@atlasauth/emulator-core 0.1.0 → 0.2.0

package/dist/handlers/connections.js

@@ -0,0 +1,332 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.connectionsHandlers = connectionsHandlers;
+const crypto_util_1 = require("../crypto-util");
+const errors_1 = require("../errors");
+const store_1 = require("../store");
+const support_1 = require("./support");
+const util_1 = require("./util");
+/**
+ * Connection history and recovery on the engine's own state: the per-connection activity log (what happened, never what was
+ * sent: method, host, status and timing only), persisted provider events with read-back and replay, hosted reconnect
+ * (settings, a one-time link, the public pages) and the exchange of a non-expiring Shopify token for an expiring one.
+ * Connections themselves are the generic CRUD layer's rows. The relay goes through the engine's `fetch` option, so it never
+ * reaches a real provider unless a test says so.
+ */
+const RETENTION_MS = 30 * 86_400_000;
+const ACTIVITY_KINDS = ['relay', 'token_read', 'refresh', 'health', 'provider_event', 'reconnect', 'token_exchange'];
+const OUTCOMES = ['ok', 'error', 'blocked'];
+const UNINSTALL = /(^|[/._-])(uninstall(ed)?|deauthori[sz]ed?|installation[._-]deleted|app[._/-]uninstalled)($|[/._-])/i;
+const MAX_PAYLOAD = 256 * 1024;
+const bad = (message, param) => new errors_1.EmulatorError('VALIDATION_FAILED', message, param);
+const st = (0, support_1.engineState)((e) => ({ activity: new store_1.Table('connection_activity', e.clock.now, 'cact'), events: new store_1.Table('connection_provider_events', e.clock.now, 'cpev'), links: new Map(), settings: { enabled: false, link_ttl_hours: 168, return_url: null, providers: [] } }));
+const connOf = (e, id) => {
+    const c = e.generic.get('connections')?.get(id);
+    if (!c)
+        throw (0, errors_1.notFound)('Connection');
+    return c;
+};
+const record = (e, connectionId, kind, outcome, extra = {}) => {
+    st(e).activity.insert({ connection_id: connectionId, kind, outcome, created_at: e.clock.now(), ...extra });
+};
+const activityView = (r) => ({ object: 'connection_activity', id: r.id, connection_id: r.connection_id, kind: r.kind, outcome: r.outcome, method: r.method ?? null, host: r.host ?? null, status: r.status ?? null, duration_ms: r.duration_ms ?? null, attempts: r.attempts ?? null, detail: r.detail ?? null, created_at: r.created_at });
+const eventView = (r, payload) => ({ object: 'connection_provider_event', id: r.id, connection_id: r.connection_id, provider: r.provider, topic: r.topic, kind: r.kind, replayed: r.replay_count > 0, replay_count: r.replay_count, received_at: r.received_at, ...(payload ? { payload: r.payload } : {}) });
+const sinceFilter = (e, v) => {
+    if (v === null)
+        return e.clock.now() - RETENTION_MS;
+    const n = /^\d+$/.test(v) ? Number(v) : Date.parse(v);
+    if (Number.isNaN(n))
+        throw bad('since must be epoch milliseconds or an ISO 8601 time.', 'since');
+    return Math.max(n, e.clock.now() - RETENTION_MS);
+};
+const hostAllowed = (host, allowed) => allowed.some((a) => (a.startsWith('*.') ? host.endsWith(a.slice(1)) && host.length > a.length - 1 : host === a));
+const hashLink = async (t) => (0, crypto_util_1.bytesToB64url)(await (0, crypto_util_1.sha256)(t));
+function announce(e, ev, replayed) {
+    e.webhooks.emit('connection.provider_event', { object: 'connection_provider_event', id: ev.id, connection_id: ev.connection_id, provider: ev.provider, topic: ev.topic, kind: ev.kind, ...(replayed ? { replayed: true, event_id: ev.id } : {}), received_at: ev.received_at });
+}
+function connectionsHandlers() {
+    const eventOf = (e, connectionId, id) => {
+        const ev = st(e).events.get(id);
+        if (!ev || ev.connection_id !== connectionId)
+            throw (0, errors_1.notFound)('Provider event');
+        return ev;
+    };
+    const eventList = (e, q, connectionId, c) => {
+        const since = sinceFilter(e, q.get('since'));
+        const rows = st(e).events.all().filter((r) => r.received_at >= since && (!connectionId || r.connection_id === connectionId) && (!q.get('connection_id') || r.connection_id === q.get('connection_id')) && (!q.get('provider') || r.provider === q.get('provider')) && (!q.get('topic') || r.topic === q.get('topic')));
+        const page = (0, store_1.paginate)(rows, (0, util_1.pageOf)(c));
+        return { object: 'list', data: page.data.map((r) => eventView(r, false)), has_more: page.has_more, next_cursor: page.next_cursor };
+    };
+    return [
+        // ── activity ──
+        {
+            method: 'GET',
+            pattern: '/v1/connections/:id/activity',
+            scope: 'organizations:read',
+            handler: (c) => {
+                const e = c.engine;
+                const conn = connOf(e, c.params.id);
+                const kind = c.query.get('kind');
+                const outcome = c.query.get('outcome');
+                if (kind && !ACTIVITY_KINDS.includes(kind))
+                    throw bad(`kind must be one of: ${ACTIVITY_KINDS.join(', ')}.`, 'kind');
+                if (outcome && !OUTCOMES.includes(outcome))
+                    throw bad(`outcome must be one of: ${OUTCOMES.join(', ')}.`, 'outcome');
+                const since = sinceFilter(e, c.query.get('since'));
+                const rows = st(e).activity.all().filter((r) => r.connection_id === conn.id && r.created_at >= since && (!kind || r.kind === kind) && (!outcome || r.outcome === outcome));
+                const page = (0, store_1.paginate)(rows, (0, util_1.pageOf)(c));
+                return { body: { object: 'list', data: page.data.map(activityView), has_more: page.has_more, next_cursor: page.next_cursor } };
+            },
+        },
+        {
+            // The relay: allowed method and host only; the log keeps method, host, status, duration and attempts, never the path, headers or body.
+            method: 'POST',
+            pattern: '/v1/connections/:id/relay',
+            scope: 'connections:relay',
+            handler: async (c) => {
+                const e = c.engine;
+                const conn = connOf(e, c.params.id);
+                const method = (0, support_1.oneOf)(c.body, 'method', ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE'], 'GET');
+                let url;
+                try {
+                    url = new URL(String(c.body.url));
+                }
+                catch {
+                    throw bad('url must be an absolute https URL.', 'url');
+                }
+                if (url.protocol !== 'https:' || url.username || url.password)
+                    throw bad('url must be an https URL without credentials.', 'url');
+                const methods = conn.allowed_methods ?? ['GET'];
+                const refuse = (detail, param) => {
+                    record(e, conn.id, 'relay', 'blocked', { method, host: url.host, detail });
+                    throw new errors_1.EmulatorError('FORBIDDEN', detail, param);
+                };
+                if (conn.status === 'revoked')
+                    refuse('This connection is revoked.', 'url');
+                if (!methods.includes(method))
+                    refuse(`${method} is not in this connection's allowed_methods.`, 'method');
+                if (!hostAllowed(url.hostname, conn.allowed_hosts ?? []))
+                    refuse('That host is not in this connection\'s allowed_hosts.', 'url');
+                if (!e.options.fetch) {
+                    record(e, conn.id, 'relay', 'error', { method, host: url.host, status: null, duration_ms: 0, attempts: 1, detail: 'no fetch configured' });
+                    throw new errors_1.EmulatorError('CONNECTION_UPSTREAM_ERROR', 'The emulator has no outbound fetch: pass the `fetch` option to answer relayed calls.');
+                }
+                const started = e.clock.now();
+                let res;
+                try {
+                    res = await e.options.fetch(url.toString(), { method, headers: c.body.headers ?? {}, body: ['GET', 'HEAD'].includes(method) ? undefined : typeof c.body.body === 'string' ? c.body.body : c.body.body === undefined ? undefined : JSON.stringify(c.body.body) });
+                }
+                catch (err) {
+                    record(e, conn.id, 'relay', 'error', { method, host: url.host, status: null, duration_ms: e.clock.now() - started, attempts: 1, detail: 'network error' });
+                    throw new errors_1.EmulatorError('CONNECTION_UPSTREAM_ERROR', `The provider could not be reached: ${err.message}`);
+                }
+                record(e, conn.id, 'relay', res.status < 400 ? 'ok' : 'error', { method, host: url.host, status: res.status, duration_ms: e.clock.now() - started, attempts: 1 });
+                return { body: { object: 'connection_relay_response', connection_id: conn.id, status: res.status, headers: Object.fromEntries(res.headers), body: await res.text() } };
+            },
+        },
+        // ── persisted provider events ──
+        {
+            // The provider's announcement lands here (in production, signature-verified per provider): stored, announced, and an uninstall revokes the connection.
+            method: 'POST',
+            pattern: '/v1/connection_provider_events/:instanceId/:provider',
+            public: true,
+            handler: (c) => {
+                const e = c.engine;
+                if (c.params.instanceId !== e.instanceId)
+                    throw (0, errors_1.notFound)('Instance');
+                const conn = connOf(e, c.body.connection_id);
+                if (conn.provider !== c.params.provider)
+                    throw (0, errors_1.notFound)('Connection for that provider');
+                if (typeof c.body.topic !== 'string' || !c.body.topic || c.body.topic.length > 200)
+                    throw bad('topic is required (up to 200 characters).', 'topic');
+                const payload = c.body.payload ?? {};
+                if (JSON.stringify(payload).length > MAX_PAYLOAD)
+                    throw bad('payload can be at most 256 KB.', 'payload');
+                const kind = UNINSTALL.test(c.body.topic) ? 'uninstall' : 'event';
+                const ev = st(e).events.insert({ connection_id: conn.id, provider: conn.provider, topic: c.body.topic, kind, payload, replay_count: 0, received_at: e.clock.now() });
+                record(e, conn.id, 'provider_event', 'ok', { detail: c.body.topic });
+                announce(e, ev, false);
+                if (kind === 'uninstall' && conn.status !== 'revoked') {
+                    conn.status = 'revoked';
+                    record(e, conn.id, 'health', 'ok', { detail: 'revoked by the provider' });
+                    e.webhooks.emit('connection.revoked', { object: 'connection', id: conn.id, provider: conn.provider, reason: 'provider_uninstall' });
+                }
+                return { status: 201, body: eventView(ev, false) };
+            },
+        },
+        { method: 'GET', pattern: '/v1/connections/:id/provider_events', scope: 'organizations:read', handler: (c) => ({ body: eventList(c.engine, c.query, connOf(c.engine, c.params.id).id, c) }) },
+        { method: 'GET', pattern: '/v1/connection_provider_event_log', scope: 'organizations:read', handler: (c) => ({ body: eventList(c.engine, c.query, null, c) }) },
+        {
+            method: 'GET',
+            pattern: '/v1/connections/:id/provider_events/:eventId',
+            scope: 'organizations:read',
+            handler: (c) => ({ body: eventView(eventOf(c.engine, connOf(c.engine, c.params.id).id, c.params.eventId), true) }),
+        },
+        {
+            // Re-announces only: a replayed uninstall never revokes a connection again.
+            method: 'POST',
+            pattern: '/v1/connections/:id/provider_events/:eventId/replay',
+            scope: 'organizations:write',
+            handler: (c) => {
+                const e = c.engine;
+                const ev = eventOf(e, connOf(e, c.params.id).id, c.params.eventId);
+                ev.replay_count++;
+                announce(e, ev, true);
+                return { body: eventView(ev, false) };
+            },
+        },
+        // ── hosted reconnect ──
+        { method: 'GET', pattern: '/v1/connection_reconnect_settings', scope: 'organizations:read', handler: (c) => ({ body: { object: 'connection_reconnect_settings', ...st(c.engine).settings } }) },
+        {
+            method: 'PUT',
+            pattern: '/v1/connection_reconnect_settings',
+            scope: 'organizations:write',
+            handler: (c) => {
+                const s = st(c.engine).settings;
+                const b = c.body;
+                const unknown = Object.keys(b).find((k) => !['enabled', 'link_ttl_hours', 'return_url', 'providers'].includes(k));
+                if (unknown)
+                    throw bad(`Unknown field: ${unknown}.`, unknown);
+                const next = { ...s };
+                if (b.enabled !== undefined) {
+                    if (typeof b.enabled !== 'boolean')
+                        throw bad('enabled must be true or false.', 'enabled');
+                    next.enabled = b.enabled;
+                }
+                if (b.link_ttl_hours !== undefined)
+                    next.link_ttl_hours = (0, support_1.intIn)(b.link_ttl_hours, 'link_ttl_hours', 1, 720);
+                if (b.return_url !== undefined) {
+                    if (b.return_url !== null) {
+                        let u = null;
+                        try {
+                            u = new URL(b.return_url);
+                        }
+                        catch {
+                            /* reported below */
+                        }
+                        if (!u || u.protocol !== 'https:' || u.username || u.password)
+                            throw bad('return_url must be an https URL.', 'return_url');
+                    }
+                    next.return_url = b.return_url;
+                }
+                if (b.providers !== undefined) {
+                    if (!Array.isArray(b.providers) || b.providers.length > 50 || b.providers.some((p) => typeof p !== 'string' || !p))
+                        throw bad('providers is a list of up to 50 provider keys.', 'providers');
+                    next.providers = [...new Set(b.providers)];
+                }
+                Object.assign(s, next);
+                return { body: { object: 'connection_reconnect_settings', ...s } };
+            },
+        },
+        {
+            // A one-time link for the owner to authorize again. Only a hash is stored; the URL is shown once. `send_email` mails the owner (your own mail provider).
+            method: 'POST',
+            pattern: '/v1/connections/:id/reconnect_link',
+            scope: 'organizations:write',
+            handler: async (c) => {
+                const e = c.engine;
+                const conn = connOf(e, c.params.id);
+                const s = st(e).settings;
+                if (c.body.send_email !== undefined && typeof c.body.send_email !== 'boolean')
+                    throw bad('send_email must be a boolean.', 'send_email');
+                const ttl = c.body.ttl_hours === undefined ? s.link_ttl_hours : (0, support_1.intIn)(c.body.ttl_hours, 'ttl_hours', 1, 720);
+                if (!s.enabled)
+                    throw new errors_1.EmulatorError('CONFLICT', 'Hosted reconnect is off. Turn it on with PUT /v1/connection_reconnect_settings.');
+                if (conn.kind !== 'oauth')
+                    throw bad('Only an oauth connection is authorized again with the provider.', 'kind');
+                if (conn.status === 'revoked')
+                    throw new errors_1.EmulatorError('CONFLICT', 'This connection was revoked; connect it again with POST /v1/connections/{id}/connect.');
+                if (s.providers.length && !s.providers.includes(conn.provider))
+                    throw bad(`Hosted reconnect is not enabled for ${conn.provider}.`, 'provider');
+                let recipients = [];
+                if (c.body.send_email === true) {
+                    const user = conn.owner?.type === 'user' ? e.db.users.get(conn.owner.id) : undefined;
+                    const primary = user?.emails?.find((m) => m.id === user?.primary_email_address_id && m.verified);
+                    if (!primary)
+                        throw bad('This connection has no email recipient (a user owner needs a verified address).', 'send_email');
+                    recipients = [primary.email_address];
+                }
+                const token = (0, store_1.randomToken)(32);
+                const expiresAt = e.clock.now() + ttl * 3_600_000;
+                st(e).links.set(await hashLink(token), { connectionId: conn.id, expiresAt, started: false });
+                const url = `${e.issuer}/v1/connection_reconnect/${token}`;
+                for (const to of recipients)
+                    e.messages.send({ channel: 'email', to, subject: `Reconnect your ${conn.provider} connection`, link: url, meta: { template: 'connection_reconnect' } });
+                record(e, conn.id, 'reconnect', 'ok', { detail: 'link issued' });
+                return { status: 201, body: { object: 'connection_reconnect_link', connection_id: conn.id, url, expires_at: expiresAt, emailed: recipients.length } };
+            },
+        },
+        {
+            // Public. Looking at the page spends nothing (a mail scanner may open it). Every bad link answers the same.
+            method: 'GET',
+            pattern: '/v1/connection_reconnect/:token',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                const link = st(e).links.get(await hashLink(c.params.token ?? ''));
+                if (!link || link.expiresAt <= e.clock.now() || link.started)
+                    throw bad('This link is not valid.', 'token');
+                const conn = connOf(e, link.connectionId);
+                return { headers: { 'cache-control': 'no-store' }, body: { object: 'connection_reconnect_page', connection: { id: conn.id, provider: conn.provider, name: conn.name ?? null }, expires_at: link.expiresAt } };
+            },
+        },
+        {
+            method: 'GET',
+            pattern: '/v1/connection_reconnect/:token/start',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                const link = st(e).links.get(await hashLink(c.params.token ?? ''));
+                if (!link || link.expiresAt <= e.clock.now() || link.started)
+                    throw bad('This link is not valid.', 'token');
+                link.started = true;
+                const conn = connOf(e, link.connectionId);
+                record(e, conn.id, 'reconnect', 'ok', { detail: 'started' });
+                const back = st(e).settings.return_url ?? `${e.issuer}/v1/connection_reconnect_done`;
+                return { status: 302, headers: { location: `${e.issuer}/__emulator/provider/${encodeURIComponent(conn.provider)}/authorize?connection_id=${conn.id}&return=${encodeURIComponent(back)}`, 'cache-control': 'no-store' } };
+            },
+        },
+        { method: 'GET', pattern: '/v1/connection_reconnect_done', public: true, handler: () => ({ headers: { 'cache-control': 'no-store' }, body: { object: 'connection_reconnect_done', ok: true } }) },
+        // ── Shopify: non-expiring offline token to an expiring one ──
+        {
+            method: 'POST',
+            pattern: '/v1/connections/:id/token/exchange',
+            scope: 'connections:token',
+            handler: async (c) => {
+                const e = c.engine;
+                const conn = connOf(e, c.params.id);
+                if (conn.provider !== 'shopify')
+                    throw bad('Only a Shopify connection has a token to exchange.', 'provider');
+                if (conn.status === 'revoked')
+                    throw new errors_1.EmulatorError('CONFLICT', 'This connection is revoked.');
+                if (conn.expiring === true)
+                    throw new errors_1.EmulatorError('CONFLICT', 'This connection already holds an expiring token.');
+                const shop = String(conn.host_params?.shop ?? conn.config?.shop ?? (conn.allowed_hosts ?? [])[0] ?? '');
+                const host = shop.includes('.') ? shop : `${shop}.myshopify.com`;
+                // The app secret goes only to the shop's own host.
+                if (!/^[a-z0-9][a-z0-9-]*\.myshopify\.com$/i.test(host))
+                    throw bad('The exchange only runs against a *.myshopify.com shop.', 'host');
+                if (!e.options.fetch)
+                    throw new errors_1.EmulatorError('OAUTH_EXCHANGE_FAILED', 'The emulator has no outbound fetch: pass the `fetch` option to play the Shopify token endpoint.');
+                let res;
+                try {
+                    res = await e.options.fetch(`https://${host}/admin/oauth/access_token`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange', expiring: 1 }) });
+                }
+                catch {
+                    throw new errors_1.EmulatorError('OAUTH_EXCHANGE_FAILED', 'The shop could not be reached; the token is unchanged.');
+                }
+                const json = res.ok ? await res.json().catch(() => null) : null;
+                if (!json || typeof json.access_token !== 'string') {
+                    record(e, conn.id, 'token_exchange', 'error', { host, status: res.status });
+                    throw new errors_1.EmulatorError('OAUTH_EXCHANGE_FAILED', 'Shopify refused the exchange; the token is unchanged.', undefined, { meta: { provider_status: res.status } });
+                }
+                conn.expiring = true;
+                conn.has_refresh_token = typeof json.refresh_token === 'string';
+                conn.updated_at = e.clock.now();
+                record(e, conn.id, 'token_exchange', 'ok', { host, status: res.status });
+                return { body: { object: 'connection_token_exchange', connection_id: conn.id, exchanged: true, expiring: true, has_refresh_token: conn.has_refresh_token, expires_in: Number(json.expires_in) || null } };
+            },
+        },
+    ];
+}
+//# sourceMappingURL=connections.js.map

package/dist/handlers/connections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../src/handlers/connections.ts"],"names":[],"mappings":";;AAsDA,kDA2PC;AA/SD,gDAAuD;AACvD,sCAAoD;AAEpD,oCAAwD;AACxD,uCAAsD;AACtD,iCAAgC;AAEhC;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,EAAE,GAAG,UAAU,CAAC;AACrC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,CAAU,CAAC;AAC9H,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AACrD,MAAM,SAAS,GAAG,sGAAsG,CAAC;AACzH,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC;AAC/B,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,EAAE,CAAC,IAAI,sBAAa,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAQvG,MAAM,EAAE,GAAG,IAAA,qBAAW,EAAC,CAAC,CAAS,EAAQ,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,aAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,aAAK,CAAC,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAE/R,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAsB,EAAO,EAAE;IACxD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC;QAAE,MAAM,IAAA,iBAAQ,EAAC,YAAY,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AACF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,YAAoB,EAAE,IAAqC,EAAE,OAAkC,EAAE,QAAa,EAAE,EAAQ,EAAE;IACnJ,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AAC7G,CAAC,CAAC;AACF,MAAM,YAAY,GAAG,CAAC,CAAM,EAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;AACtV,MAAM,SAAS,GAAG,CAAC,CAAM,EAAE,OAAgB,EAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,YAAY,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACjU,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,CAAgB,EAAU,EAAE;IAC1D,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;IACpD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,MAAM,GAAG,CAAC,uDAAuD,EAAE,OAAO,CAAC,CAAC;IACjG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;AACnD,CAAC,CAAC;AACF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,OAAiB,EAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AACnL,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAS,EAAmB,EAAE,CAAC,IAAA,2BAAa,EAAC,MAAM,IAAA,oBAAM,EAAC,CAAC,CAAC,CAAC,CAAC;AAEtF,SAAS,QAAQ,CAAC,CAAS,EAAE,EAAO,EAAE,QAAiB;IACrD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAClR,CAAC;AAED,SAAgB,mBAAmB;IACjC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,YAAoB,EAAE,EAAsB,EAAO,EAAE;QAC/E,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,aAAa,KAAK,YAAY;YAAE,MAAM,IAAA,iBAAQ,EAAC,gBAAgB,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,CAAkB,EAAE,YAA2B,EAAE,CAAM,EAAO,EAAE;QAC5F,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,KAAK,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACvT,MAAM,IAAI,GAAG,IAAA,gBAAQ,EAAC,IAAI,EAAE,IAAA,aAAM,EAAC,CAAC,CAAC,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IACrI,CAAC,CAAC;IAEF,OAAO;QACL,iBAAiB;QACjB;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACvC,IAAI,IAAI,IAAI,CAAE,cAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,MAAM,GAAG,CAAC,wBAAwB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC3I,IAAI,OAAO,IAAI,CAAE,QAA8B,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,MAAM,GAAG,CAAC,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC3I,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,UAAU,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;gBAC3K,MAAM,IAAI,GAAG,IAAA,gBAAQ,EAAC,IAAI,EAAE,IAAA,aAAM,EAAC,CAAC,CAAC,CAAC,CAAC;gBACvC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACjI,CAAC;SACF;QACD;YACE,uIAAuI;YACvI,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2BAA2B;YACpC,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpC,MAAM,MAAM,GAAG,IAAA,eAAK,EAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;gBACjG,IAAI,GAAQ,CAAC;gBACb,IAAI,CAAC;oBACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;gBACzD,CAAC;gBACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;oBAAE,MAAM,GAAG,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;gBACjI,MAAM,OAAO,GAAa,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAa,EAAS,EAAE;oBACtD,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC3E,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;gBACtD,CAAC,CAAC;gBACF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;oBAAE,MAAM,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;gBAC5E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,MAAM,CAAC,GAAG,MAAM,+CAA+C,EAAE,QAAQ,CAAC,CAAC;gBAC1G,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;oBAAE,MAAM,CAAC,uDAAuD,EAAE,KAAK,CAAC,CAAC;gBACjI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;oBACrB,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;oBAC3I,MAAM,IAAI,sBAAa,CAAC,2BAA2B,EAAE,sFAAsF,CAAC,CAAC;gBAC/I,CAAC;gBACD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC9B,IAAI,GAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,GAAG,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnQ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;oBAC3J,MAAM,IAAI,sBAAa,CAAC,2BAA2B,EAAE,sCAAuC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvH,CAAC;gBACD,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;gBAClK,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACzK,CAAC;SACF;QACD,kCAAkC;QAClC;YACE,uJAAuJ;YACvJ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sDAAsD;YAC/D,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;oBAAE,MAAM,IAAA,iBAAQ,EAAC,UAAU,CAAC,CAAC;gBACrE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC7C,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ;oBAAE,MAAM,IAAA,iBAAQ,EAAC,8BAA8B,CAAC,CAAC;gBACxF,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG;oBAAE,MAAM,GAAG,CAAC,2CAA2C,EAAE,OAAO,CAAC,CAAC;gBACpJ,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACrC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,WAAW;oBAAE,MAAM,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,CAAC;gBACzG,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;gBAClE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACrK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBACrE,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBACvB,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACtD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;oBACxB,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;oBAC1E,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACtI,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;YACrD,CAAC;SACF;QACD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE;QAC7L,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE;QAC/J;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,8CAA8C;YACvD,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;SACnH;QACD;YACE,4EAA4E;YAC5E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qDAAqD;YAC9D,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnE,EAAE,CAAC,YAAY,EAAE,CAAC;gBAClB,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;gBACtB,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;YACxC,CAAC;SACF;QACD,yBAAyB;QACzB,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE;QAC/L;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,mCAAmC;YAC5C,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;gBAChC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClH,IAAI,OAAO;oBAAE,MAAM,GAAG,CAAC,kBAAkB,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC9D,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC5B,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS;wBAAE,MAAM,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,CAAC;oBAC3F,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;gBAC3B,CAAC;gBACD,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS;oBAAE,IAAI,CAAC,cAAc,GAAG,IAAA,eAAK,EAAC,CAAC,CAAC,cAAc,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC5G,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC/B,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;wBAC1B,IAAI,CAAC,GAAe,IAAI,CAAC;wBACzB,IAAI,CAAC;4BACH,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;wBAC5B,CAAC;wBAAC,MAAM,CAAC;4BACP,oBAAoB;wBACtB,CAAC;wBACD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;4BAAE,MAAM,GAAG,CAAC,kCAAkC,EAAE,YAAY,CAAC,CAAC;oBAC7H,CAAC;oBACD,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;gBACjC,CAAC;gBACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC;wBAAE,MAAM,GAAG,CAAC,gDAAgD,EAAE,WAAW,CAAC,CAAC;oBACtM,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAS,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBACrD,CAAC;gBACD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBACvB,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;YACrE,CAAC;SACF;QACD;YACE,yJAAyJ;YACzJ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oCAAoC;YAC7C,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACzB,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS;oBAAE,MAAM,GAAG,CAAC,+BAA+B,EAAE,YAAY,CAAC,CAAC;gBACxI,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,eAAK,EAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC7G,IAAI,CAAC,CAAC,CAAC,OAAO;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,iFAAiF,CAAC,CAAC;gBACvI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;oBAAE,MAAM,GAAG,CAAC,iEAAiE,EAAE,MAAM,CAAC,CAAC;gBAChH,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,uFAAuF,CAAC,CAAC;gBAC5J,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,MAAM,GAAG,CAAC,uCAAuC,IAAI,CAAC,QAAQ,GAAG,EAAE,UAAU,CAAC,CAAC;gBAC/I,IAAI,UAAU,GAAa,EAAE,CAAC;gBAC9B,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;oBAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACrF,MAAM,OAAO,GAAI,IAAI,EAAE,MAA4B,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,wBAAwB,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;oBACxH,IAAI,CAAC,OAAO;wBAAE,MAAM,GAAG,CAAC,iFAAiF,EAAE,YAAY,CAAC,CAAC;oBACzH,UAAU,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;gBACvC,CAAC;gBACD,MAAM,KAAK,GAAG,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC;gBAC9B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,SAAS,CAAC;gBAClD,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7F,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,4BAA4B,KAAK,EAAE,CAAC;gBAC3D,KAAK,MAAM,EAAE,IAAI,UAAU;oBAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,kBAAkB,IAAI,CAAC,QAAQ,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC;gBACrL,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;gBACjE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACxJ,CAAC;SACF;QACD;YACE,4GAA4G;YAC5G,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,iCAAiC;YAC1C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;gBACnE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO;oBAAE,MAAM,GAAG,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;gBAC5G,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAChN,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,uCAAuC;YAChD,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;gBACnE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO;oBAAE,MAAM,GAAG,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;gBAC5G,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC1C,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC7D,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,MAAM,+BAA+B,CAAC;gBACrF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,IAAI,CAAC,EAAE,WAAW,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC;YAC3N,CAAC;SACF;QACD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE;QACjM,+DAA+D;QAC/D;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oCAAoC;YAC7C,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;oBAAE,MAAM,GAAG,CAAC,oDAAoD,EAAE,UAAU,CAAC,CAAC;gBAC7G,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;gBAClG,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,kDAAkD,CAAC,CAAC;gBACpH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACxG,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,gBAAgB,CAAC;gBACjE,mDAAmD;gBACnD,IAAI,CAAC,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM,GAAG,CAAC,wDAAwD,EAAE,MAAM,CAAC,CAAC;gBACrI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;oBAAE,MAAM,IAAI,sBAAa,CAAC,uBAAuB,EAAE,iGAAiG,CAAC,CAAC;gBAC1K,IAAI,GAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,GAAG,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,IAAI,2BAA2B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,iDAAiD,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACrP,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,sBAAa,CAAC,uBAAuB,EAAE,wDAAwD,CAAC,CAAC;gBAC7G,CAAC;gBACD,MAAM,IAAI,GAAQ,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;oBACnD,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC5E,MAAM,IAAI,sBAAa,CAAC,uBAAuB,EAAE,uDAAuD,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAClK,CAAC;gBACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,IAAI,CAAC,iBAAiB,GAAG,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC;gBAChE,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAChC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5M,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/handlers/device.d.ts

@@ -0,0 +1,47 @@
+import type { Engine, RouteContext, RouteDef } from '../engine';
+import type { Obj } from '../openapi';
+export declare const resetDevice: (e: Engine) => void;
+/** The unified `grants` claim entry (machine and agent grants share one shape). */
+export declare const tokenGrant: (g: {
+    type: "machine" | "agent";
+    id: string;
+    resource: string;
+    scopes: string[];
+    kind?: string | null;
+    constraints?: Obj | null;
+    expiresAt?: number | null;
+}) => Obj;
+/** A resource server by identifier or id (the generic CRUD layer stores them), or a bare identifier when none is stored. */
+export declare function resourceServerOf(e: Engine, ref: string): {
+    id: string | null;
+    identifier: string;
+    row: Obj | null;
+};
+export declare const presentAgent: (m: Obj) => Obj;
+export declare const presentAccessRequest: (r: Obj) => Obj;
+/** An agent grant is an approved, unexpired access request. The usage routes (`/v1/grants/agent/:id/...`) resolve through this. */
+export declare function agentGrant(e: Engine, id: string | undefined): Obj | undefined;
+export declare function deviceHandlers(): RouteDef[];
+/** What a request proved about the key or certificate it holds, for sender-constrained tokens (`cnf`). */
+export interface ProvedBinding {
+    jkt?: string;
+    x5t?: string;
+}
+/** Throws the validation error a machine's `token_binding` demands when `proved` does not satisfy it. */
+export declare function enforceTokenBinding(m: Obj, proved: ProvedBinding): void;
+export declare const cnfOf: (p: ProvedBinding) => Obj | undefined;
+/**
+ * Mint a machine token for `m` from the request fields (`audience`, `scopes`, `organization_id`). Every route that
+ * issues one (signed challenge, federation) goes through here, so claims never differ by way in. `beforeIssue` runs after
+ * every refusal and before the token is signed (the challenge route spends its nonce there).
+ */
+export declare function issueMachineToken(c: RouteContext, m: Obj, req: Obj, opts?: {
+    proved?: ProvedBinding;
+    maxTtlSeconds?: number;
+    extraClaims?: Obj;
+    beforeIssue?: () => void;
+}): Promise<{
+    body: Obj;
+}>;
+/** The binding a request proves on a machine route: a DPoP proof (htm POST, htu this URL, single-use jti) and/or a forwarded client certificate. */
+export declare function provedBindingOf(c: RouteContext): Promise<ProvedBinding>;