@caracalai/oauth 0.1.6-rc.2 → 0.2.0-rc.1

package/dist/cache.d.ts

@@ -2,6 +2,7 @@ import type { TokenExchangeResponse } from './types.js';
 export interface TokenCache {
     get(subjectToken: string, resource: string): TokenExchangeResponse | undefined;
     set(subjectToken: string, resource: string, token: TokenExchangeResponse): void;
+    clear(): void;
 }
 export interface InMemoryTokenCacheOptions {
     maxEntries?: number;
@@ -12,5 +13,6 @@ export declare class InMemoryTokenCache implements TokenCache {
     constructor(opts?: InMemoryTokenCacheOptions);
     get(subjectToken: string, resource: string): TokenExchangeResponse | undefined;
     set(subjectToken: string, resource: string, token: TokenExchangeResponse): void;
+    clear(): void;
 }
 //# sourceMappingURL=cache.d.ts.map

package/dist/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAEvD,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAA;IAC9E,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAA;CAChF;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAKD,qBAAa,kBAAmB,YAAW,UAAU;IACnD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA+E;IACnG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;gBAEvB,IAAI,GAAE,yBAA8B;IAQhD,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAa9E,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,IAAI;CAchF"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAEvD,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAA;IAC9E,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAA;IAC/E,KAAK,IAAI,IAAI,CAAA;CACd;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAKD,qBAAa,kBAAmB,YAAW,UAAU;IACnD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA+E;IACnG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;gBAEvB,IAAI,GAAE,yBAA8B;IAQhD,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAa9E,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,IAAI;IAe/E,KAAK,IAAI,IAAI;CAGd"}

package/dist/cache.js

@@ -44,6 +44,9 @@ export class InMemoryTokenCache {
             this.map.delete(oldest);
         }
     }
+    clear() {
+        this.map.clear();
+    }
 }
 function cacheKey(subjectToken, resource) {
     return createHmac('sha256', CACHE_KEY).update(subjectToken).update('\0').update(resource).digest('hex');

package/dist/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,sGAAsG;AAEtG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAYrD,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;AAEjC,MAAM,OAAO,kBAAkB;IACZ,GAAG,GAAG,IAAI,GAAG,EAAqE,CAAA;IAClF,UAAU,CAAQ;IAEnC,YAAY,OAAkC,EAAE;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAA;QAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,GAAG,CAAA;IACvB,CAAC;IAED,GAAG,CAAC,YAAoB,EAAE,QAAgB;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAA;QAC5B,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACxB,OAAO,KAAK,CAAC,KAAK,CAAA;IACpB,CAAC;IAED,GAAG,CAAC,YAAoB,EAAE,QAAgB,EAAE,KAA4B;QACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC1E,IAAI,WAAW,IAAI,CAAC;YAAE,OAAM;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,CAAA;QAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC3C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAK;YAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,YAAoB,EAAE,QAAgB;IACtD,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzG,CAAC"}
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,sGAAsG;AAEtG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAarD,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;AAEjC,MAAM,OAAO,kBAAkB;IACZ,GAAG,GAAG,IAAI,GAAG,EAAqE,CAAA;IAClF,UAAU,CAAQ;IAEnC,YAAY,OAAkC,EAAE;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAA;QAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,GAAG,CAAA;IACvB,CAAC;IAED,GAAG,CAAC,YAAoB,EAAE,QAAgB;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAA;QAC5B,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACxB,OAAO,KAAK,CAAC,KAAK,CAAA;IACpB,CAAC;IAED,GAAG,CAAC,YAAoB,EAAE,QAAgB,EAAE,KAA4B;QACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC1E,IAAI,WAAW,IAAI,CAAC;YAAE,OAAM;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,CAAA;QAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC3C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAK;YAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;IAClB,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,YAAoB,EAAE,QAAgB;IACtD,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzG,CAAC"}

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { type TokenCache } from './cache.js';
-import type { ExchangeOptions, TokenExchangeResponse } from './types.js';
+import type { ApprovalState, ExchangeOptions, OAuthEvent, TokenExchangeResponse } from './types.js';
 export declare class OAuthClient {
     private readonly stsUrl;
     private readonly zoneId;
@@ -8,12 +8,66 @@ export declare class OAuthClient {
     private readonly cache;
     private readonly inflight;
     private readonly identityKey;
+    /** Observability sink; each completed exchange and approval wait reports here. Failures inside the sink never reach the caller. */
+    onEvent?: (event: OAuthEvent) => void;
     constructor(stsUrl: string, zoneId: string, applicationId: string, cache?: TokenCache, fetchImpl?: typeof fetch | undefined);
+    private emit;
+    /** Drops every cached token derived by this client. In-flight exchanges are not canceled. */
+    invalidate(): void;
     exchange(subjectToken: string, resource: string | string[], opts?: ExchangeOptions): Promise<TokenExchangeResponse>;
     private cacheSubject;
     private cacheResource;
     private normalizedScopes;
     private authContext;
     private doExchange;
+    /**
+     * Long-polls an approval until an approver decides it, it expires, or
+     * the timeout elapses. Returns the final lifecycle state: 'approved' means a
+     * retry of exchange() with challengeId will mint; 'rejected' and 'expired' are
+     * terminal; 'pending' means the timeout elapsed and waiting again is safe.
+     * Pass `signal` to abort the wait early.
+     */
+    waitForApproval(approvalId: string, opts?: {
+        timeoutMs?: number;
+        signal?: AbortSignal;
+    }): Promise<ApprovalState>;
+    /**
+     * Exchanges an end user's identity token from a zone-trusted external issuer
+     * for a Caracal Subject authority record. The application authenticates itself
+     * with its client secret and relays the token verbatim; the minted record is
+     * the subject's identity anchor and carries no resource authority. Never
+     * cached: each federation is an explicit identity event.
+     */
+    federateSubject(idToken: string, opts?: {
+        clientSecret?: string;
+        ttlSeconds?: number;
+        timeoutMs?: number;
+        signal?: AbortSignal;
+    }): Promise<TokenExchangeResponse>;
+    /**
+     * Posts an end user's decision on a subject-reserved approval hold. The
+     * subject token is the user's federated session mandate, and the binding must
+     * echo the hold exactly - a prompt that does not know the held resource and
+     * scope set cannot decide it.
+     */
+    decideApproval(input: {
+        subjectToken: string;
+        approvalId: string;
+        binding: string;
+        decision: 'approved' | 'rejected';
+        reason?: string;
+        timeoutMs?: number;
+        signal?: AbortSignal;
+    }): Promise<void>;
 }
+/**
+ * Long-polls an approval's lifecycle state against STS without any client
+ * context: only the approval id and the STS URL are required, so run launches and
+ * exchange clients share one polling path.
+ */
+export declare function pollStepUpState(stsUrl: string, approvalId: string, opts?: {
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    fetchImpl?: typeof fetch;
+}): Promise<ApprovalState>;
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAwCxE,qBAAa,WAAW;IAMpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAT7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoD;IAC7E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;gBAGjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACtC,KAAK,CAAC,EAAE,UAAU,EACD,SAAS,CAAC,EAAE,OAAO,KAAK,YAAA;IAMrC,QAAQ,CACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,EAC3B,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,qBAAqB,CAAC;IA6BjC,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,WAAW;YAQL,UAAU;CA2FzB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAEhE,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AA4CnG,qBAAa,WAAW;IAQpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAX7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoD;IAC7E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,mIAAmI;IACnI,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;gBAGlB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACtC,KAAK,CAAC,EAAE,UAAU,EACD,SAAS,CAAC,EAAE,OAAO,KAAK,YAAA;IAM3C,OAAO,CAAC,IAAI;IASZ,6FAA6F;IAC7F,UAAU,IAAI,IAAI;IAIZ,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAwE7H,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,WAAW;YAIL,UAAU;IAyExB;;;;;;OAMG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAa1H;;;;;;OAMG;IACG,eAAe,CACnB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAClG,OAAO,CAAC,qBAAqB,CAAC;IAmCjC;;;;;OAKG;IACG,cAAc,CAAC,KAAK,EAAE;QAC1B,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAA;QACjC,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,WAAW,CAAA;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;CA0BlB;AAYD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CAAO,GAChF,OAAO,CAAC,aAAa,CAAC,CAcxB"}

package/dist/client.js

@@ -1,15 +1,18 @@
 // Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
 // Caracal, a product of Garudex Labs
 //
-// RFC 8693 token exchange client with pluggable token cache and 401-retry.
+// RFC 8693 token exchange client with pluggable token caching.
 import { createHmac, randomBytes } from 'node:crypto';
 import { InMemoryTokenCache } from './cache.js';
-import { InteractionRequiredError } from './types.js';
+import { CaracalError, ApprovalRequiredError, APPROVAL_STATES } from './types.js';
 const SECRET_CACHE_KEY = randomBytes(32);
 function parseSTSErrorResponse(body) {
     if (body === '')
         return {};
-    return JSON.parse(body);
+    const parsed = JSON.parse(body);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        throw new Error('invalid error response');
+    return parsed;
 }
 function formatSTSError(status, err) {
     const base = err.error_description ?? `STS error ${status}`;
@@ -20,7 +23,7 @@ async function readSTSErrorResponse(res) {
         return parseSTSErrorResponse(await res.text());
     }
     if (typeof res.json === 'function') {
-        return await res.json();
+        return (await res.json());
     }
     return {};
 }
@@ -32,6 +35,8 @@ export class OAuthClient {
     cache;
     inflight = new Map();
     identityKey;
+    /** Observability sink; each completed exchange and approval wait reports here. Failures inside the sink never reach the caller. */
+    onEvent;
     constructor(stsUrl, zoneId, applicationId, cache, fetchImpl) {
         this.stsUrl = stsUrl;
         this.zoneId = zoneId;
@@ -40,65 +45,112 @@ export class OAuthClient {
         this.cache = cache ?? new InMemoryTokenCache();
         this.identityKey = `${zoneId}::${applicationId}`;
     }
+    emit(event) {
+        if (!this.onEvent)
+            return;
+        try {
+            this.onEvent(event);
+        }
+        catch {
+            // The observability sink must never break the token path.
+        }
+    }
+    /** Drops every cached token derived by this client. In-flight exchanges are not canceled. */
+    invalidate() {
+        this.cache.clear();
+    }
     async exchange(subjectToken, resource, opts = {}) {
         const timeoutMs = opts.timeoutMs ?? 30_000;
         const preflightWindow = timeoutMs / 1000 + 30;
+        const oneShot = opts.cache === false || Boolean(opts.challengeId);
+        const resources = resourceList(resource);
+        const scopes = [...new Set(opts.scopes ?? [])].sort();
         const cacheSubject = this.cacheSubject(subjectToken, opts);
         const cacheResource = this.cacheResource(resource, opts);
-        const cached = this.cache.get(cacheSubject, cacheResource);
-        if (cached) {
-            const remaining = cached.issuedAt + cached.expiresIn - Date.now() / 1000;
-            if (remaining > preflightWindow)
-                return cached;
+        if (!oneShot && !opts.forceRefresh) {
+            const cached = this.cache.get(cacheSubject, cacheResource);
+            if (cached) {
+                // Cap the preflight window at half the token lifetime so short-lived
+                // tokens are still served from cache instead of re-minted every call.
+                const window = Math.min(preflightWindow, cached.expiresIn / 2);
+                const remaining = cached.issuedAt + cached.expiresIn - Date.now() / 1000;
+                if (remaining > window) {
+                    this.emit({ type: 'token.exchange', resources, scopes, cached: true, ok: true, durationMs: 0 });
+                    return cached;
+                }
+            }
         }
         const inflightKey = `${cacheSubject}::${cacheResource}`;
+        if (oneShot) {
+            const start = performance.now();
+            try {
+                const token = await this.doExchange(subjectToken, resource, opts);
+                this.emit({ type: 'token.exchange', resources, scopes, cached: false, ok: true, durationMs: performance.now() - start });
+                return token;
+            }
+            catch (err) {
+                this.emit({
+                    type: 'token.exchange',
+                    resources,
+                    scopes,
+                    cached: false,
+                    ok: false,
+                    durationMs: performance.now() - start,
+                    ...(err instanceof CaracalError ? { code: err.code, status: err.httpStatus } : {}),
+                });
+                throw err;
+            }
+        }
         const existing = this.inflight.get(inflightKey);
         if (existing)
-            return existing;
+            return waitForShared(existing, opts.signal);
+        const start = performance.now();
         const pending = (async () => {
             try {
-                const token = await this.doExchange(subjectToken, resource, opts, false);
+                const token = await this.doExchange(subjectToken, resource, opts);
                 this.cache.set(cacheSubject, cacheResource, token);
+                this.emit({ type: 'token.exchange', resources, scopes, cached: false, ok: true, durationMs: performance.now() - start });
                 return token;
             }
+            catch (err) {
+                this.emit({
+                    type: 'token.exchange',
+                    resources,
+                    scopes,
+                    cached: false,
+                    ok: false,
+                    durationMs: performance.now() - start,
+                    ...(err instanceof CaracalError ? { code: err.code, status: err.httpStatus } : {}),
+                });
+                throw err;
+            }
             finally {
                 this.inflight.delete(inflightKey);
             }
         })();
         this.inflight.set(inflightKey, pending);
-        return pending;
+        return waitForShared(pending, opts.signal);
     }
     cacheSubject(subjectToken, opts) {
         return [
             this.identityKey,
             secretCacheId(subjectToken),
-            secretCacheId(opts.actorToken),
+            opts.authorityRecordId ?? '',
             opts.sessionId ?? '',
-            opts.agentSessionId ?? '',
-            opts.delegationEdgeId ?? '',
+            opts.delegationId ?? '',
             this.authContext(opts),
-            secretCacheId(opts.clientAssertion),
         ].join('::');
     }
     cacheResource(resource, opts) {
-        return [
-            resourceList(resource).join(' '),
-            this.normalizedScopes(opts.scopes),
-            opts.ttlSeconds?.toString() ?? '',
-            opts.runtimeCredentialInjection === true ? 'runtime-credential-injection' : '',
-        ].join('::');
+        return [resourceList(resource).join(' '), this.normalizedScopes(opts.scopes), opts.ttlSeconds?.toString() ?? ''].join('::');
     }
     normalizedScopes(scopes) {
         return [...new Set(scopes ?? [])].sort().join(' ');
     }
     authContext(opts) {
-        return [
-            opts.clientSecret ? `secret:${secretCacheId(opts.clientSecret)}` : '',
-            opts.clientAssertion ? 'assertion' : '',
-            opts.clientAssertionType ?? '',
-        ].join(':');
+        return opts.clientSecret ? `secret:${secretCacheId(opts.clientSecret)}` : '';
     }
-    async doExchange(subjectToken, resource, opts, isRetry, deadlineMs = performance.now() + (opts.timeoutMs ?? 30_000)) {
+    async doExchange(subjectToken, resource, opts, deadlineMs = performance.now() + (opts.timeoutMs ?? 30_000)) {
         const body = new URLSearchParams({
             grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
             zone_id: this.zoneId,
@@ -112,64 +164,37 @@ export class OAuthClient {
             body.append('resource', value);
         if (opts.clientSecret)
             body.set('client_secret', opts.clientSecret);
-        if (opts.clientAssertion)
-            body.set('client_assertion', opts.clientAssertion);
-        if (opts.clientAssertionType)
-            body.set('client_assertion_type', opts.clientAssertionType);
-        if (opts.actorToken)
-            body.set('actor_token', opts.actorToken);
+        if (opts.authorityRecordId)
+            body.set('session_id', opts.authorityRecordId);
         if (opts.sessionId)
-            body.set('session_id', opts.sessionId);
-        if (opts.agentSessionId)
-            body.set('agent_session_id', opts.agentSessionId);
-        if (opts.delegationEdgeId)
-            body.set('delegation_edge_id', opts.delegationEdgeId);
+            body.set('agent_session_id', opts.sessionId);
+        if (opts.delegationId)
+            body.set('delegation_edge_id', opts.delegationId);
         const scope = this.normalizedScopes(opts.scopes);
         if (scope)
             body.set('scope', scope);
         if (opts.ttlSeconds)
             body.set('ttl_seconds', String(opts.ttlSeconds));
-        if (opts.runtimeCredentialInjection === true)
-            body.set('runtime_credential_injection', 'true');
-        const maxRetries = opts.retries ?? 3;
+        if (opts.challengeId)
+            body.set('challenge_id', opts.challengeId);
+        if (opts.signal?.aborted)
+            throw abortReason(opts.signal);
+        const remainingMs = deadlineMs - performance.now();
+        if (remainingMs <= 0)
+            throw new Error('STS request timed out');
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), remainingMs);
         let res;
-        let lastErr;
-        for (let attempt = 0; attempt <= maxRetries; attempt++) {
-            const remainingMs = deadlineMs - performance.now();
-            if (remainingMs <= 0)
-                throw new Error('STS request timed out');
-            const controller = new AbortController();
-            const timeout = setTimeout(() => controller.abort(), remainingMs);
-            try {
-                res = await (this.fetchImpl ?? fetch)(`${this.stsUrl}/oauth/2/token`, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                    body,
-                    signal: controller.signal,
-                });
-            }
-            catch (err) {
-                lastErr = err;
-                if (attempt === maxRetries)
-                    throw err;
-            }
-            finally {
-                clearTimeout(timeout);
-            }
-            if (!res) {
-                await delayWithinDeadline(jitteredBackoff(attempt), deadlineMs);
-                continue;
-            }
-            const status = res.status;
-            const transient = status === 408 || status === 425 || status === 429 || (status >= 500 && status < 600);
-            if (!transient || attempt === maxRetries)
-                break;
-            await delayWithinDeadline(retryDelayMs(res, attempt), deadlineMs);
+        try {
+            res = await (this.fetchImpl ?? fetch)(`${this.stsUrl}/oauth/2/token`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body,
+                signal: opts.signal ? AbortSignal.any([controller.signal, opts.signal]) : controller.signal,
+            });
         }
-        if (!res) {
-            if (lastErr instanceof Error)
-                throw lastErr;
-            throw new Error('STS request failed: no response');
+        finally {
+            clearTimeout(timeout);
         }
         if (!res.ok) {
             let err;
@@ -180,12 +205,20 @@ export class OAuthClient {
                 throw new Error(`STS error ${res.status}: invalid error response`);
             }
             if (err['error'] === 'interaction_required') {
-                throw new InteractionRequiredError(err['error_description'] ?? 'Step-up required', err['challenge_id'] ?? '', resourceList(resource)[0], err['acr_values']);
-            }
-            if (res.status === 401 && !isRetry) {
-                return this.doExchange(subjectToken, resource, { ...opts, retries: 0 }, true, deadlineMs);
+                throw new ApprovalRequiredError(err['error_description'] ?? 'Approval required', err['challenge_id'] ?? '', {
+                    resource: resourceList(resource)[0],
+                    state: err['state'],
+                    tier: err['tier'],
+                    binding: err['binding'],
+                    expiresAt: err['challenge_expires_at'],
+                    requestId: err['requestId'],
+                    httpStatus: res.status,
+                });
             }
-            throw new Error(formatSTSError(res.status, err));
+            throw new CaracalError(err.error || 'error', formatSTSError(res.status, err), {
+                requestId: err.requestId,
+                httpStatus: res.status,
+            });
         }
         if (!isJsonResponse(res)) {
             throw new Error('STS response invalid: expected application/json');
@@ -193,6 +226,151 @@ export class OAuthClient {
         const data = (await res.json());
         return validateSuccessResponse(data);
     }
+    /**
+     * Long-polls an approval until an approver decides it, it expires, or
+     * the timeout elapses. Returns the final lifecycle state: 'approved' means a
+     * retry of exchange() with challengeId will mint; 'rejected' and 'expired' are
+     * terminal; 'pending' means the timeout elapsed and waiting again is safe.
+     * Pass `signal` to abort the wait early.
+     */
+    async waitForApproval(approvalId, opts = {}) {
+        if (!approvalId)
+            throw new Error('waitForApproval requires an approvalId');
+        const start = performance.now();
+        try {
+            const state = await pollStepUpState(this.stsUrl, approvalId, { ...opts, fetchImpl: this.fetchImpl });
+            this.emit({ type: 'approval.wait', approvalId, state, ok: true, durationMs: performance.now() - start });
+            return state;
+        }
+        catch (err) {
+            this.emit({ type: 'approval.wait', approvalId, state: '', ok: false, durationMs: performance.now() - start });
+            throw err;
+        }
+    }
+    /**
+     * Exchanges an end user's identity token from a zone-trusted external issuer
+     * for a Caracal Subject authority record. The application authenticates itself
+     * with its client secret and relays the token verbatim; the minted record is
+     * the subject's identity anchor and carries no resource authority. Never
+     * cached: each federation is an explicit identity event.
+     */
+    async federateSubject(idToken, opts = {}) {
+        if (!idToken)
+            throw new Error('federateSubject requires the end user identity token');
+        const body = new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+            zone_id: this.zoneId,
+            application_id: this.applicationId,
+            subject_token: idToken,
+            subject_token_type: 'urn:ietf:params:oauth:token-type:id_token',
+        });
+        if (opts.clientSecret)
+            body.set('client_secret', opts.clientSecret);
+        if (opts.ttlSeconds)
+            body.set('ttl_seconds', String(opts.ttlSeconds));
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), opts.timeoutMs ?? 30_000);
+        try {
+            const res = await (this.fetchImpl ?? fetch)(`${this.stsUrl}/oauth/2/token`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body,
+                signal: opts.signal ? AbortSignal.any([controller.signal, opts.signal]) : controller.signal,
+            });
+            if (!res.ok) {
+                let err;
+                try {
+                    err = await readSTSErrorResponse(res);
+                }
+                catch {
+                    throw new Error(`STS error ${res.status}: invalid error response`);
+                }
+                throw new CaracalError(err.error ?? 'federation_failed', formatSTSError(res.status, err), { httpStatus: res.status });
+            }
+            return validateSuccessResponse((await res.json()));
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    /**
+     * Posts an end user's decision on a subject-reserved approval hold. The
+     * subject token is the user's federated session mandate, and the binding must
+     * echo the hold exactly - a prompt that does not know the held resource and
+     * scope set cannot decide it.
+     */
+    async decideApproval(input) {
+        if (!input.subjectToken || !input.approvalId || !input.binding) {
+            throw new Error('decideApproval requires subjectToken, approvalId, and binding');
+        }
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), input.timeoutMs ?? 30_000);
+        try {
+            const res = await (this.fetchImpl ?? fetch)(`${this.stsUrl}/step-up/${encodeURIComponent(input.approvalId)}/decision`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${input.subjectToken}` },
+                body: JSON.stringify({ decision: input.decision, binding: input.binding, ...(input.reason ? { reason: input.reason } : {}) }),
+                signal: input.signal ? AbortSignal.any([controller.signal, input.signal]) : controller.signal,
+            });
+            if (!res.ok) {
+                let err;
+                try {
+                    err = await readSTSErrorResponse(res);
+                }
+                catch {
+                    throw new Error(`approval decision failed: ${res.status}`);
+                }
+                throw new CaracalError(err.error ?? 'decision_failed', formatSTSError(res.status, err), { httpStatus: res.status });
+            }
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+async function waitForShared(pending, signal) {
+    if (!signal)
+        return pending;
+    if (signal.aborted)
+        throw abortReason(signal);
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(abortReason(signal));
+        signal.addEventListener('abort', abort, { once: true });
+        pending.then(resolve, reject).finally(() => signal.removeEventListener('abort', abort));
+    });
+}
+/**
+ * Long-polls an approval's lifecycle state against STS without any client
+ * context: only the approval id and the STS URL are required, so run launches and
+ * exchange clients share one polling path.
+ */
+export async function pollStepUpState(stsUrl, approvalId, opts = {}) {
+    const deadline = performance.now() + (opts.timeoutMs ?? 300_000);
+    for (;;) {
+        if (opts.signal?.aborted)
+            throw abortReason(opts.signal);
+        const remainingMs = deadline - performance.now();
+        if (remainingMs <= 0)
+            return 'pending';
+        const wait = Math.max(1, Math.min(25, Math.floor(remainingMs / 1000)));
+        const timeout = AbortSignal.timeout(Math.max(1, Math.ceil(remainingMs)));
+        const signal = opts.signal ? AbortSignal.any([timeout, opts.signal]) : timeout;
+        const res = await (opts.fetchImpl ?? fetch)(`${stsUrl}/step-up/${encodeURIComponent(approvalId)}?wait=${wait}`, { signal });
+        if (!res.ok)
+            throw new Error(`step-up status failed: ${res.status}`);
+        const data = (await res.json());
+        if (typeof data.state === 'string' && data.state !== 'pending')
+            return approvalState(data.state);
+    }
+}
+function approvalState(value) {
+    if (!APPROVAL_STATES.includes(value)) {
+        throw new Error(`step-up status returned an unknown challenge state: ${value}`);
+    }
+    return value;
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error('aborted');
 }
 function validateSuccessResponse(data) {
     if (typeof data.access_token !== 'string' || data.access_token === '') {
@@ -217,88 +395,8 @@ function validateSuccessResponse(data) {
         }
         response.targetResources = data.target_resources;
     }
-    if (data.upstreams !== undefined)
-        response.upstreams = validateUpstreams(data.upstreams);
     return response;
 }
-function validateUpstreams(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        throw new Error('STS response invalid: upstreams must be an object');
-    }
-    const upstreams = {};
-    for (const [resource, directive] of Object.entries(value)) {
-        if (!directive || typeof directive !== 'object' || Array.isArray(directive)) {
-            throw new Error('STS response invalid: upstream directive must be an object');
-        }
-        const item = directive;
-        upstreams[resource] = {
-            url: optionalString(item.url, 'upstreams.url'),
-            authMode: optionalString(item.auth_mode, 'upstreams.auth_mode'),
-            authLocation: optionalString(item.auth_location, 'upstreams.auth_location'),
-            authHeader: optionalString(item.auth_header, 'upstreams.auth_header'),
-            queryParamName: optionalString(item.query_param_name, 'upstreams.query_param_name'),
-            authScheme: optionalString(item.auth_scheme, 'upstreams.auth_scheme'),
-            allowedTokenHosts: optionalStringArray(item.allowed_token_hosts, 'upstreams.allowed_token_hosts'),
-            providerToken: optionalString(item.provider_token, 'upstreams.provider_token'),
-            providerId: optionalString(item.provider_id, 'upstreams.provider_id'),
-            grantId: optionalString(item.grant_id, 'upstreams.grant_id'),
-            forwardCaracalIdentity: optionalBoolean(item.forward_caracal_identity, 'upstreams.forward_caracal_identity'),
-            expiresAt: optionalInteger(item.expires_at, 'upstreams.expires_at'),
-        };
-    }
-    return upstreams;
-}
-function optionalString(value, name) {
-    if (value === undefined)
-        return undefined;
-    if (typeof value !== 'string')
-        throw new Error(`STS response invalid: ${name} must be a string`);
-    return value;
-}
-function optionalStringArray(value, name) {
-    if (value === undefined)
-        return undefined;
-    if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
-        throw new Error(`STS response invalid: ${name} must be a string array`);
-    }
-    return value;
-}
-function optionalBoolean(value, name) {
-    if (value === undefined)
-        return undefined;
-    if (typeof value !== 'boolean')
-        throw new Error(`STS response invalid: ${name} must be a boolean`);
-    return value;
-}
-function optionalInteger(value, name) {
-    if (value === undefined)
-        return undefined;
-    if (typeof value !== 'number' || !Number.isInteger(value))
-        throw new Error(`STS response invalid: ${name} must be an integer`);
-    return value;
-}
-function retryDelayMs(res, attempt) {
-    const retryAfter = res.headers?.get('retry-after');
-    if (retryAfter) {
-        const secs = Number(retryAfter);
-        if (Number.isFinite(secs))
-            return Math.max(0, secs * 1000);
-        const date = Date.parse(retryAfter);
-        if (!Number.isNaN(date))
-            return Math.max(0, date - Date.now());
-    }
-    return jitteredBackoff(attempt);
-}
-function jitteredBackoff(attempt) {
-    const base = Math.min(2 ** attempt * 250, 5_000);
-    return base / 2 + Math.random() * (base / 2);
-}
-async function delayWithinDeadline(waitMs, deadlineMs) {
-    const remainingMs = deadlineMs - performance.now();
-    if (remainingMs <= 0)
-        throw new Error('STS request timed out');
-    await new Promise(resolve => setTimeout(resolve, Math.min(waitMs, remainingMs)));
-}
 function isJsonResponse(res) {
     const contentType = res.headers?.get('content-type');
     if (contentType === null || contentType === undefined)
@@ -312,6 +410,6 @@ function secretCacheId(value) {
     return createHmac('sha256', SECRET_CACHE_KEY).update(value).digest('hex');
 }
 function resourceList(resource) {
-    return (Array.isArray(resource) ? resource : [resource]).map(value => value.trim()).filter(Boolean);
+    return [...new Set((Array.isArray(resource) ? resource : [resource]).map((value) => value.trim()).filter(Boolean))].sort();
 }
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,2EAA2E;AAE3E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAmB,MAAM,YAAY,CAAA;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAmBrD,MAAM,gBAAgB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;AAExC,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAA;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,GAAqB;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,IAAI,aAAa,MAAM,EAAE,CAAA;IAC3D,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,gBAAgB,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACvE,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,GAAa;IAC/C,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,qBAAqB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,MAAM,GAAG,CAAC,IAAI,EAAsB,CAAA;IAC7C,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,OAAO,WAAW;IAMH;IACA;IACA;IAEA;IATF,KAAK,CAAY;IACjB,QAAQ,GAAG,IAAI,GAAG,EAA0C,CAAA;IAC5D,WAAW,CAAQ;IAEpC,YACmB,MAAc,EACd,MAAc,EACd,aAAqB,EACtC,KAAkB,EACD,SAAwB;QAJxB,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,kBAAa,GAAb,aAAa,CAAQ;QAErB,cAAS,GAAT,SAAS,CAAe;QAEzC,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,IAAI,kBAAkB,EAAE,CAAA;QAC9C,IAAI,CAAC,WAAW,GAAG,GAAG,MAAM,KAAK,aAAa,EAAE,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,YAAoB,EACpB,QAA2B,EAC3B,OAAwB,EAAE;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAA;QAC1C,MAAM,eAAe,GAAG,SAAS,GAAG,IAAI,GAAG,EAAE,CAAA;QAE7C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;QAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;QAC1D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;YACxE,IAAI,SAAS,GAAG,eAAe;gBAAE,OAAO,MAAM,CAAA;QAChD,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,YAAY,KAAK,aAAa,EAAE,CAAA;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAE7B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;gBACxE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;gBAClD,OAAO,KAAK,CAAA;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACvC,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,YAAY,CAAC,YAAoB,EAAE,IAAqB;QAC9D,OAAO;YACL,IAAI,CAAC,WAAW;YAChB,aAAa,CAAC,YAAY,CAAC;YAC3B,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;YAC9B,IAAI,CAAC,SAAS,IAAI,EAAE;YACpB,IAAI,CAAC,cAAc,IAAI,EAAE;YACzB,IAAI,CAAC,gBAAgB,IAAI,EAAE;YAC3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC;SACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACd,CAAC;IAEO,aAAa,CAAC,QAA2B,EAAE,IAAqB;QACtE,OAAO;YACL,YAAY,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAChC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;YAClC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjC,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE;SAC/E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACd,CAAC;IAEO,gBAAgB,CAAC,MAAiB;QACxC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACpD,CAAC;IAEO,WAAW,CAAC,IAAqB;QACvC,OAAO;YACL,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YACrE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YACvC,IAAI,CAAC,mBAAmB,IAAI,EAAE;SAC/B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,YAAoB,EACpB,QAA2B,EAC3B,IAAqB,EACrB,OAAgB,EAChB,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QAE3D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,iDAAiD;YAC7D,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,cAAc,EAAE,IAAI,CAAC,aAAa;SACnC,CAAC,CAAA;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAA;YACvC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,+CAA+C,CAAC,CAAA;QACjF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC1E,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;QACnE,IAAI,IAAI,CAAC,eAAe;YAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAA;QAC5E,IAAI,IAAI,CAAC,mBAAmB;YAAE,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACzF,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC7D,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1D,IAAI,IAAI,CAAC,cAAc;YAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QAC1E,IAAI,IAAI,CAAC,gBAAgB;YAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAChF,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACnC,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QACrE,IAAI,IAAI,CAAC,0BAA0B,KAAK,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAA;QAE9F,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;QACpC,IAAI,GAAkD,CAAA;QACtD,IAAI,OAAgB,CAAA;QACpB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;YAClD,IAAI,WAAW,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;YAC9D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,WAAW,CAAC,CAAA;YACjE,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,gBAAgB,EAAE;oBACpE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;oBAChE,IAAI;oBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,GAAG,CAAA;gBACb,IAAI,OAAO,KAAK,UAAU;oBAAE,MAAM,GAAG,CAAA;YACvC,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,OAAO,CAAC,CAAA;YACvB,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,mBAAmB,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;gBAC/D,SAAQ;YACV,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;YACzB,MAAM,SAAS,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,CAAA;YACvG,IAAI,CAAC,SAAS,IAAI,OAAO,KAAK,UAAU;gBAAE,MAAK;YAC/C,MAAM,mBAAmB,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;QACnE,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,OAAO,YAAY,KAAK;gBAAE,MAAM,OAAO,CAAA;YAC3C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,GAAqB,CAAA;YACzB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,0BAA0B,CAAC,CAAA;YACpE,CAAC;YACD,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,IAAI,wBAAwB,CAChC,GAAG,CAAC,mBAAmB,CAAC,IAAI,kBAAkB,EAC9C,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EACzB,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EACzB,GAAG,CAAC,YAAY,CAAC,CAClB,CAAA;YACH,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;YAC3F,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;QAClD,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAA;QACrD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAA;IACtC,CAAC;CACF;AAED,SAAS,uBAAuB,CAAC,IAAwB;IACvD,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAA;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,QAAQ,GAA0B;QACtC,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACxC,CAAA;IACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC5G,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;QAClF,CAAC;QACD,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAA;IAClD,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACxF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,SAAS,GAAoD,EAAE,CAAA;IACrE,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,IAAI,GAAG,SAAoC,CAAA;QACjD,SAAS,CAAC,QAAQ,CAAC,GAAG;YACpB,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC;YAC9C,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC;YAC/D,YAAY,EAAE,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC;YAC3E,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,uBAAuB,CAAC;YACrE,cAAc,EAAE,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,4BAA4B,CAAC;YACnF,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,uBAAuB,CAAC;YACrE,iBAAiB,EAAE,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;YACjG,aAAa,EAAE,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,0BAA0B,CAAC;YAC9E,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,uBAAuB,CAAC;YACrE,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC;YAC5D,sBAAsB,EAAE,eAAe,CAAC,IAAI,CAAC,wBAAwB,EAAE,oCAAoC,CAAC;YAC5G,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC;SACpE,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,mBAAmB,CAAC,CAAA;IAChG,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,yBAAyB,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,oBAAoB,CAAC,CAAA;IAClG,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,qBAAqB,CAAC,CAAA;IAC9H,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,YAAY,CAAC,GAAa,EAAE,OAAe;IAClD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;QAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAA;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;IAChD,OAAO,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,UAAkB;IACnE,MAAM,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;IAClD,IAAI,WAAW,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAC9D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAA;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAa;IACnC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAClE,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5D,OAAO,SAAS,KAAK,kBAAkB,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,OAAO,UAAU,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,YAAY,CAAC,QAA2B;IAC/C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AACrG,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,+DAA+D;AAE/D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAmB,MAAM,YAAY,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAqBjF,MAAM,gBAAgB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;AAExC,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAC1B,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC7G,OAAO,MAA0B,CAAA;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,GAAqB;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,IAAI,aAAa,MAAM,EAAE,CAAA;IAC3D,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,gBAAgB,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACvE,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,GAAa;IAC/C,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,qBAAqB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAA;IAC/C,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,OAAO,WAAW;IAQH;IACA;IACA;IAEA;IAXF,KAAK,CAAY;IACjB,QAAQ,GAAG,IAAI,GAAG,EAA0C,CAAA;IAC5D,WAAW,CAAQ;IACpC,mIAAmI;IACnI,OAAO,CAA8B;IAErC,YACmB,MAAc,EACd,MAAc,EACd,aAAqB,EACtC,KAAkB,EACD,SAAwB;QAJxB,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,kBAAa,GAAb,aAAa,CAAQ;QAErB,cAAS,GAAT,SAAS,CAAe;QAEzC,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,IAAI,kBAAkB,EAAE,CAAA;QAC9C,IAAI,CAAC,WAAW,GAAG,GAAG,MAAM,KAAK,aAAa,EAAE,CAAA;IAClD,CAAC;IAEO,IAAI,CAAC,KAAiB;QAC5B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAM;QACzB,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB,EAAE,QAA2B,EAAE,OAAwB,EAAE;QAC1F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAA;QAC1C,MAAM,eAAe,GAAG,SAAS,GAAG,IAAI,GAAG,EAAE,CAAA;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAEjE,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACrD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;QAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACxD,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;YAC1D,IAAI,MAAM,EAAE,CAAC;gBACX,qEAAqE;gBACrE,sEAAsE;gBACtE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;gBAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;gBACxE,IAAI,SAAS,GAAG,MAAM,EAAE,CAAC;oBACvB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAA;oBAC/F,OAAO,MAAM,CAAA;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,YAAY,KAAK,aAAa,EAAE,CAAA;QACvD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;YAC/B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACjE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;gBACxH,OAAO,KAAK,CAAA;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,gBAAgB;oBACtB,SAAS;oBACT,MAAM;oBACN,MAAM,EAAE,KAAK;oBACb,EAAE,EAAE,KAAK;oBACT,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;oBACrC,GAAG,CAAC,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnF,CAAC,CAAA;gBACF,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/C,IAAI,QAAQ;YAAE,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAEzD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QAC/B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;gBAClD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;gBACxH,OAAO,KAAK,CAAA;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,gBAAgB;oBACtB,SAAS;oBACT,MAAM;oBACN,MAAM,EAAE,KAAK;oBACb,EAAE,EAAE,KAAK;oBACT,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;oBACrC,GAAG,CAAC,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnF,CAAC,CAAA;gBACF,MAAM,GAAG,CAAA;YACX,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACvC,OAAO,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5C,CAAC;IAEO,YAAY,CAAC,YAAoB,EAAE,IAAqB;QAC9D,OAAO;YACL,IAAI,CAAC,WAAW;YAChB,aAAa,CAAC,YAAY,CAAC;YAC3B,IAAI,CAAC,iBAAiB,IAAI,EAAE;YAC5B,IAAI,CAAC,SAAS,IAAI,EAAE;YACpB,IAAI,CAAC,YAAY,IAAI,EAAE;YACvB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;SACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACd,CAAC;IAEO,aAAa,CAAC,QAA2B,EAAE,IAAqB;QACtE,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7H,CAAC;IAEO,gBAAgB,CAAC,MAAiB;QACxC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACpD,CAAC;IAEO,WAAW,CAAC,IAAqB;QACvC,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9E,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,YAAoB,EACpB,QAA2B,EAC3B,IAAqB,EACrB,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QAE3D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,iDAAiD;YAC7D,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,cAAc,EAAE,IAAI,CAAC,aAAa;SACnC,CAAC,CAAA;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAA;YACvC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,+CAA+C,CAAC,CAAA;QACjF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC1E,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;QACnE,IAAI,IAAI,CAAC,iBAAiB;YAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC1E,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAChE,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACnC,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QACrE,IAAI,IAAI,CAAC,WAAW;YAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;QAEhE,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxD,MAAM,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QAClD,IAAI,WAAW,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC9D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,WAAW,CAAC,CAAA;QACjE,IAAI,GAAsC,CAAA;QAC1C,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,gBAAgB,EAAE;gBACpE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;aAC5F,CAAC,CAAA;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,GAAqB,CAAA;YACzB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,0BAA0B,CAAC,CAAA;YACpE,CAAC;YACD,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE;oBAC1G,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;oBACnC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;oBACnB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;oBACjB,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC;oBACvB,SAAS,EAAE,GAAG,CAAC,sBAAsB,CAAC;oBACtC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC;oBAC3B,UAAU,EAAE,GAAG,CAAC,MAAM;iBACvB,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;gBAC5E,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,UAAU,EAAE,GAAG,CAAC,MAAM;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAA;QACrD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAA;IACtC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,OAAqD,EAAE;QAC/F,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QAC/B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YACpG,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;YACxG,OAAO,KAAK,CAAA;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;YAC7G,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,OAAiG,EAAE;QAEnG,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACrF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,iDAAiD;YAC7D,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,cAAc,EAAE,IAAI,CAAC,aAAa;YAClC,aAAa,EAAE,OAAO;YACtB,kBAAkB,EAAE,2CAA2C;SAChE,CAAC,CAAA;QACF,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;QACnE,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QACrE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,CAAA;QAC9E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,gBAAgB,EAAE;gBAC1E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;aAC5F,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,GAAqB,CAAA;gBACzB,IAAI,CAAC;oBACH,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAA;gBACvC,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,0BAA0B,CAAC,CAAA;gBACpE,CAAC;gBACD,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,mBAAmB,EAAE,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YACvH,CAAC;YACD,OAAO,uBAAuB,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC,CAAA;QAC1E,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,KAQpB;QACC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;QAClF,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,CAAA;QAC/E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,YAAY,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE;gBACrH,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,EAAE;gBAC9F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7H,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;aAC9F,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,GAAqB,CAAA;gBACzB,IAAI,CAAC;oBACH,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAA;gBACvC,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;gBAC5D,CAAC;gBACD,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,iBAAiB,EAAE,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YACrH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,aAAa,CAAI,OAAmB,EAAE,MAAoB;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAA;IAC3B,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7C,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;QAC/C,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,UAAkB,EAClB,OAA+E,EAAE;IAEjF,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAA;IAChE,SAAS,CAAC;QACR,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxD,MAAM,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QAChD,IAAI,WAAW,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACtE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;QAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,MAAM,YAAY,kBAAkB,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3H,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACpE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAA;QACtD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClG,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAsB,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,uDAAuD,KAAK,EAAE,CAAC,CAAA;IACjF,CAAC;IACD,OAAO,KAAsB,CAAA;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,OAAO,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAA;AAC9E,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAwB;IACvD,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAA;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,QAAQ,GAA0B;QACtC,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACxC,CAAA;IACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC5G,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;QAClF,CAAC;QACD,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAA;IAClD,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,GAAa;IACnC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAClE,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5D,OAAO,SAAS,KAAK,kBAAkB,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,OAAO,UAAU,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,YAAY,CAAC,QAA2B;IAC/C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAC5H,CAAC"}

package/dist/types.d.ts

@@ -1,32 +1,15 @@
 import { CaracalError } from '@caracalai/core';
+export { CaracalError };
 export interface TokenExchangeRequest {
     subjectToken: string;
     resource: string | string[];
     clientId: string;
     clientSecret?: string;
-    clientAssertion?: string;
-    clientAssertionType?: string;
-    actorToken?: string;
+    authorityRecordId?: string;
     sessionId?: string;
-    agentSessionId?: string;
-    delegationEdgeId?: string;
+    delegationId?: string;
     scopes?: string[];
     ttlSeconds?: number;
-    runtimeCredentialInjection?: boolean;
-}
-export interface UpstreamDirective {
-    url?: string;
-    authMode?: string;
-    authLocation?: string;
-    authHeader?: string;
-    queryParamName?: string;
-    authScheme?: string;
-    allowedTokenHosts?: string[];
-    providerToken?: string;
-    providerId?: string;
-    grantId?: string;
-    forwardCaracalIdentity?: boolean;
-    expiresAt?: number;
 }
 export interface TokenExchangeResponse {
     accessToken: string;
@@ -34,26 +17,73 @@ export interface TokenExchangeResponse {
     expiresIn: number;
     issuedAt: number;
     targetResources?: string[];
-    upstreams?: Record<string, UpstreamDirective>;
 }
 export interface ExchangeOptions {
     clientSecret?: string;
-    clientAssertion?: string;
-    clientAssertionType?: string;
-    actorToken?: string;
+    authorityRecordId?: string;
     sessionId?: string;
-    agentSessionId?: string;
-    delegationEdgeId?: string;
+    delegationId?: string;
     scopes?: string[];
     timeoutMs?: number;
-    retries?: number;
     ttlSeconds?: number;
-    runtimeCredentialInjection?: boolean;
+    challengeId?: string;
+    /** Skip the cached token and mint a fresh one; the result still refills the cache. */
+    forceRefresh?: boolean;
+    /** Mint without reading, writing, or joining the token cache. */
+    cache?: boolean;
+    /** Aborts the exchange request. */
+    signal?: AbortSignal;
+}
+/**
+ * Lifecycle state of an approval challenge. 'approved' means a retry of the
+ * held mint with the challenge id will succeed; 'rejected' and 'expired' are
+ * terminal; 'consumed' means another request already spent the approval;
+ * 'pending' means no decision arrived within the wait and polling again is safe.
+ */
+export type ApprovalState = 'pending' | 'approved' | 'rejected' | 'expired' | 'consumed';
+export declare const APPROVAL_STATES: readonly ApprovalState[];
+export interface ApprovalRequiredDetails {
+    resource?: string;
+    state?: string;
+    tier?: string;
+    binding?: string;
+    expiresAt?: string;
+    requestId?: string;
+    httpStatus?: number;
 }
-export declare class InteractionRequiredError extends CaracalError {
-    readonly challengeId: string;
+export declare class ApprovalRequiredError extends CaracalError {
+    readonly approvalId: string;
     readonly resource?: string;
-    readonly acrValues?: string;
-    constructor(message: string, challengeId: string, resource?: string, acrValues?: string);
+    readonly state?: string;
+    readonly tier?: string;
+    readonly binding?: string;
+    readonly expiresAt?: string;
+    constructor(message: string, approvalId: string, details?: ApprovalRequiredDetails);
+}
+/**
+ * Reports whether the error is an approval hold. Prefer this over instanceof:
+ * it also recognizes holds surfaced across duplicated module instances by
+ * checking the error's machine-readable shape.
+ */
+export declare function isApprovalRequired(err: unknown): err is ApprovalRequiredError;
+/** One completed token exchange: cache hits and network mints both count, single-flight joiners do not. */
+export interface TokenExchangeEvent {
+    type: 'token.exchange';
+    resources: string[];
+    scopes: string[];
+    cached: boolean;
+    ok: boolean;
+    durationMs: number;
+    status?: number;
+    code?: string;
+}
+/** One completed approval wait and the final challenge state it observed. */
+export interface ApprovalWaitEvent {
+    type: 'approval.wait';
+    approvalId: string;
+    state: string;
+    ok: boolean;
+    durationMs: number;
 }
+export type OAuthEvent = TokenExchangeEvent | ApprovalWaitEvent;
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,0BAA0B,CAAC,EAAE,OAAO,CAAA;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,0BAA0B,CAAC,EAAE,OAAO,CAAA;CACrC;AAED,qBAAa,wBAAyB,SAAQ,YAAY;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;gBAGzB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM;CAUrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,OAAO,EAAE,YAAY,EAAE,CAAA;AAEvB,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sFAAsF;IACtF,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,iEAAiE;IACjE,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,mCAAmC;IACnC,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,CAAA;AAExF,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EAA+D,CAAA;AAEnH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,qBAAsB,SAAQ,YAAY;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;gBAEf,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA4B;CAevF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,qBAAqB,CAK7E;AAED,2GAA2G;AAC3G,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,gBAAgB,CAAA;IACtB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,EAAE,EAAE,OAAO,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,eAAe,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,OAAO,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,UAAU,GAAG,kBAAkB,GAAG,iBAAiB,CAAA"}

package/dist/types.js

@@ -3,18 +3,42 @@
 //
 // RFC 8693 token exchange types for the @caracalai/oauth client.
 import { CaracalError } from '@caracalai/core';
-export class InteractionRequiredError extends CaracalError {
-    challengeId;
+export { CaracalError };
+export const APPROVAL_STATES = ['pending', 'approved', 'rejected', 'expired', 'consumed'];
+export class ApprovalRequiredError extends CaracalError {
+    approvalId;
     resource;
-    acrValues;
-    constructor(message, challengeId, resource, acrValues) {
+    state;
+    tier;
+    binding;
+    expiresAt;
+    constructor(message, approvalId, details = {}) {
+        const { requestId, httpStatus, ...rest } = details;
         super('interaction_required', message, {
-            details: { challengeId, ...(resource ? { resource } : {}), ...(acrValues ? { acrValues } : {}) },
+            details: { approvalId, ...rest },
+            requestId,
+            httpStatus,
         });
-        this.name = 'InteractionRequiredError';
-        this.challengeId = challengeId;
-        this.resource = resource;
-        this.acrValues = acrValues;
+        this.name = 'ApprovalRequiredError';
+        this.approvalId = approvalId;
+        this.resource = details.resource;
+        this.state = details.state;
+        this.tier = details.tier;
+        this.binding = details.binding;
+        this.expiresAt = details.expiresAt;
     }
 }
+/**
+ * Reports whether the error is an approval hold. Prefer this over instanceof:
+ * it also recognizes holds surfaced across duplicated module instances by
+ * checking the error's machine-readable shape.
+ */
+export function isApprovalRequired(err) {
+    if (err instanceof ApprovalRequiredError)
+        return true;
+    if (!(err instanceof Error))
+        return false;
+    const shaped = err;
+    return shaped.code === 'interaction_required' && typeof shaped.approvalId === 'string';
+}
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,iEAAiE;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAyD9C,MAAM,OAAO,wBAAyB,SAAQ,YAAY;IAC/C,WAAW,CAAQ;IACnB,QAAQ,CAAS;IACjB,SAAS,CAAS;IAE3B,YACE,OAAe,EACf,WAAmB,EACnB,QAAiB,EACjB,SAAkB;QAElB,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE;YACrC,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACjG,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;QACtC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;QAC9B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,iEAAiE;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,OAAO,EAAE,YAAY,EAAE,CAAA;AA+CvB,MAAM,CAAC,MAAM,eAAe,GAA6B,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AAYnH,MAAM,OAAO,qBAAsB,SAAQ,YAAY;IAC5C,UAAU,CAAQ;IAClB,QAAQ,CAAS;IACjB,KAAK,CAAS;IACd,IAAI,CAAS;IACb,OAAO,CAAS;IAChB,SAAS,CAAS;IAE3B,YAAY,OAAe,EAAE,UAAkB,EAAE,UAAmC,EAAE;QACpF,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;QAClD,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE;YACrC,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE;YAChC,SAAS;YACT,UAAU;SACX,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;QACnC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QAChC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;QAC9B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACpC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,GAAG,YAAY,qBAAqB;QAAE,OAAO,IAAI,CAAA;IACrD,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACzC,MAAM,MAAM,GAAG,GAA+C,CAAA;IAC9D,OAAO,MAAM,CAAC,IAAI,KAAK,sBAAsB,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAA;AACxF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caracalai/oauth",
-  "version": "0.1.6-rc.2",
+  "version": "0.2.0-rc.1",
   "description": "Caracal RFC 8693 OAuth 2.0 token exchange client.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/Garudex-Labs/caracal",
@@ -39,11 +39,11 @@
     "prepublishOnly": "tsc"
   },
   "dependencies": {
-    "@caracalai/core": "0.1.6-rc.2"
+    "@caracalai/core": "0.2.0-rc.1"
   },
   "devDependencies": {
-    "@types/node": "^26.0.0",
+    "@types/node": "^26.1.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.10"
   }
 }