@baukit/auth-node 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Patrick Koss
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,76 @@
+# @baukit/auth-node
+
+`@baukit/auth-node` is the Node 24 OIDC device-flow package for CLI and MCP clients. It handles discovery, RFC 8628 polling, S256 PKCE, refresh rotation, and a local profile cache. It has no runtime dependencies.
+
+The package does not print instructions or open a browser. Supply callbacks for those actions.
+
+## Device-flow client
+
+```ts
+import { DeviceFlowClient } from '@baukit/auth-node/device-flow';
+
+const auth = new DeviceFlowClient(
+  {
+    issuer: process.env['OIDC_ISSUER'] ?? '',
+    clientId: process.env['OIDC_CLIENT_ID'] ?? '',
+    scopes: ['openid', 'profile', 'offline_access'],
+    audience: 'notes-api',
+    cache: {
+      namespace: 'notes-mcp',
+    },
+  },
+  {
+    environmentToken: () => process.env['NOTES_API_TOKEN'],
+  },
+);
+
+await auth.login({
+  presentation: {
+    showVerification: ({ verificationUri, userCode }) => {
+      process.stderr.write(`Open ${verificationUri}\nEnter ${userCode}\n`);
+    },
+    showStatus: (status) => {
+      process.stderr.write(`Login status: ${status}\n`);
+    },
+    openBrowser: (url) => openProductBrowser(url),
+  },
+});
+
+const token = await auth.accessToken();
+```
+
+`accessToken()` checks the injected environment-token source first. It then reads the selected cache profile and refreshes near-expiry tokens. Refreshes share one promise in a process and hold an adjacent `.lock` file while reading and replacing the cache.
+
+Pass an `AbortSignal` to `login`, `accessToken`, or `logout`. Discovery and token requests have a 15-second default timeout. A login has a 10-minute total timeout. Both limits are configurable.
+
+## Endpoint policy
+
+The configured issuer must match discovery metadata. Put known issuer aliases in `endpointPolicy.issuerAllowlist`. Token and device endpoints must share the issuer origin and path. Put a provider's documented endpoint origin in `endpointOriginAllowlist` when it uses a separate origin.
+
+All issuer, device, token, and verification URLs require HTTPS. Local development can set `allowLoopbackHttp: true`; this permits only `localhost`, `127.0.0.0/8`, and `::1`.
+
+Discovery and token bodies are limited to 64 KiB by default. Errors contain a stable code, an allowlisted message, an optional HTTP status, and no provider body. The client does not log.
+
+## Cache contract
+
+The JSON cache holds named profiles under one namespace. `defaultTokenCachePath(namespace)` resolves to `$XDG_CONFIG_HOME/<namespace>/tokens.json`, or `~/.config/<namespace>/tokens.json` when `XDG_CONFIG_HOME` is unset.
+
+On POSIX systems the cache file must have mode `0600` and its immediate directory must have mode `0700`. Existing unsafe permissions fail with `cache_permission`. The cache rejects symlink path components. Writes use a new temporary file, sync it, and atomically rename it, so a write failure before rename leaves the old file intact. Windows skips POSIX mode checks and relies on host ACLs.
+
+Use a separate namespace or profile for accounts that must not share credentials. `logout()` removes the selected profile and leaves other profiles in place.
+
+## Display-only claims
+
+`displayClaims()` and `decodeDisplayOnlyClaims()` decode a small allowlist of JWT fields without checking the signature. Use the result only for labels such as a `whoami` display. Never use it for authorization, storage partitions, audit identity, or analytics identity.
+
+## Migration from product-local auth
+
+Replace local discovery, device polling, refresh, and cache functions with one `DeviceFlowClient`. Keep these product inputs in the application:
+
+- environment variable names and defaults;
+- issuer, client ID, scopes, and audience;
+- CLI text and browser-launch behavior;
+- API base URL and bearer-token wiring; and
+- cache namespace, path, and profile selection.
+
+Older product caches do not have the versioned profile document used here. Sign out or remove the old file, then run the product's login command once. The package intentionally does not guess which product-owned legacy shape it received.

package/dist/cache.d.ts

@@ -0,0 +1,38 @@
+export interface CachedTokenProfile {
+    readonly accessToken: string;
+    readonly refreshToken?: string;
+    readonly idToken?: string;
+    readonly tokenType: string;
+    readonly expiresAt: number;
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly scopes: readonly string[];
+    readonly audience?: string;
+}
+export interface TokenCacheTransaction {
+    read(profile: string): Promise<CachedTokenProfile | undefined>;
+    write(profile: string, value: CachedTokenProfile): Promise<void>;
+    remove(profile: string): Promise<boolean>;
+}
+export interface NodeTokenCacheOptions {
+    readonly namespace: string;
+    readonly path?: string;
+    readonly platform?: NodeJS.Platform;
+    readonly now?: () => number;
+    readonly sleep?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
+    readonly lockTimeoutMs?: number;
+    readonly lockRetryMs?: number;
+}
+export declare function defaultTokenCachePath(namespace: string, environment?: Readonly<Record<string, string | undefined>>): string;
+/** A versioned profile cache that serializes mutations with an adjacent lock file. */
+export declare class NodeTokenCache {
+    #private;
+    readonly path: string;
+    readonly namespace: string;
+    constructor(options: NodeTokenCacheOptions);
+    read(profile?: string): Promise<CachedTokenProfile | undefined>;
+    write(profile: string, value: CachedTokenProfile, signal?: AbortSignal): Promise<void>;
+    remove(profile?: string, signal?: AbortSignal): Promise<boolean>;
+    withLock<T>(action: (transaction: TokenCacheTransaction) => Promise<T>, signal?: AbortSignal): Promise<T>;
+}
+//# sourceMappingURL=cache.d.ts.map

package/dist/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAQD,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAC/D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,WAAW,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GACtE,MAAM,CAQR;AAED,sFAAsF;AACtF,qBAAa,cAAc;;IACzB,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,SAAS,EAAE,MAAM,CAAC;gBAOf,OAAO,EAAE,qBAAqB;IAiBpC,IAAI,CAAC,OAAO,SAAY,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAMxE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtF,MAAM,CAAC,OAAO,SAAY,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7D,QAAQ,CAAC,CAAC,EACrB,MAAM,EAAE,CAAC,WAAW,EAAE,qBAAqB,KAAK,OAAO,CAAC,CAAC,CAAC,EAC1D,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,CAAC,CAAC;CAyHd"}

package/dist/cache.js

@@ -0,0 +1,316 @@
+/// <reference types="node" />
+import { constants } from 'node:fs';
+import { chmod, lstat, mkdir, open, rename, unlink } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join, parse, resolve, sep } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { AuthNodeError } from './errors.js';
+const CACHE_VERSION = 1;
+const CACHE_MAX_BYTES = 256 * 1024;
+const DEFAULT_LOCK_TIMEOUT_MS = 10_000;
+const DEFAULT_LOCK_RETRY_MS = 50;
+const PRIVATE_FILE_MODE = 0o600;
+const PRIVATE_DIRECTORY_MODE = 0o700;
+const UNSAFE_MODE_BITS = 0o077;
+const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+export function defaultTokenCachePath(namespace, environment = process.env) {
+    validateName(namespace, 'cache namespace');
+    const configuredHome = environment['XDG_CONFIG_HOME']?.trim();
+    const configHome = configuredHome === undefined || configuredHome.length === 0
+        ? join(homedir(), '.config')
+        : configuredHome;
+    return join(configHome, namespace, 'tokens.json');
+}
+/** A versioned profile cache that serializes mutations with an adjacent lock file. */
+export class NodeTokenCache {
+    path;
+    namespace;
+    #platform;
+    #now;
+    #sleep;
+    #lockTimeoutMs;
+    #lockRetryMs;
+    constructor(options) {
+        validateName(options.namespace, 'cache namespace');
+        this.namespace = options.namespace;
+        this.path = resolve(options.path ?? defaultTokenCachePath(options.namespace));
+        this.#platform = options.platform ?? process.platform;
+        this.#now = options.now ?? Date.now;
+        this.#sleep = options.sleep ?? abortableDelay;
+        this.#lockTimeoutMs = positiveInteger(options.lockTimeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS, 'cache lock timeout');
+        this.#lockRetryMs = positiveInteger(options.lockRetryMs ?? DEFAULT_LOCK_RETRY_MS, 'cache lock retry interval');
+    }
+    async read(profile = 'default') {
+        validateName(profile, 'cache profile');
+        const document = await this.#readDocument();
+        return document === undefined ? undefined : ownProfile(document.profiles, profile);
+    }
+    write(profile, value, signal) {
+        return this.withLock(async (transaction) => {
+            await transaction.write(profile, value);
+        }, signal);
+    }
+    remove(profile = 'default', signal) {
+        return this.withLock((transaction) => transaction.remove(profile), signal);
+    }
+    async withLock(action, signal) {
+        throwIfAborted(signal);
+        const lock = await this.#acquireLock(signal);
+        try {
+            const transaction = {
+                read: (profile) => this.#readProfile(profile),
+                write: (profile, value) => this.#writeProfile(profile, value),
+                remove: (profile) => this.#removeProfile(profile),
+            };
+            return await action(transaction);
+        }
+        finally {
+            await this.#releaseLock(lock);
+        }
+    }
+    async #readProfile(profile) {
+        validateName(profile, 'cache profile');
+        const document = await this.#readDocument();
+        return document === undefined ? undefined : ownProfile(document.profiles, profile);
+    }
+    async #writeProfile(profile, value) {
+        validateName(profile, 'cache profile');
+        validateProfile(value);
+        const current = await this.#readDocument();
+        const profiles = { ...(current?.profiles ?? {}), [profile]: value };
+        await this.#replaceDocument({ version: CACHE_VERSION, namespace: this.namespace, profiles });
+    }
+    async #removeProfile(profile) {
+        validateName(profile, 'cache profile');
+        const current = await this.#readDocument();
+        if (current === undefined || ownProfile(current.profiles, profile) === undefined)
+            return false;
+        const profiles = Object.fromEntries(Object.entries(current.profiles).filter(([name]) => name !== profile));
+        await this.#replaceDocument({ version: CACHE_VERSION, namespace: this.namespace, profiles });
+        return true;
+    }
+    async #readDocument() {
+        await assertNoSymlink(this.path, true);
+        let handle;
+        try {
+            handle = await open(this.path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        }
+        catch (error) {
+            if (nodeError(error, 'ENOENT'))
+                return undefined;
+            throw cacheIoError(error, 'cache_read_failed');
+        }
+        try {
+            const metadata = await handle.stat();
+            validateCacheFile(metadata, this.#platform);
+            if (metadata.size > CACHE_MAX_BYTES)
+                throw new AuthNodeError('cache_corrupt');
+            const contents = await handle.readFile({ encoding: 'utf8' });
+            if (Buffer.byteLength(contents) > CACHE_MAX_BYTES) {
+                throw new AuthNodeError('cache_corrupt');
+            }
+            return parseDocument(contents, this.namespace);
+        }
+        catch (error) {
+            if (error instanceof AuthNodeError)
+                throw error;
+            throw cacheIoError(error, 'cache_read_failed');
+        }
+        finally {
+            await handle.close().catch(() => undefined);
+        }
+    }
+    async #replaceDocument(document) {
+        const directory = dirname(this.path);
+        await preparePrivateDirectory(directory, this.#platform);
+        await assertNoSymlink(this.path, true);
+        const temporaryPath = `${this.path}.${String(process.pid)}.${randomUUID()}.tmp`;
+        let handle;
+        try {
+            handle = await open(temporaryPath, 'wx', PRIVATE_FILE_MODE);
+            await handle.writeFile(`${JSON.stringify(document, null, 2)}\n`, 'utf8');
+            await handle.sync();
+            await handle.close();
+            handle = undefined;
+            if (this.#platform !== 'win32')
+                await chmod(temporaryPath, PRIVATE_FILE_MODE);
+            await assertNoSymlink(this.path, true);
+            await rename(temporaryPath, this.path);
+        }
+        catch (error) {
+            await handle?.close().catch(() => undefined);
+            await unlink(temporaryPath).catch(() => undefined);
+            if (error instanceof AuthNodeError)
+                throw error;
+            throw cacheIoError(error, 'cache_write_failed');
+        }
+    }
+    async #acquireLock(signal) {
+        const directory = dirname(this.path);
+        await preparePrivateDirectory(directory, this.#platform);
+        const lockPath = `${this.path}.lock`;
+        const deadline = this.#now() + this.#lockTimeoutMs;
+        for (;;) {
+            throwIfAborted(signal);
+            await assertNoSymlink(lockPath, true);
+            try {
+                return await open(lockPath, 'wx', PRIVATE_FILE_MODE);
+            }
+            catch (error) {
+                if (!nodeError(error, 'EEXIST'))
+                    throw cacheIoError(error, 'cache_write_failed');
+            }
+            if (this.#now() >= deadline)
+                throw new AuthNodeError('cache_lock_timeout', { retryable: true });
+            await this.#sleep(this.#lockRetryMs, signal);
+        }
+    }
+    async #releaseLock(handle) {
+        const lockPath = `${this.path}.lock`;
+        let stillOwned = false;
+        try {
+            const held = await handle.stat();
+            const current = await lstat(lockPath);
+            stillOwned = held.dev === current.dev && held.ino === current.ino;
+        }
+        catch {
+            stillOwned = false;
+        }
+        await handle.close().catch(() => undefined);
+        if (stillOwned)
+            await unlink(lockPath).catch(() => undefined);
+    }
+}
+function parseDocument(contents, namespace) {
+    let value;
+    try {
+        value = JSON.parse(contents);
+    }
+    catch {
+        throw new AuthNodeError('cache_corrupt');
+    }
+    if (!isRecord(value) || value['version'] !== CACHE_VERSION || value['namespace'] !== namespace) {
+        throw new AuthNodeError('cache_corrupt');
+    }
+    const rawProfiles = value['profiles'];
+    if (!isRecord(rawProfiles))
+        throw new AuthNodeError('cache_corrupt');
+    const profiles = {};
+    for (const [name, profile] of Object.entries(rawProfiles)) {
+        validateNameOrCorrupt(name);
+        validateProfile(profile);
+        profiles[name] = profile;
+    }
+    return { version: CACHE_VERSION, namespace, profiles };
+}
+function validateProfile(value) {
+    if (!isRecord(value) ||
+        !nonEmptyString(value['accessToken']) ||
+        (value['refreshToken'] !== undefined && !nonEmptyString(value['refreshToken'])) ||
+        (value['idToken'] !== undefined && !nonEmptyString(value['idToken'])) ||
+        !nonEmptyString(value['tokenType']) ||
+        typeof value['expiresAt'] !== 'number' ||
+        !Number.isFinite(value['expiresAt']) ||
+        value['expiresAt'] <= 0 ||
+        !nonEmptyString(value['issuer']) ||
+        !nonEmptyString(value['clientId']) ||
+        !Array.isArray(value['scopes']) ||
+        !value['scopes'].every(nonEmptyString) ||
+        (value['audience'] !== undefined && !nonEmptyString(value['audience']))) {
+        throw new AuthNodeError('cache_corrupt');
+    }
+}
+async function preparePrivateDirectory(path, platform) {
+    try {
+        await assertNoSymlink(path, false);
+        await mkdir(path, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+        await assertNoSymlink(path, false);
+        const metadata = await lstat(path);
+        if (!metadata.isDirectory())
+            throw new AuthNodeError('cache_permission');
+        if (platform !== 'win32' && (metadata.mode & UNSAFE_MODE_BITS) !== 0) {
+            throw new AuthNodeError('cache_permission');
+        }
+    }
+    catch (error) {
+        if (error instanceof AuthNodeError)
+            throw error;
+        throw cacheIoError(error, 'cache_permission');
+    }
+}
+async function assertNoSymlink(path, allowMissingLeaf) {
+    const absolute = resolve(path);
+    const root = parse(absolute).root;
+    const parts = absolute.slice(root.length).split(sep).filter(Boolean);
+    let current = root;
+    for (let index = 0; index < parts.length; index += 1) {
+        current = join(current, parts[index] ?? '');
+        try {
+            const metadata = await lstat(current);
+            if (metadata.isSymbolicLink())
+                throw new AuthNodeError('cache_symlink');
+        }
+        catch (error) {
+            if (nodeError(error, 'ENOENT') && (allowMissingLeaf || index < parts.length))
+                return;
+            throw error;
+        }
+    }
+}
+function validateCacheFile(metadata, platform) {
+    if (!metadata.isFile())
+        throw new AuthNodeError('cache_permission');
+    if (platform !== 'win32' && (metadata.mode & UNSAFE_MODE_BITS) !== 0) {
+        throw new AuthNodeError('cache_permission');
+    }
+}
+function validateName(value, label) {
+    if (!SAFE_NAME.test(value))
+        throw new TypeError(`${label} has an invalid format.`);
+}
+function validateNameOrCorrupt(value) {
+    if (!SAFE_NAME.test(value))
+        throw new AuthNodeError('cache_corrupt');
+}
+function positiveInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value <= 0)
+        throw new RangeError(`${label} must be positive.`);
+    return value;
+}
+function cacheIoError(error, fallback) {
+    return new AuthNodeError(nodeError(error, 'EACCES') || nodeError(error, 'EPERM') ? 'cache_permission' : fallback);
+}
+function nodeError(error, code) {
+    return (error instanceof Error && 'code' in error && error.code === code);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function nonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+function ownProfile(profiles, name) {
+    return Object.hasOwn(profiles, name) ? profiles[name] : undefined;
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted === true)
+        throw new AuthNodeError('aborted');
+}
+function abortableDelay(milliseconds, signal) {
+    return new Promise((resolveDelay, reject) => {
+        if (signal?.aborted === true) {
+            reject(new AuthNodeError('aborted'));
+            return;
+        }
+        const onAbort = () => {
+            clearTimeout(timeout);
+            reject(new AuthNodeError('aborted'));
+        };
+        const timeout = setTimeout(() => {
+            signal?.removeEventListener('abort', onAbort);
+            resolveDelay();
+        }, milliseconds);
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
+//# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAE9B,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAmB,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,CAAC;AACnC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,SAAS,GAAG,oCAAoC,CAAC;AAoCvD,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,cAA4D,OAAO,CAAC,GAAG;IAEvE,YAAY,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,UAAU,GACd,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC;QAC5B,CAAC,CAAC,cAAc,CAAC;IACrB,OAAO,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AACpD,CAAC;AAED,sFAAsF;AACtF,MAAM,OAAO,cAAc;IACT,IAAI,CAAS;IACb,SAAS,CAAS;IACzB,SAAS,CAAkB;IAC3B,IAAI,CAAe;IACnB,MAAM,CAAgE;IACtE,cAAc,CAAS;IACvB,YAAY,CAAS;IAE9B,YAAmB,OAA8B;QAC/C,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;QAC9C,IAAI,CAAC,cAAc,GAAG,eAAe,CACnC,OAAO,CAAC,aAAa,IAAI,uBAAuB,EAChD,oBAAoB,CACrB,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,eAAe,CACjC,OAAO,CAAC,WAAW,IAAI,qBAAqB,EAC5C,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,SAAS;QACnC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC5C,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrF,CAAC;IAEM,KAAK,CAAC,OAAe,EAAE,KAAyB,EAAE,MAAoB;QAC3E,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;YACzC,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC,EAAE,MAAM,CAAC,CAAC;IACb,CAAC;IAEM,MAAM,CAAC,OAAO,GAAG,SAAS,EAAE,MAAoB;QACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAEM,KAAK,CAAC,QAAQ,CACnB,MAA0D,EAC1D,MAAoB;QAEpB,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,WAAW,GAA0B;gBACzC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;gBAC7C,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC;gBAC7D,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;aAClD,CAAC;YACF,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACnC,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC5C,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,KAAyB;QAC5D,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACvC,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;QACpE,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CACtE,CAAC;QACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,MAAM,YAAY,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACrC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,QAAQ,CAAC,IAAI,GAAG,eAAe;gBAAE,MAAM,IAAI,aAAa,CAAC,eAAe,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,eAAe,EAAE,CAAC;gBAClD,MAAM,IAAI,aAAa,CAAC,eAAe,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAa;gBAAE,MAAM,KAAK,CAAC;YAChD,MAAM,YAAY,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACjD,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAuB;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,uBAAuB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,aAAa,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,UAAU,EAAE,MAAM,CAAC;QAChF,IAAI,MAA8B,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAC5D,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO;gBAAE,MAAM,KAAK,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;YAC9E,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvC,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,KAAK,YAAY,aAAa;gBAAE,MAAM,KAAK,CAAC;YAChD,MAAM,YAAY,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAoB;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,uBAAuB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,IAAI,OAAO,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QACnD,SAAS,CAAC;YACR,cAAc,CAAC,MAAM,CAAC,CAAC;YACvB,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;oBAAE,MAAM,YAAY,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,QAAQ;gBACzB,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAkB;QACnC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,IAAI,OAAO,CAAC;QACrC,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtC,UAAU,GAAG,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,UAAU;YAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;CACF;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,SAAiB;IACxD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAY,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,eAAe,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,aAAa,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/F,MAAM,IAAI,aAAa,CAAC,eAAe,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5B,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACrC,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QAC/E,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACrE,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ;QACtC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACpC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;QACvB,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;QACtC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EACvE,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,eAAe,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,QAAyB;IAC5E,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACrE,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,CAAC,CAAC;QACzE,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,aAAa,CAAC,kBAAkB,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,aAAa;YAAE,MAAM,KAAK,CAAC;QAChD,MAAM,YAAY,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,gBAAyB;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,aAAa,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;gBAAE,OAAO;YACrF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAe,EAAE,QAAyB;IACnE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACpE,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,aAAa,CAAC,kBAAkB,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;IAChD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,eAAe,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAC5C,MAAM,IAAI,UAAU,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CACnB,KAAc,EACd,QAAyE;IAEzE,OAAO,IAAI,aAAa,CACtB,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CACxF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,IAAY;IAC7C,OAAO,CACL,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAK,KAA+B,CAAC,IAAI,KAAK,IAAI,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CACjB,QAAsD,EACtD,IAAY;IAEZ,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,SAAS,cAAc,CAAC,MAAoB;IAC1C,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,YAAoB,EAAE,MAAoB;IAChE,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,YAAY,EAAE,CAAC;QACjB,CAAC,EAAE,YAAY,CAAC,CAAC;QACjB,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/device-flow.d.ts

@@ -0,0 +1,80 @@
+import { type CachedTokenProfile, type NodeTokenCacheOptions } from './cache.js';
+export interface EndpointPolicy {
+    /** Additional issuer values accepted when discovery returns an alias. */
+    readonly issuerAllowlist?: readonly string[];
+    /** Additional origins allowed for discovered token and device endpoints. */
+    readonly endpointOriginAllowlist?: readonly string[];
+    /** Permits plain HTTP only for localhost and literal loopback addresses. */
+    readonly allowLoopbackHttp?: boolean;
+}
+export interface DeviceFlowClientConfig {
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly scopes?: readonly string[];
+    readonly audience?: string;
+    readonly cache: Pick<NodeTokenCacheOptions, 'namespace'> & Partial<Omit<NodeTokenCacheOptions, 'namespace'>>;
+    readonly profile?: string;
+    readonly endpointPolicy?: EndpointPolicy;
+    readonly maxResponseBytes?: number;
+    readonly requestTimeoutMs?: number;
+    readonly loginTimeoutMs?: number;
+    readonly refreshLeewaySeconds?: number;
+}
+export type DeviceFlowStatus = 'waiting' | 'slow-down' | 'authorized';
+export interface DeviceVerification {
+    readonly verificationUri: string;
+    readonly verificationUriComplete?: string;
+    readonly userCode: string;
+}
+export interface DeviceFlowPresentation {
+    readonly showVerification?: (verification: DeviceVerification) => void | Promise<void>;
+    readonly showStatus?: (status: DeviceFlowStatus) => void | Promise<void>;
+    readonly openBrowser?: (url: string) => void | Promise<void>;
+}
+export interface DeviceFlowEnvironment {
+    readonly fetch?: typeof globalThis.fetch;
+    readonly now?: () => number;
+    readonly sleep?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
+    readonly signal?: AbortSignal;
+    readonly environmentToken?: () => string | undefined | Promise<string | undefined>;
+}
+export interface AccessTokenOptions {
+    readonly forceRefresh?: boolean;
+    readonly signal?: AbortSignal;
+}
+export interface LoginOptions {
+    readonly signal?: AbortSignal;
+    readonly presentation?: DeviceFlowPresentation;
+}
+export interface OidcDeviceMetadata {
+    readonly issuer: string;
+    readonly deviceAuthorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+}
+export interface DisplayOnlyClaims {
+    readonly subject?: string;
+    readonly name?: string;
+    readonly preferredUsername?: string;
+    readonly email?: string;
+    readonly expiresAt?: number;
+}
+/** Node OIDC device-flow client. It never writes to stdout, stderr, or a logger. */
+export declare class DeviceFlowClient {
+    #private;
+    constructor(config: DeviceFlowClientConfig, environment?: DeviceFlowEnvironment);
+    discover(signal?: AbortSignal): Promise<OidcDeviceMetadata>;
+    login(options?: LoginOptions): Promise<CachedTokenProfile>;
+    accessToken(options?: AccessTokenOptions): Promise<string>;
+    logout(signal?: AbortSignal): Promise<boolean>;
+    /** Returns unverified claims for display text only. Never use them for authorization or identity keys. */
+    displayClaims(): Promise<DisplayOnlyClaims | undefined>;
+}
+export interface DeviceProviderRequestOptions {
+    readonly maxResponseBytes: number;
+    readonly requestTimeoutMs: number;
+    readonly signal?: AbortSignal;
+}
+export declare function discoverDeviceProvider(configuredIssuer: string, policy: EndpointPolicy, fetchImplementation: typeof globalThis.fetch, options: DeviceProviderRequestOptions): Promise<OidcDeviceMetadata>;
+/** Decodes a small allowlist of unverified JWT claims for display text only. */
+export declare function decodeDisplayOnlyClaims(token: string): DisplayOnlyClaims | undefined;
+//# sourceMappingURL=device-flow.d.ts.map

package/dist/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../src/device-flow.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkB,KAAK,kBAAkB,EAAE,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAajG,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,4EAA4E;IAC5E,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrD,4EAA4E;IAC5E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,GACtD,OAAO,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAEtE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC;CAChD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAmCD,oFAAoF;AACpF,qBAAa,gBAAgB;;gBAOR,MAAM,EAAE,sBAAsB,EAAE,WAAW,GAAE,qBAA0B;IAkBnF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkBrD,KAAK,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA2B9D,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IAyBpE,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAOrD,0GAA0G;IAC7F,aAAa,IAAI,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;CA6KrE;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,wBAAsB,sBAAsB,CAC1C,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,cAAc,EACtB,mBAAmB,EAAE,OAAO,UAAU,CAAC,KAAK,EAC5C,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,kBAAkB,CAAC,CA+C7B;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAwBpF"}