);
-        } finally {
-          const current = await options.storage.load();
-          if (current?.active && current.fence === record.fence && current.operationId === record.operationId && current.ownerId === ownerId) {
-            await options.storage.compareAndSwap(current.fence, {
-              ...current,
-              active: false,
-              expiresAt: clock.now()
-            });
-          }
-        }
-      })();
-      local = pending;
-      try {
-        return await pending;
-      } finally {
-        if (local === pending) local = void 0;
-      }
-    }
-  };
-}
-function createInMemoryRefreshCoordinator() {
-  let active;
-  let fence = 0;
-  return {
-    async runExclusive(operation) {
-      if (active) return active;
-      fence += 1;
-      const ownedFence = fence;
-      const current = Promise.resolve().then(() => operation({
-        fence: ownedFence,
-        operationId: `memory-refresh-${ownedFence}`,
-        async assertActive() {
-          if (active !== current) throw refreshFenceLost();
-        }
-      }));
-      active = current;
-      try {
-        return await current;
-      } finally {
-        if (active === current) active = void 0;
-      }
-    }
-  };
-}
-function createStaticSessionProvider(access) {
-  return {
-    async getAccess() {
-      return access;
-    }
-  };
-}
-function createManagedSessionProvider(options) {
-  if (options.storage && !options.dpopKeyProvider) {
-    throw new Agents24ClientError("Persistent session storage requires a DPoP key provider.", {
-      kind: "configuration",
-      code: "PERSISTENT_SESSION_REQUIRES_DPOP"
-    });
-  }
-  const baseUrl = normalizeBaseUrl(options.baseUrl);
-  const fetch = resolveFetch(options.fetch);
-  const clock = options.clock ?? defaultClock();
-  const ids = options.ids ?? defaultIds();
-  const coordinator = options.coordinator ?? createInMemoryRefreshCoordinator();
-  let current;
-  let refreshGrant;
-  let minting;
-  const emit = async (event) => {
-    try {
-      await options.telemetry?.emit(event);
-    } catch {
-    }
-  };
-  const loadStored = async () => {
-    const stored = await options.storage?.load() ?? null;
-    if (!stored) return null;
-    if (!stored.refreshGrant || /[\r\n\0]/.test(stored.refreshGrant)) {
-      throw new Agents24ClientError("Stored session state is invalid.", {
-        kind: "authentication",
-        code: "INVALID_STORED_SESSION"
-      });
-    }
-    if (stored.absoluteExpiresAt) {
-      const absoluteExpiry = Date.parse(stored.absoluteExpiresAt);
-      if (!Number.isFinite(absoluteExpiry) || absoluteExpiry <= clock.now()) {
-        await options.storage?.clear();
-        throw new Agents24ClientError("The persistent session has expired.", {
-          kind: "authentication",
-          code: "SESSION_EXPIRED"
-        });
-      }
-    }
-    return stored;
-  };
-  const save = async (parsed) => {
-    current = parsed.access;
-    if (parsed.refreshGrant) refreshGrant = parsed.refreshGrant;
-    if (refreshGrant && options.storage) {
-      await options.storage.save({
-        refreshGrant,
-        ...current.sessionId ? { sessionId: current.sessionId } : {},
-        ...parsed.absoluteExpiresAt ? { absoluteExpiresAt: parsed.absoluteExpiresAt } : {}
-      });
-    }
-  };
-  const mint = async (signal) => {
-    if (!minting) {
-      const url = absoluteUrl(baseUrl, `/public/client-runtime/deployments/${encodePath(options.deploymentId)}/sessions/anonymous`);
-      minting = options.mint({ fetch, url, dpopKeyProvider: options.dpopKeyProvider, signal }).then(async (value) => {
-        const parsed = parseSessionToken(value, { clock, dpopKeyProvider: options.dpopKeyProvider });
-        await save(parsed);
-        return parsed.access;
-      }).finally(() => {
-        minting = void 0;
-      });
-    }
-    return minting;
-  };
-  const refresh = async (signal) => coordinator.runExclusive(async (lease) => {
-    if (!refreshGrant && options.storage) {
-      const stored = await loadStored();
-      refreshGrant = stored?.refreshGrant;
-    }
-    if (!refreshGrant) return mint(signal);
-    await lease.assertActive();
-    const response = await dpopTokenRequest({
-      fetch,
-      url: absoluteUrl(baseUrl, "/public/client-runtime/sessions/refresh"),
-      body: { refresh_grant: refreshGrant },
-      dpopKeyProvider: options.dpopKeyProvider,
-      signal,
-      idempotencyKey: lease.operationId
-    });
-    if (!response.ok) {
-      if (response.status === 400 || response.status === 401 || response.status === 403) {
-        await lease.assertActive();
-        await options.storage?.clear();
-        refreshGrant = void 0;
-        current = void 0;
-      }
-      throw await responseError(response);
-    }
-    await lease.assertActive();
-    const parsed = parseSessionToken(await responseJson(response), { clock, dpopKeyProvider: options.dpopKeyProvider });
-    await save(parsed);
-    await emit({ type: "session.refreshed", operation: "session" });
-    return parsed.access;
-  });
-  let provider;
-  provider = {
-    async getAccess(context) {
-      if (current && current.expiresAt > clock.now()) return current;
-      if (refreshGrant || (await loadStored())?.refreshGrant) return refresh(context.signal);
-      return mint(context.signal);
-    },
-    async refresh(context) {
-      return refresh(context.signal);
-    },
-    async revoke(input) {
-      const authenticated = new AuthenticatedHttp({
-        baseUrl,
-        sessionProvider: provider,
-        fetch,
-        clock
-      });
-      await authenticated.json("POST", "/public/client-runtime/sessions/revoke", {
-        operation: "sessions.revoke",
-        idempotencyKey: input?.idempotencyKey ?? ids.createId(),
-        ...input?.signal ? { signal: input.signal } : {}
-      });
-      current = void 0;
-      refreshGrant = void 0;
-      await options.storage?.clear();
-      await emit({ type: "session.revoked", operation: "session" });
-    }
-  };
-  return provider;
-}
-function createAnonymousSessionProvider(options) {
-  if ((options.persistent || options.nativeProfileId) && !options.dpopKeyProvider) {
-    throw new Agents24ClientError("Persistent and native anonymous sessions require a DPoP key provider.", {
-      kind: "configuration",
-      code: "MISSING_DPOP_PROVIDER"
-    });
-  }
-  const ids = options.ids ?? defaultIds();
-  return createManagedSessionProvider({
-    ...options,
-    async mint({ fetch, url, dpopKeyProvider, signal }) {
-      const response = await dpopTokenRequest({
-        fetch,
-        url,
-        body: {
-          persistent: options.persistent ?? false,
-          requested_capabilities: [...options.requestedCapabilities ?? []],
-          ...options.nativeProfileId ? { native_profile_id: options.nativeProfileId } : {},
-          ...dpopKeyProvider ? { dpop_public_jwk: await dpopKeyProvider.getPublicJwk() } : {},
-          ...options.attestation ? { attestation: options.attestation } : {}
-        },
-        dpopKeyProvider,
-        prooflessInitialRequest: Boolean(dpopKeyProvider),
-        signal,
-        idempotencyKey: ids.createId()
-      });
-      if (!response.ok) throw await responseError(response);
-      return responseJson(response);
-    }
-  });
-}
-function createHostedOidcSessionProvider(options) {
-  const baseUrl = normalizeBaseUrl(options.baseUrl);
-  const fetch = resolveFetch(options.fetch);
-  const clock = options.clock ?? defaultClock();
-  let current;
-  let refreshGrant;
-  let enrollmentNonce;
-  const ids = options.ids ?? defaultIds();
-  let memoryRecord = null;
-  const effectiveStorage = {
-    async load() {
-      return await options.storage?.load() ?? memoryRecord;
-    },
-    async save(record) {
-      memoryRecord = record;
-      await options.storage?.save(record);
-    },
-    async clear() {
-      memoryRecord = null;
-      await options.storage?.clear();
-    }
-  };
-  const baseProvider = createManagedSessionProvider({
-    ...options,
-    storage: effectiveStorage,
-    async mint() {
-      throw new Agents24ClientError("Complete the hosted OIDC authorization before requesting access.", {
-        kind: "authentication",
-        code: "OIDC_AUTHORIZATION_REQUIRED"
-      });
-    }
-  });
-  return {
-    async beginAuthorization(input) {
-      const url = absoluteUrl(
-        baseUrl,
-        `/public/client-runtime/deployments/${encodePath(options.deploymentId)}/sessions/oidc/authorize`
-      );
-      const response = await dpopTokenRequest({
-        fetch,
-        url,
-        dpopKeyProvider: options.dpopKeyProvider,
-        signal: input.signal,
-        idempotencyKey: ids.createId(),
-        body: {
-          redirect_uri: input.redirectUri,
-          code_challenge: input.codeChallenge,
-          code_challenge_method: "S256",
-          persistent: true,
-          dpop_public_jwk: await options.dpopKeyProvider.getPublicJwk(),
-          ...input.nativeProfileId ? { native_profile_id: input.nativeProfileId } : {}
-        }
-      });
-      if (!response.ok) throw await responseError(response);
-      const body = await responseJson(response);
-      if (typeof body.authorization_url !== "string") {
-        throw new Agents24ClientError("The OIDC endpoint returned an invalid authorization URL.", {
-          kind: "protocol",
-          code: "INVALID_OIDC_RESPONSE"
-        });
-      }
-      if (typeof body.dpop_nonce !== "string" || !body.dpop_nonce) {
-        throw new Agents24ClientError("The OIDC endpoint did not return a DPoP enrollment nonce.", {
-          kind: "protocol",
-          code: "INVALID_OIDC_RESPONSE"
-        });
-      }
-      enrollmentNonce = body.dpop_nonce;
-      return { authorizationUrl: body.authorization_url };
-    },
-    async exchange(input) {
-      const response = await dpopTokenRequest({
-        fetch,
-        url: absoluteUrl(
-          baseUrl,
-          `/public/client-runtime/deployments/${encodePath(options.deploymentId)}/sessions/oidc/exchange`
-        ),
-        dpopKeyProvider: options.dpopKeyProvider,
-        signal: input.signal,
-        idempotencyKey: ids.createId(),
-        nonce: enrollmentNonce,
-        body: { code: input.code, code_verifier: input.codeVerifier }
-      });
-      if (!response.ok) throw await responseError(response);
-      const parsed = parseSessionToken(await responseJson(response), {
-        clock,
-        dpopKeyProvider: options.dpopKeyProvider
-      });
-      current = parsed.access;
-      enrollmentNonce = void 0;
-      refreshGrant = parsed.refreshGrant;
-      if (refreshGrant) {
-        await effectiveStorage.save({
-          refreshGrant,
-          ...current.sessionId ? { sessionId: current.sessionId } : {},
-          ...parsed.absoluteExpiresAt ? { absoluteExpiresAt: parsed.absoluteExpiresAt } : {}
-        });
-      }
-      return current;
-    },
-    async getAccess(context) {
-      if (current && current.expiresAt > clock.now()) return current;
-      return baseProvider.getAccess(context);
-    },
-    async refresh(context) {
-      return baseProvider.refresh?.(context) ?? Promise.reject(new Error("Refresh unavailable"));
-    },
-    async revoke(input) {
-      await baseProvider.revoke?.(input);
-      current = void 0;
-      refreshGrant = void 0;
-    }
-  };
-}
-
-export { createAnonymousSessionProvider, createFencedRefreshCoordinator, createHostedOidcSessionProvider, createInMemoryRefreshCoordinator, createManagedSessionProvider, createPkcePair, createStaticSessionProvider, createWebCryptoDpopKeyProvider };
+export { createAnonymousSessionProvider, createFencedRefreshCoordinator, createHostedOidcSessionProvider, createInMemoryRefreshCoordinator, createManagedSessionProvider, createPkcePair, createStaticSessionProvider, createWebCryptoDpopKeyProvider } from './chunk-FNR3KPB6.js';
+export { createAgents24Client } from './chunk-SPWEZFHZ.js';
+export { Agents24ClientError, createByteMultipartEncoder } from './chunk-GXISGBVW.js';
+import './chunk-IOVCURGW.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/base64url.ts","../src/dpop.ts","../src/sessions.ts"],"names":[],"mappings":";;;;;;AAAO,SAAS,gBAAgB,KAAA,EAA2B;AACzD,EAAA,MAAM,QAAA,GAAW,kEAAA;AACjB,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,KAAA,CAAM,MAAA,EAAQ,SAAS,CAAA,EAAG;AACpD,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAK,CAAA,IAAK,CAAA;AAC9B,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA;AAC9B,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA;AAC7B,IAAA,MAAM,SAAU,KAAA,IAAS,EAAA,GAAA,CAAQ,MAAA,IAAU,CAAA,KAAM,KAAM,KAAA,IAAS,CAAA,CAAA;AAChE,IAAA,MAAA,IAAU,QAAA,CAAU,MAAA,KAAW,EAAA,GAAM,EAAE,CAAA;AACvC,IAAA,MAAA,IAAU,QAAA,CAAU,MAAA,KAAW,EAAA,GAAM,EAAE,CAAA;AACvC,IAAA,MAAA,IAAU,WAAW,MAAA,GAAY,GAAA,GAAM,QAAA,CAAU,MAAA,KAAW,IAAK,EAAE,CAAA;AACnE,IAAA,MAAA,IAAU,KAAA,KAAU,MAAA,GAAY,GAAA,GAAM,QAAA,CAAS,SAAS,EAAE,CAAA;AAAA,EAC5D;AACA,EAAA,OAAO,MAAA,CAAO,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA;AACxE;;;AC6BA,SAAS,cAAc,QAAA,EAAyC;AAC9D,EAAA,MAAM,KAAA,GAAQ,YAAa,UAAA,CAAqD,MAAA;AAChF,EAAA,IAAI,CAAC,KAAA,EAAO,MAAA,EAAQ,MAAM,kBAAkB,eAAe,CAAA;AAC3D,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,cAAc,GAAA,EAA2B;AAChD,EAAA,IAAI,GAAA,CAAI,GAAA,KAAQ,IAAA,IAAQ,GAAA,CAAI,GAAA,KAAQ,OAAA,IAAW,CAAC,GAAA,CAAI,CAAA,IAAK,CAAC,GAAA,CAAI,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,oBAAoB,mCAAA,EAAqC;AAAA,MACjE,IAAA,EAAM,eAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,EAAE,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,OAAA,EAAS,GAAG,GAAA,CAAI,CAAA,EAAG,CAAA,EAAG,GAAA,CAAI,CAAA,EAAE;AACvD;AAEA,eAAe,IAAA,CAAK,MAAA,EAA0B,OAAA,EAA0B,KAAA,EAAgC;AACtG,EAAA,OAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAC,CAAC,CAAC,CAAA;AAC9F;AAEO,SAAS,8BAAA,CAA+B,OAAA,GAAgC,EAAC,EAAoB;AAClG,EAAA,MAAM,MAAA,GAAS,aAAA,CAAc,OAAA,CAAQ,MAAM,CAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,YAAA,EAAa;AAC5C,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,UAAA,EAAW;AACtC,EAAA,MAAM,OAAA,GAAU,cAAA,CAAe,OAAA,CAAQ,OAAO,CAAA;AAC9C,EAAA,IAAI,aAAA;AACJ,EAAA,IAAI,UAAA;AAEJ,EAAA,MAAM,YAAY,MAA8B;AAC9C,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,aAAA,GAAA,CAAiB,YAAY;AAC3B,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,OAAA,EAAS,IAAA,EAAK;AAC3C,QAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,QAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,WAAA;AAAA,UACpC,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,UACrC,KAAA;AAAA,UACA,CAAC,QAAQ,QAAQ;AAAA,SACnB;AACA,QAAA,MAAM,OAAA,CAAQ,OAAA,EAAS,IAAA,CAAK,SAAS,CAAA;AACrC,QAAA,OAAO,SAAA;AAAA,MACT,CAAA,GAAG;AAAA,IACL;AACA,IAAA,OAAO,aAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,eAAe,MAA0B;AAC7C,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,UAAA,GAAa,SAAA,EAAU,CAAE,IAAA,CAAK,OAAO,WAAW,aAAA,CAAc,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,MAAA,CAAO,SAAS,CAAC,CAAC,CAAA;AAAA,IACvH;AACA,IAAA,OAAO,UAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,YAAA;AAAA,IACA,MAAM,aAAA,GAAgB;AACpB,MAAA,MAAM,GAAA,GAAM,MAAM,YAAA,EAAa;AAC/B,MAAA,OAAO,IAAA,CAAK,OAAO,MAAA,EAAQ,OAAA,EAAS,KAAK,SAAA,CAAU,EAAE,KAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,GAAA,EAAK,GAAG,GAAA,CAAI,CAAA,EAAG,GAAG,GAAA,CAAI,CAAA,EAAG,CAAC,CAAA;AAAA,IACxG,CAAA;AAAA,IACA,MAAM,UAAU,KAAA,EAAuB;AACrC,MAAA,MAAM,GAAA,GAAM,MAAM,YAAA,EAAa;AAC/B,MAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,OAAA,CAAQ,MAAA,CAAO,KAAK,SAAA,CAAU,EAAE,GAAA,EAAK,UAAA,EAAY,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,CAAC,CAAC,CAAA;AACrG,MAAA,MAAM,MAAA,GAA0C;AAAA,QAC9C,GAAA,EAAK,IAAI,QAAA,EAAS;AAAA,QAClB,GAAA,EAAK,KAAA,CAAM,MAAA,CAAO,WAAA,EAAY;AAAA,QAC9B,GAAA,EAAK,YAAA,CAAa,KAAA,CAAM,GAAG,CAAA;AAAA,QAC3B,KAAK,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,GAAA,KAAQ,GAAI;AAAA,OACpC;AACA,MAAA,IAAI,KAAA,CAAM,WAAA,EAAa,MAAA,CAAO,GAAA,GAAM,MAAM,KAAK,MAAA,CAAO,MAAA,EAAQ,OAAA,EAAS,KAAA,CAAM,WAAW,CAAA;AACxF,MAAA,IAAI,KAAA,CAAM,KAAA,EAAO,MAAA,CAAO,KAAA,GAAQ,KAAA,CAAM,KAAA;AACtC,MAAA,MAAM,OAAA,GAAU,gBAAgB,OAAA,CAAQ,MAAA,CAAO,KAAK,SAAA,CAAU,MAAM,CAAC,CAAC,CAAA;AACtE,MAAA,MAAM,YAAA,GAAe,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AACzC,MAAA,MAAM,MAAA,GAAS,MAAM,SAAA,EAAU;AAC/B,MAAA,MAAM,YAAY,IAAI,UAAA;AAAA,QACpB,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,IAAa,MAAA,CAAO,UAAA,EAAY,OAAA,CAAQ,MAAA,CAAO,YAAY,CAAC;AAAA,OAC9G;AACA,MAAA,IAAI,SAAA,CAAU,eAAe,EAAA,EAAI;AAC/B,QAAA,MAAM,IAAI,oBAAoB,6DAAA,EAA+D;AAAA,UAC3F,IAAA,EAAM,eAAA;AAAA,UACN,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AACA,MAAA,OAAO,CAAA,EAAG,YAAY,CAAA,CAAA,EAAI,eAAA,CAAgB,SAAS,CAAC,CAAA,CAAA;AAAA,IACtD;AAAA,GACF;AACF;AAEA,eAAsB,cAAA,CACpB,aACA,YAAA,EACkD;AAClD,EAAA,MAAM,MAAA,GAAS,cAAc,WAAW,CAAA;AACxC,EAAA,MAAM,OAAA,GAAU,eAAe,YAAY,CAAA;AAC3C,EAAA,MAAM,MAAA,GAAS,IAAI,UAAA,CAAW,EAAE,CAAA;AAChC,EAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,eAAA,EAAiB,IAAA,CAAK,MAAM,CAAA;AAC3D,EAAA,IAAI,CAAC,eAAA,EAAiB,MAAM,iBAAA,CAAkB,wBAAwB,CAAA;AACtE,EAAA,eAAA,CAAgB,MAAM,CAAA;AACtB,EAAA,MAAM,QAAA,GAAW,gBAAgB,MAAM,CAAA;AACvC,EAAA,OAAO,EAAE,UAAU,SAAA,EAAW,MAAM,KAAK,MAAA,CAAO,MAAA,EAAQ,OAAA,EAAS,QAAQ,CAAA,EAAE;AAC7E;;;AC3GA,SAAS,iBAAA,CACP,OACA,OAAA,EACoF;AACpF,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,oBAAoB,oDAAA,EAAsD;AAAA,MAClF,IAAA,EAAM,UAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,IAAA,GAAO,KAAA;AACb,EAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,IAAY,CAAC,IAAA,CAAK,YAAA,IAAgB,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK,YAAY,CAAA,EAAG;AACrG,IAAA,MAAM,IAAI,oBAAoB,wDAAA,EAA0D;AAAA,MACtF,IAAA,EAAM,UAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,SAAA,GAAY,KAAK,UAAA,KAAe,MAAA,GAAS,SAAS,IAAA,CAAK,UAAA,KAAe,WAAW,QAAA,GAAW,MAAA;AAClG,EAAA,IAAI,CAAC,SAAA,IAAc,SAAA,KAAc,MAAA,IAAU,CAAC,QAAQ,eAAA,EAAkB;AACpE,IAAA,MAAM,IAAI,oBAAoB,6DAAA,EAA+D;AAAA,MAC3F,IAAA,EAAM,UAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,eAAA,GAAkB,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,KAAA,CAAM,IAAA,CAAK,UAAU,CAAA,GAAI,MAAA,CAAO,GAAA;AACnG,EAAA,MAAM,SAAA,GAAY,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,IAAY,MAAA,CAAO,QAAA,CAAS,IAAA,CAAK,UAAU,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa,CAAA;AAC9G,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,QAAA,CAAS,eAAe,CAAA,GAAI,kBAAkB,OAAA,CAAQ,KAAA,CAAM,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AACzG,EAAA,IAAI,CAAC,OAAO,QAAA,CAAS,SAAS,KAAK,SAAA,IAAa,OAAA,CAAQ,KAAA,CAAM,GAAA,EAAI,EAAG;AACnE,IAAA,MAAM,IAAI,oBAAoB,wDAAA,EAA0D;AAAA,MACtF,IAAA,EAAM,UAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,YAAA,GAAe,OAAO,IAAA,CAAK,aAAA,KAAkB,YAAY,IAAA,CAAK,aAAA,IAAiB,CAAC,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK,aAAa,CAAA,GACpH,KAAK,aAAA,GACL,MAAA;AACJ,EAAA,IAAI,IAAA,CAAK,aAAA,KAAkB,MAAA,IAAa,CAAC,YAAA,EAAc;AACrD,IAAA,MAAM,IAAI,oBAAoB,yDAAA,EAA2D;AAAA,MACvF,IAAA,EAAM,UAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,IAAI,YAAA,KAAiB,SAAA,KAAc,MAAA,IAAU,CAAC,QAAQ,eAAA,CAAA,EAAkB;AACtE,IAAA,MAAM,IAAI,oBAAoB,yDAAA,EAA2D;AAAA,MACvF,IAAA,EAAM,UAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ;AAAA,MACN,aAAa,IAAA,CAAK,YAAA;AAAA,MAClB,SAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAI,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,EAAE,SAAA,EAAW,IAAA,CAAK,UAAA,EAAW,GAAI,EAAC;AAAA,MAC5E,GAAI,MAAM,OAAA,CAAQ,IAAA,CAAK,YAAY,CAAA,IAAK,IAAA,CAAK,aAAa,KAAA,CAAM,CAAC,SAAS,OAAO,IAAA,KAAS,QAAQ,CAAA,GAC9F,EAAE,cAAc,IAAA,CAAK,YAAA,KACrB,EAAC;AAAA,MACL,GAAI,QAAQ,eAAA,GAAkB,EAAE,iBAAiB,OAAA,CAAQ,eAAA,KAAoB,EAAC;AAAA,MAC9E,GAAI,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,EAAE,SAAA,EAAW,IAAA,CAAK,UAAA,EAAW,GAAI;AAAC,KAC9E;AAAA,IACA,GAAI,YAAA,GAAe,EAAE,YAAA,KAAiB,EAAC;AAAA,IACvC,GAAI,QAAQ,IAAA,CAAK,kBAAA,IAAsB,KAAK,iCAAA,CAAA,KAAuC,QAAA,GAC/E,EAAE,iBAAA,EAAoB,IAAA,CAAK,kBAAA,IAAsB,IAAA,CAAK,iCAAA,KACtD;AAAC,GACP;AACF;AAEA,SAAS,gBAAA,GAAwC;AAC/C,EAAA,OAAO,IAAI,oBAAoB,2DAAA,EAA6D;AAAA,IAC1F,IAAA,EAAM,UAAA;AAAA,IACN,IAAA,EAAM,oBAAA;AAAA,IACN,SAAA,EAAW;AAAA,GACZ,CAAA;AACH;AAEA,SAAS,YAAY,YAAA,EAAqC;AACxD,EAAA,MAAM,WAAY,UAAA,CAEf,UAAA;AACH,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,MAAM,IAAI,oBAAoB,gEAAA,EAAkE;AAAA,MAC9F,IAAA,EAAM,oBAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,QAAA,CAAS,OAAA,EAAS,YAAY,CAAC,CAAA;AACjE;AAiBO,SAAS,+BACd,OAAA,EAC2B;AAC3B,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,YAAA,EAAa;AAC5C,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,UAAA,EAAW;AACtC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,GAAA,CAAI,QAAA,EAAS;AAChD,EAAA,MAAM,kBAAkB,IAAA,CAAK,GAAA,CAAI,GAAA,EAAO,OAAA,CAAQ,mBAAmB,GAAM,CAAA;AACzE,EAAA,MAAM,iBAAiB,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,OAAA,CAAQ,kBAAkB,GAAG,CAAA;AACjE,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,WAAA;AAC7B,EAAA,IAAI,KAAA;AAEJ,EAAA,MAAM,YAAA,GAAe,OAAO,MAAA,KAAqD;AAC/E,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,CAAQ,IAAA,EAAK;AAC3C,IAAA,IACE,CAAC,OAAA,EAAS,MAAA,IACV,QAAQ,KAAA,KAAU,MAAA,CAAO,SACzB,OAAA,CAAQ,WAAA,KAAgB,MAAA,CAAO,WAAA,IAC/B,QAAQ,OAAA,KAAY,OAAA,IACpB,QAAQ,SAAA,IAAa,KAAA,CAAM,KAAI,EAC/B;AACA,MAAA,MAAM,gBAAA,EAAiB;AAAA,IACzB;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,UAAU,YAAgD;AAC9D,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,CAAQ,IAAA,EAAK;AAC3C,MAAA,MAAM,GAAA,GAAM,MAAM,GAAA,EAAI;AACtB,MAAA,IAAI,OAAA,EAAS,MAAA,IAAU,OAAA,CAAQ,SAAA,GAAY,GAAA,EAAK;AAC9C,QAAA,MAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,GAAA,CAAI,cAAA,EAAgB,OAAA,CAAQ,SAAA,GAAY,GAAG,CAAC,CAAC,CAAA;AACzE,QAAA;AAAA,MACF;AACA,MAAA,MAAM,IAAA,GAAkC;AAAA,QACtC,MAAA,EAAQ,IAAA;AAAA,QACR,WAAW,GAAA,GAAM,eAAA;AAAA,QACjB,KAAA,EAAA,CAAQ,OAAA,EAAS,KAAA,IAAS,CAAA,IAAK,CAAA;AAAA,QAC/B,aAAa,OAAA,EAAS,MAAA,GAAS,OAAA,CAAQ,WAAA,GAAc,IAAI,QAAA,EAAS;AAAA,QAClE;AAAA,OACF;AACA,MAAA,IAAI,MAAM,QAAQ,OAAA,CAAQ,cAAA,CAAe,SAAS,KAAA,IAAS,IAAA,EAAM,IAAI,CAAA,EAAG,OAAO,IAAA;AAAA,IACjF;AAAA,EACF,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,aAAgB,SAAA,EAAmE;AACvF,MAAA,IAAI,OAAO,OAAO,KAAA;AAClB,MAAA,MAAM,WAAW,YAAY;AAC3B,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,EAAQ;AAC7B,QAAA,MAAM,KAAA,GAA6B;AAAA,UACjC,OAAO,MAAA,CAAO,KAAA;AAAA,UACd,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,YAAA,EAAc,MAAM,YAAA,CAAa,MAAM;AAAA,SACzC;AACA,QAAA,IAAI;AACF,UAAA,OAAO,MAAM,UAAU,KAAK,CAAA;AAAA,QAC9B,CAAA,SAAE;AACA,UAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,CAAQ,IAAA,EAAK;AAC3C,UAAA,IACE,OAAA,EAAS,MAAA,IACT,OAAA,CAAQ,KAAA,KAAU,MAAA,CAAO,KAAA,IACzB,OAAA,CAAQ,WAAA,KAAgB,MAAA,CAAO,WAAA,IAC/B,OAAA,CAAQ,OAAA,KAAY,OAAA,EACpB;AACA,YAAA,MAAM,OAAA,CAAQ,OAAA,CAAQ,cAAA,CAAe,OAAA,CAAQ,KAAA,EAAO;AAAA,cAClD,GAAG,OAAA;AAAA,cACH,MAAA,EAAQ,KAAA;AAAA,cACR,SAAA,EAAW,MAAM,GAAA;AAAI,aACtB,CAAA;AAAA,UACH;AAAA,QACF;AAAA,MACF,CAAA,GAAG;AACH,MAAA,KAAA,GAAQ,OAAA;AACR,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,OAAA;AAAA,MACf,CAAA,SAAE;AACA,QAAA,IAAI,KAAA,KAAU,SAAS,KAAA,GAAQ,MAAA;AAAA,MACjC;AAAA,IACF;AAAA,GACF;AACF;AAEO,SAAS,gCAAA,GAA8D;AAC5E,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,OAAO;AAAA,IACL,MAAM,aAAgB,SAAA,EAAmE;AACvF,MAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,MAAA,KAAA,IAAS,CAAA;AACT,MAAA,MAAM,UAAA,GAAa,KAAA;AACnB,MAAA,MAAM,UAAU,OAAA,CAAQ,OAAA,EAAQ,CAAE,IAAA,CAAK,MAAM,SAAA,CAAU;AAAA,QACrD,KAAA,EAAO,UAAA;AAAA,QACP,WAAA,EAAa,kBAAkB,UAAU,CAAA,CAAA;AAAA,QACzC,MAAM,YAAA,GAAe;AACnB,UAAA,IAAI,MAAA,KAAW,OAAA,EAAS,MAAM,gBAAA,EAAiB;AAAA,QACjD;AAAA,OACD,CAAC,CAAA;AACF,MAAA,MAAA,GAAS,OAAA;AACT,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,OAAA;AAAA,MACf,CAAA,SAAE;AACA,QAAA,IAAI,MAAA,KAAW,SAAS,MAAA,GAAS,MAAA;AAAA,MACnC;AAAA,IACF;AAAA,GACF;AACF;AAEO,SAAS,4BAA4B,MAAA,EAAoD;AAC9F,EAAA,OAAO;AAAA,IACL,MAAM,SAAA,GAAY;AAChB,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,GACF;AACF;AAoBO,SAAS,6BAA6B,OAAA,EAA+D;AAC1G,EAAA,IAAI,OAAA,CAAQ,OAAA,IAAW,CAAC,OAAA,CAAQ,eAAA,EAAiB;AAC/C,IAAA,MAAM,IAAI,oBAAoB,0DAAA,EAA4D;AAAA,MACxF,IAAA,EAAM,eAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,OAAA,CAAQ,OAAO,CAAA;AAChD,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,OAAA,CAAQ,KAAK,CAAA;AACxC,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,YAAA,EAAa;AAC5C,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,UAAA,EAAW;AACtC,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,WAAA,IAAe,gCAAA,EAAiC;AAC5E,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI,OAAA;AAEJ,EAAA,MAAM,IAAA,GAAO,OAAO,KAAA,KAA+D;AACjF,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,CAAQ,SAAA,EAAW,IAAA,CAAK,KAAK,CAAA;AAAA,IACrC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,aAAa,YAAwE;AACzF,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,OAAA,EAAS,MAAK,IAAK,IAAA;AAChD,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,IAAA,IAAI,CAAC,MAAA,CAAO,YAAA,IAAgB,WAAW,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA,EAAG;AAChE,MAAA,MAAM,IAAI,oBAAoB,kCAAA,EAAoC;AAAA,QAChE,IAAA,EAAM,gBAAA;AAAA,QACN,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AACA,IAAA,IAAI,OAAO,iBAAA,EAAmB;AAC5B,MAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,iBAAiB,CAAA;AAC1D,MAAA,IAAI,CAAC,OAAO,QAAA,CAAS,cAAc,KAAK,cAAA,IAAkB,KAAA,CAAM,KAAI,EAAG;AACrE,QAAA,MAAM,OAAA,CAAQ,SAAS,KAAA,EAAM;AAC7B,QAAA,MAAM,IAAI,oBAAoB,qCAAA,EAAuC;AAAA,UACnE,IAAA,EAAM,gBAAA;AAAA,UACN,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,IAAA,GAAO,OAAO,MAAA,KAAgE;AAClF,IAAA,OAAA,GAAU,MAAA,CAAO,MAAA;AACjB,IAAA,IAAI,MAAA,CAAO,YAAA,EAAc,YAAA,GAAe,MAAA,CAAO,YAAA;AAC/C,IAAA,IAAI,YAAA,IAAgB,QAAQ,OAAA,EAAS;AACnC,MAAA,MAAM,OAAA,CAAQ,QAAQ,IAAA,CAAK;AAAA,QACzB,YAAA;AAAA,QACA,GAAI,QAAQ,SAAA,GAAY,EAAE,WAAW,OAAA,CAAQ,SAAA,KAAc,EAAC;AAAA,QAC5D,GAAI,OAAO,iBAAA,GAAoB,EAAE,mBAAmB,MAAA,CAAO,iBAAA,KAAsB;AAAC,OACnF,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,IAAA,GAAO,OAAO,MAAA,KAA2D;AAC7E,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,GAAA,GAAM,YAAY,OAAA,EAAS,CAAA,mCAAA,EAAsC,WAAW,OAAA,CAAQ,YAAY,CAAC,CAAA,mBAAA,CAAqB,CAAA;AAC5H,MAAA,OAAA,GAAU,OAAA,CACP,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,EAAK,eAAA,EAAiB,OAAA,CAAQ,eAAA,EAAiB,MAAA,EAAQ,CAAA,CACrE,IAAA,CAAK,OAAO,KAAA,KAAU;AACrB,QAAA,MAAM,MAAA,GAAS,kBAAkB,KAAA,EAAO,EAAE,OAAO,eAAA,EAAiB,OAAA,CAAQ,iBAAiB,CAAA;AAC3F,QAAA,MAAM,KAAK,MAAM,CAAA;AACjB,QAAA,OAAO,MAAA,CAAO,MAAA;AAAA,MAChB,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM;AACb,QAAA,OAAA,GAAU,MAAA;AAAA,MACZ,CAAC,CAAA;AAAA,IACL;AACA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,UAAU,OAAO,MAAA,KACrB,WAAA,CAAY,YAAA,CAAa,OAAO,KAAA,KAAU;AACxC,IAAA,IAAI,CAAC,YAAA,IAAgB,OAAA,CAAQ,OAAA,EAAS;AACpC,MAAA,MAAM,MAAA,GAAS,MAAM,UAAA,EAAW;AAChC,MAAA,YAAA,GAAe,MAAA,EAAQ,YAAA;AAAA,IACzB;AACA,IAAA,IAAI,CAAC,YAAA,EAAc,OAAO,IAAA,CAAK,MAAM,CAAA;AACrC,IAAA,MAAM,MAAM,YAAA,EAAa;AACzB,IAAA,MAAM,QAAA,GAAW,MAAM,gBAAA,CAAiB;AAAA,MACtC,KAAA;AAAA,MACA,GAAA,EAAK,WAAA,CAAY,OAAA,EAAS,yCAAyC,CAAA;AAAA,MACnE,IAAA,EAAM,EAAE,aAAA,EAAe,YAAA,EAAa;AAAA,MACpC,iBAAiB,OAAA,CAAQ,eAAA;AAAA,MACzB,MAAA;AAAA,MACA,gBAAgB,KAAA,CAAM;AAAA,KACvB,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,EAAK;AACjF,QAAA,MAAM,MAAM,YAAA,EAAa;AACzB,QAAA,MAAM,OAAA,CAAQ,SAAS,KAAA,EAAM;AAC7B,QAAA,YAAA,GAAe,MAAA;AACf,QAAA,OAAA,GAAU,MAAA;AAAA,MACZ;AACA,MAAA,MAAM,MAAM,cAAc,QAAQ,CAAA;AAAA,IACpC;AACA,IAAA,MAAM,MAAM,YAAA,EAAa;AACzB,IAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,MAAM,YAAA,CAAa,QAAQ,CAAA,EAAG,EAAE,KAAA,EAAO,eAAA,EAAiB,OAAA,CAAQ,eAAA,EAAiB,CAAA;AAClH,IAAA,MAAM,KAAK,MAAM,CAAA;AACjB,IAAA,MAAM,KAAK,EAAE,IAAA,EAAM,mBAAA,EAAqB,SAAA,EAAW,WAAW,CAAA;AAC9D,IAAA,OAAO,MAAA,CAAO,MAAA;AAAA,EAChB,CAAC,CAAA;AAEH,EAAA,IAAI,QAAA;AACJ,EAAA,QAAA,GAAW;AAAA,IACT,MAAM,UAAU,OAAA,EAAS;AACvB,MAAA,IAAI,WAAW,OAAA,CAAQ,SAAA,GAAY,KAAA,CAAM,GAAA,IAAO,OAAO,OAAA;AACvD,MAAA,IAAI,YAAA,IAAA,CAAiB,MAAM,UAAA,EAAW,GAAI,cAAc,OAAO,OAAA,CAAQ,QAAQ,MAAM,CAAA;AACrF,MAAA,OAAO,IAAA,CAAK,QAAQ,MAAM,CAAA;AAAA,IAC5B,CAAA;AAAA,IACA,MAAM,QAAQ,OAAA,EAAS;AACrB,MAAA,OAAO,OAAA,CAAQ,QAAQ,MAAM,CAAA;AAAA,IAC/B,CAAA;AAAA,IACA,MAAM,OAAO,KAAA,EAAO;AAClB,MAAA,MAAM,aAAA,GAAgB,IAAI,iBAAA,CAAkB;AAAA,QAC1C,OAAA;AAAA,QACA,eAAA,EAAiB,QAAA;AAAA,QACjB,KAAA;AAAA,QACA;AAAA,OACD,CAAA;AACD,MAAA,MAAM,aAAA,CAAc,IAAA,CAAc,MAAA,EAAQ,wCAAA,EAA0C;AAAA,QAClF,SAAA,EAAW,iBAAA;AAAA,QACX,cAAA,EAAgB,KAAA,EAAO,cAAA,IAAkB,GAAA,CAAI,QAAA,EAAS;AAAA,QACtD,GAAI,OAAO,MAAA,GAAS,EAAE,QAAQ,KAAA,CAAM,MAAA,KAAW;AAAC,OACjD,CAAA;AACD,MAAA,OAAA,GAAU,MAAA;AACV,MAAA,YAAA,GAAe,MAAA;AACf,MAAA,MAAM,OAAA,CAAQ,SAAS,KAAA,EAAM;AAC7B,MAAA,MAAM,KAAK,EAAE,IAAA,EAAM,iBAAA,EAAmB,SAAA,EAAW,WAAW,CAAA;AAAA,IAC9D;AAAA,GACF;AACA,EAAA,OAAO,QAAA;AACT;AAUO,SAAS,+BAA+B,OAAA,EAAiE;AAC9G,EAAA,IAAA,CAAK,QAAQ,UAAA,IAAc,OAAA,CAAQ,eAAA,KAAoB,CAAC,QAAQ,eAAA,EAAiB;AAC/E,IAAA,MAAM,IAAI,oBAAoB,uEAAA,EAAyE;AAAA,MACrG,IAAA,EAAM,eAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,UAAA,EAAW;AACtC,EAAA,OAAO,4BAAA,CAA6B;AAAA,IAClC,GAAG,OAAA;AAAA,IACH,MAAM,IAAA,CAAK,EAAE,OAAO,GAAA,EAAK,eAAA,EAAiB,QAAO,EAAG;AAClD,MAAA,MAAM,QAAA,GAAW,MAAM,gBAAA,CAAiB;AAAA,QACtC,KAAA;AAAA,QACA,GAAA;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,UAAA,EAAY,QAAQ,UAAA,IAAc,KAAA;AAAA,UAClC,wBAAwB,CAAC,GAAI,OAAA,CAAQ,qBAAA,IAAyB,EAAG,CAAA;AAAA,UACjE,GAAI,QAAQ,eAAA,GAAkB,EAAE,mBAAmB,OAAA,CAAQ,eAAA,KAAoB,EAAC;AAAA,UAChF,GAAI,kBAAkB,EAAE,eAAA,EAAiB,MAAM,eAAA,CAAgB,YAAA,EAAa,EAAE,GAAI,EAAC;AAAA,UACnF,GAAI,QAAQ,WAAA,GAAc,EAAE,aAAa,OAAA,CAAQ,WAAA,KAAgB;AAAC,SACpE;AAAA,QACA,eAAA;AAAA,QACA,uBAAA,EAAyB,QAAQ,eAAe,CAAA;AAAA,QAChD,MAAA;AAAA,QACA,cAAA,EAAgB,IAAI,QAAA;AAAS,OAC9B,CAAA;AACD,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,EAAI,MAAM,MAAM,cAAc,QAAQ,CAAA;AACpD,MAAA,OAAO,aAAa,QAAQ,CAAA;AAAA,IAC9B;AAAA,GACD,CAAA;AACH;AAkBO,SAAS,gCAAgC,OAAA,EAAsE;AACpH,EAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,OAAA,CAAQ,OAAO,CAAA;AAChD,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,OAAA,CAAQ,KAAK,CAAA;AACxC,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,YAAA,EAAa;AAC5C,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI,eAAA;AACJ,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,UAAA,EAAW;AACtC,EAAA,IAAI,YAAA,GAAkE,IAAA;AACtE,EAAA,MAAM,gBAAA,GAAyC;AAAA,IAC7C,MAAM,IAAA,GAAO;AACX,MAAA,OAAQ,MAAM,OAAA,CAAQ,OAAA,EAAS,IAAA,EAAK,IAAM,YAAA;AAAA,IAC5C,CAAA;AAAA,IACA,MAAM,KAAK,MAAA,EAAQ;AACjB,MAAA,YAAA,GAAe,MAAA;AACf,MAAA,MAAM,OAAA,CAAQ,OAAA,EAAS,IAAA,CAAK,MAAM,CAAA;AAAA,IACpC,CAAA;AAAA,IACA,MAAM,KAAA,GAAQ;AACZ,MAAA,YAAA,GAAe,IAAA;AACf,MAAA,MAAM,OAAA,CAAQ,SAAS,KAAA,EAAM;AAAA,IAC/B;AAAA,GACF;AACA,EAAA,MAAM,eAAe,4BAAA,CAA6B;AAAA,IAChD,GAAG,OAAA;AAAA,IACH,OAAA,EAAS,gBAAA;AAAA,IACT,MAAM,IAAA,GAAO;AACX,MAAA,MAAM,IAAI,oBAAoB,kEAAA,EAAoE;AAAA,QAChG,IAAA,EAAM,gBAAA;AAAA,QACN,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AAAA,GACD,CAAA;AAED,EAAA,OAAO;AAAA,IACL,MAAM,mBAAmB,KAAA,EAAO;AAC9B,MAAA,MAAM,GAAA,GAAM,WAAA;AAAA,QACV,OAAA;AAAA,QACA,CAAA,mCAAA,EAAsC,UAAA,CAAW,OAAA,CAAQ,YAAY,CAAC,CAAA,wBAAA;AAAA,OACxE;AACA,MAAA,MAAM,QAAA,GAAW,MAAM,gBAAA,CAAiB;AAAA,QACtC,KAAA;AAAA,QACA,GAAA;AAAA,QACA,iBAAiB,OAAA,CAAQ,eAAA;AAAA,QACzB,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,cAAA,EAAgB,IAAI,QAAA,EAAS;AAAA,QAC7B,IAAA,EAAM;AAAA,UACJ,cAAc,KAAA,CAAM,WAAA;AAAA,UACpB,gBAAgB,KAAA,CAAM,aAAA;AAAA,UACtB,qBAAA,EAAuB,MAAA;AAAA,UACvB,UAAA,EAAY,IAAA;AAAA,UACZ,eAAA,EAAiB,MAAM,OAAA,CAAQ,eAAA,CAAgB,YAAA,EAAa;AAAA,UAC5D,GAAI,MAAM,eAAA,GAAkB,EAAE,mBAAmB,KAAA,CAAM,eAAA,KAAoB;AAAC;AAC9E,OACD,CAAA;AACD,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,EAAI,MAAM,MAAM,cAAc,QAAQ,CAAA;AACpD,MAAA,MAAM,IAAA,GAAQ,MAAM,YAAA,CAAa,QAAQ,CAAA;AACzC,MAAA,IAAI,OAAO,IAAA,CAAK,iBAAA,KAAsB,QAAA,EAAU;AAC9C,QAAA,MAAM,IAAI,oBAAoB,0DAAA,EAA4D;AAAA,UACxF,IAAA,EAAM,UAAA;AAAA,UACN,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AACA,MAAA,IAAI,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,IAAY,CAAC,KAAK,UAAA,EAAY;AAC3D,QAAA,MAAM,IAAI,oBAAoB,2DAAA,EAA6D;AAAA,UACzF,IAAA,EAAM,UAAA;AAAA,UACN,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AACA,MAAA,eAAA,GAAkB,IAAA,CAAK,UAAA;AACvB,MAAA,OAAO,EAAE,gBAAA,EAAkB,IAAA,CAAK,iBAAA,EAAkB;AAAA,IACpD,CAAA;AAAA,IACA,MAAM,SAAS,KAAA,EAAO;AACpB,MAAA,MAAM,QAAA,GAAW,MAAM,gBAAA,CAAiB;AAAA,QACtC,KAAA;AAAA,QACA,GAAA,EAAK,WAAA;AAAA,UACH,OAAA;AAAA,UACA,CAAA,mCAAA,EAAsC,UAAA,CAAW,OAAA,CAAQ,YAAY,CAAC,CAAA,uBAAA;AAAA,SACxE;AAAA,QACA,iBAAiB,OAAA,CAAQ,eAAA;AAAA,QACzB,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,cAAA,EAAgB,IAAI,QAAA,EAAS;AAAA,QAC7B,KAAA,EAAO,eAAA;AAAA,QACP,MAAM,EAAE,IAAA,EAAM,MAAM,IAAA,EAAM,aAAA,EAAe,MAAM,YAAA;AAAa,OAC7D,CAAA;AACD,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,EAAI,MAAM,MAAM,cAAc,QAAQ,CAAA;AACpD,MAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,MAAM,YAAA,CAAa,QAAQ,CAAA,EAAG;AAAA,QAC7D,KAAA;AAAA,QACA,iBAAiB,OAAA,CAAQ;AAAA,OAC1B,CAAA;AACD,MAAA,OAAA,GAAU,MAAA,CAAO,MAAA;AACjB,MAAA,eAAA,GAAkB,MAAA;AAClB,MAAA,YAAA,GAAe,MAAA,CAAO,YAAA;AACtB,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,MAAM,iBAAiB,IAAA,CAAK;AAAA,UAC1B,YAAA;AAAA,UACA,GAAI,QAAQ,SAAA,GAAY,EAAE,WAAW,OAAA,CAAQ,SAAA,KAAc,EAAC;AAAA,UAC5D,GAAI,OAAO,iBAAA,GAAoB,EAAE,mBAAmB,MAAA,CAAO,iBAAA,KAAsB;AAAC,SACnF,CAAA;AAAA,MACH;AACA,MAAA,OAAO,OAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,UAAU,OAAA,EAAS;AACvB,MAAA,IAAI,WAAW,OAAA,CAAQ,SAAA,GAAY,KAAA,CAAM,GAAA,IAAO,OAAO,OAAA;AACvD,MAAA,OAAO,YAAA,CAAa,UAAU,OAAO,CAAA;AAAA,IACvC,CAAA;AAAA,IACA,MAAM,QAAQ,OAAA,EAAS;AACrB,MAAA,OAAO,YAAA,CAAa,UAAU,OAAO,CAAA,IAAK,QAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,qBAAqB,CAAC,CAAA;AAAA,IAC3F,CAAA;AAAA,IACA,MAAM,OAAO,KAAA,EAAO;AAClB,MAAA,MAAM,YAAA,CAAa,SAAS,KAAK,CAAA;AACjC,MAAA,OAAA,GAAU,MAAA;AACV,MAAA,YAAA,GAAe,MAAA;AAAA,IACjB;AAAA,GACF;AACF","file":"index.js","sourcesContent":["export function base64UrlEncode(bytes: Uint8Array): string {\n  const alphabet = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n  let output = \"\";\n  for (let index = 0; index < bytes.length; index += 3) {\n    const first = bytes[index] ?? 0;\n    const second = bytes[index + 1];\n    const third = bytes[index + 2];\n    const packed = (first << 16) | ((second ?? 0) << 8) | (third ?? 0);\n    output += alphabet[(packed >>> 18) & 63];\n    output += alphabet[(packed >>> 12) & 63];\n    output += second === undefined ? \"=\" : alphabet[(packed >>> 6) & 63];\n    output += third === undefined ? \"=\" : alphabet[packed & 63];\n  }\n  return output.replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\");\n}\n\nexport function utf8Bytes(input: string): Uint8Array {\n  const Constructor = (globalThis as unknown as { TextEncoder?: new () => { encode(value: string): Uint8Array } }).TextEncoder;\n  if (!Constructor) {\n    throw new Error(\"TextEncoder capability is required.\");\n  }\n  return new Constructor().encode(input);\n}\n","import { base64UrlEncode } from \"./base64url.js\";\nimport { defaultClock, defaultIds, resolveEncoder } from \"./capabilities.js\";\nimport { Agents24ClientError, missingCapability } from \"./errors.js\";\nimport { canonicalHtu } from \"./url.js\";\nimport type { Clock, DpopKeyProvider, DpopProofInput, IdProvider, PublicJwk, TextEncoderLike } from \"./types.js\";\n\ntype CryptoKeyLike = object;\n\ninterface SubtleCryptoLike {\n  generateKey(\n    algorithm: { name: \"ECDSA\"; namedCurve: \"P-256\" },\n    extractable: false,\n    usages: readonly [\"sign\", \"verify\"],\n  ): Promise<{ privateKey: CryptoKeyLike; publicKey: CryptoKeyLike }>;\n  exportKey(format: \"jwk\", key: CryptoKeyLike): Promise<PublicJwk>;\n  sign(algorithm: { name: \"ECDSA\"; hash: \"SHA-256\" }, key: CryptoKeyLike, data: Uint8Array): Promise<ArrayBuffer>;\n  digest(algorithm: \"SHA-256\", data: Uint8Array): Promise<ArrayBuffer>;\n}\n\nexport interface WebCryptoLike {\n  subtle: SubtleCryptoLike;\n  getRandomValues?<T extends Uint8Array>(target: T): T;\n}\n\nexport interface DpopKeyHandle {\n  privateKey: CryptoKeyLike;\n  publicKey: CryptoKeyLike;\n}\n\nexport interface DpopKeyHandleStorage {\n  load(): Promise<DpopKeyHandle | null>;\n  save(handle: DpopKeyHandle): Promise<void>;\n  clear?(): Promise<void>;\n}\n\nexport interface WebCryptoDpopOptions {\n  crypto?: WebCryptoLike;\n  storage?: DpopKeyHandleStorage;\n  clock?: Clock;\n  ids?: IdProvider;\n  encoder?: TextEncoderLike;\n}\n\nfunction resolveCrypto(injected?: WebCryptoLike): WebCryptoLike {\n  const value = injected ?? (globalThis as unknown as { crypto?: WebCryptoLike }).crypto;\n  if (!value?.subtle) throw missingCapability(\"crypto.subtle\");\n  return value;\n}\n\nfunction publicJwkOnly(jwk: PublicJwk): PublicJwk {\n  if (jwk.kty !== \"EC\" || jwk.crv !== \"P-256\" || !jwk.x || !jwk.y) {\n    throw new Agents24ClientError(\"DPoP requires a P-256 public key.\", {\n      kind: \"configuration\",\n      code: \"INVALID_DPOP_KEY\",\n    });\n  }\n  return { kty: \"EC\", crv: \"P-256\", x: jwk.x, y: jwk.y };\n}\n\nasync function hash(subtle: SubtleCryptoLike, encoder: TextEncoderLike, input: string): Promise<string> {\n  return base64UrlEncode(new Uint8Array(await subtle.digest(\"SHA-256\", encoder.encode(input))));\n}\n\nexport function createWebCryptoDpopKeyProvider(options: WebCryptoDpopOptions = {}): DpopKeyProvider {\n  const crypto = resolveCrypto(options.crypto);\n  const clock = options.clock ?? defaultClock();\n  const ids = options.ids ?? defaultIds();\n  const encoder = resolveEncoder(options.encoder);\n  let handlePromise: Promise<DpopKeyHandle> | undefined;\n  let jwkPromise: Promise<PublicJwk> | undefined;\n\n  const getHandle = (): Promise<DpopKeyHandle> => {\n    if (!handlePromise) {\n      handlePromise = (async () => {\n        const stored = await options.storage?.load();\n        if (stored) return stored;\n        const generated = await crypto.subtle.generateKey(\n          { name: \"ECDSA\", namedCurve: \"P-256\" },\n          false,\n          [\"sign\", \"verify\"],\n        );\n        await options.storage?.save(generated);\n        return generated;\n      })();\n    }\n    return handlePromise;\n  };\n\n  const getPublicJwk = (): Promise<PublicJwk> => {\n    if (!jwkPromise) {\n      jwkPromise = getHandle().then(async (handle) => publicJwkOnly(await crypto.subtle.exportKey(\"jwk\", handle.publicKey)));\n    }\n    return jwkPromise;\n  };\n\n  return {\n    getPublicJwk,\n    async getThumbprint() {\n      const jwk = await getPublicJwk();\n      return hash(crypto.subtle, encoder, JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }));\n    },\n    async signProof(input: DpopProofInput) {\n      const jwk = await getPublicJwk();\n      const header = base64UrlEncode(encoder.encode(JSON.stringify({ typ: \"dpop+jwt\", alg: \"ES256\", jwk })));\n      const claims: Record<string, string | number> = {\n        jti: ids.createId(),\n        htm: input.method.toUpperCase(),\n        htu: canonicalHtu(input.url),\n        iat: Math.floor(clock.now() / 1000),\n      };\n      if (input.accessToken) claims.ath = await hash(crypto.subtle, encoder, input.accessToken);\n      if (input.nonce) claims.nonce = input.nonce;\n      const payload = base64UrlEncode(encoder.encode(JSON.stringify(claims)));\n      const signingInput = `${header}.${payload}`;\n      const handle = await getHandle();\n      const signature = new Uint8Array(\n        await crypto.subtle.sign({ name: \"ECDSA\", hash: \"SHA-256\" }, handle.privateKey, encoder.encode(signingInput)),\n      );\n      if (signature.byteLength !== 64) {\n        throw new Agents24ClientError(\"The WebCrypto provider returned a non-JOSE ECDSA signature.\", {\n          kind: \"configuration\",\n          code: \"INVALID_DPOP_SIGNATURE\",\n        });\n      }\n      return `${signingInput}.${base64UrlEncode(signature)}`;\n    },\n  };\n}\n\nexport async function createPkcePair(\n  cryptoInput?: WebCryptoLike,\n  encoderInput?: TextEncoderLike,\n): Promise<{ verifier: string; challenge: string }> {\n  const crypto = resolveCrypto(cryptoInput);\n  const encoder = resolveEncoder(encoderInput);\n  const random = new Uint8Array(32);\n  const getRandomValues = crypto.getRandomValues?.bind(crypto);\n  if (!getRandomValues) throw missingCapability(\"crypto.getRandomValues\");\n  getRandomValues(random);\n  const verifier = base64UrlEncode(random);\n  return { verifier, challenge: await hash(crypto.subtle, encoder, verifier) };\n}\n","import { defaultClock, defaultIds, resolveFetch } from \"./capabilities.js\";\nimport { Agents24ClientError } from \"./errors.js\";\nimport { AuthenticatedHttp, dpopTokenRequest, responseError, responseJson } from \"./http.js\";\nimport { absoluteUrl, encodePath, normalizeBaseUrl } from \"./url.js\";\nimport type {\n  AbortSignalLike,\n  ClientSessionAccess,\n  ClientSessionProvider,\n  ClientSessionStorage,\n  Clock,\n  DpopKeyProvider,\n  FetchLike,\n  IdProvider,\n  SessionRefreshCoordinator,\n  SessionRefreshFenceRecord,\n  SessionRefreshFenceStorage,\n  SessionRefreshLease,\n  TelemetrySink,\n  WaitCapability,\n} from \"./types.js\";\n\ntype SessionTokenBody = {\n  access_token?: unknown;\n  token_type?: unknown;\n  expires_in?: unknown;\n  expires_at?: unknown;\n  refresh_grant?: unknown;\n  refresh_expires_at?: unknown;\n  refresh_grant_absolute_expires_at?: unknown;\n  session_id?: unknown;\n  capabilities?: unknown;\n  dpop_nonce?: unknown;\n};\n\nfunction parseSessionToken(\n  value: unknown,\n  options: { clock: Clock; dpopKeyProvider?: DpopKeyProvider | undefined },\n): { access: ClientSessionAccess; refreshGrant?: string; absoluteExpiresAt?: string } {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new Agents24ClientError(\"The session endpoint returned an invalid response.\", {\n      kind: \"protocol\",\n      code: \"INVALID_SESSION_RESPONSE\",\n    });\n  }\n  const body = value as SessionTokenBody;\n  if (typeof body.access_token !== \"string\" || !body.access_token || /[\\r\\n\\0]/.test(body.access_token)) {\n    throw new Agents24ClientError(\"The session endpoint returned an invalid access token.\", {\n      kind: \"protocol\",\n      code: \"INVALID_SESSION_RESPONSE\",\n    });\n  }\n  const tokenType = body.token_type === \"DPoP\" ? \"DPoP\" : body.token_type === \"Bearer\" ? \"Bearer\" : undefined;\n  if (!tokenType || (tokenType === \"DPoP\" && !options.dpopKeyProvider)) {\n    throw new Agents24ClientError(\"The session endpoint returned an unsupported token profile.\", {\n      kind: \"protocol\",\n      code: \"INVALID_TOKEN_PROFILE\",\n    });\n  }\n  const parsedExpiresAt = typeof body.expires_at === \"string\" ? Date.parse(body.expires_at) : Number.NaN;\n  const expiresIn = typeof body.expires_in === \"number\" && Number.isFinite(body.expires_in) ? body.expires_in : 0;\n  const expiresAt = Number.isFinite(parsedExpiresAt) ? parsedExpiresAt : options.clock.now() + expiresIn * 1000;\n  if (!Number.isFinite(expiresAt) || expiresAt <= options.clock.now()) {\n    throw new Agents24ClientError(\"The session endpoint returned an expired access token.\", {\n      kind: \"protocol\",\n      code: \"INVALID_SESSION_EXPIRY\",\n    });\n  }\n  const refreshGrant = typeof body.refresh_grant === \"string\" && body.refresh_grant && !/[\\r\\n\\0]/.test(body.refresh_grant)\n    ? body.refresh_grant\n    : undefined;\n  if (body.refresh_grant !== undefined && !refreshGrant) {\n    throw new Agents24ClientError(\"The session endpoint returned an invalid refresh grant.\", {\n      kind: \"protocol\",\n      code: \"INVALID_SESSION_RESPONSE\",\n    });\n  }\n  if (refreshGrant && (tokenType !== \"DPoP\" || !options.dpopKeyProvider)) {\n    throw new Agents24ClientError(\"Persistent sessions require a DPoP-bound token profile.\", {\n      kind: \"protocol\",\n      code: \"INVALID_TOKEN_PROFILE\",\n    });\n  }\n  return {\n    access: {\n      accessToken: body.access_token,\n      tokenType,\n      expiresAt,\n      ...(typeof body.session_id === \"string\" ? { sessionId: body.session_id } : {}),\n      ...(Array.isArray(body.capabilities) && body.capabilities.every((item) => typeof item === \"string\")\n        ? { capabilities: body.capabilities as string[] }\n        : {}),\n      ...(options.dpopKeyProvider ? { dpopKeyProvider: options.dpopKeyProvider } : {}),\n      ...(typeof body.dpop_nonce === \"string\" ? { dpopNonce: body.dpop_nonce } : {}),\n    },\n    ...(refreshGrant ? { refreshGrant } : {}),\n    ...(typeof (body.refresh_expires_at ?? body.refresh_grant_absolute_expires_at) === \"string\"\n      ? { absoluteExpiresAt: (body.refresh_expires_at ?? body.refresh_grant_absolute_expires_at) as string }\n      : {}),\n  };\n}\n\nfunction refreshFenceLost(): Agents24ClientError {\n  return new Agents24ClientError(\"Refresh coordination ownership changed before completion.\", {\n    kind: \"conflict\",\n    code: \"REFRESH_FENCE_LOST\",\n    retryable: true,\n  });\n}\n\nfunction defaultWait(milliseconds: number): Promise<void> {\n  const schedule = (globalThis as unknown as {\n    setTimeout?: (callback: () => void, delay: number) => unknown;\n  }).setTimeout;\n  if (!schedule) {\n    throw new Agents24ClientError(\"Cross-runtime refresh coordination requires a wait capability.\", {\n      kind: \"missing_capability\",\n      code: \"MISSING_WAIT_CAPABILITY\",\n    });\n  }\n  return new Promise((resolve) => schedule(resolve, milliseconds));\n}\n\nexport interface FencedRefreshCoordinatorOptions {\n  storage: SessionRefreshFenceStorage;\n  clock?: Clock;\n  ids?: IdProvider;\n  ownerId?: string;\n  leaseDurationMs?: number;\n  pollIntervalMs?: number;\n  wait?: WaitCapability;\n}\n\n/**\n * Coordinates refresh-grant rotation across tabs/processes through an injected\n * atomic compare-and-swap store. Takeovers retain the same operation ID so a\n * timed-out owner and its successor address one server idempotency record.\n */\nexport function createFencedRefreshCoordinator(\n  options: FencedRefreshCoordinatorOptions,\n): SessionRefreshCoordinator {\n  const clock = options.clock ?? defaultClock();\n  const ids = options.ids ?? defaultIds();\n  const ownerId = options.ownerId ?? ids.createId();\n  const leaseDurationMs = Math.max(1_000, options.leaseDurationMs ?? 60_000);\n  const pollIntervalMs = Math.max(10, options.pollIntervalMs ?? 100);\n  const wait = options.wait ?? defaultWait;\n  let local: Promise<unknown> | undefined;\n\n  const assertActive = async (record: SessionRefreshFenceRecord): Promise<void> => {\n    const current = await options.storage.load();\n    if (\n      !current?.active ||\n      current.fence !== record.fence ||\n      current.operationId !== record.operationId ||\n      current.ownerId !== ownerId ||\n      current.expiresAt <= clock.now()\n    ) {\n      throw refreshFenceLost();\n    }\n  };\n\n  const acquire = async (): Promise<SessionRefreshFenceRecord> => {\n    while (true) {\n      const current = await options.storage.load();\n      const now = clock.now();\n      if (current?.active && current.expiresAt > now) {\n        await wait(Math.max(1, Math.min(pollIntervalMs, current.expiresAt - now)));\n        continue;\n      }\n      const next: SessionRefreshFenceRecord = {\n        active: true,\n        expiresAt: now + leaseDurationMs,\n        fence: (current?.fence ?? 0) + 1,\n        operationId: current?.active ? current.operationId : ids.createId(),\n        ownerId,\n      };\n      if (await options.storage.compareAndSwap(current?.fence ?? null, next)) return next;\n    }\n  };\n\n  return {\n    async runExclusive<T>(operation: (lease: SessionRefreshLease) => Promise<T>): Promise<T> {\n      if (local) return local as Promise<T>;\n      const pending = (async () => {\n        const record = await acquire();\n        const lease: SessionRefreshLease = {\n          fence: record.fence,\n          operationId: record.operationId,\n          assertActive: () => assertActive(record),\n        };\n        try {\n          return await operation(lease);\n        } finally {\n          const current = await options.storage.load();\n          if (\n            current?.active &&\n            current.fence === record.fence &&\n            current.operationId === record.operationId &&\n            current.ownerId === ownerId\n          ) {\n            await options.storage.compareAndSwap(current.fence, {\n              ...current,\n              active: false,\n              expiresAt: clock.now(),\n            });\n          }\n        }\n      })();\n      local = pending;\n      try {\n        return await pending;\n      } finally {\n        if (local === pending) local = undefined;\n      }\n    },\n  };\n}\n\nexport function createInMemoryRefreshCoordinator(): SessionRefreshCoordinator {\n  let active: Promise<unknown> | undefined;\n  let fence = 0;\n  return {\n    async runExclusive<T>(operation: (lease: SessionRefreshLease) => Promise<T>): Promise<T> {\n      if (active) return active as Promise<T>;\n      fence += 1;\n      const ownedFence = fence;\n      const current = Promise.resolve().then(() => operation({\n        fence: ownedFence,\n        operationId: `memory-refresh-${ownedFence}`,\n        async assertActive() {\n          if (active !== current) throw refreshFenceLost();\n        },\n      }));\n      active = current;\n      try {\n        return await current;\n      } finally {\n        if (active === current) active = undefined;\n      }\n    },\n  };\n}\n\nexport function createStaticSessionProvider(access: ClientSessionAccess): ClientSessionProvider {\n  return {\n    async getAccess() {\n      return access;\n    },\n  };\n}\n\nexport interface ManagedSessionProviderOptions {\n  baseUrl: string;\n  deploymentId: string;\n  fetch?: FetchLike;\n  dpopKeyProvider?: DpopKeyProvider | undefined;\n  storage?: ClientSessionStorage;\n  coordinator?: SessionRefreshCoordinator;\n  clock?: Clock;\n  ids?: IdProvider;\n  telemetry?: TelemetrySink;\n  mint(input: {\n    fetch: FetchLike;\n    url: string;\n    dpopKeyProvider?: DpopKeyProvider | undefined;\n    signal?: AbortSignalLike | undefined;\n  }): Promise<unknown>;\n}\n\nexport function createManagedSessionProvider(options: ManagedSessionProviderOptions): ClientSessionProvider {\n  if (options.storage && !options.dpopKeyProvider) {\n    throw new Agents24ClientError(\"Persistent session storage requires a DPoP key provider.\", {\n      kind: \"configuration\",\n      code: \"PERSISTENT_SESSION_REQUIRES_DPOP\",\n    });\n  }\n  const baseUrl = normalizeBaseUrl(options.baseUrl);\n  const fetch = resolveFetch(options.fetch);\n  const clock = options.clock ?? defaultClock();\n  const ids = options.ids ?? defaultIds();\n  const coordinator = options.coordinator ?? createInMemoryRefreshCoordinator();\n  let current: ClientSessionAccess | undefined;\n  let refreshGrant: string | undefined;\n  let minting: Promise<ClientSessionAccess> | undefined;\n\n  const emit = async (event: Parameters<TelemetrySink[\"emit\"]>[0]): Promise<void> => {\n    try {\n      await options.telemetry?.emit(event);\n    } catch {\n      // Session telemetry is noncredential and cannot affect authentication.\n    }\n  };\n\n  const loadStored = async (): Promise<Awaited<ReturnType<ClientSessionStorage[\"load\"]>>> => {\n    const stored = await options.storage?.load() ?? null;\n    if (!stored) return null;\n    if (!stored.refreshGrant || /[\\r\\n\\0]/.test(stored.refreshGrant)) {\n      throw new Agents24ClientError(\"Stored session state is invalid.\", {\n        kind: \"authentication\",\n        code: \"INVALID_STORED_SESSION\",\n      });\n    }\n    if (stored.absoluteExpiresAt) {\n      const absoluteExpiry = Date.parse(stored.absoluteExpiresAt);\n      if (!Number.isFinite(absoluteExpiry) || absoluteExpiry <= clock.now()) {\n        await options.storage?.clear();\n        throw new Agents24ClientError(\"The persistent session has expired.\", {\n          kind: \"authentication\",\n          code: \"SESSION_EXPIRED\",\n        });\n      }\n    }\n    return stored;\n  };\n\n  const save = async (parsed: ReturnType<typeof parseSessionToken>): Promise<void> => {\n    current = parsed.access;\n    if (parsed.refreshGrant) refreshGrant = parsed.refreshGrant;\n    if (refreshGrant && options.storage) {\n      await options.storage.save({\n        refreshGrant,\n        ...(current.sessionId ? { sessionId: current.sessionId } : {}),\n        ...(parsed.absoluteExpiresAt ? { absoluteExpiresAt: parsed.absoluteExpiresAt } : {}),\n      });\n    }\n  };\n\n  const mint = async (signal?: AbortSignalLike): Promise<ClientSessionAccess> => {\n    if (!minting) {\n      const url = absoluteUrl(baseUrl, `/public/client-runtime/deployments/${encodePath(options.deploymentId)}/sessions/anonymous`);\n      minting = options\n        .mint({ fetch, url, dpopKeyProvider: options.dpopKeyProvider, signal })\n        .then(async (value) => {\n          const parsed = parseSessionToken(value, { clock, dpopKeyProvider: options.dpopKeyProvider });\n          await save(parsed);\n          return parsed.access;\n        })\n        .finally(() => {\n          minting = undefined;\n        });\n    }\n    return minting;\n  };\n\n  const refresh = async (signal?: AbortSignalLike): Promise<ClientSessionAccess> =>\n    coordinator.runExclusive(async (lease) => {\n      if (!refreshGrant && options.storage) {\n        const stored = await loadStored();\n        refreshGrant = stored?.refreshGrant;\n      }\n      if (!refreshGrant) return mint(signal);\n      await lease.assertActive();\n      const response = await dpopTokenRequest({\n        fetch,\n        url: absoluteUrl(baseUrl, \"/public/client-runtime/sessions/refresh\"),\n        body: { refresh_grant: refreshGrant },\n        dpopKeyProvider: options.dpopKeyProvider,\n        signal,\n        idempotencyKey: lease.operationId,\n      });\n      if (!response.ok) {\n        if (response.status === 400 || response.status === 401 || response.status === 403) {\n          await lease.assertActive();\n          await options.storage?.clear();\n          refreshGrant = undefined;\n          current = undefined;\n        }\n        throw await responseError(response);\n      }\n      await lease.assertActive();\n      const parsed = parseSessionToken(await responseJson(response), { clock, dpopKeyProvider: options.dpopKeyProvider });\n      await save(parsed);\n      await emit({ type: \"session.refreshed\", operation: \"session\" });\n      return parsed.access;\n    });\n\n  let provider: ClientSessionProvider;\n  provider = {\n    async getAccess(context) {\n      if (current && current.expiresAt > clock.now()) return current;\n      if (refreshGrant || (await loadStored())?.refreshGrant) return refresh(context.signal);\n      return mint(context.signal);\n    },\n    async refresh(context) {\n      return refresh(context.signal);\n    },\n    async revoke(input) {\n      const authenticated = new AuthenticatedHttp({\n        baseUrl,\n        sessionProvider: provider,\n        fetch,\n        clock,\n      });\n      await authenticated.json<unknown>(\"POST\", \"/public/client-runtime/sessions/revoke\", {\n        operation: \"sessions.revoke\",\n        idempotencyKey: input?.idempotencyKey ?? ids.createId(),\n        ...(input?.signal ? { signal: input.signal } : {}),\n      });\n      current = undefined;\n      refreshGrant = undefined;\n      await options.storage?.clear();\n      await emit({ type: \"session.revoked\", operation: \"session\" });\n    },\n  };\n  return provider;\n}\n\nexport interface AnonymousSessionProviderOptions\n  extends Omit<ManagedSessionProviderOptions, \"mint\"> {\n  persistent?: boolean;\n  nativeProfileId?: string;\n  requestedCapabilities?: readonly string[];\n  attestation?: string;\n}\n\nexport function createAnonymousSessionProvider(options: AnonymousSessionProviderOptions): ClientSessionProvider {\n  if ((options.persistent || options.nativeProfileId) && !options.dpopKeyProvider) {\n    throw new Agents24ClientError(\"Persistent and native anonymous sessions require a DPoP key provider.\", {\n      kind: \"configuration\",\n      code: \"MISSING_DPOP_PROVIDER\",\n    });\n  }\n  const ids = options.ids ?? defaultIds();\n  return createManagedSessionProvider({\n    ...options,\n    async mint({ fetch, url, dpopKeyProvider, signal }) {\n      const response = await dpopTokenRequest({\n        fetch,\n        url,\n        body: {\n          persistent: options.persistent ?? false,\n          requested_capabilities: [...(options.requestedCapabilities ?? [])],\n          ...(options.nativeProfileId ? { native_profile_id: options.nativeProfileId } : {}),\n          ...(dpopKeyProvider ? { dpop_public_jwk: await dpopKeyProvider.getPublicJwk() } : {}),\n          ...(options.attestation ? { attestation: options.attestation } : {}),\n        },\n        dpopKeyProvider,\n        prooflessInitialRequest: Boolean(dpopKeyProvider),\n        signal,\n        idempotencyKey: ids.createId(),\n      });\n      if (!response.ok) throw await responseError(response);\n      return responseJson(response);\n    },\n  });\n}\n\nexport interface HostedOidcSessionProvider extends ClientSessionProvider {\n  beginAuthorization(input: {\n    redirectUri: string;\n    codeChallenge: string;\n    nativeProfileId?: string;\n    signal?: AbortSignalLike;\n  }): Promise<{ authorizationUrl: string }>;\n  exchange(input: { code: string; codeVerifier: string; signal?: AbortSignalLike }): Promise<ClientSessionAccess>;\n}\n\nexport interface HostedOidcSessionProviderOptions\n  extends Omit<ManagedSessionProviderOptions, \"mint\"> {\n  dpopKeyProvider: DpopKeyProvider;\n  redirectUri?: string;\n}\n\nexport function createHostedOidcSessionProvider(options: HostedOidcSessionProviderOptions): HostedOidcSessionProvider {\n  const baseUrl = normalizeBaseUrl(options.baseUrl);\n  const fetch = resolveFetch(options.fetch);\n  const clock = options.clock ?? defaultClock();\n  let current: ClientSessionAccess | undefined;\n  let refreshGrant: string | undefined;\n  let enrollmentNonce: string | undefined;\n  const ids = options.ids ?? defaultIds();\n  let memoryRecord: Awaited<ReturnType<ClientSessionStorage[\"load\"]>> = null;\n  const effectiveStorage: ClientSessionStorage = {\n    async load() {\n      return (await options.storage?.load()) ?? memoryRecord;\n    },\n    async save(record) {\n      memoryRecord = record;\n      await options.storage?.save(record);\n    },\n    async clear() {\n      memoryRecord = null;\n      await options.storage?.clear();\n    },\n  };\n  const baseProvider = createManagedSessionProvider({\n    ...options,\n    storage: effectiveStorage,\n    async mint() {\n      throw new Agents24ClientError(\"Complete the hosted OIDC authorization before requesting access.\", {\n        kind: \"authentication\",\n        code: \"OIDC_AUTHORIZATION_REQUIRED\",\n      });\n    },\n  });\n\n  return {\n    async beginAuthorization(input) {\n      const url = absoluteUrl(\n        baseUrl,\n        `/public/client-runtime/deployments/${encodePath(options.deploymentId)}/sessions/oidc/authorize`,\n      );\n      const response = await dpopTokenRequest({\n        fetch,\n        url,\n        dpopKeyProvider: options.dpopKeyProvider,\n        signal: input.signal,\n        idempotencyKey: ids.createId(),\n        body: {\n          redirect_uri: input.redirectUri,\n          code_challenge: input.codeChallenge,\n          code_challenge_method: \"S256\",\n          persistent: true,\n          dpop_public_jwk: await options.dpopKeyProvider.getPublicJwk(),\n          ...(input.nativeProfileId ? { native_profile_id: input.nativeProfileId } : {}),\n        },\n      });\n      if (!response.ok) throw await responseError(response);\n      const body = (await responseJson(response)) as Record<string, unknown>;\n      if (typeof body.authorization_url !== \"string\") {\n        throw new Agents24ClientError(\"The OIDC endpoint returned an invalid authorization URL.\", {\n          kind: \"protocol\",\n          code: \"INVALID_OIDC_RESPONSE\",\n        });\n      }\n      if (typeof body.dpop_nonce !== \"string\" || !body.dpop_nonce) {\n        throw new Agents24ClientError(\"The OIDC endpoint did not return a DPoP enrollment nonce.\", {\n          kind: \"protocol\",\n          code: \"INVALID_OIDC_RESPONSE\",\n        });\n      }\n      enrollmentNonce = body.dpop_nonce;\n      return { authorizationUrl: body.authorization_url };\n    },\n    async exchange(input) {\n      const response = await dpopTokenRequest({\n        fetch,\n        url: absoluteUrl(\n          baseUrl,\n          `/public/client-runtime/deployments/${encodePath(options.deploymentId)}/sessions/oidc/exchange`,\n        ),\n        dpopKeyProvider: options.dpopKeyProvider,\n        signal: input.signal,\n        idempotencyKey: ids.createId(),\n        nonce: enrollmentNonce,\n        body: { code: input.code, code_verifier: input.codeVerifier },\n      });\n      if (!response.ok) throw await responseError(response);\n      const parsed = parseSessionToken(await responseJson(response), {\n        clock,\n        dpopKeyProvider: options.dpopKeyProvider,\n      });\n      current = parsed.access;\n      enrollmentNonce = undefined;\n      refreshGrant = parsed.refreshGrant;\n      if (refreshGrant) {\n        await effectiveStorage.save({\n          refreshGrant,\n          ...(current.sessionId ? { sessionId: current.sessionId } : {}),\n          ...(parsed.absoluteExpiresAt ? { absoluteExpiresAt: parsed.absoluteExpiresAt } : {}),\n        });\n      }\n      return current;\n    },\n    async getAccess(context) {\n      if (current && current.expiresAt > clock.now()) return current;\n      return baseProvider.getAccess(context);\n    },\n    async refresh(context) {\n      return baseProvider.refresh?.(context) ?? Promise.reject(new Error(\"Refresh unavailable\"));\n    },\n    async revoke(input) {\n      await baseProvider.revoke?.(input);\n      current = undefined;\n      refreshGrant = undefined;\n    },\n  };\n}\n"]}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}