@caracalai/oauth 0.1.2 → 0.1.4-rc.1

package/README.md

@@ -0,0 +1,17 @@
+# Caracal OAuth for TypeScript
+
+TypeScript RFC 8693 token exchange client for Caracal STS.
+
+```ts
+import { OAuthClient } from '@caracalai/oauth'
+
+const client = new OAuthClient('https://sts.example.com', 'zone1', 'app1')
+const token = await client.exchange(subjectToken, 'resource://api', {
+  clientSecret: 'client-secret',
+  scopes: ['read'],
+})
+```
+
+Successful responses are validated before caching. Cache keys isolate subject tokens, actor tokens, session/delegation context, scopes, TTL, and client authentication context. The default cache is in-memory and process-local.
+
+Docs: https://caracal.run/sdks/oauth/

package/dist/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAEvD,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAA;IAC9E,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAA;CAChF;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAID,qBAAa,kBAAmB,YAAW,UAAU;IACnD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAyE;IAC7F,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;gBAEvB,IAAI,GAAE,yBAA8B;IAQhD,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAa9E,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,IAAI;CAehF"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAEvD,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAA;IAC9E,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAA;CAChF;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAKD,qBAAa,kBAAmB,YAAW,UAAU;IACnD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAyE;IAC7F,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;gBAEvB,IAAI,GAAE,yBAA8B;IAQhD,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAa9E,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,IAAI;CAehF"}

package/dist/cache.js

@@ -1,9 +1,10 @@
 // Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
 // Caracal, a product of Garudex Labs
 //
-// TokenCache interface and bounded in-memory default keyed by hashed subject+resource.
-import { createHash } from 'node:crypto';
+// TokenCache interface and bounded in-memory default keyed by protected subject-resource identifiers.
+import { createHmac, randomBytes } from 'node:crypto';
 const DEFAULT_MAX_ENTRIES = 10_000;
+const CACHE_KEY = randomBytes(32);
 export class InMemoryTokenCache {
     map = new Map();
     maxEntries;
@@ -45,6 +46,6 @@ export class InMemoryTokenCache {
     }
 }
 function cacheKey(subjectToken, resource) {
-    return createHash('sha256').update(subjectToken).update('\0').update(resource).digest('hex');
+    return createHmac('sha256', CACHE_KEY).update(subjectToken).update('\0').update(resource).digest('hex');
 }
 //# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,uFAAuF;AAEvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAYxC,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAElC,MAAM,OAAO,kBAAkB;IACZ,GAAG,GAAG,IAAI,GAAG,EAA+D,CAAA;IAC5E,UAAU,CAAQ;IAEnC,YAAY,OAAkC,EAAE;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAA;QAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,GAAG,CAAA;IACvB,CAAC;IAED,GAAG,CAAC,YAAoB,EAAE,QAAgB;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAA;QAC5B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACxB,OAAO,KAAK,CAAC,KAAK,CAAA;IACpB,CAAC;IAED,GAAG,CAAC,YAAoB,EAAE,QAAgB,EAAE,KAA4B;QACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;YAChB,KAAK;YACL,SAAS,EAAE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,SAAS;SAC5C,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC3C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAK;YAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,YAAoB,EAAE,QAAgB;IACtD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC9F,CAAC"}
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,sGAAsG;AAEtG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAYrD,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;AAEjC,MAAM,OAAO,kBAAkB;IACZ,GAAG,GAAG,IAAI,GAAG,EAA+D,CAAA;IAC5E,UAAU,CAAQ;IAEnC,YAAY,OAAkC,EAAE;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAA;QAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,GAAG,CAAA;IACvB,CAAC;IAED,GAAG,CAAC,YAAoB,EAAE,QAAgB;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAA;QAC5B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACxB,OAAO,KAAK,CAAC,KAAK,CAAA;IACpB,CAAC;IAED,GAAG,CAAC,YAAoB,EAAE,QAAgB,EAAE,KAA4B;QACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;YAChB,KAAK;YACL,SAAS,EAAE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,SAAS;SAC5C,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC3C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAK;YAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,YAAoB,EAAE,QAAgB;IACtD,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzG,CAAC"}

package/dist/client.d.ts

@@ -4,14 +4,16 @@ export declare class OAuthClient {
     private readonly stsUrl;
     private readonly zoneId;
     private readonly applicationId;
+    private readonly fetchImpl?;
     private readonly cache;
     private readonly inflight;
     private readonly identityKey;
-    constructor(stsUrl: string, zoneId: string, applicationId: string, cache?: TokenCache);
-    exchange(subjectToken: string, resource: string, opts?: ExchangeOptions): Promise<TokenExchangeResponse>;
+    constructor(stsUrl: string, zoneId: string, applicationId: string, cache?: TokenCache, fetchImpl?: typeof fetch | undefined);
+    exchange(subjectToken: string, resource: string | string[], opts?: ExchangeOptions): Promise<TokenExchangeResponse>;
     private cacheSubject;
     private cacheResource;
     private normalizedScopes;
+    private authContext;
     private doExchange;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAKA,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAwBxE,qBAAa,WAAW;IAMpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAPhC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoD;IAC7E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;gBAGjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACtC,KAAK,CAAC,EAAE,UAAU;IAMd,QAAQ,CACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,qBAAqB,CAAC;IA6BjC,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,gBAAgB;YAIV,UAAU;CA+FzB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAwCxE,qBAAa,WAAW;IAMpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAT7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoD;IAC7E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;gBAGjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACtC,KAAK,CAAC,EAAE,UAAU,EACD,SAAS,CAAC,EAAE,OAAO,KAAK,YAAA;IAMrC,QAAQ,CACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,EAC3B,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,qBAAqB,CAAC;IA6BjC,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,WAAW;YAQL,UAAU;CA2FzB"}

package/dist/client.js

@@ -2,13 +2,19 @@
 // Caracal, a product of Garudex Labs
 //
 // RFC 8693 token exchange client with pluggable token cache and 401-retry.
+import { createHmac, randomBytes } from 'node:crypto';
 import { InMemoryTokenCache } from './cache.js';
 import { InteractionRequiredError } from './types.js';
+const SECRET_CACHE_KEY = randomBytes(32);
 function parseSTSErrorResponse(body) {
     if (body === '')
         return {};
     return JSON.parse(body);
 }
+function formatSTSError(status, err) {
+    const base = err.error_description ?? `STS error ${status}`;
+    return err.requestId ? `${base} (request_id=${err.requestId})` : base;
+}
 async function readSTSErrorResponse(res) {
     if (typeof res.text === 'function') {
         return parseSTSErrorResponse(await res.text());
@@ -22,13 +28,15 @@ export class OAuthClient {
     stsUrl;
     zoneId;
     applicationId;
+    fetchImpl;
     cache;
     inflight = new Map();
     identityKey;
-    constructor(stsUrl, zoneId, applicationId, cache) {
+    constructor(stsUrl, zoneId, applicationId, cache, fetchImpl) {
         this.stsUrl = stsUrl;
         this.zoneId = zoneId;
         this.applicationId = applicationId;
+        this.fetchImpl = fetchImpl;
         this.cache = cache ?? new InMemoryTokenCache();
         this.identityKey = `${zoneId}::${applicationId}`;
     }
@@ -63,29 +71,45 @@ export class OAuthClient {
     cacheSubject(subjectToken, opts) {
         return [
             this.identityKey,
-            subjectToken,
-            opts.actorToken ?? '',
+            secretCacheId(subjectToken),
+            secretCacheId(opts.actorToken),
             opts.sessionId ?? '',
             opts.agentSessionId ?? '',
             opts.delegationEdgeId ?? '',
-            opts.clientAssertion ?? '',
+            this.authContext(opts),
+            secretCacheId(opts.clientAssertion),
         ].join('::');
     }
     cacheResource(resource, opts) {
-        return [resource, this.normalizedScopes(opts.scopes), opts.ttlSeconds?.toString() ?? ''].join('::');
+        return [
+            resourceList(resource).join(' '),
+            this.normalizedScopes(opts.scopes),
+            opts.ttlSeconds?.toString() ?? '',
+            opts.runtimeCredentialInjection === true ? 'runtime-credential-injection' : '',
+        ].join('::');
     }
     normalizedScopes(scopes) {
         return [...new Set(scopes ?? [])].sort().join(' ');
     }
-    async doExchange(subjectToken, resource, opts, isRetry) {
+    authContext(opts) {
+        return [
+            opts.clientSecret ? `secret:${secretCacheId(opts.clientSecret)}` : '',
+            opts.clientAssertion ? 'assertion' : '',
+            opts.clientAssertionType ?? '',
+        ].join(':');
+    }
+    async doExchange(subjectToken, resource, opts, isRetry, deadlineMs = Date.now() + (opts.timeoutMs ?? 30_000)) {
         const body = new URLSearchParams({
             grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
-            subject_token: subjectToken,
-            subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',
-            resource,
             zone_id: this.zoneId,
             application_id: this.applicationId,
         });
+        if (subjectToken) {
+            body.set('subject_token', subjectToken);
+            body.set('subject_token_type', 'urn:ietf:params:oauth:token-type:access_token');
+        }
+        for (const value of resourceList(resource))
+            body.append('resource', value);
         if (opts.clientSecret)
             body.set('client_secret', opts.clientSecret);
         if (opts.clientAssertion)
@@ -105,45 +129,48 @@ export class OAuthClient {
             body.set('scope', scope);
         if (opts.ttlSeconds)
             body.set('ttl_seconds', String(opts.ttlSeconds));
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), opts.timeoutMs ?? 30_000);
+        if (opts.runtimeCredentialInjection === true)
+            body.set('runtime_credential_injection', 'true');
         const maxRetries = opts.retries ?? 3;
         let res;
-        try {
-            for (let attempt = 0; attempt <= maxRetries; attempt++) {
-                res = await fetch(`${this.stsUrl}/oauth/2/token`, {
+        let lastErr;
+        for (let attempt = 0; attempt <= maxRetries; attempt++) {
+            const remainingMs = deadlineMs - Date.now();
+            if (remainingMs <= 0)
+                throw new Error('STS request timed out');
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), remainingMs);
+            try {
+                res = await (this.fetchImpl ?? fetch)(`${this.stsUrl}/oauth/2/token`, {
                     method: 'POST',
                     headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
                     body,
                     signal: controller.signal,
                 });
-                const status = res.status;
-                const transient = status === 408 || status === 425 || status === 429 || (status >= 500 && status < 600);
-                if (!transient || attempt === maxRetries)
-                    break;
-                const retryAfter = res.headers?.get('retry-after');
-                let waitMs;
-                if (retryAfter) {
-                    const secs = Number(retryAfter);
-                    if (Number.isFinite(secs))
-                        waitMs = Math.max(0, secs * 1000);
-                    else {
-                        const date = Date.parse(retryAfter);
-                        waitMs = Number.isNaN(date) ? 250 * 2 ** attempt : Math.max(0, date - Date.now());
-                    }
-                }
-                else {
-                    const base = Math.min(2 ** attempt * 250, 5_000);
-                    waitMs = base / 2 + Math.random() * (base / 2);
-                }
-                await new Promise(r => setTimeout(r, waitMs));
             }
+            catch (err) {
+                lastErr = err;
+                if (attempt === maxRetries)
+                    throw err;
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+            if (!res) {
+                await delayWithinDeadline(jitteredBackoff(attempt), deadlineMs);
+                continue;
+            }
+            const status = res.status;
+            const transient = status === 408 || status === 425 || status === 429 || (status >= 500 && status < 600);
+            if (!transient || attempt === maxRetries)
+                break;
+            await delayWithinDeadline(retryDelayMs(res, attempt), deadlineMs);
         }
-        finally {
-            clearTimeout(timeout);
-        }
-        if (!res)
+        if (!res) {
+            if (lastErr instanceof Error)
+                throw lastErr;
             throw new Error('STS request failed: no response');
+        }
         if (!res.ok) {
             let err;
             try {
@@ -153,24 +180,124 @@ export class OAuthClient {
                 throw new Error(`STS error ${res.status}: invalid error response`);
             }
             if (err['error'] === 'interaction_required') {
-                throw new InteractionRequiredError(err['error_description'] ?? 'Step-up required', err['challenge_id'] ?? '', resource, err['acr_values']);
+                throw new InteractionRequiredError(err['error_description'] ?? 'Step-up required', err['challenge_id'] ?? '', resourceList(resource)[0], err['acr_values']);
             }
             if (res.status === 401 && !isRetry) {
-                return this.doExchange(subjectToken, resource, opts, true);
+                return this.doExchange(subjectToken, resource, { ...opts, retries: 0 }, true, deadlineMs);
             }
-            throw new Error(err['error_description'] ?? `STS error ${res.status}`);
+            throw new Error(formatSTSError(res.status, err));
         }
         if (!isJsonResponse(res)) {
             throw new Error('STS response invalid: expected application/json');
         }
         const data = (await res.json());
-        return {
-            accessToken: data['access_token'],
-            tokenType: 'Bearer',
-            expiresIn: data['expires_in'],
-            issuedAt: Math.floor(Date.now() / 1000),
+        return validateSuccessResponse(data);
+    }
+}
+function validateSuccessResponse(data) {
+    if (typeof data.access_token !== 'string' || data.access_token === '') {
+        throw new Error('STS response invalid: access_token is required');
+    }
+    if (data.token_type !== undefined && data.token_type !== 'Bearer') {
+        throw new Error('STS response invalid: token_type must be Bearer');
+    }
+    const expiresIn = data.expires_in;
+    if (typeof expiresIn !== 'number' || !Number.isInteger(expiresIn) || expiresIn <= 0) {
+        throw new Error('STS response invalid: expires_in must be a positive integer');
+    }
+    const response = {
+        accessToken: data.access_token,
+        tokenType: 'Bearer',
+        expiresIn,
+        issuedAt: Math.floor(Date.now() / 1000),
+    };
+    if (data.target_resources !== undefined) {
+        if (!Array.isArray(data.target_resources) || data.target_resources.some((item) => typeof item !== 'string')) {
+            throw new Error('STS response invalid: target_resources must be a string array');
+        }
+        response.targetResources = data.target_resources;
+    }
+    if (data.upstreams !== undefined)
+        response.upstreams = validateUpstreams(data.upstreams);
+    return response;
+}
+function validateUpstreams(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('STS response invalid: upstreams must be an object');
+    }
+    const upstreams = {};
+    for (const [resource, directive] of Object.entries(value)) {
+        if (!directive || typeof directive !== 'object' || Array.isArray(directive)) {
+            throw new Error('STS response invalid: upstream directive must be an object');
+        }
+        const item = directive;
+        upstreams[resource] = {
+            url: optionalString(item.url, 'upstreams.url'),
+            authMode: optionalString(item.auth_mode, 'upstreams.auth_mode'),
+            authLocation: optionalString(item.auth_location, 'upstreams.auth_location'),
+            authHeader: optionalString(item.auth_header, 'upstreams.auth_header'),
+            queryParamName: optionalString(item.query_param_name, 'upstreams.query_param_name'),
+            authScheme: optionalString(item.auth_scheme, 'upstreams.auth_scheme'),
+            allowedTokenHosts: optionalStringArray(item.allowed_token_hosts, 'upstreams.allowed_token_hosts'),
+            providerToken: optionalString(item.provider_token, 'upstreams.provider_token'),
+            providerId: optionalString(item.provider_id, 'upstreams.provider_id'),
+            grantId: optionalString(item.grant_id, 'upstreams.grant_id'),
+            forwardCaracalIdentity: optionalBoolean(item.forward_caracal_identity, 'upstreams.forward_caracal_identity'),
+            expiresAt: optionalInteger(item.expires_at, 'upstreams.expires_at'),
         };
     }
+    return upstreams;
+}
+function optionalString(value, name) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string')
+        throw new Error(`STS response invalid: ${name} must be a string`);
+    return value;
+}
+function optionalStringArray(value, name) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
+        throw new Error(`STS response invalid: ${name} must be a string array`);
+    }
+    return value;
+}
+function optionalBoolean(value, name) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'boolean')
+        throw new Error(`STS response invalid: ${name} must be a boolean`);
+    return value;
+}
+function optionalInteger(value, name) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'number' || !Number.isInteger(value))
+        throw new Error(`STS response invalid: ${name} must be an integer`);
+    return value;
+}
+function retryDelayMs(res, attempt) {
+    const retryAfter = res.headers?.get('retry-after');
+    if (retryAfter) {
+        const secs = Number(retryAfter);
+        if (Number.isFinite(secs))
+            return Math.max(0, secs * 1000);
+        const date = Date.parse(retryAfter);
+        if (!Number.isNaN(date))
+            return Math.max(0, date - Date.now());
+    }
+    return jitteredBackoff(attempt);
+}
+function jitteredBackoff(attempt) {
+    const base = Math.min(2 ** attempt * 250, 5_000);
+    return base / 2 + Math.random() * (base / 2);
+}
+async function delayWithinDeadline(waitMs, deadlineMs) {
+    const remainingMs = deadlineMs - Date.now();
+    if (remainingMs <= 0)
+        throw new Error('STS request timed out');
+    await new Promise(resolve => setTimeout(resolve, Math.min(waitMs, remainingMs)));
 }
 function isJsonResponse(res) {
     const contentType = res.headers?.get('content-type');
@@ -179,4 +306,12 @@ function isJsonResponse(res) {
     const mediaType = contentType.toLowerCase().split(';', 1)[0];
     return mediaType === 'application/json' || mediaType.endsWith('+json');
 }
+function secretCacheId(value) {
+    if (!value)
+        return '';
+    return createHmac('sha256', SECRET_CACHE_KEY).update(value).digest('hex');
+}
+function resourceList(resource) {
+    return (Array.isArray(resource) ? resource : [resource]).map(value => value.trim()).filter(Boolean);
+}
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,2EAA2E;AAE3E,OAAO,EAAE,kBAAkB,EAAmB,MAAM,YAAY,CAAA;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAUrD,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAA;AAC7C,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,GAAa;IAC/C,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,qBAAqB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,MAAM,GAAG,CAAC,IAAI,EAAsB,CAAA;IAC7C,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,OAAO,WAAW;IAMH;IACA;IACA;IAPF,KAAK,CAAY;IACjB,QAAQ,GAAG,IAAI,GAAG,EAA0C,CAAA;IAC5D,WAAW,CAAQ;IAEpC,YACmB,MAAc,EACd,MAAc,EACd,aAAqB,EACtC,KAAkB;QAHD,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,kBAAa,GAAb,aAAa,CAAQ;QAGtC,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,IAAI,kBAAkB,EAAE,CAAA;QAC9C,IAAI,CAAC,WAAW,GAAG,GAAG,MAAM,KAAK,aAAa,EAAE,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,YAAoB,EACpB,QAAgB,EAChB,OAAwB,EAAE;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAA;QAC1C,MAAM,eAAe,GAAG,SAAS,GAAG,IAAI,GAAG,EAAE,CAAA;QAE7C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;QAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;QAC1D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;YACxE,IAAI,SAAS,GAAG,eAAe;gBAAE,OAAO,MAAM,CAAA;QAChD,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,YAAY,KAAK,aAAa,EAAE,CAAA;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAE7B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;gBACxE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;gBAClD,OAAO,KAAK,CAAA;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACvC,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,YAAY,CAAC,YAAoB,EAAE,IAAqB;QAC9D,OAAO;YACL,IAAI,CAAC,WAAW;YAChB,YAAY;YACZ,IAAI,CAAC,UAAU,IAAI,EAAE;YACrB,IAAI,CAAC,SAAS,IAAI,EAAE;YACpB,IAAI,CAAC,cAAc,IAAI,EAAE;YACzB,IAAI,CAAC,gBAAgB,IAAI,EAAE;YAC3B,IAAI,CAAC,eAAe,IAAI,EAAE;SAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACd,CAAC;IAEO,aAAa,CAAC,QAAgB,EAAE,IAAqB;QAC3D,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrG,CAAC;IAEO,gBAAgB,CAAC,MAAiB;QACxC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACpD,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,YAAoB,EACpB,QAAgB,EAChB,IAAqB,EACrB,OAAgB;QAEhB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,iDAAiD;YAC7D,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,+CAA+C;YACnE,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,cAAc,EAAE,IAAI,CAAC,aAAa;SACnC,CAAC,CAAA;QACF,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;QACnE,IAAI,IAAI,CAAC,eAAe;YAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAA;QAC5E,IAAI,IAAI,CAAC,mBAAmB;YAAE,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACzF,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC7D,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1D,IAAI,IAAI,CAAC,cAAc;YAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QAC1E,IAAI,IAAI,CAAC,gBAAgB;YAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAChF,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACnC,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAErE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,CAAA;QAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;QACpC,IAAI,GAAkD,CAAA;QACtD,IAAI,CAAC;YACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;gBACvD,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,gBAAgB,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;oBAChE,IAAI;oBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAA;gBACF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;gBACzB,MAAM,SAAS,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,CAAA;gBACvG,IAAI,CAAC,SAAS,IAAI,OAAO,KAAK,UAAU;oBAAE,MAAK;gBAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;gBAClD,IAAI,MAAc,CAAA;gBAClB,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;oBAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAA;yBACvD,CAAC;wBACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;wBACnC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;oBACnF,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;oBAChD,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;gBAChD,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;YAC/C,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QAE5D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,GAAqB,CAAA;YACzB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,0BAA0B,CAAC,CAAA;YACpE,CAAC;YACD,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,IAAI,wBAAwB,CAChC,GAAG,CAAC,mBAAmB,CAAC,IAAI,kBAAkB,EAC9C,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EACzB,QAAQ,EACR,GAAG,CAAC,YAAY,CAAC,CAClB,CAAA;YACH,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;YAC5D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACxE,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAA;QACD,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;YACjC,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;YAC7B,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACxC,CAAA;IACH,CAAC;CACF;AAED,SAAS,cAAc,CAAC,GAAa;IACnC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAClE,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5D,OAAO,SAAS,KAAK,kBAAkB,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AACxE,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,2EAA2E;AAE3E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAmB,MAAM,YAAY,CAAA;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAmBrD,MAAM,gBAAgB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;AAExC,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAA;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,GAAqB;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,IAAI,aAAa,MAAM,EAAE,CAAA;IAC3D,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,gBAAgB,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACvE,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,GAAa;IAC/C,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,qBAAqB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,MAAM,GAAG,CAAC,IAAI,EAAsB,CAAA;IAC7C,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,OAAO,WAAW;IAMH;IACA;IACA;IAEA;IATF,KAAK,CAAY;IACjB,QAAQ,GAAG,IAAI,GAAG,EAA0C,CAAA;IAC5D,WAAW,CAAQ;IAEpC,YACmB,MAAc,EACd,MAAc,EACd,aAAqB,EACtC,KAAkB,EACD,SAAwB;QAJxB,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,kBAAa,GAAb,aAAa,CAAQ;QAErB,cAAS,GAAT,SAAS,CAAe;QAEzC,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,IAAI,kBAAkB,EAAE,CAAA;QAC9C,IAAI,CAAC,WAAW,GAAG,GAAG,MAAM,KAAK,aAAa,EAAE,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,YAAoB,EACpB,QAA2B,EAC3B,OAAwB,EAAE;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAA;QAC1C,MAAM,eAAe,GAAG,SAAS,GAAG,IAAI,GAAG,EAAE,CAAA;QAE7C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;QAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;QAC1D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;YACxE,IAAI,SAAS,GAAG,eAAe;gBAAE,OAAO,MAAM,CAAA;QAChD,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,YAAY,KAAK,aAAa,EAAE,CAAA;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAE7B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;gBACxE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;gBAClD,OAAO,KAAK,CAAA;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACvC,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,YAAY,CAAC,YAAoB,EAAE,IAAqB;QAC9D,OAAO;YACL,IAAI,CAAC,WAAW;YAChB,aAAa,CAAC,YAAY,CAAC;YAC3B,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;YAC9B,IAAI,CAAC,SAAS,IAAI,EAAE;YACpB,IAAI,CAAC,cAAc,IAAI,EAAE;YACzB,IAAI,CAAC,gBAAgB,IAAI,EAAE;YAC3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC;SACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACd,CAAC;IAEO,aAAa,CAAC,QAA2B,EAAE,IAAqB;QACtE,OAAO;YACL,YAAY,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAChC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;YAClC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjC,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE;SAC/E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACd,CAAC;IAEO,gBAAgB,CAAC,MAAiB;QACxC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACpD,CAAC;IAEO,WAAW,CAAC,IAAqB;QACvC,OAAO;YACL,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YACrE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YACvC,IAAI,CAAC,mBAAmB,IAAI,EAAE;SAC/B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,YAAoB,EACpB,QAA2B,EAC3B,IAAqB,EACrB,OAAgB,EAChB,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QAEpD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,iDAAiD;YAC7D,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,cAAc,EAAE,IAAI,CAAC,aAAa;SACnC,CAAC,CAAA;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAA;YACvC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,+CAA+C,CAAC,CAAA;QACjF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC1E,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;QACnE,IAAI,IAAI,CAAC,eAAe;YAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAA;QAC5E,IAAI,IAAI,CAAC,mBAAmB;YAAE,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACzF,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC7D,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1D,IAAI,IAAI,CAAC,cAAc;YAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QAC1E,IAAI,IAAI,CAAC,gBAAgB;YAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAChF,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACnC,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QACrE,IAAI,IAAI,CAAC,0BAA0B,KAAK,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAA;QAE9F,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;QACpC,IAAI,GAAkD,CAAA;QACtD,IAAI,OAAgB,CAAA;QACpB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC3C,IAAI,WAAW,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;YAC9D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,WAAW,CAAC,CAAA;YACjE,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,gBAAgB,EAAE;oBACpE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;oBAChE,IAAI;oBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,GAAG,CAAA;gBACb,IAAI,OAAO,KAAK,UAAU;oBAAE,MAAM,GAAG,CAAA;YACvC,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,OAAO,CAAC,CAAA;YACvB,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,mBAAmB,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;gBAC/D,SAAQ;YACV,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;YACzB,MAAM,SAAS,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,CAAA;YACvG,IAAI,CAAC,SAAS,IAAI,OAAO,KAAK,UAAU;gBAAE,MAAK;YAC/C,MAAM,mBAAmB,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;QACnE,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,OAAO,YAAY,KAAK;gBAAE,MAAM,OAAO,CAAA;YAC3C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,GAAqB,CAAA;YACzB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,0BAA0B,CAAC,CAAA;YACpE,CAAC;YACD,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,IAAI,wBAAwB,CAChC,GAAG,CAAC,mBAAmB,CAAC,IAAI,kBAAkB,EAC9C,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EACzB,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EACzB,GAAG,CAAC,YAAY,CAAC,CAClB,CAAA;YACH,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;YAC3F,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;QAClD,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAA;QACrD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAA;IACtC,CAAC;CACF;AAED,SAAS,uBAAuB,CAAC,IAAwB;IACvD,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAA;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,QAAQ,GAA0B;QACtC,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACxC,CAAA;IACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC5G,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;QAClF,CAAC;QACD,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAA;IAClD,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACxF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,SAAS,GAAoD,EAAE,CAAA;IACrE,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,IAAI,GAAG,SAAoC,CAAA;QACjD,SAAS,CAAC,QAAQ,CAAC,GAAG;YACpB,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC;YAC9C,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC;YAC/D,YAAY,EAAE,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC;YAC3E,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,uBAAuB,CAAC;YACrE,cAAc,EAAE,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,4BAA4B,CAAC;YACnF,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,uBAAuB,CAAC;YACrE,iBAAiB,EAAE,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;YACjG,aAAa,EAAE,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,0BAA0B,CAAC;YAC9E,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,uBAAuB,CAAC;YACrE,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC;YAC5D,sBAAsB,EAAE,eAAe,CAAC,IAAI,CAAC,wBAAwB,EAAE,oCAAoC,CAAC;YAC5G,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC;SACpE,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,mBAAmB,CAAC,CAAA;IAChG,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,yBAAyB,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,oBAAoB,CAAC,CAAA;IAClG,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,qBAAqB,CAAC,CAAA;IAC9H,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,YAAY,CAAC,GAAa,EAAE,OAAe;IAClD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;QAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAA;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;IAChD,OAAO,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,UAAkB;IACnE,MAAM,WAAW,GAAG,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC3C,IAAI,WAAW,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAC9D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAA;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAa;IACnC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAClE,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5D,OAAO,SAAS,KAAK,kBAAkB,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,OAAO,UAAU,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,YAAY,CAAC,QAA2B;IAC/C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AACrG,CAAC"}

package/dist/index.js

@@ -1,7 +1,7 @@
 // Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
 // Caracal, a product of Garudex Labs
 //
-// @caracalai/oauth — RFC 8693 token exchange client.
+// @caracalai/oauth: RFC 8693 token exchange client.
 export * from './types.js';
 export * from './cache.js';
 export * from './client.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,qDAAqD;AAErD,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,oDAAoD;AAEpD,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA"}

package/dist/types.d.ts

@@ -1,7 +1,7 @@
 import { CaracalError } from '@caracalai/core';
 export interface TokenExchangeRequest {
     subjectToken: string;
-    resource: string;
+    resource: string | string[];
     clientId: string;
     clientSecret?: string;
     clientAssertion?: string;
@@ -12,12 +12,29 @@ export interface TokenExchangeRequest {
     delegationEdgeId?: string;
     scopes?: string[];
     ttlSeconds?: number;
+    runtimeCredentialInjection?: boolean;
+}
+export interface UpstreamDirective {
+    url?: string;
+    authMode?: string;
+    authLocation?: string;
+    authHeader?: string;
+    queryParamName?: string;
+    authScheme?: string;
+    allowedTokenHosts?: string[];
+    providerToken?: string;
+    providerId?: string;
+    grantId?: string;
+    forwardCaracalIdentity?: boolean;
+    expiresAt?: number;
 }
 export interface TokenExchangeResponse {
     accessToken: string;
     tokenType: 'Bearer';
     expiresIn: number;
     issuedAt: number;
+    targetResources?: string[];
+    upstreams?: Record<string, UpstreamDirective>;
 }
 export interface ExchangeOptions {
     clientSecret?: string;
@@ -31,6 +48,7 @@ export interface ExchangeOptions {
     timeoutMs?: number;
     retries?: number;
     ttlSeconds?: number;
+    runtimeCredentialInjection?: boolean;
 }
 export declare class InteractionRequiredError extends CaracalError {
     readonly challengeId: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,wBAAyB,SAAQ,YAAY;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;gBAGzB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM;CAUrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,0BAA0B,CAAC,EAAE,OAAO,CAAA;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,0BAA0B,CAAC,EAAE,OAAO,CAAA;CACrC;AAED,qBAAa,wBAAyB,SAAQ,YAAY;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;gBAGzB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM;CAUrB"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,iEAAiE;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAsC9C,MAAM,OAAO,wBAAyB,SAAQ,YAAY;IAC/C,WAAW,CAAQ;IACnB,QAAQ,CAAS;IACjB,SAAS,CAAS;IAE3B,YACE,OAAe,EACf,WAAmB,EACnB,QAAiB,EACjB,SAAkB;QAElB,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE;YACrC,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACjG,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;QACtC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;QAC9B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,iEAAiE;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAyD9C,MAAM,OAAO,wBAAyB,SAAQ,YAAY;IAC/C,WAAW,CAAQ;IACnB,QAAQ,CAAS;IACjB,SAAS,CAAS;IAE3B,YACE,OAAe,EACf,WAAmB,EACnB,QAAiB,EACjB,SAAkB;QAElB,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE;YACrC,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACjG,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;QACtC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;QAC9B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caracalai/oauth",
-  "version": "0.1.2",
+  "version": "0.1.4-rc.1",
   "description": "Caracal RFC 8693 OAuth 2.0 token exchange client.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/Garudex-Labs/caracal",
@@ -26,8 +26,8 @@
   },
   "files": [
     "dist",
-    "README.md",
-    "LICENSE"
+    "LICENSE",
+    "README.md"
   ],
   "publishConfig": {
     "access": "public"
@@ -39,7 +39,7 @@
     "prepublishOnly": "tsc"
   },
   "dependencies": {
-    "@caracalai/core": "0.1.2"
+    "@caracalai/core": "0.1.4-rc.1"
   },
   "devDependencies": {
     "@types/node": "^24.12.2",