@anthropic-ai/sdk 0.92.0 → 0.94.0

package/lib/credentials/oidc-federation.d.mts

@@ -0,0 +1,40 @@
+import type { Fetch } from "../../internal/builtin-types.mjs";
+import type { AccessTokenProvider, IdentityTokenProvider } from "./types.mjs";
+export type OIDCFederationConfig = {
+    identityTokenProvider: IdentityTokenProvider;
+    federationRuleId: string;
+    organizationId: string;
+    serviceAccountId?: string | undefined;
+    /**
+     * Optional `wrkspc_*` tagged ID, or the literal `"default"` to scope the
+     * token to the organization's default workspace. When omitted the server
+     * picks the rule's sole enabled workspace, else the org default if the rule
+     * covers it. Required when the rule enables more than one non-default
+     * workspace, or to target a specific workspace other than the one the
+     * server would pick. The minted token is workspace-scoped: per-request
+     * workspace selection (the `anthropic-workspace-id` header) is not supported
+     * for federation tokens — switching workspaces requires a new token exchange
+     * with a different `workspaceId`.
+     */
+    workspaceId?: string | undefined;
+    baseURL: string;
+    fetch: Fetch;
+    /**
+     * Overrides the outgoing User-Agent header on the token exchange. When
+     * empty, sends an SDK-identified UA so the token endpoint's access logs
+     * identify the caller.
+     */
+    userAgent?: string | undefined;
+};
+/**
+ * Exchanges an external OIDC JWT for an Anthropic access token via the
+ * RFC 7523 jwt-bearer grant.
+ *
+ * Each invocation performs a fresh token exchange. Wrap in a
+ * {@link TokenCache} to avoid exchanging on every request.
+ *
+ * Federation grants do not return a refresh token — callers re-exchange
+ * their assertion on expiry.
+ */
+export declare function oidcFederationProvider(config: OIDCFederationConfig): AccessTokenProvider;
+//# sourceMappingURL=oidc-federation.d.mts.map

package/lib/credentials/oidc-federation.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-federation.d.mts","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":"OAAO,KAAK,EAAE,KAAK,EAAE;OACd,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE;AAc1D,MAAM,MAAM,oBAAoB,GAAG;IACjC,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CAuFxF"}

package/lib/credentials/oidc-federation.d.ts

@@ -0,0 +1,40 @@
+import type { Fetch } from "../../internal/builtin-types.js";
+import type { AccessTokenProvider, IdentityTokenProvider } from "./types.js";
+export type OIDCFederationConfig = {
+    identityTokenProvider: IdentityTokenProvider;
+    federationRuleId: string;
+    organizationId: string;
+    serviceAccountId?: string | undefined;
+    /**
+     * Optional `wrkspc_*` tagged ID, or the literal `"default"` to scope the
+     * token to the organization's default workspace. When omitted the server
+     * picks the rule's sole enabled workspace, else the org default if the rule
+     * covers it. Required when the rule enables more than one non-default
+     * workspace, or to target a specific workspace other than the one the
+     * server would pick. The minted token is workspace-scoped: per-request
+     * workspace selection (the `anthropic-workspace-id` header) is not supported
+     * for federation tokens — switching workspaces requires a new token exchange
+     * with a different `workspaceId`.
+     */
+    workspaceId?: string | undefined;
+    baseURL: string;
+    fetch: Fetch;
+    /**
+     * Overrides the outgoing User-Agent header on the token exchange. When
+     * empty, sends an SDK-identified UA so the token endpoint's access logs
+     * identify the caller.
+     */
+    userAgent?: string | undefined;
+};
+/**
+ * Exchanges an external OIDC JWT for an Anthropic access token via the
+ * RFC 7523 jwt-bearer grant.
+ *
+ * Each invocation performs a fresh token exchange. Wrap in a
+ * {@link TokenCache} to avoid exchanging on every request.
+ *
+ * Federation grants do not return a refresh token — callers re-exchange
+ * their assertion on expiry.
+ */
+export declare function oidcFederationProvider(config: OIDCFederationConfig): AccessTokenProvider;
+//# sourceMappingURL=oidc-federation.d.ts.map

package/lib/credentials/oidc-federation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-federation.d.ts","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":"OAAO,KAAK,EAAE,KAAK,EAAE;OACd,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE;AAc1D,MAAM,MAAM,oBAAoB,GAAG;IACjC,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CAuFxF"}

package/lib/credentials/oidc-federation.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oidcFederationProvider = oidcFederationProvider;
+const types_1 = require("./types.js");
+const time_1 = require("../../internal/utils/time.js");
+const version_1 = require("../../version.js");
+/**
+ * Exchanges an external OIDC JWT for an Anthropic access token via the
+ * RFC 7523 jwt-bearer grant.
+ *
+ * Each invocation performs a fresh token exchange. Wrap in a
+ * {@link TokenCache} to avoid exchanging on every request.
+ *
+ * Federation grants do not return a refresh token — callers re-exchange
+ * their assertion on expiry.
+ */
+function oidcFederationProvider(config) {
+    return async () => {
+        (0, types_1.requireSecureTokenEndpoint)(config.baseURL);
+        const jwt = await config.identityTokenProvider();
+        // The token endpoint enforces a 16 KiB assertion limit; surface a clear
+        // client-side error so misconfigured projected-token sources are
+        // diagnosable without a server round-trip.
+        if (jwt.length > 16 * 1024) {
+            throw new types_1.WorkloadIdentityError(`Identity token is ${Math.ceil(jwt.length / 1024)} KiB, exceeds the 16 KiB assertion limit`);
+        }
+        const body = {
+            grant_type: types_1.GRANT_TYPE_JWT_BEARER,
+            assertion: jwt,
+            federation_rule_id: config.federationRuleId,
+            organization_id: config.organizationId,
+        };
+        if (config.serviceAccountId) {
+            body['service_account_id'] = config.serviceAccountId;
+        }
+        if (config.workspaceId) {
+            body['workspace_id'] = config.workspaceId;
+        }
+        const url = `${config.baseURL}${types_1.TOKEN_ENDPOINT}`;
+        let resp;
+        try {
+            resp = await config.fetch(url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'anthropic-beta': `${types_1.OAUTH_API_BETA_HEADER},${types_1.FEDERATION_BETA_HEADER}`,
+                    'User-Agent': config.userAgent || `anthropic-sdk-typescript/${version_1.VERSION} oidcFederationProvider`,
+                },
+                body: JSON.stringify(body),
+            });
+        }
+        catch (err) {
+            throw new types_1.WorkloadIdentityError(`Failed to reach token endpoint ${url}: ${err}`);
+        }
+        const requestId = resp.headers.get('Request-Id');
+        if (!resp.ok) {
+            const text = await resp.text().catch(() => '');
+            const redacted = (0, types_1.redactSensitive)(text);
+            // A 401 is hard to debug from the status code alone, so surface
+            // guidance: check the federation rule, optionally set a workspace ID
+            // (the most common fix when no workspaceId is configured), and point at
+            // the Workload identity page in Claude Console for the server-side
+            // authentication event log. Other statuses (5xx, 400, ...) get no hint.
+            let hint = '';
+            if (resp.status === 401) {
+                const hintMiddle = config.workspaceId ? '' : ("If your federation rule is scoped to multiple workspaces, set the ANTHROPIC_WORKSPACE_ID environment variable, the 'workspace_id' config key, or the `workspaceId` option. ");
+                hint = ` Ensure your federation rule matches your identity token. ${hintMiddle}View your authentication events in the Workload identity page of Claude Console for more details.`;
+            }
+            throw new types_1.WorkloadIdentityError(`Token exchange failed with status ${resp.status}${requestId ? ` (request-id ${requestId})` : ''}: ${redacted}${hint}`, resp.status, redacted, requestId);
+        }
+        const data = await (0, types_1.parseTokenResponse)(resp, requestId);
+        const expiresIn = Number(data.expires_in);
+        if (!Number.isFinite(expiresIn)) {
+            throw new types_1.WorkloadIdentityError(`Token endpoint response missing required fields: ${JSON.stringify((0, types_1.redactSensitive)(data))}`, resp.status, (0, types_1.redactSensitive)(data), requestId);
+        }
+        return {
+            token: data.access_token,
+            expiresAt: (0, time_1.nowAsSeconds)() + expiresIn,
+        };
+    };
+}
+//# sourceMappingURL=oidc-federation.js.map

package/lib/credentials/oidc-federation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-federation.js","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":";;AAoDA,wDAuFC;AAzID,sCASiB;AACjB,uDAAyD;AACzD,8CAAwC;AA6BxC;;;;;;;;;GASG;AACH,SAAgB,sBAAsB,CAAC,MAA4B;IACjE,OAAO,KAAK,IAAI,EAAE;QAChB,IAAA,kCAA0B,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjD,wEAAwE;QACxE,iEAAiE;QACjE,2CAA2C;QAC3C,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,6BAAqB,CAC7B,qBAAqB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,0CAA0C,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,6BAAqB;YACjC,SAAS,EAAE,GAAG;YACd,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;YAC3C,eAAe,EAAE,MAAM,CAAC,cAAc;SACvC,CAAC;QACF,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,sBAAc,EAAE,CAAC;QACjD,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,GAAG,6BAAqB,IAAI,8BAAsB,EAAE;oBACtE,YAAY,EAAE,MAAM,CAAC,SAAS,IAAI,4BAA4B,iBAAO,yBAAyB;iBAC/F;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,6BAAqB,CAAC,kCAAkC,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,CAAC;YACvC,gEAAgE;YAChE,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,UAAU,GACd,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACxB,6KAA6K,CAC9K,CAAC;gBACJ,IAAI,GAAG,6DAA6D,UAAU,mGAAmG,CAAC;YACpL,CAAC;YACD,MAAM,IAAI,6BAAqB,CAC7B,qCAAqC,IAAI,CAAC,MAAM,GAC9C,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,EAC7C,KAAK,QAAQ,GAAG,IAAI,EAAE,EACtB,IAAI,CAAC,MAAM,EACX,QAAQ,EACR,SAAS,CACV,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAA,0BAAkB,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,6BAAqB,CAC7B,oDAAoD,IAAI,CAAC,SAAS,CAAC,IAAA,uBAAe,EAAC,IAAI,CAAC,CAAC,EAAE,EAC3F,IAAI,CAAC,MAAM,EACX,IAAA,uBAAe,EAAC,IAAI,CAAC,EACrB,SAAS,CACV,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,SAAS,EAAE,IAAA,mBAAY,GAAE,GAAG,SAAS;SACtC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/lib/credentials/oidc-federation.mjs

@@ -0,0 +1,79 @@
+import { FEDERATION_BETA_HEADER, GRANT_TYPE_JWT_BEARER, OAUTH_API_BETA_HEADER, TOKEN_ENDPOINT, WorkloadIdentityError, parseTokenResponse, redactSensitive, requireSecureTokenEndpoint, } from "./types.mjs";
+import { nowAsSeconds } from "../../internal/utils/time.mjs";
+import { VERSION } from "../../version.mjs";
+/**
+ * Exchanges an external OIDC JWT for an Anthropic access token via the
+ * RFC 7523 jwt-bearer grant.
+ *
+ * Each invocation performs a fresh token exchange. Wrap in a
+ * {@link TokenCache} to avoid exchanging on every request.
+ *
+ * Federation grants do not return a refresh token — callers re-exchange
+ * their assertion on expiry.
+ */
+export function oidcFederationProvider(config) {
+    return async () => {
+        requireSecureTokenEndpoint(config.baseURL);
+        const jwt = await config.identityTokenProvider();
+        // The token endpoint enforces a 16 KiB assertion limit; surface a clear
+        // client-side error so misconfigured projected-token sources are
+        // diagnosable without a server round-trip.
+        if (jwt.length > 16 * 1024) {
+            throw new WorkloadIdentityError(`Identity token is ${Math.ceil(jwt.length / 1024)} KiB, exceeds the 16 KiB assertion limit`);
+        }
+        const body = {
+            grant_type: GRANT_TYPE_JWT_BEARER,
+            assertion: jwt,
+            federation_rule_id: config.federationRuleId,
+            organization_id: config.organizationId,
+        };
+        if (config.serviceAccountId) {
+            body['service_account_id'] = config.serviceAccountId;
+        }
+        if (config.workspaceId) {
+            body['workspace_id'] = config.workspaceId;
+        }
+        const url = `${config.baseURL}${TOKEN_ENDPOINT}`;
+        let resp;
+        try {
+            resp = await config.fetch(url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'anthropic-beta': `${OAUTH_API_BETA_HEADER},${FEDERATION_BETA_HEADER}`,
+                    'User-Agent': config.userAgent || `anthropic-sdk-typescript/${VERSION} oidcFederationProvider`,
+                },
+                body: JSON.stringify(body),
+            });
+        }
+        catch (err) {
+            throw new WorkloadIdentityError(`Failed to reach token endpoint ${url}: ${err}`);
+        }
+        const requestId = resp.headers.get('Request-Id');
+        if (!resp.ok) {
+            const text = await resp.text().catch(() => '');
+            const redacted = redactSensitive(text);
+            // A 401 is hard to debug from the status code alone, so surface
+            // guidance: check the federation rule, optionally set a workspace ID
+            // (the most common fix when no workspaceId is configured), and point at
+            // the Workload identity page in Claude Console for the server-side
+            // authentication event log. Other statuses (5xx, 400, ...) get no hint.
+            let hint = '';
+            if (resp.status === 401) {
+                const hintMiddle = config.workspaceId ? '' : ("If your federation rule is scoped to multiple workspaces, set the ANTHROPIC_WORKSPACE_ID environment variable, the 'workspace_id' config key, or the `workspaceId` option. ");
+                hint = ` Ensure your federation rule matches your identity token. ${hintMiddle}View your authentication events in the Workload identity page of Claude Console for more details.`;
+            }
+            throw new WorkloadIdentityError(`Token exchange failed with status ${resp.status}${requestId ? ` (request-id ${requestId})` : ''}: ${redacted}${hint}`, resp.status, redacted, requestId);
+        }
+        const data = await parseTokenResponse(resp, requestId);
+        const expiresIn = Number(data.expires_in);
+        if (!Number.isFinite(expiresIn)) {
+            throw new WorkloadIdentityError(`Token endpoint response missing required fields: ${JSON.stringify(redactSensitive(data))}`, resp.status, redactSensitive(data), requestId);
+        }
+        return {
+            token: data.access_token,
+            expiresAt: nowAsSeconds() + expiresIn,
+        };
+    };
+}
+//# sourceMappingURL=oidc-federation.mjs.map

package/lib/credentials/oidc-federation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-federation.mjs","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":"OAEO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,0BAA0B,GAC3B;OACM,EAAE,YAAY,EAAE;OAChB,EAAE,OAAO,EAAE;AA6BlB;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA4B;IACjE,OAAO,KAAK,IAAI,EAAE;QAChB,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjD,wEAAwE;QACxE,iEAAiE;QACjE,2CAA2C;QAC3C,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,qBAAqB,CAC7B,qBAAqB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,0CAA0C,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,qBAAqB;YACjC,SAAS,EAAE,GAAG;YACd,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;YAC3C,eAAe,EAAE,MAAM,CAAC,cAAc;SACvC,CAAC;QACF,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,cAAc,EAAE,CAAC;QACjD,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,GAAG,qBAAqB,IAAI,sBAAsB,EAAE;oBACtE,YAAY,EAAE,MAAM,CAAC,SAAS,IAAI,4BAA4B,OAAO,yBAAyB;iBAC/F;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACvC,gEAAgE;YAChE,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,UAAU,GACd,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACxB,6KAA6K,CAC9K,CAAC;gBACJ,IAAI,GAAG,6DAA6D,UAAU,mGAAmG,CAAC;YACpL,CAAC;YACD,MAAM,IAAI,qBAAqB,CAC7B,qCAAqC,IAAI,CAAC,MAAM,GAC9C,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,EAC7C,KAAK,QAAQ,GAAG,IAAI,EAAE,EACtB,IAAI,CAAC,MAAM,EACX,QAAQ,EACR,SAAS,CACV,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,qBAAqB,CAC7B,oDAAoD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAC3F,IAAI,CAAC,MAAM,EACX,eAAe,CAAC,IAAI,CAAC,EACrB,SAAS,CACV,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,SAAS,EAAE,YAAY,EAAE,GAAG,SAAS;SACtC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/lib/credentials/token-cache.d.mts

@@ -0,0 +1,54 @@
+import type { AccessTokenProvider } from "./types.mjs";
+/**
+ * Wraps an {@link AccessTokenProvider} with two-tier proactive refresh
+ * and concurrent deduplication.
+ *
+ * Refresh policy on each {@link getToken} call:
+ *
+ * - No cached token → call provider (blocking), cache, return.
+ * - Cached with `expiresAt == null` → return cached forever.
+ * - More than 120s remaining → return cached.
+ * - 30–120s remaining (advisory window) → return stale token immediately,
+ *   kick off background refresh. On failure, log and keep stale.
+ * - Less than 30s remaining or expired (mandatory) → block and refresh.
+ *   On failure, throw.
+ *
+ * Concurrent mandatory callers coalesce into a single provider call.
+ */
+export declare class TokenCache {
+    private provider;
+    private cached;
+    private pendingRefresh;
+    private nextForce;
+    private lastAdvisoryError;
+    private onAdvisoryRefreshError;
+    constructor(provider: AccessTokenProvider, onAdvisoryRefreshError?: (err: unknown) => void);
+    getToken(): Promise<string>;
+    /**
+     * Clears the cached token and marks the next {@link getToken} as a forced
+     * refresh, so the underlying provider bypasses any on-disk freshness check.
+     * Called after a 401 — the server has just told us the token is bad even
+     * if its `expires_at` still looks fresh.
+     */
+    invalidate(): void;
+    /**
+     * Mandatory refresh. Joins any in-flight refresh unless forced — a forced
+     * refresh must not coalesce into a non-forced one that may re-serve the
+     * same stale disk token.
+     */
+    private refresh;
+    /**
+     * Advisory background refresh. Shares the same in-flight promise as
+     * mandatory refreshes for deduplication, but swallows errors so the
+     * stale cached token keeps being served. Backs off for
+     * {@link ADVISORY_REFRESH_BACKOFF_IN_SECONDS} after a failure so an
+     * outage during the advisory window doesn't hammer the token endpoint.
+     */
+    private backgroundRefresh;
+    /**
+     * Core refresh. Sets {@link pendingRefresh} so concurrent callers
+     * (both advisory and mandatory) coalesce into a single provider call.
+     */
+    private doRefresh;
+}
+//# sourceMappingURL=token-cache.d.mts.map

package/lib/credentials/token-cache.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cache.d.mts","sourceRoot":"","sources":["../../src/lib/credentials/token-cache.ts"],"names":[],"mappings":"OAAO,KAAK,EAAe,mBAAmB,EAAE;AAQhD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,cAAc,CAAqC;IAC3D,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,sBAAsB,CAAuC;gBAEzD,QAAQ,EAAE,mBAAmB,EAAE,sBAAsB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI;IAKpF,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IA6BjC;;;;;OAKG;IACH,UAAU,IAAI,IAAI;IAKlB;;;;OAIG;IACH,OAAO,CAAC,OAAO;IAOf;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;OAGG;IACH,OAAO,CAAC,SAAS;CAclB"}

package/lib/credentials/token-cache.d.ts

@@ -0,0 +1,54 @@
+import type { AccessTokenProvider } from "./types.js";
+/**
+ * Wraps an {@link AccessTokenProvider} with two-tier proactive refresh
+ * and concurrent deduplication.
+ *
+ * Refresh policy on each {@link getToken} call:
+ *
+ * - No cached token → call provider (blocking), cache, return.
+ * - Cached with `expiresAt == null` → return cached forever.
+ * - More than 120s remaining → return cached.
+ * - 30–120s remaining (advisory window) → return stale token immediately,
+ *   kick off background refresh. On failure, log and keep stale.
+ * - Less than 30s remaining or expired (mandatory) → block and refresh.
+ *   On failure, throw.
+ *
+ * Concurrent mandatory callers coalesce into a single provider call.
+ */
+export declare class TokenCache {
+    private provider;
+    private cached;
+    private pendingRefresh;
+    private nextForce;
+    private lastAdvisoryError;
+    private onAdvisoryRefreshError;
+    constructor(provider: AccessTokenProvider, onAdvisoryRefreshError?: (err: unknown) => void);
+    getToken(): Promise<string>;
+    /**
+     * Clears the cached token and marks the next {@link getToken} as a forced
+     * refresh, so the underlying provider bypasses any on-disk freshness check.
+     * Called after a 401 — the server has just told us the token is bad even
+     * if its `expires_at` still looks fresh.
+     */
+    invalidate(): void;
+    /**
+     * Mandatory refresh. Joins any in-flight refresh unless forced — a forced
+     * refresh must not coalesce into a non-forced one that may re-serve the
+     * same stale disk token.
+     */
+    private refresh;
+    /**
+     * Advisory background refresh. Shares the same in-flight promise as
+     * mandatory refreshes for deduplication, but swallows errors so the
+     * stale cached token keeps being served. Backs off for
+     * {@link ADVISORY_REFRESH_BACKOFF_IN_SECONDS} after a failure so an
+     * outage during the advisory window doesn't hammer the token endpoint.
+     */
+    private backgroundRefresh;
+    /**
+     * Core refresh. Sets {@link pendingRefresh} so concurrent callers
+     * (both advisory and mandatory) coalesce into a single provider call.
+     */
+    private doRefresh;
+}
+//# sourceMappingURL=token-cache.d.ts.map

package/lib/credentials/token-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cache.d.ts","sourceRoot":"","sources":["../../src/lib/credentials/token-cache.ts"],"names":[],"mappings":"OAAO,KAAK,EAAe,mBAAmB,EAAE;AAQhD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,cAAc,CAAqC;IAC3D,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,sBAAsB,CAAuC;gBAEzD,QAAQ,EAAE,mBAAmB,EAAE,sBAAsB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI;IAKpF,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IA6BjC;;;;;OAKG;IACH,UAAU,IAAI,IAAI;IAKlB;;;;OAIG;IACH,OAAO,CAAC,OAAO;IAOf;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;OAGG;IACH,OAAO,CAAC,SAAS;CAclB"}

package/lib/credentials/token-cache.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenCache = void 0;
+const types_1 = require("./types.js");
+const time_1 = require("../../internal/utils/time.js");
+/**
+ * Wraps an {@link AccessTokenProvider} with two-tier proactive refresh
+ * and concurrent deduplication.
+ *
+ * Refresh policy on each {@link getToken} call:
+ *
+ * - No cached token → call provider (blocking), cache, return.
+ * - Cached with `expiresAt == null` → return cached forever.
+ * - More than 120s remaining → return cached.
+ * - 30–120s remaining (advisory window) → return stale token immediately,
+ *   kick off background refresh. On failure, log and keep stale.
+ * - Less than 30s remaining or expired (mandatory) → block and refresh.
+ *   On failure, throw.
+ *
+ * Concurrent mandatory callers coalesce into a single provider call.
+ */
+class TokenCache {
+    constructor(provider, onAdvisoryRefreshError) {
+        this.cached = null;
+        this.pendingRefresh = null;
+        this.nextForce = false;
+        this.lastAdvisoryError = 0;
+        this.provider = provider;
+        this.onAdvisoryRefreshError = onAdvisoryRefreshError;
+    }
+    async getToken() {
+        const force = this.nextForce;
+        this.nextForce = false;
+        const cached = this.cached;
+        if (force || cached == null) {
+            const token = await this.refresh(force);
+            return token.token;
+        }
+        if (cached.expiresAt == null) {
+            return cached.token;
+        }
+        const remaining = cached.expiresAt - (0, time_1.nowAsSeconds)();
+        if (remaining > types_1.ADVISORY_REFRESH_THRESHOLD_IN_SECONDS) {
+            return cached.token;
+        }
+        if (remaining > types_1.MANDATORY_REFRESH_THRESHOLD_IN_SECONDS) {
+            this.backgroundRefresh();
+            return cached.token;
+        }
+        const token = await this.refresh();
+        return token.token;
+    }
+    /**
+     * Clears the cached token and marks the next {@link getToken} as a forced
+     * refresh, so the underlying provider bypasses any on-disk freshness check.
+     * Called after a 401 — the server has just told us the token is bad even
+     * if its `expires_at` still looks fresh.
+     */
+    invalidate() {
+        this.cached = null;
+        this.nextForce = true;
+    }
+    /**
+     * Mandatory refresh. Joins any in-flight refresh unless forced — a forced
+     * refresh must not coalesce into a non-forced one that may re-serve the
+     * same stale disk token.
+     */
+    refresh(force = false) {
+        if (this.pendingRefresh && !force) {
+            return this.pendingRefresh;
+        }
+        return this.doRefresh(force);
+    }
+    /**
+     * Advisory background refresh. Shares the same in-flight promise as
+     * mandatory refreshes for deduplication, but swallows errors so the
+     * stale cached token keeps being served. Backs off for
+     * {@link ADVISORY_REFRESH_BACKOFF_IN_SECONDS} after a failure so an
+     * outage during the advisory window doesn't hammer the token endpoint.
+     */
+    backgroundRefresh() {
+        if (this.pendingRefresh) {
+            return;
+        }
+        if ((0, time_1.nowAsSeconds)() - this.lastAdvisoryError < types_1.ADVISORY_REFRESH_BACKOFF_IN_SECONDS) {
+            return;
+        }
+        this.doRefresh().catch((err) => {
+            this.lastAdvisoryError = (0, time_1.nowAsSeconds)();
+            // Advisory failure: keep serving the stale cached token, but surface
+            // the error to the caller-provided hook so it can be logged.
+            this.onAdvisoryRefreshError?.(err);
+        });
+    }
+    /**
+     * Core refresh. Sets {@link pendingRefresh} so concurrent callers
+     * (both advisory and mandatory) coalesce into a single provider call.
+     */
+    doRefresh(force = false) {
+        this.pendingRefresh = this.provider(force ? { forceRefresh: true } : undefined).then((token) => {
+            this.cached = token;
+            this.pendingRefresh = null;
+            return token;
+        }, (err) => {
+            this.pendingRefresh = null;
+            throw err;
+        });
+        return this.pendingRefresh;
+    }
+}
+exports.TokenCache = TokenCache;
+//# sourceMappingURL=token-cache.js.map

package/lib/credentials/token-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cache.js","sourceRoot":"","sources":["../../src/lib/credentials/token-cache.ts"],"names":[],"mappings":";;;AACA,sCAIiB;AACjB,uDAAyD;AAEzD;;;;;;;;;;;;;;;GAeG;AACH,MAAa,UAAU;IAQrB,YAAY,QAA6B,EAAE,sBAA+C;QANlF,WAAM,GAAuB,IAAI,CAAC;QAClC,mBAAc,GAAgC,IAAI,CAAC;QACnD,cAAS,GAAG,KAAK,CAAC;QAClB,sBAAiB,GAAG,CAAC,CAAC;QAI5B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3B,IAAI,KAAK,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,GAAG,IAAA,mBAAY,GAAE,CAAC;QAEpD,IAAI,SAAS,GAAG,6CAAqC,EAAE,CAAC;YACtD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,IAAI,SAAS,GAAG,8CAAsC,EAAE,CAAC;YACvD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,UAAU;QACR,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACK,OAAO,CAAC,KAAK,GAAG,KAAK;QAC3B,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB;QACvB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,IAAA,mBAAY,GAAE,GAAG,IAAI,CAAC,iBAAiB,GAAG,2CAAmC,EAAE,CAAC;YAClF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7B,IAAI,CAAC,iBAAiB,GAAG,IAAA,mBAAY,GAAE,CAAC;YACxC,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,CAAC,sBAAsB,EAAE,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,SAAS,CAAC,KAAK,GAAG,KAAK;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAClF,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC,CACF,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;CACF;AAzGD,gCAyGC"}

package/lib/credentials/token-cache.mjs

@@ -0,0 +1,108 @@
+import { ADVISORY_REFRESH_BACKOFF_IN_SECONDS, ADVISORY_REFRESH_THRESHOLD_IN_SECONDS, MANDATORY_REFRESH_THRESHOLD_IN_SECONDS, } from "./types.mjs";
+import { nowAsSeconds } from "../../internal/utils/time.mjs";
+/**
+ * Wraps an {@link AccessTokenProvider} with two-tier proactive refresh
+ * and concurrent deduplication.
+ *
+ * Refresh policy on each {@link getToken} call:
+ *
+ * - No cached token → call provider (blocking), cache, return.
+ * - Cached with `expiresAt == null` → return cached forever.
+ * - More than 120s remaining → return cached.
+ * - 30–120s remaining (advisory window) → return stale token immediately,
+ *   kick off background refresh. On failure, log and keep stale.
+ * - Less than 30s remaining or expired (mandatory) → block and refresh.
+ *   On failure, throw.
+ *
+ * Concurrent mandatory callers coalesce into a single provider call.
+ */
+export class TokenCache {
+    constructor(provider, onAdvisoryRefreshError) {
+        this.cached = null;
+        this.pendingRefresh = null;
+        this.nextForce = false;
+        this.lastAdvisoryError = 0;
+        this.provider = provider;
+        this.onAdvisoryRefreshError = onAdvisoryRefreshError;
+    }
+    async getToken() {
+        const force = this.nextForce;
+        this.nextForce = false;
+        const cached = this.cached;
+        if (force || cached == null) {
+            const token = await this.refresh(force);
+            return token.token;
+        }
+        if (cached.expiresAt == null) {
+            return cached.token;
+        }
+        const remaining = cached.expiresAt - nowAsSeconds();
+        if (remaining > ADVISORY_REFRESH_THRESHOLD_IN_SECONDS) {
+            return cached.token;
+        }
+        if (remaining > MANDATORY_REFRESH_THRESHOLD_IN_SECONDS) {
+            this.backgroundRefresh();
+            return cached.token;
+        }
+        const token = await this.refresh();
+        return token.token;
+    }
+    /**
+     * Clears the cached token and marks the next {@link getToken} as a forced
+     * refresh, so the underlying provider bypasses any on-disk freshness check.
+     * Called after a 401 — the server has just told us the token is bad even
+     * if its `expires_at` still looks fresh.
+     */
+    invalidate() {
+        this.cached = null;
+        this.nextForce = true;
+    }
+    /**
+     * Mandatory refresh. Joins any in-flight refresh unless forced — a forced
+     * refresh must not coalesce into a non-forced one that may re-serve the
+     * same stale disk token.
+     */
+    refresh(force = false) {
+        if (this.pendingRefresh && !force) {
+            return this.pendingRefresh;
+        }
+        return this.doRefresh(force);
+    }
+    /**
+     * Advisory background refresh. Shares the same in-flight promise as
+     * mandatory refreshes for deduplication, but swallows errors so the
+     * stale cached token keeps being served. Backs off for
+     * {@link ADVISORY_REFRESH_BACKOFF_IN_SECONDS} after a failure so an
+     * outage during the advisory window doesn't hammer the token endpoint.
+     */
+    backgroundRefresh() {
+        if (this.pendingRefresh) {
+            return;
+        }
+        if (nowAsSeconds() - this.lastAdvisoryError < ADVISORY_REFRESH_BACKOFF_IN_SECONDS) {
+            return;
+        }
+        this.doRefresh().catch((err) => {
+            this.lastAdvisoryError = nowAsSeconds();
+            // Advisory failure: keep serving the stale cached token, but surface
+            // the error to the caller-provided hook so it can be logged.
+            this.onAdvisoryRefreshError?.(err);
+        });
+    }
+    /**
+     * Core refresh. Sets {@link pendingRefresh} so concurrent callers
+     * (both advisory and mandatory) coalesce into a single provider call.
+     */
+    doRefresh(force = false) {
+        this.pendingRefresh = this.provider(force ? { forceRefresh: true } : undefined).then((token) => {
+            this.cached = token;
+            this.pendingRefresh = null;
+            return token;
+        }, (err) => {
+            this.pendingRefresh = null;
+            throw err;
+        });
+        return this.pendingRefresh;
+    }
+}
+//# sourceMappingURL=token-cache.mjs.map

package/lib/credentials/token-cache.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cache.mjs","sourceRoot":"","sources":["../../src/lib/credentials/token-cache.ts"],"names":[],"mappings":"OACO,EACL,mCAAmC,EACnC,qCAAqC,EACrC,sCAAsC,GACvC;OACM,EAAE,YAAY,EAAE;AAEvB;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,UAAU;IAQrB,YAAY,QAA6B,EAAE,sBAA+C;QANlF,WAAM,GAAuB,IAAI,CAAC;QAClC,mBAAc,GAAgC,IAAI,CAAC;QACnD,cAAS,GAAG,KAAK,CAAC;QAClB,sBAAiB,GAAG,CAAC,CAAC;QAI5B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3B,IAAI,KAAK,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;QAEpD,IAAI,SAAS,GAAG,qCAAqC,EAAE,CAAC;YACtD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,IAAI,SAAS,GAAG,sCAAsC,EAAE,CAAC;YACvD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,UAAU;QACR,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACK,OAAO,CAAC,KAAK,GAAG,KAAK;QAC3B,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB;QACvB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,YAAY,EAAE,GAAG,IAAI,CAAC,iBAAiB,GAAG,mCAAmC,EAAE,CAAC;YAClF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7B,IAAI,CAAC,iBAAiB,GAAG,YAAY,EAAE,CAAC;YACxC,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,CAAC,sBAAsB,EAAE,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,SAAS,CAAC,KAAK,GAAG,KAAK;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAClF,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC,CACF,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;CACF"}