@cboxdk/id-js 0.20.0 → 0.21.0

package/dist/agent.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/issuer.ts","../src/agent/errors.ts","../src/agent/http.ts","../src/pkce.ts","../src/agent/client-auth.ts","../src/agent/register.ts","../src/agent/grants.ts","../src/agent/binding.ts"],"names":["generateKeyPair","exportJWK","calculateJwkThumbprint","SignJWT","alg","importJWK"],"mappings":";;;;;AAIO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAC;AAmB9C,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA,EACnD,WAAA,CACE,OAAA,EAES,KAAA,EAEA,gBAAA,EAEA,QAUA,UAAA,EACT;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAhBJ,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAEA,IAAA,IAAA,CAAA,gBAAA,GAAA,gBAAA;AAEA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAUA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EAGX;AAAA,EAjBW,KAAA;AAAA,EAEA,gBAAA;AAAA,EAEA,MAAA;AAAA,EAUA,UAAA;AAAA;AAAA,EAMX,IAAI,aAAA,GAAyB;AAC3B,IAAA,OAAO,KAAK,MAAA,KAAW,GAAA;AAAA,EACzB;AACF;;;AC7CO,SAAS,mBAAmB,MAAA,EAAsB;AACvD,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,MAAM,CAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,mBAAmB,6CAA6C,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,QAAA,KAAa,WAAA,IAAe,GAAA,CAAI,QAAA,KAAa,WAAA,IAAe,GAAA,CAAI,QAAA,KAAa,OAAA,IAAW,GAAA,CAAI,QAAA,KAAa,KAAA;AAE9H,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,OAAA,IAAW,QAAA,EAAU;AACxC,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,IAAI,kBAAA;AAAA,IACR,CAAA,6CAAA,EAAgD,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK,IAAI,QAAQ,CAAA,EAAA;AAAA,GAC/E;AACF;;;ACtBO,IAAM,eAAA,GAAN,cAA8B,mBAAA,CAAoB;AAAC;AAGnD,IAAM,iBAAA,GAAN,cAAgC,eAAA,CAAgB;AAAC;AAMjD,IAAM,iBAAA,GAAN,cAAgC,eAAA,CAAgB;AAAC;AAGjD,IAAM,iBAAA,GAAN,cAAgC,eAAA,CAAgB;AAAC;AAQjD,IAAM,kBAAA,GAAN,cAAiC,eAAA,CAAgB;AAAC;AAMlD,IAAM,kBAAA,GAAN,cAAiC,eAAA,CAAgB;AAAC;AAGlD,IAAM,kBAAA,GAAN,cAAiC,eAAA,CAAgB;AAAC;AAMlD,IAAM,0BAAA,GAAN,cAAyC,eAAA,CAAgB;AAAC;AAO1D,IAAM,aAAA,GAAN,cAA4B,eAAA,CAAgB;AAAC;AAG7C,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAC;AAEtD,IAAM,OAAA,GAAkD;AAAA,EACtD,aAAA,EAAe,iBAAA;AAAA,EACf,aAAA,EAAe,iBAAA;AAAA,EACf,aAAA,EAAe,iBAAA;AAAA,EACf,cAAA,EAAgB,kBAAA;AAAA,EAChB,cAAA,EAAgB,kBAAA;AAAA,EAChB,eAAA,EAAiB,kBAAA;AAAA,EACjB,uBAAA,EAAyB,0BAAA;AAAA,EACzB,SAAA,EAAW;AACb,CAAA;AAeA,eAAsB,iBAAiB,QAAA,EAA2C;AAChF,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AACjD,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,gBAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAEvC,IAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,MAAA,MAAM,MAAA,GAAS,MAAA;AACf,MAAA,KAAA,GAAQ,OAAO,MAAA,CAAO,OAAO,MAAM,QAAA,GAAW,MAAA,CAAO,OAAO,CAAA,GAAI,KAAA,CAAA;AAChE,MAAA,gBAAA,GAAmB,OAAO,MAAA,CAAO,mBAAmB,MAAM,QAAA,GAAW,MAAA,CAAO,mBAAmB,CAAA,GAAI,KAAA,CAAA;AAAA,IACrG;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAIA,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,KAAA,KAAU,MAAA,EAAW;AAClD,IAAA,KAAA,GAAQ,WAAA;AAAA,EACV;AAIA,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,EAAA,MAAM,UAAA,GAAa,MAAA,KAAW,IAAA,IAAQ,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,IAAA,EAAM,CAAA,GAAI,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,CAAA,GAAI,MAAA;AAE5F,EAAA,OAAO,EAAE,KAAA,EAAO,gBAAA,EAAkB,MAAA,EAAQ,QAAA,CAAS,QAAQ,UAAA,EAAW;AACxE;AAGO,SAAS,UAAA,CAAW,SAAuB,QAAA,EAAmC;AACnF,EAAA,MAAM,KAAA,GAAA,CAAS,QAAQ,KAAA,KAAU,MAAA,GAAY,QAAQ,OAAA,CAAQ,KAAK,IAAI,MAAA,KAAc,eAAA;AACpF,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,KAAA,IAAS,CAAA,KAAA,EAAQ,QAAQ,MAAM,CAAA,CAAA;AAEtD,EAAA,OAAO,IAAI,KAAA,CAAM,CAAA,EAAG,QAAQ,KAAK,MAAM,CAAA,CAAA,EAAI,OAAA,CAAQ,KAAA,EAAO,OAAA,CAAQ,gBAAA,EAAkB,OAAA,CAAQ,MAAA,EAAQ,QAAQ,UAAU,CAAA;AACxH;;;ACvEA,eAAsB,2BAAA,CACpB,MAAA,EACA,OAAA,GAA+B,EAAC,EACM;AACtC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,mBAAmB,0BAA0B,CAAA;AAAA,EACzD;AACA,EAAA,kBAAA,CAAmB,MAAM,CAAA;AAEzB,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,SAAA,CAAU,MAAM,CAAC,CAAA,uCAAA,CAAA;AAChC,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,EAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB,IAAK,OAAO,CAAA;AAEpG,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,oBAAoB,CAAA,qCAAA,EAAwC,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,EAAK,MAAA,EAAW,MAAA,EAAW,QAAA,CAAS,MAAM,CAAA;AAAA,EACjI;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,SAAS,IAAA,EAAK;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,oBAAoB,iDAAiD,CAAA;AAAA,EACjF;AAEA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,EAAM;AAC3C,IAAA,MAAM,IAAI,oBAAoB,sDAAsD,CAAA;AAAA,EACtF;AAEA,EAAA,MAAM,QAAA,GAAW,GAAA;AAEjB,EAAA,IAAI,OAAO,QAAA,CAAS,MAAA,KAAW,QAAA,IAAY,SAAA,CAAU,SAAS,MAAM,CAAA,KAAM,SAAA,CAAU,MAAM,CAAA,EAAG;AAC3F,IAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,6DAAA,EAAgE,OAAO,QAAA,CAAS,MAAM,CAAC,CAAA,EAAA,CAAI,CAAA;AAAA,EAC3H;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,cAAA,KAAmB,QAAA,IAAY,QAAA,CAAS,mBAAmB,EAAA,EAAI;AACjF,IAAA,MAAM,IAAI,oBAAoB,0DAA0D,CAAA;AAAA,EAC1F;AAEA,EAAA,OAAO,QAAA;AACT;AAGO,SAAS,gBAAgB,OAAA,EAAmE;AACjG,EAAA,OAAO,OAAA,CAAQ,QAAA,KAAa,MAAA,GACxB,OAAA,CAAQ,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAA,GAChC,2BAAA,CAA4B,OAAA,CAAQ,MAAA,EAAQ,OAAO,CAAA;AACzD;AAGO,SAAS,eAAA,CACd,QAAA,EACA,IAAA,EACA,IAAA,EACQ;AACR,EAAA,MAAM,KAAA,GAAQ,SAAS,IAAI,CAAA;AAC3B,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA,EAAI;AAC7C,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,2CAAA,EAA8C,IAAI,CAAA,yBAAA,EAA4B,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,EACpH;AACA,EAAA,OAAO,KAAA;AACT;AAMA,eAAsB,IAAA,CAAK,GAAA,EAAa,IAAA,EAAmB,OAAA,EAAiD;AAC1G,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC9C,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,OAAA,CAAQ,aAAa,GAAM,CAAA;AAC9E,EAAA,MAAM,OAAA,GAAU,MAAY,UAAA,CAAW,KAAA,EAAM;AAE7C,EAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,KAAY,IAAA,EAAM;AACpC,IAAA,YAAA,CAAa,KAAK,CAAA;AAClB,IAAA,MAAM,IAAI,oBAAoB,4BAA4B,CAAA;AAAA,EAC5D;AACA,EAAA,OAAA,CAAQ,QAAQ,gBAAA,CAAiB,OAAA,EAAS,SAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAEjE,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,UAAU,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,EACpE,SAAS,KAAA,EAAO;AAGd,IAAA,IAAK,OAAA,CAAQ,MAAA,EAAoC,OAAA,KAAY,IAAA,EAAM;AACjE,MAAA,MAAM,IAAI,oBAAoB,4BAA4B,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI,UAAA,CAAW,OAAO,OAAA,EAAS;AAC7B,MAAA,MAAM,IAAI,oBAAoB,CAAA,eAAA,EAAkB,IAAI,IAAI,GAAG,CAAA,CAAE,MAAM,CAAA,WAAA,CAAa,CAAA;AAAA,IAClF;AACA,IAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,eAAA,EAAkB,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAM,CAAA,SAAA,EAAY,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAChG,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAClB,IAAA,OAAA,CAAQ,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AAAA,EACtD;AACF;AAEO,SAAS,UAAU,KAAA,EAAuB;AAC/C,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACjC;;;AC5IA,SAAS,UAAU,KAAA,EAA2B;AAC5C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;AAGO,SAAS,WAAA,CAAY,QAAQ,EAAA,EAAY;AAC9C,EAAA,OAAO,UAAU,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,KAAK,CAAC,CAAC,CAAA;AAChE;;;ACwCA,eAAsB,qBAAA,CAAsB,MAA0B,OAAA,EAAiC;AACrG,EAAA,MAAM,EAAE,SAAA,EAAW,UAAA,EAAW,GAAI,MAAMA,qBAAgB,GAAA,EAAK,EAAE,WAAA,EAAa,IAAA,EAAM,CAAA;AAClF,EAAA,MAAM,UAAA,GAAa,MAAMC,cAAA,CAAU,SAAS,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,MAAMC,2BAAA,CAAuB,UAAA,EAAY,QAAQ,CAAA;AAE7D,EAAA,MAAM,YAAiB,EAAE,GAAG,YAAY,GAAA,EAAK,GAAA,EAAK,KAAK,KAAA,EAAM;AAC7D,EAAA,MAAM,UAAA,GAAkB,EAAE,GAAI,MAAMD,cAAA,CAAU,UAAU,CAAA,EAAI,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,KAAA,EAAM;AAEjF,EAAA,OAAO,EAAE,GAAA,EAAK,GAAA,EAAK,SAAA,EAAW,YAAY,UAAA,EAAW;AACvD;AAOA,eAAsB,qBAAA,CACpB,IAAA,EACA,QAAA,EACA,OAAA,GAA4D,EAAC,EAC5C;AACjB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,QAAQ,eAAA,IAAmB,EAAA,EAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AACxE,EAAA,MAAM,UAAA,GAAa,KAAK,KAAA,CAAA,CAAO,OAAA,CAAQ,OAAO,IAAA,CAAK,GAAA,MAAS,GAAI,CAAA;AAChE,EAAA,MAAM,EAAE,GAAA,EAAK,GAAA,EAAK,KAAI,GAAI,MAAM,WAAW,IAAI,CAAA;AAE/C,EAAA,MAAM,MAAA,GAAwC,EAAE,GAAA,EAAI;AACpD,EAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,IAAA,MAAA,CAAO,GAAA,GAAM,GAAA;AAAA,EACf;AAEA,EAAA,OAAO,IAAIE,YAAA,CAAQ,EAAE,EAClB,kBAAA,CAAmB,MAAM,CAAA,CACzB,SAAA,CAAU,IAAA,CAAK,QAAQ,CAAA,CACvB,UAAA,CAAW,KAAK,QAAQ,CAAA,CACxB,WAAA,CAAY,QAAQ,CAAA,CACpB,MAAA,CAAO,WAAA,CAAY,EAAE,CAAC,CAAA,CACtB,WAAA,CAAY,UAAU,CAAA,CACtB,iBAAA,CAAkB,UAAA,GAAa,QAAQ,CAAA,CACvC,KAAK,GAAG,CAAA;AACb;AAOA,eAAsB,eAAA,CACpB,IAAA,EACA,IAAA,EACA,OAAA,EACA,QAAA,EACe;AACf,EAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,IAAA,MAAM,IAAI,mBAAmB,2BAA2B,CAAA;AAAA,EAC1D;AAEA,EAAA,QAAQ,KAAK,MAAA;AAAQ,IACnB,KAAK,iBAAA;AACH,MAAA,IAAA,CAAK,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,QAAQ,CAAA;AACnC,MAAA,IAAA,CAAK,GAAA,CAAI,yBAAyB,wDAAwD,CAAA;AAC1F,MAAA,IAAA,CAAK,IAAI,kBAAA,EAAoB,MAAM,qBAAA,CAAsB,IAAA,EAAM,QAAQ,CAAC,CAAA;AACxE,MAAA;AAAA,IACF,KAAK,qBAAA;AACH,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,QAAA,MAAM,IAAI,mBAAmB,+CAA+C,CAAA;AAAA,MAC9E;AAEA,MAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,MAAA,EAAS,IAAA,CAAK,GAAG,UAAA,CAAW,IAAA,CAAK,QAAQ,CAAC,IAAI,UAAA,CAAW,IAAA,CAAK,YAAY,CAAC,EAAE,CAAC,CAAA,CAAA;AACzG,MAAA;AAAA,IACF,KAAK,oBAAA;AACH,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,QAAA,MAAM,IAAI,mBAAmB,8CAA8C,CAAA;AAAA,MAC7E;AACA,MAAA,IAAA,CAAK,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,QAAQ,CAAA;AACnC,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,YAAY,CAAA;AAC3C,MAAA;AAAA,IACF,KAAK,MAAA;AACH,MAAA,IAAA,CAAK,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,QAAQ,CAAA;AACnC,MAAA;AAAA;AAEN;AAEA,eAAe,WACb,IAAA,EAC4F;AAC5F,EAAA,MAAM,SAAS,IAAA,CAAK,UAAA;AAEpB,EAAA,IAAI,WAAA,CAAY,MAAM,CAAA,EAAG;AACvB,IAAA,MAAMC,IAAAA,GAAM,IAAA,CAAK,GAAA,IAAO,gBAAA,CAAiB,MAAM,CAAA;AAC/C,IAAA,OAAO,EAAE,GAAA,EAAK,MAAA,EAAQ,KAAAA,IAAAA,EAAK,GAAA,EAAK,KAAK,GAAA,EAAI;AAAA,EAC3C;AAEA,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,KAAW,QAAQ,OAAO,MAAA,CAAO,MAAM,QAAA,EAAU;AACjF,IAAA,MAAM,IAAI,mBAAmB,+DAA+D,CAAA;AAAA,EAC9F;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,UAAA,CAAW,MAAM,CAAA;AACzC,EAAA,MAAM,GAAA,GAAM,MAAMC,cAAA,CAAU,MAAA,EAAQ,GAAG,CAAA;AAEvC,EAAA,OAAO,EAAE,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,IAAA,CAAK,GAAA,KAAQ,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,GAAA,GAAM,MAAA,CAAA,EAAW;AAChG;AAEA,SAAS,YAAY,KAAA,EAAoC;AACvD,EAAA,OAAO,OAAO,SAAA,KAAc,WAAA,IAAe,KAAA,YAAiB,SAAA;AAC9D;AAEA,SAAS,iBAAiB,GAAA,EAAoC;AAC5D,EAAA,IAAI,GAAA,CAAI,SAAA,CAAU,IAAA,KAAS,OAAA,EAAS;AAClC,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,IAAI,GAAA,CAAI,SAAA,CAAU,IAAA,KAAS,mBAAA,EAAqB;AAC9C,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,iCAAA,EAAoC,GAAA,CAAI,SAAA,CAAU,IAAI,CAAA,qBAAA,CAAuB,CAAA;AAC5G;AAEA,SAAS,WAAW,GAAA,EAA8B;AAChD,EAAA,IAAI,GAAA,CAAI,GAAA,KAAQ,OAAA,IAAW,GAAA,CAAI,QAAQ,OAAA,EAAS;AAC9C,IAAA,OAAO,GAAA,CAAI,GAAA;AAAA,EACb;AACA,EAAA,IAAI,GAAA,CAAI,QAAQ,MAAA,IAAa,GAAA,CAAI,QAAQ,IAAA,IAAQ,GAAA,CAAI,QAAQ,OAAA,EAAS;AACpE,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,IAAI,GAAA,CAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,CAAI,QAAQ,KAAA,EAAO;AAC9C,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,mBAAmB,uDAAuD,CAAA;AACtF;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,OAAO,kBAAA,CAAmB,KAAK,CAAA,CAAE,OAAA,CAAQ,QAAQ,GAAG,CAAA;AACtD;;;ACrLO,IAAM,eAAA,GAAkB;AAExB,IAAM,sBAAA,GAAyB;AAqDtC,eAAsB,oBAAoB,OAAA,EAAqE;AAC7G,EAAA,IAAI,CAAC,QAAQ,UAAA,EAAY;AACvB,IAAA,MAAM,IAAI,mBAAmB,2BAA2B,CAAA;AAAA,EAC1D;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG;AACnC,IAAA,MAAM,IAAI,mBAAmB,4CAA4C,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,OAAO,CAAA;AAC9C,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,QAAA,EAAU,uBAAA,EAAyB,6BAA6B,CAAA;AACjG,EAAA,MAAM,MAAA,GAAS,QAAQ,uBAAA,IAA2B,iBAAA;AAElD,EAAA,MAAM,OAAA,GAAU,MAAA,KAAW,iBAAA,GACvB,OAAA,CAAQ,OAAA,IAAY,MAAM,qBAAA,CAAsB,OAAA,CAAQ,GAAA,IAAO,OAAO,CAAA,GACtE,IAAA;AAEJ,EAAA,MAAM,QAAA,GAAoC;AAAA,IACxC,GAAG,OAAA,CAAQ,aAAA;AAAA,IACX,aAAa,OAAA,CAAQ,UAAA;AAAA,IACrB,aAAa,OAAA,CAAQ,UAAA;AAAA,IACrB,0BAAA,EAA4B,MAAA;AAAA;AAAA;AAAA,IAG5B,eAAe,EAAC;AAAA,IAChB,gBAAgB;AAAC,GACnB;AAEA,EAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAC/B,IAAA,QAAA,CAAS,OAAO,CAAA,GAAI,WAAA,CAAY,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,YAAY,IAAA,EAAM;AACpB,IAAA,QAAA,CAAS,MAAM,CAAA,GAAI,EAAE,MAAM,CAAC,OAAA,CAAQ,SAAS,CAAA,EAAE;AAAA,EACjD;AAEA,EAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AACzG,EAAA,IAAI,QAAQ,kBAAA,EAAoB;AAC9B,IAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,OAAA,CAAQ,kBAAkB,CAAA,CAAA;AAAA,EACjE;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,EAAU,EAAE,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA,IAAK,OAAO,CAAA;AAE1G,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,UAAA,CAAW,MAAM,gBAAA,CAAiB,QAAQ,GAAG,4BAA4B,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,MAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,EAAA,MAAM,QAAA,GAAW,MAAM,WAAW,CAAA;AAElC,EAAA,IAAI,QAAQ,IAAA,IAAQ,OAAO,QAAA,KAAa,QAAA,IAAY,aAAa,EAAA,EAAI;AACnE,IAAA,MAAM,IAAI,oBAAoB,iDAAiD,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,YAAA,GAAe,OAAO,GAAA,CAAI,eAAe,MAAM,QAAA,GAAW,GAAA,CAAI,eAAe,CAAA,GAAI,IAAA;AACvF,EAAA,MAAM,gBAAA,GAAmB,OAAO,GAAA,CAAI,4BAA4B,MAAM,QAAA,GAAW,GAAA,CAAI,4BAA4B,CAAA,GAAI,MAAA;AAErH,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,YAAY,IAAA,EAAM;AACpB,IAAA,IAAA,GAAO,EAAE,MAAA,EAAQ,iBAAA,EAAmB,QAAA,EAAU,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAY,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAK,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAI;AAAA,EACnH,CAAA,MAAA,IAAW,iBAAiB,IAAA,EAAM;AAChC,IAAA,IAAA,GAAO,EAAE,MAAA,EAAQ,qBAAA,EAAuB,QAAA,EAAU,YAAA,EAAa;AAAA,EACjE,CAAA,MAAO;AACL,IAAA,IAAA,GAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,QAAA,EAAS;AAAA,EACpC;AAEA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,YAAA;AAAA,IACA,uBAAA,EAAyB,OAAO,GAAA,CAAI,2BAA2B,MAAM,QAAA,GAAW,GAAA,CAAI,2BAA2B,CAAA,GAAI,IAAA;AAAA,IACnH,qBAAA,EAAuB,OAAO,GAAA,CAAI,yBAAyB,MAAM,QAAA,GAAW,GAAA,CAAI,yBAAyB,CAAA,GAAI,IAAA;AAAA,IAC7G,uBAAA,EAAyB,gBAAA;AAAA,IACzB,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CAAA,GAAI,GAAA,CAAI,aAAa,CAAA,CAAE,OAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAQ,IAAI,OAAA,CAAQ,UAAA;AAAA,IAC/H,KAAA,EAAO,OAAO,GAAA,CAAI,OAAO,MAAM,QAAA,GAAW,GAAA,CAAI,OAAO,CAAA,GAAI,IAAA;AAAA,IACzD,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAEO,SAAS,YAAY,KAAA,EAAkC;AAC5D,EAAA,OAAA,CAAQ,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,CAAM,MAAM,KAAK,CAAA,GAAI,KAAA,EAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,KAAM,EAAE,CAAA,CAAE,KAAK,GAAG,CAAA;AAClG;;;AC7CA,eAAsB,iBAAiB,OAAA,EAAqE;AAC1G,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,OAAO,CAAA;AAC9C,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,QAAA,EAAU,qCAAA,EAAuC,MAAM,CAAA;AAExF,EAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,IAAA,MAAM,IAAI,mBAAmB,0BAA0B,CAAA;AAAA,EACzD;AAEA,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,OAAA,CAAQ,QAAQ,CAAA;AAC9C,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB,EAAE,UAAA,EAAY,OAAA,CAAQ,SAAA,EAAW,KAAA,EAAO,WAAA,CAAY,OAAA,CAAQ,KAAK,CAAA,EAAG,CAAA;AAErG,EAAA,IAAI,OAAA,CAAQ,mBAAmB,EAAA,EAAI;AACjC,IAAA,IAAA,CAAK,GAAA,CAAI,iBAAA,EAAmB,OAAA,CAAQ,cAAc,CAAA;AAAA,EACpD;AACA,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,IAAA,CAAK,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAC3B;AACA,EAAA,IAAI,OAAA,CAAQ,oBAAoB,MAAA,EAAW;AACzC,IAAA,IAAA,CAAK,GAAA,CAAI,kBAAA,EAAoB,MAAA,CAAO,OAAA,CAAQ,eAAe,CAAC,CAAA;AAAA,EAC9D;AACA,EAAA,IAAI,OAAA,CAAQ,KAAA,KAAU,MAAA,IAAa,OAAA,CAAQ,UAAU,EAAA,EAAI;AACvD,IAAA,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,OAAA,CAAQ,KAAK,CAAA;AAAA,EACjC;AAEA,EAAA,MAAM,UAAU,MAAM,QAAA,CAAS,UAAU,IAAA,EAAM,OAAA,EAAS,UAAU,2CAA2C,CAAA;AAC7G,EAAA,MAAM,SAAA,GAAY,QAAQ,aAAa,CAAA;AAEvC,EAAA,IAAI,OAAO,SAAA,KAAc,QAAA,IAAY,SAAA,KAAc,EAAA,EAAI;AACrD,IAAA,MAAM,IAAI,oBAAoB,iEAAiE,CAAA;AAAA,EACjG;AAEA,EAAA,MAAM,SAAA,GAAY,cAAA,CAAe,OAAA,CAAQ,YAAY,CAAC,CAAA,IAAK,GAAA;AAE3D,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,SAAA;AAAA;AAAA,IAEA,QAAA,EAAU,cAAA,CAAe,OAAA,CAAQ,UAAU,CAAC,CAAA,IAAK,CAAA;AAAA,IACjD,SAAA,EAAW,MAAM,SAAA,GAAY,GAAA;AAAA,IAC7B;AAAA,GACF;AACF;AAYA,eAAsB,gBAAgB,OAAA,EAAsD;AAC1F,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB,EAAE,UAAA,EAAY,iBAAiB,WAAA,EAAa,OAAA,CAAQ,aAAA,CAAc,SAAA,EAAW,CAAA;AAC9G,EAAA,OAAO,UAAU,IAAA,EAAM,OAAA,CAAQ,aAAA,CAAc,QAAA,EAAU,SAAS,kCAAkC,CAAA;AACpG;AAUA,eAAsB,wBACpB,OAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,OAAO,CAAA;AAC9C,EAAA,MAAM,gBAAgB,OAAA,CAAQ,aAAA;AAE9B,EAAA,OAAO,QAAA,CAAS,aAAA,EAAe,OAAA,EAAS,MAAM,eAAA,CAAgB,EAAE,GAAG,OAAA,EAAS,QAAA,EAAU,CAAA,EAAG,qBAAqB,CAAA;AAChH;AAiCA,eAAsB,yBAAyB,OAAA,EAA6E;AAC1H,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,OAAO,CAAA;AAC9C,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,QAAA,EAAU,+BAAA,EAAiC,kBAAkB,CAAA;AAC9F,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,OAAA,CAAQ,QAAQ,CAAA;AAC9C,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AAEjC,EAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAC/B,IAAA,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,WAAA,CAAY,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,IAAA,CAAK,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAC3B;AAEA,EAAA,MAAM,UAAU,MAAM,QAAA,CAAS,UAAU,IAAA,EAAM,OAAA,EAAS,UAAU,qCAAqC,CAAA;AACvG,EAAA,MAAM,UAAA,GAAa,QAAQ,aAAa,CAAA;AACxC,EAAA,MAAM,QAAA,GAAW,QAAQ,WAAW,CAAA;AACpC,EAAA,MAAM,eAAA,GAAkB,QAAQ,kBAAkB,CAAA;AAElD,EAAA,IAAI,OAAO,eAAe,QAAA,IAAY,OAAO,aAAa,QAAA,IAAY,OAAO,oBAAoB,QAAA,EAAU;AACzG,IAAA,MAAM,IAAI,oBAAoB,mDAAmD,CAAA;AAAA,EACnF;AAEA,EAAA,MAAM,SAAA,GAAY,cAAA,CAAe,OAAA,CAAQ,YAAY,CAAC,CAAA,IAAK,GAAA;AAE3D,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAA;AAAA,IACA,uBAAA,EAAyB,OAAO,OAAA,CAAQ,2BAA2B,MAAM,QAAA,GAAW,OAAA,CAAQ,2BAA2B,CAAA,GAAI,IAAA;AAAA,IAC3H,SAAA;AAAA;AAAA,IAEA,QAAA,EAAU,cAAA,CAAe,OAAA,CAAQ,UAAU,CAAC,CAAA,IAAK,CAAA;AAAA,IACjD,SAAA,EAAW,MAAM,SAAA,GAAY,GAAA;AAAA,IAC7B;AAAA,GACF;AACF;AAOA,eAAsB,wBAAwB,OAAA,EAA8D;AAC1G,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB,EAAE,UAAA,EAAY,wBAAwB,WAAA,EAAa,OAAA,CAAQ,aAAA,CAAc,UAAA,EAAY,CAAA;AACtH,EAAA,OAAO,UAAU,IAAA,EAAM,OAAA,CAAQ,aAAA,CAAc,QAAA,EAAU,SAAS,6BAA6B,CAAA;AAC/F;AAGA,eAAsB,mBACpB,OAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,OAAO,CAAA;AAE9C,EAAA,OAAO,QAAA,CAAS,OAAA,CAAQ,aAAA,EAAe,OAAA,EAAS,MAAM,uBAAA,CAAwB,EAAE,GAAG,OAAA,EAAS,QAAA,EAAU,CAAA,EAAG,aAAa,CAAA;AACxH;AAqBA,eAAsB,mBAAmB,OAAA,EAA0D;AACjG,EAAA,IAAI,CAAC,QAAQ,YAAA,EAAc;AACzB,IAAA,MAAM,IAAI,mBAAmB,6BAA6B,CAAA;AAAA,EAC5D;AAEA,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB,EAAE,YAAY,eAAA,EAAiB,aAAA,EAAe,OAAA,CAAQ,YAAA,EAAc,CAAA;AACrG,EAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAC/B,IAAA,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,WAAA,CAAY,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAC9C;AAIA,EAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,IAAA,EAAM,YAAA,CAAa,QAAQ,QAAQ,CAAA,EAAG,OAAA,EAAS,sBAAA,EAAwB,KAAK,CAAA;AAE3G,EAAA,OAAQ,MAAA,CAAuD,MAAA;AACjE;AAMA,eAAe,QAAA,CACb,aAAA,EACA,OAAA,EACA,IAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,YAAA;AAC/B,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,IAAA,CAAK,GAAA;AAChC,EAAA,IAAI,aAAa,IAAA,CAAK,GAAA,CAAI,aAAA,CAAc,QAAA,EAAU,CAAC,CAAA,GAAI,GAAA;AACvD,EAAA,IAAI,UAAA,GAAa,UAAA;AAEjB,EAAA,WAAS;AACP,IAAA,cAAA,CAAe,QAAQ,MAAM,CAAA;AAE7B,IAAA,IAAI,GAAA,EAAI,IAAK,aAAA,CAAc,SAAA,EAAW;AACpC,MAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,IAAA,EAAO,IAAI,iDAAiD,eAAe,CAAA;AAAA,IACzG;AAEA,IAAA,MAAM,KAAA,CAAM,UAAA,EAAY,OAAA,CAAQ,MAAM,CAAA;AAEtC,IAAA,cAAA,CAAe,QAAQ,MAAM,CAAA;AAE7B,IAAA,IAAI,GAAA,EAAI,IAAK,aAAA,CAAc,SAAA,EAAW;AACpC,MAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,IAAA,EAAO,IAAI,iDAAiD,eAAe,CAAA;AAAA,IACzG;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,EAAK;AAE1B,IAAA,IAAI,MAAA,CAAO,WAAW,UAAA,EAAY;AAChC,MAAA,OAAO,MAAA,CAAO,MAAA;AAAA,IAChB;AAEA,IAAA,IAAI,MAAA,CAAO,WAAW,WAAA,EAAa;AAGjC,MAAA,UAAA,IAAc,GAAA;AACd,MAAA,UAAA,GAAa,KAAK,GAAA,CAAI,UAAA,EAAA,CAAa,MAAA,CAAO,UAAA,IAAc,KAAK,GAAI,CAAA;AACjE,MAAA;AAAA,IACF;AAEA,IAAA,UAAA,GAAa,UAAA;AAAA,EACf;AACF;AAEA,eAAe,UACb,IAAA,EACA,QAAA,EACA,OAAA,EACA,QAAA,EACA,UAAU,IAAA,EACW;AACrB,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,OAAO,CAAA;AAC9C,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,QAAA,EAAU,gBAAA,EAAkB,gBAAgB,CAAA;AAI7E,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,IAAA,CAAK,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAC3B;AAEA,EAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAC1H,EAAA,MAAM,gBAAgB,OAAA,CAAQ,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,SAAS,cAAc,CAAA;AAE5E,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,EAAU,EAAE,QAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAK,EAAG,OAAO,CAAA;AAEhF,EAAA,IAAI,SAAS,EAAA,EAAI;AACf,IAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,QAAQ,MAAM,UAAA,CAAW,QAAQ,CAAA,EAAE;AAAA,EAClE;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,gBAAA,CAAiB,QAAQ,CAAA;AAE/C,EAAA,IAAI,OAAA,IAAW,OAAA,CAAQ,KAAA,KAAU,uBAAA,EAAyB;AACxD,IAAA,OAAO,EAAE,QAAQ,SAAA,EAAU;AAAA,EAC7B;AACA,EAAA,IAAI,OAAA,IAAW,OAAA,CAAQ,KAAA,KAAU,WAAA,EAAa;AAC5C,IAAA,OAAO,EAAE,MAAA,EAAQ,WAAA,EAAa,UAAA,EAAY,OAAA,CAAQ,cAAc,IAAA,EAAK;AAAA,EACvE;AAEA,EAAA,MAAM,UAAA,CAAW,SAAS,QAAQ,CAAA;AACpC;AAEA,eAAe,QAAA,CACb,QAAA,EACA,IAAA,EACA,OAAA,EACA,UACA,QAAA,EACkC;AAClC,EAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAC1H,EAAA,MAAM,gBAAgB,OAAA,CAAQ,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,SAAS,cAAc,CAAA;AAE5E,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,EAAU,EAAE,QAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAK,EAAG,OAAO,CAAA;AAEhF,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,UAAA,CAAW,MAAM,gBAAA,CAAiB,QAAQ,GAAG,QAAQ,CAAA;AAAA,EAC7D;AAEA,EAAA,MAAM,UAAmB,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC/D,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,KAAY,IAAA,EAAM;AACnD,IAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,EAAG,QAAQ,CAAA,qCAAA,CAAuC,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,WAAW,QAAA,EAA0C;AAClE,EAAA,MAAM,MAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,EAAA,MAAM,WAAA,GAAc,MAAM,cAAc,CAAA;AAExC,EAAA,IAAI,QAAQ,IAAA,IAAQ,OAAO,WAAA,KAAgB,QAAA,IAAY,gBAAgB,EAAA,EAAI;AACzE,IAAA,MAAM,IAAI,oBAAoB,6CAA6C,CAAA;AAAA,EAC7E;AAEA,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,SAAA,EAAW,OAAO,GAAA,CAAI,YAAY,MAAM,QAAA,GAAW,GAAA,CAAI,YAAY,CAAA,GAAI,QAAA;AAAA,IACvE,SAAA,EAAW,OAAO,GAAA,CAAI,YAAY,MAAM,QAAA,GAAW,GAAA,CAAI,YAAY,CAAA,GAAI,IAAA;AAAA,IACvE,YAAA,EAAc,OAAO,GAAA,CAAI,eAAe,MAAM,QAAA,GAAW,GAAA,CAAI,eAAe,CAAA,GAAI,IAAA;AAAA,IAChF,OAAA,EAAS,OAAO,GAAA,CAAI,UAAU,MAAM,QAAA,GAAW,GAAA,CAAI,UAAU,CAAA,GAAI,IAAA;AAAA,IACjE,KAAA,EAAO,OAAO,GAAA,CAAI,OAAO,MAAM,QAAA,GAAW,GAAA,CAAI,OAAO,CAAA,GAAI,IAAA;AAAA,IACzD;AAAA,GACF;AACF;AAEA,SAAS,aAAa,QAAA,EAAmD;AACvE,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,IAAA,GAAO,OAAO,QAAA,KAAa,QAAA,GAAW,CAAC,QAAQ,CAAA,GAAI,CAAC,GAAG,QAAQ,CAAA;AACrE,EAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AAEpB,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,IAAI,IAAI,CAAC,CAAA;AAAA,IACjB,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,0CAAA,EAA6C,CAAC,CAAA,EAAA,CAAI,CAAA;AAAA,IACjF;AACA,IAAA,IAAI,GAAA,CAAI,SAAS,EAAA,EAAI;AACnB,MAAA,MAAM,IAAI,mBAAmB,yCAAyC,CAAA;AAAA,IACxE;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,eAAe,KAAA,EAA+B;AACrD,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,MAAA,CAAO,SAAS,KAAK,CAAA,IAAK,KAAA,IAAS,CAAA,GAAI,KAAA,GAAQ,IAAA;AACrF;AAEA,SAAS,eAAe,MAAA,EAAuC;AAC7D,EAAA,IAAI,MAAA,EAAQ,YAAY,IAAA,EAAM;AAC5B,IAAA,MAAM,IAAI,oBAAoB,sCAAsC,CAAA;AAAA,EACtE;AACF;AAGA,SAAS,YAAA,CAAa,IAAY,MAAA,EAAqC;AACrE,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,IAAI,MAAA,EAAQ,YAAY,IAAA,EAAM;AAC5B,MAAA,MAAA,CAAO,IAAI,mBAAA,CAAoB,sCAAsC,CAAC,CAAA;AACtE,MAAA;AAAA,IACF;AACA,IAAA,MAAM,UAAU,MAAY;AAC1B,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAA,CAAO,IAAI,mBAAA,CAAoB,sCAAsC,CAAC,CAAA;AAAA,IACxE,CAAA;AACA,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,EAAQ,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAC5C,MAAA,OAAA,EAAQ;AAAA,IACV,GAAG,EAAE,CAAA;AACL,IAAA,MAAA,EAAQ,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC3D,CAAC,CAAA;AACH;;;AChdO,IAAM,qBAAA,GAAwB;AAY9B,SAAS,iBAAA,CAAkB,SAAS,CAAA,EAAW;AACpD,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,MAAM,KAAK,MAAA,GAAS,CAAA,IAAK,SAAS,EAAA,EAAI;AAC1D,IAAA,MAAM,IAAI,mBAAmB,wDAAwD,CAAA;AAAA,EACvF;AAEA,EAAA,MAAM,OAAO,qBAAA,CAAsB,MAAA;AAGnC,EAAA,MAAM,KAAA,GAAQ,MAAO,GAAA,GAAM,IAAA;AAC3B,EAAA,IAAI,IAAA,GAAO,EAAA;AAEX,EAAA,OAAO,IAAA,CAAK,SAAS,MAAA,EAAQ;AAC3B,IAAA,KAAA,MAAW,IAAA,IAAQ,OAAO,eAAA,CAAgB,IAAI,WAAW,MAAA,GAAS,CAAC,CAAC,CAAA,EAAG;AACrE,MAAA,IAAI,IAAA,GAAO,KAAA,IAAS,IAAA,CAAK,MAAA,GAAS,MAAA,EAAQ;AACxC,QAAA,IAAA,IAAQ,qBAAA,CAAsB,OAAO,IAAI,CAAA;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT","file":"agent.cjs","sourcesContent":["/**\n * Base class for every error this SDK throws, so callers can `catch (e) { if (e\n * instanceof CboxIdError) ... }` in one branch.\n */\nexport class CboxIdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\n/** The client is misconfigured (a required option is missing or empty). */\nexport class ConfigurationError extends CboxIdError {}\n\n/**\n * The login `state` did not match what was stored — the callback is forged or\n * stale. Treat as a fresh start, not an error to surface to the user.\n */\nexport class InvalidStateError extends CboxIdError {}\n\n/**\n * Login could not be completed: the provider returned an error, the callback was\n * missing a code, or a token / id_token failed verification.\n *\n * `error` carries the RFC 6749 §5.2 code the authorization server sent, when it sent one.\n * It used to be discarded at every back-channel boundary, leaving a single message string\n * for outcomes that need opposite responses: `invalid_grant` on a refresh means the\n * session is over and the person has to sign in again, while `temporarily_unavailable`\n * means try the same token in a moment. A caller reduced to matching on prose either\n * retries what can never succeed, or signs out somebody who did not need to be.\n */\nexport class AuthenticationError extends CboxIdError {\n  constructor(\n    message: string,\n    /** RFC 6749 §5.2 error code, when the server sent a parseable one. */\n    readonly error?: string,\n    /** The server's `error_description`, verbatim. Not end-user copy. */\n    readonly errorDescription?: string,\n    /** HTTP status, for the cases where the body says nothing useful. */\n    readonly status?: number,\n    /**\n     * Seconds to wait, off the `Retry-After` header — set only on a 429.\n     *\n     * The distinction it carries is the one a caller most needs and could least infer:\n     * a 429 is the ONLY back-channel failure where the same request will succeed\n     * unchanged if you simply wait. Every other one needs a different request, or a new\n     * sign-in. Without this the SDK reported \"token refresh failed\" and a caller with a\n     * retry loop hammered a limiter that was already telling it exactly how long to stop.\n     */\n    readonly retryAfter?: number,\n  ) {\n    super(message);\n  }\n\n  /** Whether waiting `retryAfter` seconds and repeating the same request is worth it. */\n  get isRateLimited(): boolean {\n    return this.status === 429;\n  }\n}\n\n/**\n * Read an OAuth error out of a failed token-endpoint response.\n *\n * Best-effort by design: a 502 from a proxy is HTML, a captive portal is worse, and the\n * caller still needs an error rather than a parse exception. What it must never do is\n * invent a code — an absent or unparseable `error` stays undefined, so\n * `e.error === 'invalid_grant'` is true only because the server said so.\n */\nexport async function oauthError(response: Response, fallback: string): Promise<AuthenticationError> {\n  const body = await response.text().catch(() => '');\n\n  let code: string | undefined;\n  let description: string | undefined;\n\n  try {\n    const parsed: unknown = JSON.parse(body);\n\n    if (typeof parsed === 'object' && parsed !== null) {\n      const { error, error_description: errorDescription } = parsed as Record<string, unknown>;\n      code = typeof error === 'string' ? error : undefined;\n      description = typeof errorDescription === 'string' ? errorDescription : undefined;\n    }\n  } catch {\n    // Not JSON. The status and the truncated body below are all there is to report.\n  }\n\n  // THE BODY IS NEVER ECHOED. These calls carry `client_secret`, `code_verifier` and\n  // refresh tokens in their REQUEST, and a debug proxy, a captive portal or an upstream\n  // error page that reflects what it received puts those straight into a thrown message\n  // — which production apps log. Only the server's own OAuth error code travels, and\n  // failing that, the status alone.\n  const detail = code ?? `HTTP ${response.status}`;\n\n  // `Retry-After` is seconds here — Laravel's throttler writes the integer form. The\n  // HTTP-date form is legal too and is deliberately NOT parsed: guessing at a clock\n  // skew is worse than saying nothing, and `status === 429` still tells the caller to\n  // back off.\n  const retryAfterHeader = response.headers.get('retry-after');\n  const retryAfter = retryAfterHeader !== null && /^\\d+$/.test(retryAfterHeader.trim())\n    ? Number(retryAfterHeader.trim())\n    : undefined;\n\n  return new AuthenticationError(`${fallback}: ${detail}`, code, description, response.status, retryAfter);\n}\n\n/**\n * The Frontend API refused, or could not be reached.\n *\n * Carries a `code` because the four ways this goes wrong need four different responses\n * from the caller, and telling them apart from a message string is the kind of thing\n * that works until somebody rewords the message:\n *\n *  - `origin_not_allowed` — the overwhelmingly likely cause of a refusal, and a\n *    configuration problem the developer fixes once in the console.\n *  - `rate_limited` — back off; `retryAfter` says for how long, when the server said.\n *  - `unavailable` — the network, or a 5xx. Transient by assumption; already retried.\n *  - `malformed` — a 200 whose body is not the document we expect, which means something\n *    between the page and us is rewriting responses (a proxy, an extension, a captive\n *    portal). Worth distinguishing, because retrying it never helps.\n */\nexport class FrontendApiError extends CboxIdError {\n  constructor(\n    message: string,\n    readonly code: 'origin_not_allowed' | 'rate_limited' | 'unavailable' | 'malformed',\n    readonly status?: number,\n    readonly retryAfter?: number,\n  ) {\n    super(message);\n  }\n}\n","import { ConfigurationError } from './errors.js';\n\n/**\n * An issuer must be HTTPS.\n *\n * Everything this SDK does with it carries a credential: the authorization code, the PKCE\n * verifier, the client secret, the refresh token. Over `http://` a network attacker reads\n * all of them — and, worse, replaces the discovery document and JWKS, at which point a\n * forged id_token verifies cleanly and the whole verification chain proves nothing.\n *\n * Loopback is allowed because a native app's own callback listener is loopback by\n * definition (RFC 8252) and a dev instance runs there.\n */\nexport function assertSecureIssuer(issuer: string): void {\n  let url: URL;\n\n  try {\n    url = new URL(issuer);\n  } catch {\n    throw new ConfigurationError('Cbox ID config `issuer` is not a valid URL.');\n  }\n\n  if (url.protocol === 'https:') {\n    return;\n  }\n\n  const loopback = url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]' || url.hostname === '::1';\n\n  if (url.protocol === 'http:' && loopback) {\n    return;\n  }\n\n  throw new ConfigurationError(\n    `Cbox ID config \\`issuer\\` must be https (got ${url.protocol}//${url.hostname}).`,\n  );\n}\n","import { AuthenticationError, CboxIdError } from '../errors.js';\n\n/**\n * A CIBA, device-grant or registration request was refused with an OAuth error.\n *\n * Extends {@link AuthenticationError}, so `error`, `errorDescription`, `status` and\n * `retryAfter` read the same as on every other back-channel failure in this SDK, and a\n * caller already catching `AuthenticationError` keeps working. Branch on the subclass (or\n * on `error`), never on the message.\n *\n * The REQUEST is never part of the error: these calls carry client assertions, secrets and\n * device codes, and production CLIs log what they throw.\n */\nexport class AgentGrantError extends AuthenticationError {}\n\n/** The person declined (`access_denied`). Final — do not poll again. */\nexport class AccessDeniedError extends AgentGrantError {}\n\n/**\n * The `auth_req_id` or `device_code` expired before anyone approved it (`expired_token`).\n * Also thrown locally when the wait outlives the request's `expires_in`. Start again.\n */\nexport class ExpiredTokenError extends AgentGrantError {}\n\n/** The `auth_req_id`, `device_code` or refresh token is not valid (`invalid_grant`). */\nexport class InvalidGrantError extends AgentGrantError {}\n\n/**\n * The `resource` (RFC 8707) is not one this client may ask for, the poll named a\n * different resource than the request that started it, or the resource lets\n * self-registered clients use CIBA only with `private_key_jwt` and this one is keyless\n * (`invalid_target`).\n */\nexport class InvalidTargetError extends AgentGrantError {}\n\n/**\n * Client authentication failed (`invalid_client`): an unknown `client_id`, a bad secret, an\n * assertion signed by a key the server does not hold, or a replayed `jti`.\n */\nexport class InvalidClientError extends AgentGrantError {}\n\n/** The `login_hint` names nobody the server can reach (`unknown_user_id`). */\nexport class UnknownUserIdError extends AgentGrantError {}\n\n/**\n * The `binding_message` is missing where the server requires one (self-registered clients),\n * or too long to show beside Approve (`invalid_binding_message`).\n */\nexport class InvalidBindingMessageError extends AgentGrantError {}\n\n/**\n * The server asked us to slow down (`slow_down`, or HTTP 429). `retryAfter` carries the\n * `Retry-After` seconds when the server sent them. The wait helpers absorb this themselves;\n * it is thrown only from a call that does not loop (registration, starting a flow).\n */\nexport class SlowDownError extends AgentGrantError {}\n\n/** The caller aborted the wait (its `AbortSignal` fired). */\nexport class GrantCancelledError extends CboxIdError {}\n\nconst BY_CODE: Record<string, typeof AgentGrantError> = {\n  access_denied: AccessDeniedError,\n  expired_token: ExpiredTokenError,\n  invalid_grant: InvalidGrantError,\n  invalid_target: InvalidTargetError,\n  invalid_client: InvalidClientError,\n  unknown_user_id: UnknownUserIdError,\n  invalid_binding_message: InvalidBindingMessageError,\n  slow_down: SlowDownError,\n};\n\n/** A parsed `{ error, error_description }` body plus the bits of the response that matter. */\nexport interface OAuthFailure {\n  error: string | undefined;\n  errorDescription: string | undefined;\n  status: number;\n  retryAfter: number | undefined;\n}\n\n/**\n * Read an OAuth error body without ever echoing it. A 502 from a proxy is HTML, and an\n * error page that reflects the request would put a client assertion into a log line — so\n * only the server's own `error` code (or the status) reaches the message.\n */\nexport async function readOAuthFailure(response: Response): Promise<OAuthFailure> {\n  const text = await response.text().catch(() => '');\n  let error: string | undefined;\n  let errorDescription: string | undefined;\n\n  try {\n    const parsed: unknown = JSON.parse(text);\n\n    if (typeof parsed === 'object' && parsed !== null) {\n      const record = parsed as Record<string, unknown>;\n      error = typeof record['error'] === 'string' ? record['error'] : undefined;\n      errorDescription = typeof record['error_description'] === 'string' ? record['error_description'] : undefined;\n    }\n  } catch {\n    // Not JSON: the status alone is what there is to report.\n  }\n\n  // A 429 IS slow_down, whatever (or whether) the body says — the limiter in front of the\n  // endpoint may answer before the OAuth layer does.\n  if (response.status === 429 && error === undefined) {\n    error = 'slow_down';\n  }\n\n  // Seconds only. The HTTP-date form is legal but guessing at clock skew is worse than\n  // falling back to the +5s rule.\n  const header = response.headers.get('retry-after');\n  const retryAfter = header !== null && /^\\d+$/.test(header.trim()) ? Number(header.trim()) : undefined;\n\n  return { error, errorDescription, status: response.status, retryAfter };\n}\n\n/** The typed error for a failure: a subclass for the codes callers branch on, else the base. */\nexport function grantError(failure: OAuthFailure, fallback: string): AgentGrantError {\n  const Klass = (failure.error !== undefined ? BY_CODE[failure.error] : undefined) ?? AgentGrantError;\n  const detail = failure.error ?? `HTTP ${failure.status}`;\n\n  return new Klass(`${fallback}: ${detail}`, failure.error, failure.errorDescription, failure.status, failure.retryAfter);\n}\n","import { assertSecureIssuer } from '../issuer.js';\nimport { AuthenticationError, ConfigurationError } from '../errors.js';\nimport { GrantCancelledError } from './errors.js';\n\n/**\n * RFC 8414 authorization server metadata, as Cbox ID publishes it at\n * `{issuer}/.well-known/oauth-authorization-server`. Only the members this module reads are\n * typed; the rest pass through.\n */\nexport interface AuthorizationServerMetadata {\n  issuer: string;\n  token_endpoint: string;\n  registration_endpoint?: string;\n  backchannel_authentication_endpoint?: string;\n  device_authorization_endpoint?: string;\n  backchannel_token_delivery_modes_supported?: string[];\n  backchannel_user_code_parameter_supported?: boolean;\n  grant_types_supported?: string[];\n  token_endpoint_auth_methods_supported?: string[];\n  token_endpoint_auth_signing_alg_values_supported?: string[];\n  [member: string]: unknown;\n}\n\n/** Transport options every call in this module takes. */\nexport interface AgentRequestOptions {\n  /** A `fetch` to use instead of the global one (tests, proxies, instrumentation). */\n  fetch?: typeof fetch;\n  /** Per-request timeout in milliseconds. Default 10 000. */\n  timeoutMs?: number;\n  /** Abort the call (and, for the wait helpers, the whole wait). */\n  signal?: AbortSignal;\n}\n\n/** Where to find the server: its issuer, and optionally metadata you already discovered. */\nexport interface AgentServerOptions extends AgentRequestOptions {\n  /** The Cbox ID issuer, e.g. `https://acme.cboxid.com`. Must be https (loopback excepted). */\n  issuer: string;\n  /**\n   * Metadata from {@link discoverAuthorizationServer}. Pass it to skip a discovery round\n   * trip per call; omitted, each call discovers it (the wait helpers discover once).\n   */\n  metadata?: AuthorizationServerMetadata;\n}\n\n/**\n * Fetch and check the authorization server metadata (RFC 8414).\n *\n * The document's `issuer` must equal the one asked for (§3.3) — otherwise a host answering\n * with another tenant's metadata would receive this client's assertions and codes.\n */\nexport async function discoverAuthorizationServer(\n  issuer: string,\n  options: AgentRequestOptions = {},\n): Promise<AuthorizationServerMetadata> {\n  if (!issuer) {\n    throw new ConfigurationError('An `issuer` is required.');\n  }\n  assertSecureIssuer(issuer);\n\n  const url = `${trimSlash(issuer)}/.well-known/oauth-authorization-server`;\n  const response = await send(url, { method: 'GET', headers: { accept: 'application/json' } }, options);\n\n  if (!response.ok) {\n    throw new AuthenticationError(`Discovery request failed with status ${response.status}.`, undefined, undefined, response.status);\n  }\n\n  let doc: unknown;\n  try {\n    doc = await response.json();\n  } catch {\n    throw new AuthenticationError('The authorization server metadata was not JSON.');\n  }\n\n  if (typeof doc !== 'object' || doc === null) {\n    throw new AuthenticationError('The authorization server metadata was not an object.');\n  }\n\n  const metadata = doc as AuthorizationServerMetadata;\n\n  if (typeof metadata.issuer !== 'string' || trimSlash(metadata.issuer) !== trimSlash(issuer)) {\n    throw new AuthenticationError(`The authorization server metadata is for a different issuer (${String(metadata.issuer)}).`);\n  }\n  if (typeof metadata.token_endpoint !== 'string' || metadata.token_endpoint === '') {\n    throw new AuthenticationError('The authorization server metadata has no token_endpoint.');\n  }\n\n  return metadata;\n}\n\n/** Metadata from the options, or discovered. */\nexport function resolveMetadata(options: AgentServerOptions): Promise<AuthorizationServerMetadata> {\n  return options.metadata !== undefined\n    ? Promise.resolve(options.metadata)\n    : discoverAuthorizationServer(options.issuer, options);\n}\n\n/** A named endpoint, or a ConfigurationError saying the server does not offer it. */\nexport function requireEndpoint(\n  metadata: AuthorizationServerMetadata,\n  name: 'registration_endpoint' | 'backchannel_authentication_endpoint' | 'device_authorization_endpoint' | 'token_endpoint',\n  what: string,\n): string {\n  const value = metadata[name];\n  if (typeof value !== 'string' || value === '') {\n    throw new ConfigurationError(`This Cbox ID instance does not advertise a ${name}, so it does not support ${what}.`);\n  }\n  return value;\n}\n\n/**\n * `fetch` with a timeout and the caller's signal combined. A caller abort becomes\n * {@link GrantCancelledError}; a timeout or network failure an {@link AuthenticationError}.\n */\nexport async function send(url: string, init: RequestInit, options: AgentRequestOptions): Promise<Response> {\n  const fetchImpl = options.fetch ?? globalThis.fetch;\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 10_000);\n  const onAbort = (): void => controller.abort();\n\n  if (options.signal?.aborted === true) {\n    clearTimeout(timer);\n    throw new GrantCancelledError('The request was cancelled.');\n  }\n  options.signal?.addEventListener('abort', onAbort, { once: true });\n\n  try {\n    return await fetchImpl(url, { ...init, signal: controller.signal });\n  } catch (error) {\n    // Re-read through a widened type: the early return above narrowed `aborted` to false,\n    // but the signal may have fired while the request was in flight.\n    if ((options.signal as AbortSignal | undefined)?.aborted === true) {\n      throw new GrantCancelledError('The request was cancelled.');\n    }\n    if (controller.signal.aborted) {\n      throw new AuthenticationError(`The request to ${new URL(url).origin} timed out.`);\n    }\n    throw new AuthenticationError(`The request to ${new URL(url).origin} failed: ${String(error)}`);\n  } finally {\n    clearTimeout(timer);\n    options.signal?.removeEventListener('abort', onAbort);\n  }\n}\n\nexport function trimSlash(value: string): string {\n  return value.replace(/\\/+$/, '');\n}\n","/**\n * PKCE (RFC 7636) and the random values the login flow needs, built on Web Crypto\n * (`globalThis.crypto`) so the same code runs on Node, edge runtimes and browsers.\n */\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** A URL-safe random token of `bytes` bytes (default 32), for state and nonce. */\nexport function randomToken(bytes = 32): string {\n  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));\n}\n\n/** A high-entropy PKCE code verifier. */\nexport function createVerifier(): string {\n  return randomToken(32);\n}\n\n/** The S256 code challenge for a verifier. */\nexport async function challenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));\n  return base64url(new Uint8Array(digest));\n}\n","import { calculateJwkThumbprint, exportJWK, generateKeyPair, importJWK, SignJWT, type JWK } from 'jose';\nimport { ConfigurationError } from '../errors.js';\nimport { randomToken } from '../pkce.js';\n\n/** The client-assertion algorithms this module signs with. Cbox ID accepts both. */\nexport type ClientKeyAlgorithm = 'ES256' | 'RS256';\n\n/** A signing key pair for `private_key_jwt`, from {@link generateClientKeyPair}. */\nexport interface ClientKeyPair {\n  alg: ClientKeyAlgorithm;\n  /** The RFC 7638 thumbprint of the public key, used as `kid`. */\n  kid: string;\n  /** The public JWK (with `kid`, `alg`, `use: 'sig'`) — what registration sends in `jwks`. */\n  publicJwk: JWK;\n  /**\n   * The private JWK. PERSIST THIS, and only this, somewhere the user alone can read\n   * (mode 0600, the OS keychain). It is the client's credential: whoever holds it is the\n   * client. Never log it, never commit it.\n   */\n  privateJwk: JWK;\n  /** The private key as a WebCrypto `CryptoKey`, ready to sign with. */\n  privateKey: CryptoKey;\n}\n\n/**\n * How the client authenticates at the backchannel, device and token endpoints.\n *\n * - `private_key_jwt` (RFC 7523): a short-lived assertion signed with your private key.\n *   The right choice for a self-registered agent or CLI: nothing secret ever crosses the\n *   wire, and the server stores only the public key.\n * - `client_secret_basic` / `client_secret_post`: a console-issued secret.\n * - `none`: a public client names itself by `client_id` only. Fine for the device grant.\n *   For CIBA, Cbox ID accepts a keyless self-registered client only when the resource\n *   allows it (`dynamic_public_backchannel`); otherwise the answer is `invalid_target`.\n *   Prefer `private_key_jwt` for CIBA: a public `client_id` proves nothing, and CIBA has no front\n *   channel to bind the flow to.\n */\nexport type ClientAuth =\n  | {\n      method: 'private_key_jwt';\n      clientId: string;\n      /** A `CryptoKey`, or the private JWK you persisted from {@link generateClientKeyPair}. */\n      privateKey: CryptoKey | JWK;\n      /** Inferred from the key when omitted. */\n      alg?: ClientKeyAlgorithm;\n      /** Sent as the assertion's `kid`. Taken from a JWK's own `kid` when omitted. */\n      kid?: string;\n    }\n  | { method: 'client_secret_basic' | 'client_secret_post'; clientId: string; clientSecret: string }\n  | { method: 'none'; clientId: string };\n\n/**\n * A fresh signing key pair for `private_key_jwt`, generated with WebCrypto (via `jose`), so\n * it runs on Node, Deno, Bun and edge runtimes. ES256 by default — small keys, small\n * signatures. The private key is extractable on purpose: the caller must persist it.\n */\nexport async function generateClientKeyPair(alg: ClientKeyAlgorithm = 'ES256'): Promise<ClientKeyPair> {\n  const { publicKey, privateKey } = await generateKeyPair(alg, { extractable: true });\n  const publicBare = await exportJWK(publicKey);\n  const kid = await calculateJwkThumbprint(publicBare, 'sha256');\n\n  const publicJwk: JWK = { ...publicBare, kid, alg, use: 'sig' };\n  const privateJwk: JWK = { ...(await exportJWK(privateKey)), kid, alg, use: 'sig' };\n\n  return { alg, kid, publicJwk, privateJwk, privateKey };\n}\n\n/**\n * A signed RFC 7523 client assertion: `iss` = `sub` = client id, `aud` = the token\n * endpoint, a random `jti` (the server remembers it, so each assertion is single-use),\n * `iat` now and `exp` at most 60 seconds later.\n */\nexport async function createClientAssertion(\n  auth: Extract<ClientAuth, { method: 'private_key_jwt' }>,\n  audience: string,\n  options: { now?: () => number; lifetimeSeconds?: number } = {},\n): Promise<string> {\n  const lifetime = Math.min(Math.max(options.lifetimeSeconds ?? 60, 1), 60);\n  const nowSeconds = Math.floor((options.now ?? Date.now)() / 1000);\n  const { key, alg, kid } = await signingKey(auth);\n\n  const header: { alg: string; kid?: string } = { alg };\n  if (kid !== undefined) {\n    header.kid = kid;\n  }\n\n  return new SignJWT({})\n    .setProtectedHeader(header)\n    .setIssuer(auth.clientId)\n    .setSubject(auth.clientId)\n    .setAudience(audience)\n    .setJti(randomToken(16))\n    .setIssuedAt(nowSeconds)\n    .setExpirationTime(nowSeconds + lifetime)\n    .sign(key);\n}\n\n/**\n * Put client authentication on a request: fields in the form body, and/or an\n * `Authorization` header. `audience` is the token endpoint, the one value Cbox ID accepts\n * on assertions to all of its endpoints.\n */\nexport async function applyClientAuth(\n  auth: ClientAuth,\n  body: URLSearchParams,\n  headers: Record<string, string>,\n  audience: string,\n): Promise<void> {\n  if (!auth.clientId) {\n    throw new ConfigurationError('A `clientId` is required.');\n  }\n\n  switch (auth.method) {\n    case 'private_key_jwt':\n      body.set('client_id', auth.clientId);\n      body.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');\n      body.set('client_assertion', await createClientAssertion(auth, audience));\n      return;\n    case 'client_secret_basic':\n      if (!auth.clientSecret) {\n        throw new ConfigurationError('`client_secret_basic` needs a `clientSecret`.');\n      }\n      // RFC 6749 §2.3.1: both halves are form-encoded before they are joined.\n      headers['authorization'] = `Basic ${btoa(`${formEncode(auth.clientId)}:${formEncode(auth.clientSecret)}`)}`;\n      return;\n    case 'client_secret_post':\n      if (!auth.clientSecret) {\n        throw new ConfigurationError('`client_secret_post` needs a `clientSecret`.');\n      }\n      body.set('client_id', auth.clientId);\n      body.set('client_secret', auth.clientSecret);\n      return;\n    case 'none':\n      body.set('client_id', auth.clientId);\n      return;\n  }\n}\n\nasync function signingKey(\n  auth: Extract<ClientAuth, { method: 'private_key_jwt' }>,\n): Promise<{ key: CryptoKey | Uint8Array; alg: ClientKeyAlgorithm; kid: string | undefined }> {\n  const source = auth.privateKey;\n\n  if (isCryptoKey(source)) {\n    const alg = auth.alg ?? algFromCryptoKey(source);\n    return { key: source, alg, kid: auth.kid };\n  }\n\n  if (typeof source !== 'object' || source === null || typeof source.d !== 'string') {\n    throw new ConfigurationError('`privateKey` must be a CryptoKey or a private JWK (with `d`).');\n  }\n\n  const alg = auth.alg ?? algFromJwk(source);\n  const key = await importJWK(source, alg);\n\n  return { key, alg, kid: auth.kid ?? (typeof source.kid === 'string' ? source.kid : undefined) };\n}\n\nfunction isCryptoKey(value: unknown): value is CryptoKey {\n  return typeof CryptoKey !== 'undefined' && value instanceof CryptoKey;\n}\n\nfunction algFromCryptoKey(key: CryptoKey): ClientKeyAlgorithm {\n  if (key.algorithm.name === 'ECDSA') {\n    return 'ES256';\n  }\n  if (key.algorithm.name === 'RSASSA-PKCS1-v1_5') {\n    return 'RS256';\n  }\n  throw new ConfigurationError(`Unsupported client key algorithm ${key.algorithm.name}; use ES256 or RS256.`);\n}\n\nfunction algFromJwk(jwk: JWK): ClientKeyAlgorithm {\n  if (jwk.alg === 'ES256' || jwk.alg === 'RS256') {\n    return jwk.alg as ClientKeyAlgorithm;\n  }\n  if (jwk.alg === undefined && jwk.kty === 'EC' && jwk.crv === 'P-256') {\n    return 'ES256';\n  }\n  if (jwk.alg === undefined && jwk.kty === 'RSA') {\n    return 'RS256';\n  }\n  throw new ConfigurationError('The private JWK is not an ES256 (P-256) or RS256 key.');\n}\n\nfunction formEncode(value: string): string {\n  return encodeURIComponent(value).replace(/%20/g, '+');\n}\n","import { AuthenticationError, ConfigurationError } from '../errors.js';\nimport { generateClientKeyPair, type ClientAuth, type ClientKeyAlgorithm, type ClientKeyPair } from './client-auth.js';\nimport { grantError, readOAuthFailure } from './errors.js';\nimport { requireEndpoint, resolveMetadata, send, type AgentServerOptions } from './http.js';\n\n/** The CIBA grant type (OpenID CIBA Core). */\nexport const CIBA_GRANT_TYPE = 'urn:openid:params:grant-type:ciba';\n/** The device authorization grant type (RFC 8628). */\nexport const DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';\n\nexport interface RegisterAgentClientOptions extends AgentServerOptions {\n  /** Shown to the person approving, so make it recognisable: \"Cbox Brain CLI on ada-mbp\". */\n  clientName: string;\n  /** e.g. `[CIBA_GRANT_TYPE, 'refresh_token']` or `[DEVICE_CODE_GRANT_TYPE, 'refresh_token']`. */\n  grantTypes: string[];\n  /** The scope ceiling to register. A space-separated string or a list. */\n  scope?: string | string[];\n  /**\n   * `private_key_jwt` (default): a key pair is generated (or `keyPair` used) and the\n   * public half registered inline as `jwks`. `none`: a public client — the device grant,\n   * or CIBA where the resource allows keyless clients. `private_key_jwt` is recommended for CIBA.\n   */\n  tokenEndpointAuthMethod?: 'private_key_jwt' | 'none';\n  /** Algorithm for the generated key pair. Default ES256. */\n  alg?: ClientKeyAlgorithm;\n  /** Register an existing key pair instead of generating one. */\n  keyPair?: ClientKeyPair;\n  /** RFC 7591 §3 initial access token, when the instance requires one to register. */\n  initialAccessToken?: string;\n  /** Further RFC 7591 client metadata, sent as-is (e.g. `software_id`, `client_uri`). */\n  extraMetadata?: Record<string, unknown>;\n}\n\nexport interface RegisteredAgentClient {\n  clientId: string;\n  /** Present only if the server issued one; a `private_key_jwt` or `none` client has none. */\n  clientSecret: string | null;\n  /** RFC 7592 credential for reading/updating/deleting the registration. Persist it if you need that. */\n  registrationAccessToken: string | null;\n  registrationClientUri: string | null;\n  tokenEndpointAuthMethod: string;\n  grantTypes: string[];\n  scope: string | null;\n  /** The key pair registered, for `private_key_jwt`. Persist `keyPair.privateJwk`. */\n  keyPair: ClientKeyPair | null;\n  /** Ready to hand to {@link startBackchannel} / {@link startDeviceAuthorization}. */\n  auth: ClientAuth;\n  /** The full registration response. */\n  raw: Record<string, unknown>;\n}\n\n/**\n * Register this agent or CLI as an OAuth client (RFC 7591 dynamic client registration).\n *\n * Do it once per installation and persist the result: `clientId` and, for\n * `private_key_jwt`, `keyPair.privateJwk`. Re-registering on every run fills the\n * environment's app list with copies.\n *\n * @throws ConfigurationError when the instance has dynamic registration switched off.\n * @throws AgentGrantError (e.g. `invalid_client_metadata`) when the server refuses.\n */\nexport async function registerAgentClient(options: RegisterAgentClientOptions): Promise<RegisteredAgentClient> {\n  if (!options.clientName) {\n    throw new ConfigurationError('`clientName` is required.');\n  }\n  if (options.grantTypes.length === 0) {\n    throw new ConfigurationError('`grantTypes` must name at least one grant.');\n  }\n\n  const metadata = await resolveMetadata(options);\n  const endpoint = requireEndpoint(metadata, 'registration_endpoint', 'dynamic client registration');\n  const method = options.tokenEndpointAuthMethod ?? 'private_key_jwt';\n\n  const keyPair = method === 'private_key_jwt'\n    ? options.keyPair ?? (await generateClientKeyPair(options.alg ?? 'ES256'))\n    : null;\n\n  const document: Record<string, unknown> = {\n    ...options.extraMetadata,\n    client_name: options.clientName,\n    grant_types: options.grantTypes,\n    token_endpoint_auth_method: method,\n    // Neither CIBA nor the device grant has a redirect; say so rather than let the server\n    // assume an authorization-code client.\n    redirect_uris: [],\n    response_types: [],\n  };\n\n  if (options.scope !== undefined) {\n    document['scope'] = scopeString(options.scope);\n  }\n  if (keyPair !== null) {\n    document['jwks'] = { keys: [keyPair.publicJwk] };\n  }\n\n  const headers: Record<string, string> = { 'content-type': 'application/json', accept: 'application/json' };\n  if (options.initialAccessToken) {\n    headers['authorization'] = `Bearer ${options.initialAccessToken}`;\n  }\n\n  const response = await send(endpoint, { method: 'POST', headers, body: JSON.stringify(document) }, options);\n\n  if (!response.ok) {\n    throw grantError(await readOAuthFailure(response), 'Client registration failed');\n  }\n\n  const raw = (await response.json().catch(() => null)) as Record<string, unknown> | null;\n  const clientId = raw?.['client_id'];\n\n  if (raw === null || typeof clientId !== 'string' || clientId === '') {\n    throw new AuthenticationError('The registration response carried no client_id.');\n  }\n\n  const clientSecret = typeof raw['client_secret'] === 'string' ? raw['client_secret'] : null;\n  const registeredMethod = typeof raw['token_endpoint_auth_method'] === 'string' ? raw['token_endpoint_auth_method'] : method;\n\n  let auth: ClientAuth;\n  if (keyPair !== null) {\n    auth = { method: 'private_key_jwt', clientId, privateKey: keyPair.privateKey, alg: keyPair.alg, kid: keyPair.kid };\n  } else if (clientSecret !== null) {\n    auth = { method: 'client_secret_basic', clientId, clientSecret };\n  } else {\n    auth = { method: 'none', clientId };\n  }\n\n  return {\n    clientId,\n    clientSecret,\n    registrationAccessToken: typeof raw['registration_access_token'] === 'string' ? raw['registration_access_token'] : null,\n    registrationClientUri: typeof raw['registration_client_uri'] === 'string' ? raw['registration_client_uri'] : null,\n    tokenEndpointAuthMethod: registeredMethod,\n    grantTypes: Array.isArray(raw['grant_types']) ? raw['grant_types'].filter((g): g is string => typeof g === 'string') : options.grantTypes,\n    scope: typeof raw['scope'] === 'string' ? raw['scope'] : null,\n    keyPair,\n    auth,\n    raw,\n  };\n}\n\nexport function scopeString(scope: string | string[]): string {\n  return (typeof scope === 'string' ? scope.split(/\\s+/) : scope).filter((s) => s !== '').join(' ');\n}\n","import { AuthenticationError, ConfigurationError } from '../errors.js';\nimport { applyClientAuth, type ClientAuth } from './client-auth.js';\nimport { ExpiredTokenError, GrantCancelledError, grantError, readOAuthFailure } from './errors.js';\nimport {\n  requireEndpoint,\n  resolveMetadata,\n  send,\n  type AgentServerOptions,\n  type AuthorizationServerMetadata,\n} from './http.js';\nimport { CIBA_GRANT_TYPE, DEVICE_CODE_GRANT_TYPE, scopeString } from './register.js';\n\n/** Tokens from a completed CIBA or device grant. */\nexport interface AgentTokens {\n  accessToken: string;\n  tokenType: string;\n  /** Seconds, when the server said. */\n  expiresIn: number | null;\n  refreshToken: string | null;\n  /**\n   * The id_token, when `openid` was granted — returned as-is, NOT verified here. Verify it\n   * with `CboxIdClient` (or `jose` against the JWKS) before trusting anything in it.\n   */\n  idToken: string | null;\n  scope: string | null;\n  /** The full token response. */\n  raw: Record<string, unknown>;\n}\n\n/** One poll's outcome. Final failures are thrown, not returned. */\nexport type PollResult =\n  | { status: 'complete'; tokens: AgentTokens }\n  | { status: 'pending' }\n  /** Slow down: add 5 s to the interval, and wait at least `retryAfter` seconds if given. */\n  | { status: 'slow_down'; retryAfter: number | null };\n\n/** Options shared by the wait helpers. */\nexport interface WaitOptions {\n  /** Replace the timer — tests pass a fake that records the waits. Must honour `signal`. */\n  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;\n  /** Clock in epoch milliseconds. Default `Date.now`. */\n  now?: () => number;\n}\n\ninterface ClientOptions extends AgentServerOptions {\n  /** How the client authenticates. See {@link ClientAuth}. */\n  client: ClientAuth;\n}\n\n// ---------------------------------------------------------------------------------------\n// CIBA (poll mode)\n// ---------------------------------------------------------------------------------------\n\nexport interface StartBackchannelOptions extends ClientOptions {\n  /** Who should approve: a Cbox ID user id, or a confirmed email address. */\n  loginHint: string;\n  /** Space-separated string or list. Bounded by the client's registered scopes. */\n  scope: string | string[];\n  /**\n   * Shown beside Approve. Put a {@link createBindingCode} code in it and print the same\n   * code locally. Required by Cbox ID for self-registered clients; at most 255 characters.\n   */\n  bindingMessage: string;\n  /**\n   * RFC 8707 resource indicator(s) — the API the token is for. Optional in the type, but\n   * REQUIRED by Cbox ID for self-registered clients.\n   * Its settings also decide whether a keyless (`none`) client may use CIBA at all.\n   */\n  resource?: string | string[];\n  /** Seconds the request may wait for approval (the server may shorten it). */\n  requestedExpiry?: number;\n  /** Echoed into the id_token, so you can bind it to this request. */\n  nonce?: string;\n}\n\n/** A started CIBA request. Persistable as JSON. */\nexport interface BackchannelAuthorization {\n  authReqId: string;\n  expiresIn: number;\n  /** Seconds between polls. */\n  interval: number;\n  /** Epoch ms after which polling is pointless. */\n  expiresAt: number;\n  /** The resource(s) the request named, re-sent on every poll (the server checks they match). */\n  resource: string[];\n}\n\n/**\n * Start a CIBA request (OpenID CIBA Core §7, poll mode): Cbox ID shows `bindingMessage` to\n * the person named by `loginHint` and waits for Approve.\n *\n * `backchannel_user_code_parameter` is not supported by Cbox ID, so no user code is sent.\n *\n * @throws InvalidClientError, UnknownUserIdError, InvalidBindingMessageError,\n *   InvalidTargetError, SlowDownError, AgentGrantError.\n */\nexport async function startBackchannel(options: StartBackchannelOptions): Promise<BackchannelAuthorization> {\n  const now = Date.now();\n  const metadata = await resolveMetadata(options);\n  const endpoint = requireEndpoint(metadata, 'backchannel_authentication_endpoint', 'CIBA');\n\n  if (!options.loginHint) {\n    throw new ConfigurationError('`loginHint` is required.');\n  }\n\n  const resource = resourceList(options.resource);\n  const body = new URLSearchParams({ login_hint: options.loginHint, scope: scopeString(options.scope) });\n\n  if (options.bindingMessage !== '') {\n    body.set('binding_message', options.bindingMessage);\n  }\n  for (const r of resource) {\n    body.append('resource', r);\n  }\n  if (options.requestedExpiry !== undefined) {\n    body.set('requested_expiry', String(options.requestedExpiry));\n  }\n  if (options.nonce !== undefined && options.nonce !== '') {\n    body.set('nonce', options.nonce);\n  }\n\n  const payload = await postForm(endpoint, body, options, metadata, 'Backchannel authentication request failed');\n  const authReqId = payload['auth_req_id'];\n\n  if (typeof authReqId !== 'string' || authReqId === '') {\n    throw new AuthenticationError('The backchannel authentication response carried no auth_req_id.');\n  }\n\n  const expiresIn = positiveNumber(payload['expires_in']) ?? 120;\n\n  return {\n    authReqId,\n    expiresIn,\n    // CIBA Core §7.3: absent means 5 seconds.\n    interval: positiveNumber(payload['interval']) ?? 5,\n    expiresAt: now + expiresIn * 1000,\n    resource,\n  };\n}\n\nexport interface PollBackchannelOptions extends ClientOptions {\n  authorization: Pick<BackchannelAuthorization, 'authReqId' | 'resource'>;\n}\n\n/**\n * Poll the token endpoint once for a CIBA request.\n *\n * @throws AccessDeniedError, ExpiredTokenError, InvalidGrantError, InvalidTargetError,\n *   InvalidClientError, AgentGrantError.\n */\nexport async function pollBackchannel(options: PollBackchannelOptions): Promise<PollResult> {\n  const body = new URLSearchParams({ grant_type: CIBA_GRANT_TYPE, auth_req_id: options.authorization.authReqId });\n  return pollToken(body, options.authorization.resource, options, 'Backchannel token request failed');\n}\n\n/**\n * Poll until the person approves, and return the tokens.\n *\n * Waits `interval` seconds before each poll; on `slow_down` (or a 429) adds five seconds\n * for good and waits at least `Retry-After`; keeps going on `authorization_pending`; stops\n * on anything final. Throws {@link ExpiredTokenError} once `expiresAt` passes and\n * {@link GrantCancelledError} when `signal` fires — wire it to Ctrl-C.\n */\nexport async function waitForBackchannelToken(\n  options: PollBackchannelOptions & WaitOptions & { authorization: BackchannelAuthorization },\n): Promise<AgentTokens> {\n  const metadata = await resolveMetadata(options);\n  const authorization = options.authorization;\n\n  return waitLoop(authorization, options, () => pollBackchannel({ ...options, metadata }), 'backchannel request');\n}\n\n// ---------------------------------------------------------------------------------------\n// Device authorization grant (RFC 8628)\n// ---------------------------------------------------------------------------------------\n\nexport interface StartDeviceAuthorizationOptions extends ClientOptions {\n  scope?: string | string[];\n  /** RFC 8707 resource indicator(s). */\n  resource?: string | string[];\n}\n\n/** A started device authorization. Persistable as JSON. */\nexport interface DeviceGrantAuthorization {\n  deviceCode: string;\n  /** Show this to the person. */\n  userCode: string;\n  /** Where they enter it. */\n  verificationUri: string;\n  /** The same page with the code filled in — good for a QR code or `open`. */\n  verificationUriComplete: string | null;\n  expiresIn: number;\n  interval: number;\n  expiresAt: number;\n  resource: string[];\n}\n\n/**\n * Start the device authorization grant: you get a `userCode` to show and a\n * `verificationUri` for the person to open on any device.\n *\n * @throws InvalidClientError, InvalidTargetError, SlowDownError, AgentGrantError.\n */\nexport async function startDeviceAuthorization(options: StartDeviceAuthorizationOptions): Promise<DeviceGrantAuthorization> {\n  const now = Date.now();\n  const metadata = await resolveMetadata(options);\n  const endpoint = requireEndpoint(metadata, 'device_authorization_endpoint', 'the device grant');\n  const resource = resourceList(options.resource);\n  const body = new URLSearchParams();\n\n  if (options.scope !== undefined) {\n    body.set('scope', scopeString(options.scope));\n  }\n  for (const r of resource) {\n    body.append('resource', r);\n  }\n\n  const payload = await postForm(endpoint, body, options, metadata, 'Device authorization request failed');\n  const deviceCode = payload['device_code'];\n  const userCode = payload['user_code'];\n  const verificationUri = payload['verification_uri'];\n\n  if (typeof deviceCode !== 'string' || typeof userCode !== 'string' || typeof verificationUri !== 'string') {\n    throw new AuthenticationError('The device authorization response was incomplete.');\n  }\n\n  const expiresIn = positiveNumber(payload['expires_in']) ?? 600;\n\n  return {\n    deviceCode,\n    userCode,\n    verificationUri,\n    verificationUriComplete: typeof payload['verification_uri_complete'] === 'string' ? payload['verification_uri_complete'] : null,\n    expiresIn,\n    // RFC 8628 §3.2: absent means 5 seconds.\n    interval: positiveNumber(payload['interval']) ?? 5,\n    expiresAt: now + expiresIn * 1000,\n    resource,\n  };\n}\n\nexport interface PollDeviceAuthorizationOptions extends ClientOptions {\n  authorization: Pick<DeviceGrantAuthorization, 'deviceCode' | 'resource'>;\n}\n\n/** Poll the token endpoint once for a device authorization. */\nexport async function pollDeviceAuthorization(options: PollDeviceAuthorizationOptions): Promise<PollResult> {\n  const body = new URLSearchParams({ grant_type: DEVICE_CODE_GRANT_TYPE, device_code: options.authorization.deviceCode });\n  return pollToken(body, options.authorization.resource, options, 'Device token request failed');\n}\n\n/** Poll until the person approves the device code. Same rules as {@link waitForBackchannelToken}. */\nexport async function waitForDeviceToken(\n  options: PollDeviceAuthorizationOptions & WaitOptions & { authorization: DeviceGrantAuthorization },\n): Promise<AgentTokens> {\n  const metadata = await resolveMetadata(options);\n\n  return waitLoop(options.authorization, options, () => pollDeviceAuthorization({ ...options, metadata }), 'device code');\n}\n\n// ---------------------------------------------------------------------------------------\n// Refresh\n// ---------------------------------------------------------------------------------------\n\nexport interface RefreshAgentTokensOptions extends ClientOptions {\n  refreshToken: string;\n  /** Narrow the scope (never widen it). */\n  scope?: string | string[];\n  /** RFC 8707 resource indicator(s) for the new access token. */\n  resource?: string | string[];\n}\n\n/**\n * Exchange a refresh token, authenticating the same way the grant did (including\n * `private_key_jwt`). Cbox ID rotates refresh tokens and revokes the family on reuse, so\n * ALWAYS persist the returned `refreshToken` and discard the old one.\n *\n * @throws InvalidGrantError when the refresh token is no longer valid — sign in again.\n */\nexport async function refreshAgentTokens(options: RefreshAgentTokensOptions): Promise<AgentTokens> {\n  if (!options.refreshToken) {\n    throw new ConfigurationError('`refreshToken` is required.');\n  }\n\n  const body = new URLSearchParams({ grant_type: 'refresh_token', refresh_token: options.refreshToken });\n  if (options.scope !== undefined) {\n    body.set('scope', scopeString(options.scope));\n  }\n\n  // `polling: false`: pending and slow_down mean nothing on a refresh, so they are thrown\n  // like any other refusal (a 429 as SlowDownError with its Retry-After).\n  const result = await pollToken(body, resourceList(options.resource), options, 'Token refresh failed', false);\n\n  return (result as Extract<PollResult, { status: 'complete' }>).tokens;\n}\n\n// ---------------------------------------------------------------------------------------\n// Shared\n// ---------------------------------------------------------------------------------------\n\nasync function waitLoop(\n  authorization: { interval: number; expiresAt: number },\n  options: WaitOptions & { signal?: AbortSignal },\n  poll: () => Promise<PollResult>,\n  what: string,\n): Promise<AgentTokens> {\n  const sleep = options.sleep ?? defaultSleep;\n  const now = options.now ?? Date.now;\n  let intervalMs = Math.max(authorization.interval, 0) * 1000;\n  let nextWaitMs = intervalMs;\n\n  for (;;) {\n    throwIfAborted(options.signal);\n\n    if (now() >= authorization.expiresAt) {\n      throw new ExpiredTokenError(`The ${what} expired before it was approved. Start again.`, 'expired_token');\n    }\n\n    await sleep(nextWaitMs, options.signal);\n    // A custom sleep may not honour the signal; check again before spending a request.\n    throwIfAborted(options.signal);\n\n    if (now() >= authorization.expiresAt) {\n      throw new ExpiredTokenError(`The ${what} expired before it was approved. Start again.`, 'expired_token');\n    }\n\n    const result = await poll();\n\n    if (result.status === 'complete') {\n      return result.tokens;\n    }\n\n    if (result.status === 'slow_down') {\n      // Permanently, not for one round (RFC 8628 §3.5, CIBA Core §11): returning to the\n      // refused rate earns the same answer forever.\n      intervalMs += 5000;\n      nextWaitMs = Math.max(intervalMs, (result.retryAfter ?? 0) * 1000);\n      continue;\n    }\n\n    nextWaitMs = intervalMs;\n  }\n}\n\nasync function pollToken(\n  body: URLSearchParams,\n  resource: readonly string[],\n  options: ClientOptions,\n  fallback: string,\n  polling = true,\n): Promise<PollResult> {\n  const metadata = await resolveMetadata(options);\n  const endpoint = requireEndpoint(metadata, 'token_endpoint', 'token requests');\n\n  // The same resource(s) the request started with; Cbox ID refuses a mismatch with\n  // invalid_target.\n  for (const r of resource) {\n    body.append('resource', r);\n  }\n\n  const headers: Record<string, string> = { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' };\n  await applyClientAuth(options.client, body, headers, metadata.token_endpoint);\n\n  const response = await send(endpoint, { method: 'POST', headers, body }, options);\n\n  if (response.ok) {\n    return { status: 'complete', tokens: await tokensFrom(response) };\n  }\n\n  const failure = await readOAuthFailure(response);\n\n  if (polling && failure.error === 'authorization_pending') {\n    return { status: 'pending' };\n  }\n  if (polling && failure.error === 'slow_down') {\n    return { status: 'slow_down', retryAfter: failure.retryAfter ?? null };\n  }\n\n  throw grantError(failure, fallback);\n}\n\nasync function postForm(\n  endpoint: string,\n  body: URLSearchParams,\n  options: ClientOptions,\n  metadata: AuthorizationServerMetadata,\n  fallback: string,\n): Promise<Record<string, unknown>> {\n  const headers: Record<string, string> = { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' };\n  await applyClientAuth(options.client, body, headers, metadata.token_endpoint);\n\n  const response = await send(endpoint, { method: 'POST', headers, body }, options);\n\n  if (!response.ok) {\n    throw grantError(await readOAuthFailure(response), fallback);\n  }\n\n  const payload: unknown = await response.json().catch(() => null);\n  if (typeof payload !== 'object' || payload === null) {\n    throw new AuthenticationError(`${fallback}: the response was not a JSON object.`);\n  }\n  return payload as Record<string, unknown>;\n}\n\nasync function tokensFrom(response: Response): Promise<AgentTokens> {\n  const raw = (await response.json().catch(() => null)) as Record<string, unknown> | null;\n  const accessToken = raw?.['access_token'];\n\n  if (raw === null || typeof accessToken !== 'string' || accessToken === '') {\n    throw new AuthenticationError('The token response carried no access_token.');\n  }\n\n  return {\n    accessToken,\n    tokenType: typeof raw['token_type'] === 'string' ? raw['token_type'] : 'Bearer',\n    expiresIn: typeof raw['expires_in'] === 'number' ? raw['expires_in'] : null,\n    refreshToken: typeof raw['refresh_token'] === 'string' ? raw['refresh_token'] : null,\n    idToken: typeof raw['id_token'] === 'string' ? raw['id_token'] : null,\n    scope: typeof raw['scope'] === 'string' ? raw['scope'] : null,\n    raw,\n  };\n}\n\nfunction resourceList(resource: string | string[] | undefined): string[] {\n  if (resource === undefined) {\n    return [];\n  }\n  const list = typeof resource === 'string' ? [resource] : [...resource];\n  for (const r of list) {\n    // RFC 8707 §2: an absolute URI without a fragment.\n    let url: URL;\n    try {\n      url = new URL(r);\n    } catch {\n      throw new ConfigurationError(`\\`resource\\` must be an absolute URI (got ${r}).`);\n    }\n    if (url.hash !== '') {\n      throw new ConfigurationError('`resource` must not contain a fragment.');\n    }\n  }\n  return list;\n}\n\nfunction positiveNumber(value: unknown): number | null {\n  return typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : null;\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted === true) {\n    throw new GrantCancelledError('The wait for approval was cancelled.');\n  }\n}\n\n/** An interruptible timer: the abort is wired to the timer, so Ctrl-C does not wait out an interval. */\nfunction defaultSleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted === true) {\n      reject(new GrantCancelledError('The wait for approval was cancelled.'));\n      return;\n    }\n    const onAbort = (): void => {\n      clearTimeout(timer);\n      reject(new GrantCancelledError('The wait for approval was cancelled.'));\n    };\n    const timer = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n","import { ConfigurationError } from '../errors.js';\n\n/**\n * Uppercase letters and digits a person cannot confuse when reading them off one screen\n * and matching them on another: no 0/O, 1/I/L, 5/S, 2/Z, 8/B.\n */\nexport const BINDING_CODE_ALPHABET = 'ACDEFGHJKMNPQRTUVWXY34679';\n\n/**\n * A short random code for a CIBA `binding_message`, e.g. `K7QM`.\n *\n * Show it in your terminal and put it in the binding message; Cbox ID shows the message\n * beside Approve, and the person approves only when the two match. That is what stops a\n * prompt somebody else triggered from being approved by reflex. Cbox ID requires a\n * binding message from self-registered clients.\n *\n * Uniform over the alphabet (rejection sampling, WebCrypto randomness).\n */\nexport function createBindingCode(length = 4): string {\n  if (!Number.isInteger(length) || length < 1 || length > 32) {\n    throw new ConfigurationError('A binding code length must be an integer from 1 to 32.');\n  }\n\n  const size = BINDING_CODE_ALPHABET.length;\n  // The largest multiple of `size` that fits in a byte; bytes at or above it are dropped so\n  // every character is equally likely.\n  const limit = 256 - (256 % size);\n  let code = '';\n\n  while (code.length < length) {\n    for (const byte of crypto.getRandomValues(new Uint8Array(length * 2))) {\n      if (byte < limit && code.length < length) {\n        code += BINDING_CODE_ALPHABET[byte % size];\n      }\n    }\n  }\n\n  return code;\n}\n"]}

package/dist/agent.d.cts

@@ -0,0 +1,400 @@
+import { JWK } from 'jose';
+import { A as AuthenticationError, C as CboxIdError } from './errors-D61xljZE.cjs';
+export { a as ConfigurationError } from './errors-D61xljZE.cjs';
+
+/**
+ * RFC 8414 authorization server metadata, as Cbox ID publishes it at
+ * `{issuer}/.well-known/oauth-authorization-server`. Only the members this module reads are
+ * typed; the rest pass through.
+ */
+interface AuthorizationServerMetadata {
+    issuer: string;
+    token_endpoint: string;
+    registration_endpoint?: string;
+    backchannel_authentication_endpoint?: string;
+    device_authorization_endpoint?: string;
+    backchannel_token_delivery_modes_supported?: string[];
+    backchannel_user_code_parameter_supported?: boolean;
+    grant_types_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+    token_endpoint_auth_signing_alg_values_supported?: string[];
+    [member: string]: unknown;
+}
+/** Transport options every call in this module takes. */
+interface AgentRequestOptions {
+    /** A `fetch` to use instead of the global one (tests, proxies, instrumentation). */
+    fetch?: typeof fetch;
+    /** Per-request timeout in milliseconds. Default 10 000. */
+    timeoutMs?: number;
+    /** Abort the call (and, for the wait helpers, the whole wait). */
+    signal?: AbortSignal;
+}
+/** Where to find the server: its issuer, and optionally metadata you already discovered. */
+interface AgentServerOptions extends AgentRequestOptions {
+    /** The Cbox ID issuer, e.g. `https://acme.cboxid.com`. Must be https (loopback excepted). */
+    issuer: string;
+    /**
+     * Metadata from {@link discoverAuthorizationServer}. Pass it to skip a discovery round
+     * trip per call; omitted, each call discovers it (the wait helpers discover once).
+     */
+    metadata?: AuthorizationServerMetadata;
+}
+/**
+ * Fetch and check the authorization server metadata (RFC 8414).
+ *
+ * The document's `issuer` must equal the one asked for (§3.3) — otherwise a host answering
+ * with another tenant's metadata would receive this client's assertions and codes.
+ */
+declare function discoverAuthorizationServer(issuer: string, options?: AgentRequestOptions): Promise<AuthorizationServerMetadata>;
+
+/** The client-assertion algorithms this module signs with. Cbox ID accepts both. */
+type ClientKeyAlgorithm = 'ES256' | 'RS256';
+/** A signing key pair for `private_key_jwt`, from {@link generateClientKeyPair}. */
+interface ClientKeyPair {
+    alg: ClientKeyAlgorithm;
+    /** The RFC 7638 thumbprint of the public key, used as `kid`. */
+    kid: string;
+    /** The public JWK (with `kid`, `alg`, `use: 'sig'`) — what registration sends in `jwks`. */
+    publicJwk: JWK;
+    /**
+     * The private JWK. PERSIST THIS, and only this, somewhere the user alone can read
+     * (mode 0600, the OS keychain). It is the client's credential: whoever holds it is the
+     * client. Never log it, never commit it.
+     */
+    privateJwk: JWK;
+    /** The private key as a WebCrypto `CryptoKey`, ready to sign with. */
+    privateKey: CryptoKey;
+}
+/**
+ * How the client authenticates at the backchannel, device and token endpoints.
+ *
+ * - `private_key_jwt` (RFC 7523): a short-lived assertion signed with your private key.
+ *   The right choice for a self-registered agent or CLI: nothing secret ever crosses the
+ *   wire, and the server stores only the public key.
+ * - `client_secret_basic` / `client_secret_post`: a console-issued secret.
+ * - `none`: a public client names itself by `client_id` only. Fine for the device grant.
+ *   For CIBA, Cbox ID accepts a keyless self-registered client only when the resource
+ *   allows it (`dynamic_public_backchannel`); otherwise the answer is `invalid_target`.
+ *   Prefer `private_key_jwt` for CIBA: a public `client_id` proves nothing, and CIBA has no front
+ *   channel to bind the flow to.
+ */
+type ClientAuth = {
+    method: 'private_key_jwt';
+    clientId: string;
+    /** A `CryptoKey`, or the private JWK you persisted from {@link generateClientKeyPair}. */
+    privateKey: CryptoKey | JWK;
+    /** Inferred from the key when omitted. */
+    alg?: ClientKeyAlgorithm;
+    /** Sent as the assertion's `kid`. Taken from a JWK's own `kid` when omitted. */
+    kid?: string;
+} | {
+    method: 'client_secret_basic' | 'client_secret_post';
+    clientId: string;
+    clientSecret: string;
+} | {
+    method: 'none';
+    clientId: string;
+};
+/**
+ * A fresh signing key pair for `private_key_jwt`, generated with WebCrypto (via `jose`), so
+ * it runs on Node, Deno, Bun and edge runtimes. ES256 by default — small keys, small
+ * signatures. The private key is extractable on purpose: the caller must persist it.
+ */
+declare function generateClientKeyPair(alg?: ClientKeyAlgorithm): Promise<ClientKeyPair>;
+/**
+ * A signed RFC 7523 client assertion: `iss` = `sub` = client id, `aud` = the token
+ * endpoint, a random `jti` (the server remembers it, so each assertion is single-use),
+ * `iat` now and `exp` at most 60 seconds later.
+ */
+declare function createClientAssertion(auth: Extract<ClientAuth, {
+    method: 'private_key_jwt';
+}>, audience: string, options?: {
+    now?: () => number;
+    lifetimeSeconds?: number;
+}): Promise<string>;
+
+/** The CIBA grant type (OpenID CIBA Core). */
+declare const CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
+/** The device authorization grant type (RFC 8628). */
+declare const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+interface RegisterAgentClientOptions extends AgentServerOptions {
+    /** Shown to the person approving, so make it recognisable: "Cbox Brain CLI on ada-mbp". */
+    clientName: string;
+    /** e.g. `[CIBA_GRANT_TYPE, 'refresh_token']` or `[DEVICE_CODE_GRANT_TYPE, 'refresh_token']`. */
+    grantTypes: string[];
+    /** The scope ceiling to register. A space-separated string or a list. */
+    scope?: string | string[];
+    /**
+     * `private_key_jwt` (default): a key pair is generated (or `keyPair` used) and the
+     * public half registered inline as `jwks`. `none`: a public client — the device grant,
+     * or CIBA where the resource allows keyless clients. `private_key_jwt` is recommended for CIBA.
+     */
+    tokenEndpointAuthMethod?: 'private_key_jwt' | 'none';
+    /** Algorithm for the generated key pair. Default ES256. */
+    alg?: ClientKeyAlgorithm;
+    /** Register an existing key pair instead of generating one. */
+    keyPair?: ClientKeyPair;
+    /** RFC 7591 §3 initial access token, when the instance requires one to register. */
+    initialAccessToken?: string;
+    /** Further RFC 7591 client metadata, sent as-is (e.g. `software_id`, `client_uri`). */
+    extraMetadata?: Record<string, unknown>;
+}
+interface RegisteredAgentClient {
+    clientId: string;
+    /** Present only if the server issued one; a `private_key_jwt` or `none` client has none. */
+    clientSecret: string | null;
+    /** RFC 7592 credential for reading/updating/deleting the registration. Persist it if you need that. */
+    registrationAccessToken: string | null;
+    registrationClientUri: string | null;
+    tokenEndpointAuthMethod: string;
+    grantTypes: string[];
+    scope: string | null;
+    /** The key pair registered, for `private_key_jwt`. Persist `keyPair.privateJwk`. */
+    keyPair: ClientKeyPair | null;
+    /** Ready to hand to {@link startBackchannel} / {@link startDeviceAuthorization}. */
+    auth: ClientAuth;
+    /** The full registration response. */
+    raw: Record<string, unknown>;
+}
+/**
+ * Register this agent or CLI as an OAuth client (RFC 7591 dynamic client registration).
+ *
+ * Do it once per installation and persist the result: `clientId` and, for
+ * `private_key_jwt`, `keyPair.privateJwk`. Re-registering on every run fills the
+ * environment's app list with copies.
+ *
+ * @throws ConfigurationError when the instance has dynamic registration switched off.
+ * @throws AgentGrantError (e.g. `invalid_client_metadata`) when the server refuses.
+ */
+declare function registerAgentClient(options: RegisterAgentClientOptions): Promise<RegisteredAgentClient>;
+
+/** Tokens from a completed CIBA or device grant. */
+interface AgentTokens {
+    accessToken: string;
+    tokenType: string;
+    /** Seconds, when the server said. */
+    expiresIn: number | null;
+    refreshToken: string | null;
+    /**
+     * The id_token, when `openid` was granted — returned as-is, NOT verified here. Verify it
+     * with `CboxIdClient` (or `jose` against the JWKS) before trusting anything in it.
+     */
+    idToken: string | null;
+    scope: string | null;
+    /** The full token response. */
+    raw: Record<string, unknown>;
+}
+/** One poll's outcome. Final failures are thrown, not returned. */
+type PollResult = {
+    status: 'complete';
+    tokens: AgentTokens;
+} | {
+    status: 'pending';
+}
+/** Slow down: add 5 s to the interval, and wait at least `retryAfter` seconds if given. */
+ | {
+    status: 'slow_down';
+    retryAfter: number | null;
+};
+/** Options shared by the wait helpers. */
+interface WaitOptions {
+    /** Replace the timer — tests pass a fake that records the waits. Must honour `signal`. */
+    sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+    /** Clock in epoch milliseconds. Default `Date.now`. */
+    now?: () => number;
+}
+interface ClientOptions extends AgentServerOptions {
+    /** How the client authenticates. See {@link ClientAuth}. */
+    client: ClientAuth;
+}
+interface StartBackchannelOptions extends ClientOptions {
+    /** Who should approve: a Cbox ID user id, or a confirmed email address. */
+    loginHint: string;
+    /** Space-separated string or list. Bounded by the client's registered scopes. */
+    scope: string | string[];
+    /**
+     * Shown beside Approve. Put a {@link createBindingCode} code in it and print the same
+     * code locally. Required by Cbox ID for self-registered clients; at most 255 characters.
+     */
+    bindingMessage: string;
+    /**
+     * RFC 8707 resource indicator(s) — the API the token is for. Optional in the type, but
+     * REQUIRED by Cbox ID for self-registered clients.
+     * Its settings also decide whether a keyless (`none`) client may use CIBA at all.
+     */
+    resource?: string | string[];
+    /** Seconds the request may wait for approval (the server may shorten it). */
+    requestedExpiry?: number;
+    /** Echoed into the id_token, so you can bind it to this request. */
+    nonce?: string;
+}
+/** A started CIBA request. Persistable as JSON. */
+interface BackchannelAuthorization {
+    authReqId: string;
+    expiresIn: number;
+    /** Seconds between polls. */
+    interval: number;
+    /** Epoch ms after which polling is pointless. */
+    expiresAt: number;
+    /** The resource(s) the request named, re-sent on every poll (the server checks they match). */
+    resource: string[];
+}
+/**
+ * Start a CIBA request (OpenID CIBA Core §7, poll mode): Cbox ID shows `bindingMessage` to
+ * the person named by `loginHint` and waits for Approve.
+ *
+ * `backchannel_user_code_parameter` is not supported by Cbox ID, so no user code is sent.
+ *
+ * @throws InvalidClientError, UnknownUserIdError, InvalidBindingMessageError,
+ *   InvalidTargetError, SlowDownError, AgentGrantError.
+ */
+declare function startBackchannel(options: StartBackchannelOptions): Promise<BackchannelAuthorization>;
+interface PollBackchannelOptions extends ClientOptions {
+    authorization: Pick<BackchannelAuthorization, 'authReqId' | 'resource'>;
+}
+/**
+ * Poll the token endpoint once for a CIBA request.
+ *
+ * @throws AccessDeniedError, ExpiredTokenError, InvalidGrantError, InvalidTargetError,
+ *   InvalidClientError, AgentGrantError.
+ */
+declare function pollBackchannel(options: PollBackchannelOptions): Promise<PollResult>;
+/**
+ * Poll until the person approves, and return the tokens.
+ *
+ * Waits `interval` seconds before each poll; on `slow_down` (or a 429) adds five seconds
+ * for good and waits at least `Retry-After`; keeps going on `authorization_pending`; stops
+ * on anything final. Throws {@link ExpiredTokenError} once `expiresAt` passes and
+ * {@link GrantCancelledError} when `signal` fires — wire it to Ctrl-C.
+ */
+declare function waitForBackchannelToken(options: PollBackchannelOptions & WaitOptions & {
+    authorization: BackchannelAuthorization;
+}): Promise<AgentTokens>;
+interface StartDeviceAuthorizationOptions extends ClientOptions {
+    scope?: string | string[];
+    /** RFC 8707 resource indicator(s). */
+    resource?: string | string[];
+}
+/** A started device authorization. Persistable as JSON. */
+interface DeviceGrantAuthorization {
+    deviceCode: string;
+    /** Show this to the person. */
+    userCode: string;
+    /** Where they enter it. */
+    verificationUri: string;
+    /** The same page with the code filled in — good for a QR code or `open`. */
+    verificationUriComplete: string | null;
+    expiresIn: number;
+    interval: number;
+    expiresAt: number;
+    resource: string[];
+}
+/**
+ * Start the device authorization grant: you get a `userCode` to show and a
+ * `verificationUri` for the person to open on any device.
+ *
+ * @throws InvalidClientError, InvalidTargetError, SlowDownError, AgentGrantError.
+ */
+declare function startDeviceAuthorization(options: StartDeviceAuthorizationOptions): Promise<DeviceGrantAuthorization>;
+interface PollDeviceAuthorizationOptions extends ClientOptions {
+    authorization: Pick<DeviceGrantAuthorization, 'deviceCode' | 'resource'>;
+}
+/** Poll the token endpoint once for a device authorization. */
+declare function pollDeviceAuthorization(options: PollDeviceAuthorizationOptions): Promise<PollResult>;
+/** Poll until the person approves the device code. Same rules as {@link waitForBackchannelToken}. */
+declare function waitForDeviceToken(options: PollDeviceAuthorizationOptions & WaitOptions & {
+    authorization: DeviceGrantAuthorization;
+}): Promise<AgentTokens>;
+interface RefreshAgentTokensOptions extends ClientOptions {
+    refreshToken: string;
+    /** Narrow the scope (never widen it). */
+    scope?: string | string[];
+    /** RFC 8707 resource indicator(s) for the new access token. */
+    resource?: string | string[];
+}
+/**
+ * Exchange a refresh token, authenticating the same way the grant did (including
+ * `private_key_jwt`). Cbox ID rotates refresh tokens and revokes the family on reuse, so
+ * ALWAYS persist the returned `refreshToken` and discard the old one.
+ *
+ * @throws InvalidGrantError when the refresh token is no longer valid — sign in again.
+ */
+declare function refreshAgentTokens(options: RefreshAgentTokensOptions): Promise<AgentTokens>;
+
+/**
+ * Uppercase letters and digits a person cannot confuse when reading them off one screen
+ * and matching them on another: no 0/O, 1/I/L, 5/S, 2/Z, 8/B.
+ */
+declare const BINDING_CODE_ALPHABET = "ACDEFGHJKMNPQRTUVWXY34679";
+/**
+ * A short random code for a CIBA `binding_message`, e.g. `K7QM`.
+ *
+ * Show it in your terminal and put it in the binding message; Cbox ID shows the message
+ * beside Approve, and the person approves only when the two match. That is what stops a
+ * prompt somebody else triggered from being approved by reflex. Cbox ID requires a
+ * binding message from self-registered clients.
+ *
+ * Uniform over the alphabet (rejection sampling, WebCrypto randomness).
+ */
+declare function createBindingCode(length?: number): string;
+
+/**
+ * A CIBA, device-grant or registration request was refused with an OAuth error.
+ *
+ * Extends {@link AuthenticationError}, so `error`, `errorDescription`, `status` and
+ * `retryAfter` read the same as on every other back-channel failure in this SDK, and a
+ * caller already catching `AuthenticationError` keeps working. Branch on the subclass (or
+ * on `error`), never on the message.
+ *
+ * The REQUEST is never part of the error: these calls carry client assertions, secrets and
+ * device codes, and production CLIs log what they throw.
+ */
+declare class AgentGrantError extends AuthenticationError {
+}
+/** The person declined (`access_denied`). Final — do not poll again. */
+declare class AccessDeniedError extends AgentGrantError {
+}
+/**
+ * The `auth_req_id` or `device_code` expired before anyone approved it (`expired_token`).
+ * Also thrown locally when the wait outlives the request's `expires_in`. Start again.
+ */
+declare class ExpiredTokenError extends AgentGrantError {
+}
+/** The `auth_req_id`, `device_code` or refresh token is not valid (`invalid_grant`). */
+declare class InvalidGrantError extends AgentGrantError {
+}
+/**
+ * The `resource` (RFC 8707) is not one this client may ask for, the poll named a
+ * different resource than the request that started it, or the resource lets
+ * self-registered clients use CIBA only with `private_key_jwt` and this one is keyless
+ * (`invalid_target`).
+ */
+declare class InvalidTargetError extends AgentGrantError {
+}
+/**
+ * Client authentication failed (`invalid_client`): an unknown `client_id`, a bad secret, an
+ * assertion signed by a key the server does not hold, or a replayed `jti`.
+ */
+declare class InvalidClientError extends AgentGrantError {
+}
+/** The `login_hint` names nobody the server can reach (`unknown_user_id`). */
+declare class UnknownUserIdError extends AgentGrantError {
+}
+/**
+ * The `binding_message` is missing where the server requires one (self-registered clients),
+ * or too long to show beside Approve (`invalid_binding_message`).
+ */
+declare class InvalidBindingMessageError extends AgentGrantError {
+}
+/**
+ * The server asked us to slow down (`slow_down`, or HTTP 429). `retryAfter` carries the
+ * `Retry-After` seconds when the server sent them. The wait helpers absorb this themselves;
+ * it is thrown only from a call that does not loop (registration, starting a flow).
+ */
+declare class SlowDownError extends AgentGrantError {
+}
+/** The caller aborted the wait (its `AbortSignal` fired). */
+declare class GrantCancelledError extends CboxIdError {
+}
+
+export { AccessDeniedError, AgentGrantError, type AgentRequestOptions, type AgentServerOptions, type AgentTokens, AuthenticationError, type AuthorizationServerMetadata, BINDING_CODE_ALPHABET, type BackchannelAuthorization, CIBA_GRANT_TYPE, CboxIdError, type ClientAuth, type ClientKeyAlgorithm, type ClientKeyPair, DEVICE_CODE_GRANT_TYPE, type DeviceGrantAuthorization, ExpiredTokenError, GrantCancelledError, InvalidBindingMessageError, InvalidClientError, InvalidGrantError, InvalidTargetError, type PollBackchannelOptions, type PollDeviceAuthorizationOptions, type PollResult, type RefreshAgentTokensOptions, type RegisterAgentClientOptions, type RegisteredAgentClient, SlowDownError, type StartBackchannelOptions, type StartDeviceAuthorizationOptions, UnknownUserIdError, type WaitOptions, createBindingCode, createClientAssertion, discoverAuthorizationServer, generateClientKeyPair, pollBackchannel, pollDeviceAuthorization, refreshAgentTokens, registerAgentClient, startBackchannel, startDeviceAuthorization, waitForBackchannelToken, waitForDeviceToken };