@cboxdk/id-js 0.20.0 → 0.21.0

package/dist/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/agent/errors.ts","../src/agent/http.ts","../src/agent/client-auth.ts","../src/agent/register.ts","../src/agent/grants.ts","../src/agent/binding.ts"],"names":["alg"],"mappings":";;;;;;;AAaO,IAAM,eAAA,GAAN,cAA8B,mBAAA,CAAoB;AAAC;AAGnD,IAAM,iBAAA,GAAN,cAAgC,eAAA,CAAgB;AAAC;AAMjD,IAAM,iBAAA,GAAN,cAAgC,eAAA,CAAgB;AAAC;AAGjD,IAAM,iBAAA,GAAN,cAAgC,eAAA,CAAgB;AAAC;AAQjD,IAAM,kBAAA,GAAN,cAAiC,eAAA,CAAgB;AAAC;AAMlD,IAAM,kBAAA,GAAN,cAAiC,eAAA,CAAgB;AAAC;AAGlD,IAAM,kBAAA,GAAN,cAAiC,eAAA,CAAgB;AAAC;AAMlD,IAAM,0BAAA,GAAN,cAAyC,eAAA,CAAgB;AAAC;AAO1D,IAAM,aAAA,GAAN,cAA4B,eAAA,CAAgB;AAAC;AAG7C,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAC;AAEtD,IAAM,OAAA,GAAkD;AAAA,EACtD,aAAA,EAAe,iBAAA;AAAA,EACf,aAAA,EAAe,iBAAA;AAAA,EACf,aAAA,EAAe,iBAAA;AAAA,EACf,cAAA,EAAgB,kBAAA;AAAA,EAChB,cAAA,EAAgB,kBAAA;AAAA,EAChB,eAAA,EAAiB,kBAAA;AAAA,EACjB,uBAAA,EAAyB,0BAAA;AAAA,EACzB,SAAA,EAAW;AACb,CAAA;AAeA,eAAsB,iBAAiB,QAAA,EAA2C;AAChF,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AACjD,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,gBAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAEvC,IAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,MAAA,MAAM,MAAA,GAAS,MAAA;AACf,MAAA,KAAA,GAAQ,OAAO,MAAA,CAAO,OAAO,MAAM,QAAA,GAAW,MAAA,CAAO,OAAO,CAAA,GAAI,KAAA,CAAA;AAChE,MAAA,gBAAA,GAAmB,OAAO,MAAA,CAAO,mBAAmB,MAAM,QAAA,GAAW,MAAA,CAAO,mBAAmB,CAAA,GAAI,KAAA,CAAA;AAAA,IACrG;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAIA,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,KAAA,KAAU,MAAA,EAAW;AAClD,IAAA,KAAA,GAAQ,WAAA;AAAA,EACV;AAIA,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,EAAA,MAAM,UAAA,GAAa,MAAA,KAAW,IAAA,IAAQ,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,IAAA,EAAM,CAAA,GAAI,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,CAAA,GAAI,MAAA;AAE5F,EAAA,OAAO,EAAE,KAAA,EAAO,gBAAA,EAAkB,MAAA,EAAQ,QAAA,CAAS,QAAQ,UAAA,EAAW;AACxE;AAGO,SAAS,UAAA,CAAW,SAAuB,QAAA,EAAmC;AACnF,EAAA,MAAM,KAAA,GAAA,CAAS,QAAQ,KAAA,KAAU,MAAA,GAAY,QAAQ,OAAA,CAAQ,KAAK,IAAI,MAAA,KAAc,eAAA;AACpF,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,KAAA,IAAS,CAAA,KAAA,EAAQ,QAAQ,MAAM,CAAA,CAAA;AAEtD,EAAA,OAAO,IAAI,KAAA,CAAM,CAAA,EAAG,QAAQ,KAAK,MAAM,CAAA,CAAA,EAAI,OAAA,CAAQ,KAAA,EAAO,OAAA,CAAQ,gBAAA,EAAkB,OAAA,CAAQ,MAAA,EAAQ,QAAQ,UAAU,CAAA;AACxH;;;ACvEA,eAAsB,2BAAA,CACpB,MAAA,EACA,OAAA,GAA+B,EAAC,EACM;AACtC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,mBAAmB,0BAA0B,CAAA;AAAA,EACzD;AACA,EAAA,kBAAA,CAAmB,MAAM,CAAA;AAEzB,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,SAAA,CAAU,MAAM,CAAC,CAAA,uCAAA,CAAA;AAChC,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,EAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB,IAAK,OAAO,CAAA;AAEpG,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,oBAAoB,CAAA,qCAAA,EAAwC,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA,EAAK,MAAA,EAAW,MAAA,EAAW,QAAA,CAAS,MAAM,CAAA;AAAA,EACjI;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,SAAS,IAAA,EAAK;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,oBAAoB,iDAAiD,CAAA;AAAA,EACjF;AAEA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,EAAM;AAC3C,IAAA,MAAM,IAAI,oBAAoB,sDAAsD,CAAA;AAAA,EACtF;AAEA,EAAA,MAAM,QAAA,GAAW,GAAA;AAEjB,EAAA,IAAI,OAAO,QAAA,CAAS,MAAA,KAAW,QAAA,IAAY,SAAA,CAAU,SAAS,MAAM,CAAA,KAAM,SAAA,CAAU,MAAM,CAAA,EAAG;AAC3F,IAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,6DAAA,EAAgE,OAAO,QAAA,CAAS,MAAM,CAAC,CAAA,EAAA,CAAI,CAAA;AAAA,EAC3H;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,cAAA,KAAmB,QAAA,IAAY,QAAA,CAAS,mBAAmB,EAAA,EAAI;AACjF,IAAA,MAAM,IAAI,oBAAoB,0DAA0D,CAAA;AAAA,EAC1F;AAEA,EAAA,OAAO,QAAA;AACT;AAGO,SAAS,gBAAgB,OAAA,EAAmE;AACjG,EAAA,OAAO,OAAA,CAAQ,QAAA,KAAa,MAAA,GACxB,OAAA,CAAQ,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAA,GAChC,2BAAA,CAA4B,OAAA,CAAQ,MAAA,EAAQ,OAAO,CAAA;AACzD;AAGO,SAAS,eAAA,CACd,QAAA,EACA,IAAA,EACA,IAAA,EACQ;AACR,EAAA,MAAM,KAAA,GAAQ,SAAS,IAAI,CAAA;AAC3B,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA,EAAI;AAC7C,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,2CAAA,EAA8C,IAAI,CAAA,yBAAA,EAA4B,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,EACpH;AACA,EAAA,OAAO,KAAA;AACT;AAMA,eAAsB,IAAA,CAAK,GAAA,EAAa,IAAA,EAAmB,OAAA,EAAiD;AAC1G,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC9C,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,OAAA,CAAQ,aAAa,GAAM,CAAA;AAC9E,EAAA,MAAM,OAAA,GAAU,MAAY,UAAA,CAAW,KAAA,EAAM;AAE7C,EAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,KAAY,IAAA,EAAM;AACpC,IAAA,YAAA,CAAa,KAAK,CAAA;AAClB,IAAA,MAAM,IAAI,oBAAoB,4BAA4B,CAAA;AAAA,EAC5D;AACA,EAAA,OAAA,CAAQ,QAAQ,gBAAA,CAAiB,OAAA,EAAS,SAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAEjE,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,UAAU,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,EACpE,SAAS,KAAA,EAAO;AAGd,IAAA,IAAK,OAAA,CAAQ,MAAA,EAAoC,OAAA,KAAY,IAAA,EAAM;AACjE,MAAA,MAAM,IAAI,oBAAoB,4BAA4B,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI,UAAA,CAAW,OAAO,OAAA,EAAS;AAC7B,MAAA,MAAM,IAAI,oBAAoB,CAAA,eAAA,EAAkB,IAAI,IAAI,GAAG,CAAA,CAAE,MAAM,CAAA,WAAA,CAAa,CAAA;AAAA,IAClF;AACA,IAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,eAAA,EAAkB,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,MAAM,CAAA,SAAA,EAAY,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,EAChG,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAClB,IAAA,OAAA,CAAQ,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AAAA,EACtD;AACF;AAEO,SAAS,UAAU,KAAA,EAAuB;AAC/C,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACjC;ACzFA,eAAsB,qBAAA,CAAsB,MAA0B,OAAA,EAAiC;AACrG,EAAA,MAAM,EAAE,SAAA,EAAW,UAAA,EAAW,GAAI,MAAM,gBAAgB,GAAA,EAAK,EAAE,WAAA,EAAa,IAAA,EAAM,CAAA;AAClF,EAAA,MAAM,UAAA,GAAa,MAAM,SAAA,CAAU,SAAS,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,MAAM,sBAAA,CAAuB,UAAA,EAAY,QAAQ,CAAA;AAE7D,EAAA,MAAM,YAAiB,EAAE,GAAG,YAAY,GAAA,EAAK,GAAA,EAAK,KAAK,KAAA,EAAM;AAC7D,EAAA,MAAM,UAAA,GAAkB,EAAE,GAAI,MAAM,SAAA,CAAU,UAAU,CAAA,EAAI,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,KAAA,EAAM;AAEjF,EAAA,OAAO,EAAE,GAAA,EAAK,GAAA,EAAK,SAAA,EAAW,YAAY,UAAA,EAAW;AACvD;AAOA,eAAsB,qBAAA,CACpB,IAAA,EACA,QAAA,EACA,OAAA,GAA4D,EAAC,EAC5C;AACjB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,QAAQ,eAAA,IAAmB,EAAA,EAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AACxE,EAAA,MAAM,UAAA,GAAa,KAAK,KAAA,CAAA,CAAO,OAAA,CAAQ,OAAO,IAAA,CAAK,GAAA,MAAS,GAAI,CAAA;AAChE,EAAA,MAAM,EAAE,GAAA,EAAK,GAAA,EAAK,KAAI,GAAI,MAAM,WAAW,IAAI,CAAA;AAE/C,EAAA,MAAM,MAAA,GAAwC,EAAE,GAAA,EAAI;AACpD,EAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,IAAA,MAAA,CAAO,GAAA,GAAM,GAAA;AAAA,EACf;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,EAAE,EAClB,kBAAA,CAAmB,MAAM,CAAA,CACzB,SAAA,CAAU,IAAA,CAAK,QAAQ,CAAA,CACvB,UAAA,CAAW,KAAK,QAAQ,CAAA,CACxB,WAAA,CAAY,QAAQ,CAAA,CACpB,MAAA,CAAO,WAAA,CAAY,EAAE,CAAC,CAAA,CACtB,WAAA,CAAY,UAAU,CAAA,CACtB,iBAAA,CAAkB,UAAA,GAAa,QAAQ,CAAA,CACvC,KAAK,GAAG,CAAA;AACb;AAOA,eAAsB,eAAA,CACpB,IAAA,EACA,IAAA,EACA,OAAA,EACA,QAAA,EACe;AACf,EAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,IAAA,MAAM,IAAI,mBAAmB,2BAA2B,CAAA;AAAA,EAC1D;AAEA,EAAA,QAAQ,KAAK,MAAA;AAAQ,IACnB,KAAK,iBAAA;AACH,MAAA,IAAA,CAAK,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,QAAQ,CAAA;AACnC,MAAA,IAAA,CAAK,GAAA,CAAI,yBAAyB,wDAAwD,CAAA;AAC1F,MAAA,IAAA,CAAK,IAAI,kBAAA,EAAoB,MAAM,qBAAA,CAAsB,IAAA,EAAM,QAAQ,CAAC,CAAA;AACxE,MAAA;AAAA,IACF,KAAK,qBAAA;AACH,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,QAAA,MAAM,IAAI,mBAAmB,+CAA+C,CAAA;AAAA,MAC9E;AAEA,MAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,MAAA,EAAS,IAAA,CAAK,GAAG,UAAA,CAAW,IAAA,CAAK,QAAQ,CAAC,IAAI,UAAA,CAAW,IAAA,CAAK,YAAY,CAAC,EAAE,CAAC,CAAA,CAAA;AACzG,MAAA;AAAA,IACF,KAAK,oBAAA;AACH,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,QAAA,MAAM,IAAI,mBAAmB,8CAA8C,CAAA;AAAA,MAC7E;AACA,MAAA,IAAA,CAAK,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,QAAQ,CAAA;AACnC,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,YAAY,CAAA;AAC3C,MAAA;AAAA,IACF,KAAK,MAAA;AACH,MAAA,IAAA,CAAK,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,QAAQ,CAAA;AACnC,MAAA;AAAA;AAEN;AAEA,eAAe,WACb,IAAA,EAC4F;AAC5F,EAAA,MAAM,SAAS,IAAA,CAAK,UAAA;AAEpB,EAAA,IAAI,WAAA,CAAY,MAAM,CAAA,EAAG;AACvB,IAAA,MAAMA,IAAAA,GAAM,IAAA,CAAK,GAAA,IAAO,gBAAA,CAAiB,MAAM,CAAA;AAC/C,IAAA,OAAO,EAAE,GAAA,EAAK,MAAA,EAAQ,KAAAA,IAAAA,EAAK,GAAA,EAAK,KAAK,GAAA,EAAI;AAAA,EAC3C;AAEA,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,KAAW,QAAQ,OAAO,MAAA,CAAO,MAAM,QAAA,EAAU;AACjF,IAAA,MAAM,IAAI,mBAAmB,+DAA+D,CAAA;AAAA,EAC9F;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,UAAA,CAAW,MAAM,CAAA;AACzC,EAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,MAAA,EAAQ,GAAG,CAAA;AAEvC,EAAA,OAAO,EAAE,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,IAAA,CAAK,GAAA,KAAQ,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,GAAA,GAAM,MAAA,CAAA,EAAW;AAChG;AAEA,SAAS,YAAY,KAAA,EAAoC;AACvD,EAAA,OAAO,OAAO,SAAA,KAAc,WAAA,IAAe,KAAA,YAAiB,SAAA;AAC9D;AAEA,SAAS,iBAAiB,GAAA,EAAoC;AAC5D,EAAA,IAAI,GAAA,CAAI,SAAA,CAAU,IAAA,KAAS,OAAA,EAAS;AAClC,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,IAAI,GAAA,CAAI,SAAA,CAAU,IAAA,KAAS,mBAAA,EAAqB;AAC9C,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,iCAAA,EAAoC,GAAA,CAAI,SAAA,CAAU,IAAI,CAAA,qBAAA,CAAuB,CAAA;AAC5G;AAEA,SAAS,WAAW,GAAA,EAA8B;AAChD,EAAA,IAAI,GAAA,CAAI,GAAA,KAAQ,OAAA,IAAW,GAAA,CAAI,QAAQ,OAAA,EAAS;AAC9C,IAAA,OAAO,GAAA,CAAI,GAAA;AAAA,EACb;AACA,EAAA,IAAI,GAAA,CAAI,QAAQ,MAAA,IAAa,GAAA,CAAI,QAAQ,IAAA,IAAQ,GAAA,CAAI,QAAQ,OAAA,EAAS;AACpE,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,IAAI,GAAA,CAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,CAAI,QAAQ,KAAA,EAAO;AAC9C,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,mBAAmB,uDAAuD,CAAA;AACtF;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,OAAO,kBAAA,CAAmB,KAAK,CAAA,CAAE,OAAA,CAAQ,QAAQ,GAAG,CAAA;AACtD;;;ACrLO,IAAM,eAAA,GAAkB;AAExB,IAAM,sBAAA,GAAyB;AAqDtC,eAAsB,oBAAoB,OAAA,EAAqE;AAC7G,EAAA,IAAI,CAAC,QAAQ,UAAA,EAAY;AACvB,IAAA,MAAM,IAAI,mBAAmB,2BAA2B,CAAA;AAAA,EAC1D;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG;AACnC,IAAA,MAAM,IAAI,mBAAmB,4CAA4C,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,OAAO,CAAA;AAC9C,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,QAAA,EAAU,uBAAA,EAAyB,6BAA6B,CAAA;AACjG,EAAA,MAAM,MAAA,GAAS,QAAQ,uBAAA,IAA2B,iBAAA;AAElD,EAAA,MAAM,OAAA,GAAU,MAAA,KAAW,iBAAA,GACvB,OAAA,CAAQ,OAAA,IAAY,MAAM,qBAAA,CAAsB,OAAA,CAAQ,GAAA,IAAO,OAAO,CAAA,GACtE,IAAA;AAEJ,EAAA,MAAM,QAAA,GAAoC;AAAA,IACxC,GAAG,OAAA,CAAQ,aAAA;AAAA,IACX,aAAa,OAAA,CAAQ,UAAA;AAAA,IACrB,aAAa,OAAA,CAAQ,UAAA;AAAA,IACrB,0BAAA,EAA4B,MAAA;AAAA;AAAA;AAAA,IAG5B,eAAe,EAAC;AAAA,IAChB,gBAAgB;AAAC,GACnB;AAEA,EAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAC/B,IAAA,QAAA,CAAS,OAAO,CAAA,GAAI,WAAA,CAAY,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,YAAY,IAAA,EAAM;AACpB,IAAA,QAAA,CAAS,MAAM,CAAA,GAAI,EAAE,MAAM,CAAC,OAAA,CAAQ,SAAS,CAAA,EAAE;AAAA,EACjD;AAEA,EAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AACzG,EAAA,IAAI,QAAQ,kBAAA,EAAoB;AAC9B,IAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,OAAA,CAAQ,kBAAkB,CAAA,CAAA;AAAA,EACjE;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,EAAU,EAAE,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA,IAAK,OAAO,CAAA;AAE1G,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,UAAA,CAAW,MAAM,gBAAA,CAAiB,QAAQ,GAAG,4BAA4B,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,MAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,EAAA,MAAM,QAAA,GAAW,MAAM,WAAW,CAAA;AAElC,EAAA,IAAI,QAAQ,IAAA,IAAQ,OAAO,QAAA,KAAa,QAAA,IAAY,aAAa,EAAA,EAAI;AACnE,IAAA,MAAM,IAAI,oBAAoB,iDAAiD,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,YAAA,GAAe,OAAO,GAAA,CAAI,eAAe,MAAM,QAAA,GAAW,GAAA,CAAI,eAAe,CAAA,GAAI,IAAA;AACvF,EAAA,MAAM,gBAAA,GAAmB,OAAO,GAAA,CAAI,4BAA4B,MAAM,QAAA,GAAW,GAAA,CAAI,4BAA4B,CAAA,GAAI,MAAA;AAErH,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,YAAY,IAAA,EAAM;AACpB,IAAA,IAAA,GAAO,EAAE,MAAA,EAAQ,iBAAA,EAAmB,QAAA,EAAU,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAY,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAK,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAI;AAAA,EACnH,CAAA,MAAA,IAAW,iBAAiB,IAAA,EAAM;AAChC,IAAA,IAAA,GAAO,EAAE,MAAA,EAAQ,qBAAA,EAAuB,QAAA,EAAU,YAAA,EAAa;AAAA,EACjE,CAAA,MAAO;AACL,IAAA,IAAA,GAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,QAAA,EAAS;AAAA,EACpC;AAEA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,YAAA;AAAA,IACA,uBAAA,EAAyB,OAAO,GAAA,CAAI,2BAA2B,MAAM,QAAA,GAAW,GAAA,CAAI,2BAA2B,CAAA,GAAI,IAAA;AAAA,IACnH,qBAAA,EAAuB,OAAO,GAAA,CAAI,yBAAyB,MAAM,QAAA,GAAW,GAAA,CAAI,yBAAyB,CAAA,GAAI,IAAA;AAAA,IAC7G,uBAAA,EAAyB,gBAAA;AAAA,IACzB,YAAY,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CAAA,GAAI,GAAA,CAAI,aAAa,CAAA,CAAE,OAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAQ,IAAI,OAAA,CAAQ,UAAA;AAAA,IAC/H,KAAA,EAAO,OAAO,GAAA,CAAI,OAAO,MAAM,QAAA,GAAW,GAAA,CAAI,OAAO,CAAA,GAAI,IAAA;AAAA,IACzD,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAEO,SAAS,YAAY,KAAA,EAAkC;AAC5D,EAAA,OAAA,CAAQ,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,CAAM,MAAM,KAAK,CAAA,GAAI,KAAA,EAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,KAAM,EAAE,CAAA,CAAE,KAAK,GAAG,CAAA;AAClG;;;AC7CA,eAAsB,iBAAiB,OAAA,EAAqE;AAC1G,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,OAAO,CAAA;AAC9C,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,QAAA,EAAU,qCAAA,EAAuC,MAAM,CAAA;AAExF,EAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,IAAA,MAAM,IAAI,mBAAmB,0BAA0B,CAAA;AAAA,EACzD;AAEA,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,OAAA,CAAQ,QAAQ,CAAA;AAC9C,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB,EAAE,UAAA,EAAY,OAAA,CAAQ,SAAA,EAAW,KAAA,EAAO,WAAA,CAAY,OAAA,CAAQ,KAAK,CAAA,EAAG,CAAA;AAErG,EAAA,IAAI,OAAA,CAAQ,mBAAmB,EAAA,EAAI;AACjC,IAAA,IAAA,CAAK,GAAA,CAAI,iBAAA,EAAmB,OAAA,CAAQ,cAAc,CAAA;AAAA,EACpD;AACA,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,IAAA,CAAK,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAC3B;AACA,EAAA,IAAI,OAAA,CAAQ,oBAAoB,MAAA,EAAW;AACzC,IAAA,IAAA,CAAK,GAAA,CAAI,kBAAA,EAAoB,MAAA,CAAO,OAAA,CAAQ,eAAe,CAAC,CAAA;AAAA,EAC9D;AACA,EAAA,IAAI,OAAA,CAAQ,KAAA,KAAU,MAAA,IAAa,OAAA,CAAQ,UAAU,EAAA,EAAI;AACvD,IAAA,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,OAAA,CAAQ,KAAK,CAAA;AAAA,EACjC;AAEA,EAAA,MAAM,UAAU,MAAM,QAAA,CAAS,UAAU,IAAA,EAAM,OAAA,EAAS,UAAU,2CAA2C,CAAA;AAC7G,EAAA,MAAM,SAAA,GAAY,QAAQ,aAAa,CAAA;AAEvC,EAAA,IAAI,OAAO,SAAA,KAAc,QAAA,IAAY,SAAA,KAAc,EAAA,EAAI;AACrD,IAAA,MAAM,IAAI,oBAAoB,iEAAiE,CAAA;AAAA,EACjG;AAEA,EAAA,MAAM,SAAA,GAAY,cAAA,CAAe,OAAA,CAAQ,YAAY,CAAC,CAAA,IAAK,GAAA;AAE3D,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,SAAA;AAAA;AAAA,IAEA,QAAA,EAAU,cAAA,CAAe,OAAA,CAAQ,UAAU,CAAC,CAAA,IAAK,CAAA;AAAA,IACjD,SAAA,EAAW,MAAM,SAAA,GAAY,GAAA;AAAA,IAC7B;AAAA,GACF;AACF;AAYA,eAAsB,gBAAgB,OAAA,EAAsD;AAC1F,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB,EAAE,UAAA,EAAY,iBAAiB,WAAA,EAAa,OAAA,CAAQ,aAAA,CAAc,SAAA,EAAW,CAAA;AAC9G,EAAA,OAAO,UAAU,IAAA,EAAM,OAAA,CAAQ,aAAA,CAAc,QAAA,EAAU,SAAS,kCAAkC,CAAA;AACpG;AAUA,eAAsB,wBACpB,OAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,OAAO,CAAA;AAC9C,EAAA,MAAM,gBAAgB,OAAA,CAAQ,aAAA;AAE9B,EAAA,OAAO,QAAA,CAAS,aAAA,EAAe,OAAA,EAAS,MAAM,eAAA,CAAgB,EAAE,GAAG,OAAA,EAAS,QAAA,EAAU,CAAA,EAAG,qBAAqB,CAAA;AAChH;AAiCA,eAAsB,yBAAyB,OAAA,EAA6E;AAC1H,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,OAAO,CAAA;AAC9C,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,QAAA,EAAU,+BAAA,EAAiC,kBAAkB,CAAA;AAC9F,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,OAAA,CAAQ,QAAQ,CAAA;AAC9C,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AAEjC,EAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAC/B,IAAA,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,WAAA,CAAY,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,IAAA,CAAK,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAC3B;AAEA,EAAA,MAAM,UAAU,MAAM,QAAA,CAAS,UAAU,IAAA,EAAM,OAAA,EAAS,UAAU,qCAAqC,CAAA;AACvG,EAAA,MAAM,UAAA,GAAa,QAAQ,aAAa,CAAA;AACxC,EAAA,MAAM,QAAA,GAAW,QAAQ,WAAW,CAAA;AACpC,EAAA,MAAM,eAAA,GAAkB,QAAQ,kBAAkB,CAAA;AAElD,EAAA,IAAI,OAAO,eAAe,QAAA,IAAY,OAAO,aAAa,QAAA,IAAY,OAAO,oBAAoB,QAAA,EAAU;AACzG,IAAA,MAAM,IAAI,oBAAoB,mDAAmD,CAAA;AAAA,EACnF;AAEA,EAAA,MAAM,SAAA,GAAY,cAAA,CAAe,OAAA,CAAQ,YAAY,CAAC,CAAA,IAAK,GAAA;AAE3D,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAA;AAAA,IACA,uBAAA,EAAyB,OAAO,OAAA,CAAQ,2BAA2B,MAAM,QAAA,GAAW,OAAA,CAAQ,2BAA2B,CAAA,GAAI,IAAA;AAAA,IAC3H,SAAA;AAAA;AAAA,IAEA,QAAA,EAAU,cAAA,CAAe,OAAA,CAAQ,UAAU,CAAC,CAAA,IAAK,CAAA;AAAA,IACjD,SAAA,EAAW,MAAM,SAAA,GAAY,GAAA;AAAA,IAC7B;AAAA,GACF;AACF;AAOA,eAAsB,wBAAwB,OAAA,EAA8D;AAC1G,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB,EAAE,UAAA,EAAY,wBAAwB,WAAA,EAAa,OAAA,CAAQ,aAAA,CAAc,UAAA,EAAY,CAAA;AACtH,EAAA,OAAO,UAAU,IAAA,EAAM,OAAA,CAAQ,aAAA,CAAc,QAAA,EAAU,SAAS,6BAA6B,CAAA;AAC/F;AAGA,eAAsB,mBACpB,OAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,OAAO,CAAA;AAE9C,EAAA,OAAO,QAAA,CAAS,OAAA,CAAQ,aAAA,EAAe,OAAA,EAAS,MAAM,uBAAA,CAAwB,EAAE,GAAG,OAAA,EAAS,QAAA,EAAU,CAAA,EAAG,aAAa,CAAA;AACxH;AAqBA,eAAsB,mBAAmB,OAAA,EAA0D;AACjG,EAAA,IAAI,CAAC,QAAQ,YAAA,EAAc;AACzB,IAAA,MAAM,IAAI,mBAAmB,6BAA6B,CAAA;AAAA,EAC5D;AAEA,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB,EAAE,YAAY,eAAA,EAAiB,aAAA,EAAe,OAAA,CAAQ,YAAA,EAAc,CAAA;AACrG,EAAA,IAAI,OAAA,CAAQ,UAAU,MAAA,EAAW;AAC/B,IAAA,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,WAAA,CAAY,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAC9C;AAIA,EAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,IAAA,EAAM,YAAA,CAAa,QAAQ,QAAQ,CAAA,EAAG,OAAA,EAAS,sBAAA,EAAwB,KAAK,CAAA;AAE3G,EAAA,OAAQ,MAAA,CAAuD,MAAA;AACjE;AAMA,eAAe,QAAA,CACb,aAAA,EACA,OAAA,EACA,IAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,YAAA;AAC/B,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,IAAA,CAAK,GAAA;AAChC,EAAA,IAAI,aAAa,IAAA,CAAK,GAAA,CAAI,aAAA,CAAc,QAAA,EAAU,CAAC,CAAA,GAAI,GAAA;AACvD,EAAA,IAAI,UAAA,GAAa,UAAA;AAEjB,EAAA,WAAS;AACP,IAAA,cAAA,CAAe,QAAQ,MAAM,CAAA;AAE7B,IAAA,IAAI,GAAA,EAAI,IAAK,aAAA,CAAc,SAAA,EAAW;AACpC,MAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,IAAA,EAAO,IAAI,iDAAiD,eAAe,CAAA;AAAA,IACzG;AAEA,IAAA,MAAM,KAAA,CAAM,UAAA,EAAY,OAAA,CAAQ,MAAM,CAAA;AAEtC,IAAA,cAAA,CAAe,QAAQ,MAAM,CAAA;AAE7B,IAAA,IAAI,GAAA,EAAI,IAAK,aAAA,CAAc,SAAA,EAAW;AACpC,MAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,IAAA,EAAO,IAAI,iDAAiD,eAAe,CAAA;AAAA,IACzG;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,EAAK;AAE1B,IAAA,IAAI,MAAA,CAAO,WAAW,UAAA,EAAY;AAChC,MAAA,OAAO,MAAA,CAAO,MAAA;AAAA,IAChB;AAEA,IAAA,IAAI,MAAA,CAAO,WAAW,WAAA,EAAa;AAGjC,MAAA,UAAA,IAAc,GAAA;AACd,MAAA,UAAA,GAAa,KAAK,GAAA,CAAI,UAAA,EAAA,CAAa,MAAA,CAAO,UAAA,IAAc,KAAK,GAAI,CAAA;AACjE,MAAA;AAAA,IACF;AAEA,IAAA,UAAA,GAAa,UAAA;AAAA,EACf;AACF;AAEA,eAAe,UACb,IAAA,EACA,QAAA,EACA,OAAA,EACA,QAAA,EACA,UAAU,IAAA,EACW;AACrB,EAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,OAAO,CAAA;AAC9C,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,QAAA,EAAU,gBAAA,EAAkB,gBAAgB,CAAA;AAI7E,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,IAAA,CAAK,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAC3B;AAEA,EAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAC1H,EAAA,MAAM,gBAAgB,OAAA,CAAQ,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,SAAS,cAAc,CAAA;AAE5E,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,EAAU,EAAE,QAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAK,EAAG,OAAO,CAAA;AAEhF,EAAA,IAAI,SAAS,EAAA,EAAI;AACf,IAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,QAAQ,MAAM,UAAA,CAAW,QAAQ,CAAA,EAAE;AAAA,EAClE;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,gBAAA,CAAiB,QAAQ,CAAA;AAE/C,EAAA,IAAI,OAAA,IAAW,OAAA,CAAQ,KAAA,KAAU,uBAAA,EAAyB;AACxD,IAAA,OAAO,EAAE,QAAQ,SAAA,EAAU;AAAA,EAC7B;AACA,EAAA,IAAI,OAAA,IAAW,OAAA,CAAQ,KAAA,KAAU,WAAA,EAAa;AAC5C,IAAA,OAAO,EAAE,MAAA,EAAQ,WAAA,EAAa,UAAA,EAAY,OAAA,CAAQ,cAAc,IAAA,EAAK;AAAA,EACvE;AAEA,EAAA,MAAM,UAAA,CAAW,SAAS,QAAQ,CAAA;AACpC;AAEA,eAAe,QAAA,CACb,QAAA,EACA,IAAA,EACA,OAAA,EACA,UACA,QAAA,EACkC;AAClC,EAAA,MAAM,OAAA,GAAkC,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAC1H,EAAA,MAAM,gBAAgB,OAAA,CAAQ,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,SAAS,cAAc,CAAA;AAE5E,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,EAAU,EAAE,QAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAK,EAAG,OAAO,CAAA;AAEhF,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,UAAA,CAAW,MAAM,gBAAA,CAAiB,QAAQ,GAAG,QAAQ,CAAA;AAAA,EAC7D;AAEA,EAAA,MAAM,UAAmB,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC/D,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,KAAY,IAAA,EAAM;AACnD,IAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,EAAG,QAAQ,CAAA,qCAAA,CAAuC,CAAA;AAAA,EAClF;AACA,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,WAAW,QAAA,EAA0C;AAClE,EAAA,MAAM,MAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACnD,EAAA,MAAM,WAAA,GAAc,MAAM,cAAc,CAAA;AAExC,EAAA,IAAI,QAAQ,IAAA,IAAQ,OAAO,WAAA,KAAgB,QAAA,IAAY,gBAAgB,EAAA,EAAI;AACzE,IAAA,MAAM,IAAI,oBAAoB,6CAA6C,CAAA;AAAA,EAC7E;AAEA,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,SAAA,EAAW,OAAO,GAAA,CAAI,YAAY,MAAM,QAAA,GAAW,GAAA,CAAI,YAAY,CAAA,GAAI,QAAA;AAAA,IACvE,SAAA,EAAW,OAAO,GAAA,CAAI,YAAY,MAAM,QAAA,GAAW,GAAA,CAAI,YAAY,CAAA,GAAI,IAAA;AAAA,IACvE,YAAA,EAAc,OAAO,GAAA,CAAI,eAAe,MAAM,QAAA,GAAW,GAAA,CAAI,eAAe,CAAA,GAAI,IAAA;AAAA,IAChF,OAAA,EAAS,OAAO,GAAA,CAAI,UAAU,MAAM,QAAA,GAAW,GAAA,CAAI,UAAU,CAAA,GAAI,IAAA;AAAA,IACjE,KAAA,EAAO,OAAO,GAAA,CAAI,OAAO,MAAM,QAAA,GAAW,GAAA,CAAI,OAAO,CAAA,GAAI,IAAA;AAAA,IACzD;AAAA,GACF;AACF;AAEA,SAAS,aAAa,QAAA,EAAmD;AACvE,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,IAAA,GAAO,OAAO,QAAA,KAAa,QAAA,GAAW,CAAC,QAAQ,CAAA,GAAI,CAAC,GAAG,QAAQ,CAAA;AACrE,EAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AAEpB,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,IAAI,IAAI,CAAC,CAAA;AAAA,IACjB,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,0CAAA,EAA6C,CAAC,CAAA,EAAA,CAAI,CAAA;AAAA,IACjF;AACA,IAAA,IAAI,GAAA,CAAI,SAAS,EAAA,EAAI;AACnB,MAAA,MAAM,IAAI,mBAAmB,yCAAyC,CAAA;AAAA,IACxE;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,eAAe,KAAA,EAA+B;AACrD,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,MAAA,CAAO,SAAS,KAAK,CAAA,IAAK,KAAA,IAAS,CAAA,GAAI,KAAA,GAAQ,IAAA;AACrF;AAEA,SAAS,eAAe,MAAA,EAAuC;AAC7D,EAAA,IAAI,MAAA,EAAQ,YAAY,IAAA,EAAM;AAC5B,IAAA,MAAM,IAAI,oBAAoB,sCAAsC,CAAA;AAAA,EACtE;AACF;AAGA,SAAS,YAAA,CAAa,IAAY,MAAA,EAAqC;AACrE,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,IAAI,MAAA,EAAQ,YAAY,IAAA,EAAM;AAC5B,MAAA,MAAA,CAAO,IAAI,mBAAA,CAAoB,sCAAsC,CAAC,CAAA;AACtE,MAAA;AAAA,IACF;AACA,IAAA,MAAM,UAAU,MAAY;AAC1B,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAA,CAAO,IAAI,mBAAA,CAAoB,sCAAsC,CAAC,CAAA;AAAA,IACxE,CAAA;AACA,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,EAAQ,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAC5C,MAAA,OAAA,EAAQ;AAAA,IACV,GAAG,EAAE,CAAA;AACL,IAAA,MAAA,EAAQ,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC3D,CAAC,CAAA;AACH;;;AChdO,IAAM,qBAAA,GAAwB;AAY9B,SAAS,iBAAA,CAAkB,SAAS,CAAA,EAAW;AACpD,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,MAAM,KAAK,MAAA,GAAS,CAAA,IAAK,SAAS,EAAA,EAAI;AAC1D,IAAA,MAAM,IAAI,mBAAmB,wDAAwD,CAAA;AAAA,EACvF;AAEA,EAAA,MAAM,OAAO,qBAAA,CAAsB,MAAA;AAGnC,EAAA,MAAM,KAAA,GAAQ,MAAO,GAAA,GAAM,IAAA;AAC3B,EAAA,IAAI,IAAA,GAAO,EAAA;AAEX,EAAA,OAAO,IAAA,CAAK,SAAS,MAAA,EAAQ;AAC3B,IAAA,KAAA,MAAW,IAAA,IAAQ,OAAO,eAAA,CAAgB,IAAI,WAAW,MAAA,GAAS,CAAC,CAAC,CAAA,EAAG;AACrE,MAAA,IAAI,IAAA,GAAO,KAAA,IAAS,IAAA,CAAK,MAAA,GAAS,MAAA,EAAQ;AACxC,QAAA,IAAA,IAAQ,qBAAA,CAAsB,OAAO,IAAI,CAAA;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT","file":"agent.js","sourcesContent":["import { AuthenticationError, CboxIdError } from '../errors.js';\n\n/**\n * A CIBA, device-grant or registration request was refused with an OAuth error.\n *\n * Extends {@link AuthenticationError}, so `error`, `errorDescription`, `status` and\n * `retryAfter` read the same as on every other back-channel failure in this SDK, and a\n * caller already catching `AuthenticationError` keeps working. Branch on the subclass (or\n * on `error`), never on the message.\n *\n * The REQUEST is never part of the error: these calls carry client assertions, secrets and\n * device codes, and production CLIs log what they throw.\n */\nexport class AgentGrantError extends AuthenticationError {}\n\n/** The person declined (`access_denied`). Final — do not poll again. */\nexport class AccessDeniedError extends AgentGrantError {}\n\n/**\n * The `auth_req_id` or `device_code` expired before anyone approved it (`expired_token`).\n * Also thrown locally when the wait outlives the request's `expires_in`. Start again.\n */\nexport class ExpiredTokenError extends AgentGrantError {}\n\n/** The `auth_req_id`, `device_code` or refresh token is not valid (`invalid_grant`). */\nexport class InvalidGrantError extends AgentGrantError {}\n\n/**\n * The `resource` (RFC 8707) is not one this client may ask for, the poll named a\n * different resource than the request that started it, or the resource lets\n * self-registered clients use CIBA only with `private_key_jwt` and this one is keyless\n * (`invalid_target`).\n */\nexport class InvalidTargetError extends AgentGrantError {}\n\n/**\n * Client authentication failed (`invalid_client`): an unknown `client_id`, a bad secret, an\n * assertion signed by a key the server does not hold, or a replayed `jti`.\n */\nexport class InvalidClientError extends AgentGrantError {}\n\n/** The `login_hint` names nobody the server can reach (`unknown_user_id`). */\nexport class UnknownUserIdError extends AgentGrantError {}\n\n/**\n * The `binding_message` is missing where the server requires one (self-registered clients),\n * or too long to show beside Approve (`invalid_binding_message`).\n */\nexport class InvalidBindingMessageError extends AgentGrantError {}\n\n/**\n * The server asked us to slow down (`slow_down`, or HTTP 429). `retryAfter` carries the\n * `Retry-After` seconds when the server sent them. The wait helpers absorb this themselves;\n * it is thrown only from a call that does not loop (registration, starting a flow).\n */\nexport class SlowDownError extends AgentGrantError {}\n\n/** The caller aborted the wait (its `AbortSignal` fired). */\nexport class GrantCancelledError extends CboxIdError {}\n\nconst BY_CODE: Record<string, typeof AgentGrantError> = {\n  access_denied: AccessDeniedError,\n  expired_token: ExpiredTokenError,\n  invalid_grant: InvalidGrantError,\n  invalid_target: InvalidTargetError,\n  invalid_client: InvalidClientError,\n  unknown_user_id: UnknownUserIdError,\n  invalid_binding_message: InvalidBindingMessageError,\n  slow_down: SlowDownError,\n};\n\n/** A parsed `{ error, error_description }` body plus the bits of the response that matter. */\nexport interface OAuthFailure {\n  error: string | undefined;\n  errorDescription: string | undefined;\n  status: number;\n  retryAfter: number | undefined;\n}\n\n/**\n * Read an OAuth error body without ever echoing it. A 502 from a proxy is HTML, and an\n * error page that reflects the request would put a client assertion into a log line — so\n * only the server's own `error` code (or the status) reaches the message.\n */\nexport async function readOAuthFailure(response: Response): Promise<OAuthFailure> {\n  const text = await response.text().catch(() => '');\n  let error: string | undefined;\n  let errorDescription: string | undefined;\n\n  try {\n    const parsed: unknown = JSON.parse(text);\n\n    if (typeof parsed === 'object' && parsed !== null) {\n      const record = parsed as Record<string, unknown>;\n      error = typeof record['error'] === 'string' ? record['error'] : undefined;\n      errorDescription = typeof record['error_description'] === 'string' ? record['error_description'] : undefined;\n    }\n  } catch {\n    // Not JSON: the status alone is what there is to report.\n  }\n\n  // A 429 IS slow_down, whatever (or whether) the body says — the limiter in front of the\n  // endpoint may answer before the OAuth layer does.\n  if (response.status === 429 && error === undefined) {\n    error = 'slow_down';\n  }\n\n  // Seconds only. The HTTP-date form is legal but guessing at clock skew is worse than\n  // falling back to the +5s rule.\n  const header = response.headers.get('retry-after');\n  const retryAfter = header !== null && /^\\d+$/.test(header.trim()) ? Number(header.trim()) : undefined;\n\n  return { error, errorDescription, status: response.status, retryAfter };\n}\n\n/** The typed error for a failure: a subclass for the codes callers branch on, else the base. */\nexport function grantError(failure: OAuthFailure, fallback: string): AgentGrantError {\n  const Klass = (failure.error !== undefined ? BY_CODE[failure.error] : undefined) ?? AgentGrantError;\n  const detail = failure.error ?? `HTTP ${failure.status}`;\n\n  return new Klass(`${fallback}: ${detail}`, failure.error, failure.errorDescription, failure.status, failure.retryAfter);\n}\n","import { assertSecureIssuer } from '../issuer.js';\nimport { AuthenticationError, ConfigurationError } from '../errors.js';\nimport { GrantCancelledError } from './errors.js';\n\n/**\n * RFC 8414 authorization server metadata, as Cbox ID publishes it at\n * `{issuer}/.well-known/oauth-authorization-server`. Only the members this module reads are\n * typed; the rest pass through.\n */\nexport interface AuthorizationServerMetadata {\n  issuer: string;\n  token_endpoint: string;\n  registration_endpoint?: string;\n  backchannel_authentication_endpoint?: string;\n  device_authorization_endpoint?: string;\n  backchannel_token_delivery_modes_supported?: string[];\n  backchannel_user_code_parameter_supported?: boolean;\n  grant_types_supported?: string[];\n  token_endpoint_auth_methods_supported?: string[];\n  token_endpoint_auth_signing_alg_values_supported?: string[];\n  [member: string]: unknown;\n}\n\n/** Transport options every call in this module takes. */\nexport interface AgentRequestOptions {\n  /** A `fetch` to use instead of the global one (tests, proxies, instrumentation). */\n  fetch?: typeof fetch;\n  /** Per-request timeout in milliseconds. Default 10 000. */\n  timeoutMs?: number;\n  /** Abort the call (and, for the wait helpers, the whole wait). */\n  signal?: AbortSignal;\n}\n\n/** Where to find the server: its issuer, and optionally metadata you already discovered. */\nexport interface AgentServerOptions extends AgentRequestOptions {\n  /** The Cbox ID issuer, e.g. `https://acme.cboxid.com`. Must be https (loopback excepted). */\n  issuer: string;\n  /**\n   * Metadata from {@link discoverAuthorizationServer}. Pass it to skip a discovery round\n   * trip per call; omitted, each call discovers it (the wait helpers discover once).\n   */\n  metadata?: AuthorizationServerMetadata;\n}\n\n/**\n * Fetch and check the authorization server metadata (RFC 8414).\n *\n * The document's `issuer` must equal the one asked for (§3.3) — otherwise a host answering\n * with another tenant's metadata would receive this client's assertions and codes.\n */\nexport async function discoverAuthorizationServer(\n  issuer: string,\n  options: AgentRequestOptions = {},\n): Promise<AuthorizationServerMetadata> {\n  if (!issuer) {\n    throw new ConfigurationError('An `issuer` is required.');\n  }\n  assertSecureIssuer(issuer);\n\n  const url = `${trimSlash(issuer)}/.well-known/oauth-authorization-server`;\n  const response = await send(url, { method: 'GET', headers: { accept: 'application/json' } }, options);\n\n  if (!response.ok) {\n    throw new AuthenticationError(`Discovery request failed with status ${response.status}.`, undefined, undefined, response.status);\n  }\n\n  let doc: unknown;\n  try {\n    doc = await response.json();\n  } catch {\n    throw new AuthenticationError('The authorization server metadata was not JSON.');\n  }\n\n  if (typeof doc !== 'object' || doc === null) {\n    throw new AuthenticationError('The authorization server metadata was not an object.');\n  }\n\n  const metadata = doc as AuthorizationServerMetadata;\n\n  if (typeof metadata.issuer !== 'string' || trimSlash(metadata.issuer) !== trimSlash(issuer)) {\n    throw new AuthenticationError(`The authorization server metadata is for a different issuer (${String(metadata.issuer)}).`);\n  }\n  if (typeof metadata.token_endpoint !== 'string' || metadata.token_endpoint === '') {\n    throw new AuthenticationError('The authorization server metadata has no token_endpoint.');\n  }\n\n  return metadata;\n}\n\n/** Metadata from the options, or discovered. */\nexport function resolveMetadata(options: AgentServerOptions): Promise<AuthorizationServerMetadata> {\n  return options.metadata !== undefined\n    ? Promise.resolve(options.metadata)\n    : discoverAuthorizationServer(options.issuer, options);\n}\n\n/** A named endpoint, or a ConfigurationError saying the server does not offer it. */\nexport function requireEndpoint(\n  metadata: AuthorizationServerMetadata,\n  name: 'registration_endpoint' | 'backchannel_authentication_endpoint' | 'device_authorization_endpoint' | 'token_endpoint',\n  what: string,\n): string {\n  const value = metadata[name];\n  if (typeof value !== 'string' || value === '') {\n    throw new ConfigurationError(`This Cbox ID instance does not advertise a ${name}, so it does not support ${what}.`);\n  }\n  return value;\n}\n\n/**\n * `fetch` with a timeout and the caller's signal combined. A caller abort becomes\n * {@link GrantCancelledError}; a timeout or network failure an {@link AuthenticationError}.\n */\nexport async function send(url: string, init: RequestInit, options: AgentRequestOptions): Promise<Response> {\n  const fetchImpl = options.fetch ?? globalThis.fetch;\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 10_000);\n  const onAbort = (): void => controller.abort();\n\n  if (options.signal?.aborted === true) {\n    clearTimeout(timer);\n    throw new GrantCancelledError('The request was cancelled.');\n  }\n  options.signal?.addEventListener('abort', onAbort, { once: true });\n\n  try {\n    return await fetchImpl(url, { ...init, signal: controller.signal });\n  } catch (error) {\n    // Re-read through a widened type: the early return above narrowed `aborted` to false,\n    // but the signal may have fired while the request was in flight.\n    if ((options.signal as AbortSignal | undefined)?.aborted === true) {\n      throw new GrantCancelledError('The request was cancelled.');\n    }\n    if (controller.signal.aborted) {\n      throw new AuthenticationError(`The request to ${new URL(url).origin} timed out.`);\n    }\n    throw new AuthenticationError(`The request to ${new URL(url).origin} failed: ${String(error)}`);\n  } finally {\n    clearTimeout(timer);\n    options.signal?.removeEventListener('abort', onAbort);\n  }\n}\n\nexport function trimSlash(value: string): string {\n  return value.replace(/\\/+$/, '');\n}\n","import { calculateJwkThumbprint, exportJWK, generateKeyPair, importJWK, SignJWT, type JWK } from 'jose';\nimport { ConfigurationError } from '../errors.js';\nimport { randomToken } from '../pkce.js';\n\n/** The client-assertion algorithms this module signs with. Cbox ID accepts both. */\nexport type ClientKeyAlgorithm = 'ES256' | 'RS256';\n\n/** A signing key pair for `private_key_jwt`, from {@link generateClientKeyPair}. */\nexport interface ClientKeyPair {\n  alg: ClientKeyAlgorithm;\n  /** The RFC 7638 thumbprint of the public key, used as `kid`. */\n  kid: string;\n  /** The public JWK (with `kid`, `alg`, `use: 'sig'`) — what registration sends in `jwks`. */\n  publicJwk: JWK;\n  /**\n   * The private JWK. PERSIST THIS, and only this, somewhere the user alone can read\n   * (mode 0600, the OS keychain). It is the client's credential: whoever holds it is the\n   * client. Never log it, never commit it.\n   */\n  privateJwk: JWK;\n  /** The private key as a WebCrypto `CryptoKey`, ready to sign with. */\n  privateKey: CryptoKey;\n}\n\n/**\n * How the client authenticates at the backchannel, device and token endpoints.\n *\n * - `private_key_jwt` (RFC 7523): a short-lived assertion signed with your private key.\n *   The right choice for a self-registered agent or CLI: nothing secret ever crosses the\n *   wire, and the server stores only the public key.\n * - `client_secret_basic` / `client_secret_post`: a console-issued secret.\n * - `none`: a public client names itself by `client_id` only. Fine for the device grant.\n *   For CIBA, Cbox ID accepts a keyless self-registered client only when the resource\n *   allows it (`dynamic_public_backchannel`); otherwise the answer is `invalid_target`.\n *   Prefer `private_key_jwt` for CIBA: a public `client_id` proves nothing, and CIBA has no front\n *   channel to bind the flow to.\n */\nexport type ClientAuth =\n  | {\n      method: 'private_key_jwt';\n      clientId: string;\n      /** A `CryptoKey`, or the private JWK you persisted from {@link generateClientKeyPair}. */\n      privateKey: CryptoKey | JWK;\n      /** Inferred from the key when omitted. */\n      alg?: ClientKeyAlgorithm;\n      /** Sent as the assertion's `kid`. Taken from a JWK's own `kid` when omitted. */\n      kid?: string;\n    }\n  | { method: 'client_secret_basic' | 'client_secret_post'; clientId: string; clientSecret: string }\n  | { method: 'none'; clientId: string };\n\n/**\n * A fresh signing key pair for `private_key_jwt`, generated with WebCrypto (via `jose`), so\n * it runs on Node, Deno, Bun and edge runtimes. ES256 by default — small keys, small\n * signatures. The private key is extractable on purpose: the caller must persist it.\n */\nexport async function generateClientKeyPair(alg: ClientKeyAlgorithm = 'ES256'): Promise<ClientKeyPair> {\n  const { publicKey, privateKey } = await generateKeyPair(alg, { extractable: true });\n  const publicBare = await exportJWK(publicKey);\n  const kid = await calculateJwkThumbprint(publicBare, 'sha256');\n\n  const publicJwk: JWK = { ...publicBare, kid, alg, use: 'sig' };\n  const privateJwk: JWK = { ...(await exportJWK(privateKey)), kid, alg, use: 'sig' };\n\n  return { alg, kid, publicJwk, privateJwk, privateKey };\n}\n\n/**\n * A signed RFC 7523 client assertion: `iss` = `sub` = client id, `aud` = the token\n * endpoint, a random `jti` (the server remembers it, so each assertion is single-use),\n * `iat` now and `exp` at most 60 seconds later.\n */\nexport async function createClientAssertion(\n  auth: Extract<ClientAuth, { method: 'private_key_jwt' }>,\n  audience: string,\n  options: { now?: () => number; lifetimeSeconds?: number } = {},\n): Promise<string> {\n  const lifetime = Math.min(Math.max(options.lifetimeSeconds ?? 60, 1), 60);\n  const nowSeconds = Math.floor((options.now ?? Date.now)() / 1000);\n  const { key, alg, kid } = await signingKey(auth);\n\n  const header: { alg: string; kid?: string } = { alg };\n  if (kid !== undefined) {\n    header.kid = kid;\n  }\n\n  return new SignJWT({})\n    .setProtectedHeader(header)\n    .setIssuer(auth.clientId)\n    .setSubject(auth.clientId)\n    .setAudience(audience)\n    .setJti(randomToken(16))\n    .setIssuedAt(nowSeconds)\n    .setExpirationTime(nowSeconds + lifetime)\n    .sign(key);\n}\n\n/**\n * Put client authentication on a request: fields in the form body, and/or an\n * `Authorization` header. `audience` is the token endpoint, the one value Cbox ID accepts\n * on assertions to all of its endpoints.\n */\nexport async function applyClientAuth(\n  auth: ClientAuth,\n  body: URLSearchParams,\n  headers: Record<string, string>,\n  audience: string,\n): Promise<void> {\n  if (!auth.clientId) {\n    throw new ConfigurationError('A `clientId` is required.');\n  }\n\n  switch (auth.method) {\n    case 'private_key_jwt':\n      body.set('client_id', auth.clientId);\n      body.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');\n      body.set('client_assertion', await createClientAssertion(auth, audience));\n      return;\n    case 'client_secret_basic':\n      if (!auth.clientSecret) {\n        throw new ConfigurationError('`client_secret_basic` needs a `clientSecret`.');\n      }\n      // RFC 6749 §2.3.1: both halves are form-encoded before they are joined.\n      headers['authorization'] = `Basic ${btoa(`${formEncode(auth.clientId)}:${formEncode(auth.clientSecret)}`)}`;\n      return;\n    case 'client_secret_post':\n      if (!auth.clientSecret) {\n        throw new ConfigurationError('`client_secret_post` needs a `clientSecret`.');\n      }\n      body.set('client_id', auth.clientId);\n      body.set('client_secret', auth.clientSecret);\n      return;\n    case 'none':\n      body.set('client_id', auth.clientId);\n      return;\n  }\n}\n\nasync function signingKey(\n  auth: Extract<ClientAuth, { method: 'private_key_jwt' }>,\n): Promise<{ key: CryptoKey | Uint8Array; alg: ClientKeyAlgorithm; kid: string | undefined }> {\n  const source = auth.privateKey;\n\n  if (isCryptoKey(source)) {\n    const alg = auth.alg ?? algFromCryptoKey(source);\n    return { key: source, alg, kid: auth.kid };\n  }\n\n  if (typeof source !== 'object' || source === null || typeof source.d !== 'string') {\n    throw new ConfigurationError('`privateKey` must be a CryptoKey or a private JWK (with `d`).');\n  }\n\n  const alg = auth.alg ?? algFromJwk(source);\n  const key = await importJWK(source, alg);\n\n  return { key, alg, kid: auth.kid ?? (typeof source.kid === 'string' ? source.kid : undefined) };\n}\n\nfunction isCryptoKey(value: unknown): value is CryptoKey {\n  return typeof CryptoKey !== 'undefined' && value instanceof CryptoKey;\n}\n\nfunction algFromCryptoKey(key: CryptoKey): ClientKeyAlgorithm {\n  if (key.algorithm.name === 'ECDSA') {\n    return 'ES256';\n  }\n  if (key.algorithm.name === 'RSASSA-PKCS1-v1_5') {\n    return 'RS256';\n  }\n  throw new ConfigurationError(`Unsupported client key algorithm ${key.algorithm.name}; use ES256 or RS256.`);\n}\n\nfunction algFromJwk(jwk: JWK): ClientKeyAlgorithm {\n  if (jwk.alg === 'ES256' || jwk.alg === 'RS256') {\n    return jwk.alg as ClientKeyAlgorithm;\n  }\n  if (jwk.alg === undefined && jwk.kty === 'EC' && jwk.crv === 'P-256') {\n    return 'ES256';\n  }\n  if (jwk.alg === undefined && jwk.kty === 'RSA') {\n    return 'RS256';\n  }\n  throw new ConfigurationError('The private JWK is not an ES256 (P-256) or RS256 key.');\n}\n\nfunction formEncode(value: string): string {\n  return encodeURIComponent(value).replace(/%20/g, '+');\n}\n","import { AuthenticationError, ConfigurationError } from '../errors.js';\nimport { generateClientKeyPair, type ClientAuth, type ClientKeyAlgorithm, type ClientKeyPair } from './client-auth.js';\nimport { grantError, readOAuthFailure } from './errors.js';\nimport { requireEndpoint, resolveMetadata, send, type AgentServerOptions } from './http.js';\n\n/** The CIBA grant type (OpenID CIBA Core). */\nexport const CIBA_GRANT_TYPE = 'urn:openid:params:grant-type:ciba';\n/** The device authorization grant type (RFC 8628). */\nexport const DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';\n\nexport interface RegisterAgentClientOptions extends AgentServerOptions {\n  /** Shown to the person approving, so make it recognisable: \"Cbox Brain CLI on ada-mbp\". */\n  clientName: string;\n  /** e.g. `[CIBA_GRANT_TYPE, 'refresh_token']` or `[DEVICE_CODE_GRANT_TYPE, 'refresh_token']`. */\n  grantTypes: string[];\n  /** The scope ceiling to register. A space-separated string or a list. */\n  scope?: string | string[];\n  /**\n   * `private_key_jwt` (default): a key pair is generated (or `keyPair` used) and the\n   * public half registered inline as `jwks`. `none`: a public client — the device grant,\n   * or CIBA where the resource allows keyless clients. `private_key_jwt` is recommended for CIBA.\n   */\n  tokenEndpointAuthMethod?: 'private_key_jwt' | 'none';\n  /** Algorithm for the generated key pair. Default ES256. */\n  alg?: ClientKeyAlgorithm;\n  /** Register an existing key pair instead of generating one. */\n  keyPair?: ClientKeyPair;\n  /** RFC 7591 §3 initial access token, when the instance requires one to register. */\n  initialAccessToken?: string;\n  /** Further RFC 7591 client metadata, sent as-is (e.g. `software_id`, `client_uri`). */\n  extraMetadata?: Record<string, unknown>;\n}\n\nexport interface RegisteredAgentClient {\n  clientId: string;\n  /** Present only if the server issued one; a `private_key_jwt` or `none` client has none. */\n  clientSecret: string | null;\n  /** RFC 7592 credential for reading/updating/deleting the registration. Persist it if you need that. */\n  registrationAccessToken: string | null;\n  registrationClientUri: string | null;\n  tokenEndpointAuthMethod: string;\n  grantTypes: string[];\n  scope: string | null;\n  /** The key pair registered, for `private_key_jwt`. Persist `keyPair.privateJwk`. */\n  keyPair: ClientKeyPair | null;\n  /** Ready to hand to {@link startBackchannel} / {@link startDeviceAuthorization}. */\n  auth: ClientAuth;\n  /** The full registration response. */\n  raw: Record<string, unknown>;\n}\n\n/**\n * Register this agent or CLI as an OAuth client (RFC 7591 dynamic client registration).\n *\n * Do it once per installation and persist the result: `clientId` and, for\n * `private_key_jwt`, `keyPair.privateJwk`. Re-registering on every run fills the\n * environment's app list with copies.\n *\n * @throws ConfigurationError when the instance has dynamic registration switched off.\n * @throws AgentGrantError (e.g. `invalid_client_metadata`) when the server refuses.\n */\nexport async function registerAgentClient(options: RegisterAgentClientOptions): Promise<RegisteredAgentClient> {\n  if (!options.clientName) {\n    throw new ConfigurationError('`clientName` is required.');\n  }\n  if (options.grantTypes.length === 0) {\n    throw new ConfigurationError('`grantTypes` must name at least one grant.');\n  }\n\n  const metadata = await resolveMetadata(options);\n  const endpoint = requireEndpoint(metadata, 'registration_endpoint', 'dynamic client registration');\n  const method = options.tokenEndpointAuthMethod ?? 'private_key_jwt';\n\n  const keyPair = method === 'private_key_jwt'\n    ? options.keyPair ?? (await generateClientKeyPair(options.alg ?? 'ES256'))\n    : null;\n\n  const document: Record<string, unknown> = {\n    ...options.extraMetadata,\n    client_name: options.clientName,\n    grant_types: options.grantTypes,\n    token_endpoint_auth_method: method,\n    // Neither CIBA nor the device grant has a redirect; say so rather than let the server\n    // assume an authorization-code client.\n    redirect_uris: [],\n    response_types: [],\n  };\n\n  if (options.scope !== undefined) {\n    document['scope'] = scopeString(options.scope);\n  }\n  if (keyPair !== null) {\n    document['jwks'] = { keys: [keyPair.publicJwk] };\n  }\n\n  const headers: Record<string, string> = { 'content-type': 'application/json', accept: 'application/json' };\n  if (options.initialAccessToken) {\n    headers['authorization'] = `Bearer ${options.initialAccessToken}`;\n  }\n\n  const response = await send(endpoint, { method: 'POST', headers, body: JSON.stringify(document) }, options);\n\n  if (!response.ok) {\n    throw grantError(await readOAuthFailure(response), 'Client registration failed');\n  }\n\n  const raw = (await response.json().catch(() => null)) as Record<string, unknown> | null;\n  const clientId = raw?.['client_id'];\n\n  if (raw === null || typeof clientId !== 'string' || clientId === '') {\n    throw new AuthenticationError('The registration response carried no client_id.');\n  }\n\n  const clientSecret = typeof raw['client_secret'] === 'string' ? raw['client_secret'] : null;\n  const registeredMethod = typeof raw['token_endpoint_auth_method'] === 'string' ? raw['token_endpoint_auth_method'] : method;\n\n  let auth: ClientAuth;\n  if (keyPair !== null) {\n    auth = { method: 'private_key_jwt', clientId, privateKey: keyPair.privateKey, alg: keyPair.alg, kid: keyPair.kid };\n  } else if (clientSecret !== null) {\n    auth = { method: 'client_secret_basic', clientId, clientSecret };\n  } else {\n    auth = { method: 'none', clientId };\n  }\n\n  return {\n    clientId,\n    clientSecret,\n    registrationAccessToken: typeof raw['registration_access_token'] === 'string' ? raw['registration_access_token'] : null,\n    registrationClientUri: typeof raw['registration_client_uri'] === 'string' ? raw['registration_client_uri'] : null,\n    tokenEndpointAuthMethod: registeredMethod,\n    grantTypes: Array.isArray(raw['grant_types']) ? raw['grant_types'].filter((g): g is string => typeof g === 'string') : options.grantTypes,\n    scope: typeof raw['scope'] === 'string' ? raw['scope'] : null,\n    keyPair,\n    auth,\n    raw,\n  };\n}\n\nexport function scopeString(scope: string | string[]): string {\n  return (typeof scope === 'string' ? scope.split(/\\s+/) : scope).filter((s) => s !== '').join(' ');\n}\n","import { AuthenticationError, ConfigurationError } from '../errors.js';\nimport { applyClientAuth, type ClientAuth } from './client-auth.js';\nimport { ExpiredTokenError, GrantCancelledError, grantError, readOAuthFailure } from './errors.js';\nimport {\n  requireEndpoint,\n  resolveMetadata,\n  send,\n  type AgentServerOptions,\n  type AuthorizationServerMetadata,\n} from './http.js';\nimport { CIBA_GRANT_TYPE, DEVICE_CODE_GRANT_TYPE, scopeString } from './register.js';\n\n/** Tokens from a completed CIBA or device grant. */\nexport interface AgentTokens {\n  accessToken: string;\n  tokenType: string;\n  /** Seconds, when the server said. */\n  expiresIn: number | null;\n  refreshToken: string | null;\n  /**\n   * The id_token, when `openid` was granted — returned as-is, NOT verified here. Verify it\n   * with `CboxIdClient` (or `jose` against the JWKS) before trusting anything in it.\n   */\n  idToken: string | null;\n  scope: string | null;\n  /** The full token response. */\n  raw: Record<string, unknown>;\n}\n\n/** One poll's outcome. Final failures are thrown, not returned. */\nexport type PollResult =\n  | { status: 'complete'; tokens: AgentTokens }\n  | { status: 'pending' }\n  /** Slow down: add 5 s to the interval, and wait at least `retryAfter` seconds if given. */\n  | { status: 'slow_down'; retryAfter: number | null };\n\n/** Options shared by the wait helpers. */\nexport interface WaitOptions {\n  /** Replace the timer — tests pass a fake that records the waits. Must honour `signal`. */\n  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;\n  /** Clock in epoch milliseconds. Default `Date.now`. */\n  now?: () => number;\n}\n\ninterface ClientOptions extends AgentServerOptions {\n  /** How the client authenticates. See {@link ClientAuth}. */\n  client: ClientAuth;\n}\n\n// ---------------------------------------------------------------------------------------\n// CIBA (poll mode)\n// ---------------------------------------------------------------------------------------\n\nexport interface StartBackchannelOptions extends ClientOptions {\n  /** Who should approve: a Cbox ID user id, or a confirmed email address. */\n  loginHint: string;\n  /** Space-separated string or list. Bounded by the client's registered scopes. */\n  scope: string | string[];\n  /**\n   * Shown beside Approve. Put a {@link createBindingCode} code in it and print the same\n   * code locally. Required by Cbox ID for self-registered clients; at most 255 characters.\n   */\n  bindingMessage: string;\n  /**\n   * RFC 8707 resource indicator(s) — the API the token is for. Optional in the type, but\n   * REQUIRED by Cbox ID for self-registered clients.\n   * Its settings also decide whether a keyless (`none`) client may use CIBA at all.\n   */\n  resource?: string | string[];\n  /** Seconds the request may wait for approval (the server may shorten it). */\n  requestedExpiry?: number;\n  /** Echoed into the id_token, so you can bind it to this request. */\n  nonce?: string;\n}\n\n/** A started CIBA request. Persistable as JSON. */\nexport interface BackchannelAuthorization {\n  authReqId: string;\n  expiresIn: number;\n  /** Seconds between polls. */\n  interval: number;\n  /** Epoch ms after which polling is pointless. */\n  expiresAt: number;\n  /** The resource(s) the request named, re-sent on every poll (the server checks they match). */\n  resource: string[];\n}\n\n/**\n * Start a CIBA request (OpenID CIBA Core §7, poll mode): Cbox ID shows `bindingMessage` to\n * the person named by `loginHint` and waits for Approve.\n *\n * `backchannel_user_code_parameter` is not supported by Cbox ID, so no user code is sent.\n *\n * @throws InvalidClientError, UnknownUserIdError, InvalidBindingMessageError,\n *   InvalidTargetError, SlowDownError, AgentGrantError.\n */\nexport async function startBackchannel(options: StartBackchannelOptions): Promise<BackchannelAuthorization> {\n  const now = Date.now();\n  const metadata = await resolveMetadata(options);\n  const endpoint = requireEndpoint(metadata, 'backchannel_authentication_endpoint', 'CIBA');\n\n  if (!options.loginHint) {\n    throw new ConfigurationError('`loginHint` is required.');\n  }\n\n  const resource = resourceList(options.resource);\n  const body = new URLSearchParams({ login_hint: options.loginHint, scope: scopeString(options.scope) });\n\n  if (options.bindingMessage !== '') {\n    body.set('binding_message', options.bindingMessage);\n  }\n  for (const r of resource) {\n    body.append('resource', r);\n  }\n  if (options.requestedExpiry !== undefined) {\n    body.set('requested_expiry', String(options.requestedExpiry));\n  }\n  if (options.nonce !== undefined && options.nonce !== '') {\n    body.set('nonce', options.nonce);\n  }\n\n  const payload = await postForm(endpoint, body, options, metadata, 'Backchannel authentication request failed');\n  const authReqId = payload['auth_req_id'];\n\n  if (typeof authReqId !== 'string' || authReqId === '') {\n    throw new AuthenticationError('The backchannel authentication response carried no auth_req_id.');\n  }\n\n  const expiresIn = positiveNumber(payload['expires_in']) ?? 120;\n\n  return {\n    authReqId,\n    expiresIn,\n    // CIBA Core §7.3: absent means 5 seconds.\n    interval: positiveNumber(payload['interval']) ?? 5,\n    expiresAt: now + expiresIn * 1000,\n    resource,\n  };\n}\n\nexport interface PollBackchannelOptions extends ClientOptions {\n  authorization: Pick<BackchannelAuthorization, 'authReqId' | 'resource'>;\n}\n\n/**\n * Poll the token endpoint once for a CIBA request.\n *\n * @throws AccessDeniedError, ExpiredTokenError, InvalidGrantError, InvalidTargetError,\n *   InvalidClientError, AgentGrantError.\n */\nexport async function pollBackchannel(options: PollBackchannelOptions): Promise<PollResult> {\n  const body = new URLSearchParams({ grant_type: CIBA_GRANT_TYPE, auth_req_id: options.authorization.authReqId });\n  return pollToken(body, options.authorization.resource, options, 'Backchannel token request failed');\n}\n\n/**\n * Poll until the person approves, and return the tokens.\n *\n * Waits `interval` seconds before each poll; on `slow_down` (or a 429) adds five seconds\n * for good and waits at least `Retry-After`; keeps going on `authorization_pending`; stops\n * on anything final. Throws {@link ExpiredTokenError} once `expiresAt` passes and\n * {@link GrantCancelledError} when `signal` fires — wire it to Ctrl-C.\n */\nexport async function waitForBackchannelToken(\n  options: PollBackchannelOptions & WaitOptions & { authorization: BackchannelAuthorization },\n): Promise<AgentTokens> {\n  const metadata = await resolveMetadata(options);\n  const authorization = options.authorization;\n\n  return waitLoop(authorization, options, () => pollBackchannel({ ...options, metadata }), 'backchannel request');\n}\n\n// ---------------------------------------------------------------------------------------\n// Device authorization grant (RFC 8628)\n// ---------------------------------------------------------------------------------------\n\nexport interface StartDeviceAuthorizationOptions extends ClientOptions {\n  scope?: string | string[];\n  /** RFC 8707 resource indicator(s). */\n  resource?: string | string[];\n}\n\n/** A started device authorization. Persistable as JSON. */\nexport interface DeviceGrantAuthorization {\n  deviceCode: string;\n  /** Show this to the person. */\n  userCode: string;\n  /** Where they enter it. */\n  verificationUri: string;\n  /** The same page with the code filled in — good for a QR code or `open`. */\n  verificationUriComplete: string | null;\n  expiresIn: number;\n  interval: number;\n  expiresAt: number;\n  resource: string[];\n}\n\n/**\n * Start the device authorization grant: you get a `userCode` to show and a\n * `verificationUri` for the person to open on any device.\n *\n * @throws InvalidClientError, InvalidTargetError, SlowDownError, AgentGrantError.\n */\nexport async function startDeviceAuthorization(options: StartDeviceAuthorizationOptions): Promise<DeviceGrantAuthorization> {\n  const now = Date.now();\n  const metadata = await resolveMetadata(options);\n  const endpoint = requireEndpoint(metadata, 'device_authorization_endpoint', 'the device grant');\n  const resource = resourceList(options.resource);\n  const body = new URLSearchParams();\n\n  if (options.scope !== undefined) {\n    body.set('scope', scopeString(options.scope));\n  }\n  for (const r of resource) {\n    body.append('resource', r);\n  }\n\n  const payload = await postForm(endpoint, body, options, metadata, 'Device authorization request failed');\n  const deviceCode = payload['device_code'];\n  const userCode = payload['user_code'];\n  const verificationUri = payload['verification_uri'];\n\n  if (typeof deviceCode !== 'string' || typeof userCode !== 'string' || typeof verificationUri !== 'string') {\n    throw new AuthenticationError('The device authorization response was incomplete.');\n  }\n\n  const expiresIn = positiveNumber(payload['expires_in']) ?? 600;\n\n  return {\n    deviceCode,\n    userCode,\n    verificationUri,\n    verificationUriComplete: typeof payload['verification_uri_complete'] === 'string' ? payload['verification_uri_complete'] : null,\n    expiresIn,\n    // RFC 8628 §3.2: absent means 5 seconds.\n    interval: positiveNumber(payload['interval']) ?? 5,\n    expiresAt: now + expiresIn * 1000,\n    resource,\n  };\n}\n\nexport interface PollDeviceAuthorizationOptions extends ClientOptions {\n  authorization: Pick<DeviceGrantAuthorization, 'deviceCode' | 'resource'>;\n}\n\n/** Poll the token endpoint once for a device authorization. */\nexport async function pollDeviceAuthorization(options: PollDeviceAuthorizationOptions): Promise<PollResult> {\n  const body = new URLSearchParams({ grant_type: DEVICE_CODE_GRANT_TYPE, device_code: options.authorization.deviceCode });\n  return pollToken(body, options.authorization.resource, options, 'Device token request failed');\n}\n\n/** Poll until the person approves the device code. Same rules as {@link waitForBackchannelToken}. */\nexport async function waitForDeviceToken(\n  options: PollDeviceAuthorizationOptions & WaitOptions & { authorization: DeviceGrantAuthorization },\n): Promise<AgentTokens> {\n  const metadata = await resolveMetadata(options);\n\n  return waitLoop(options.authorization, options, () => pollDeviceAuthorization({ ...options, metadata }), 'device code');\n}\n\n// ---------------------------------------------------------------------------------------\n// Refresh\n// ---------------------------------------------------------------------------------------\n\nexport interface RefreshAgentTokensOptions extends ClientOptions {\n  refreshToken: string;\n  /** Narrow the scope (never widen it). */\n  scope?: string | string[];\n  /** RFC 8707 resource indicator(s) for the new access token. */\n  resource?: string | string[];\n}\n\n/**\n * Exchange a refresh token, authenticating the same way the grant did (including\n * `private_key_jwt`). Cbox ID rotates refresh tokens and revokes the family on reuse, so\n * ALWAYS persist the returned `refreshToken` and discard the old one.\n *\n * @throws InvalidGrantError when the refresh token is no longer valid — sign in again.\n */\nexport async function refreshAgentTokens(options: RefreshAgentTokensOptions): Promise<AgentTokens> {\n  if (!options.refreshToken) {\n    throw new ConfigurationError('`refreshToken` is required.');\n  }\n\n  const body = new URLSearchParams({ grant_type: 'refresh_token', refresh_token: options.refreshToken });\n  if (options.scope !== undefined) {\n    body.set('scope', scopeString(options.scope));\n  }\n\n  // `polling: false`: pending and slow_down mean nothing on a refresh, so they are thrown\n  // like any other refusal (a 429 as SlowDownError with its Retry-After).\n  const result = await pollToken(body, resourceList(options.resource), options, 'Token refresh failed', false);\n\n  return (result as Extract<PollResult, { status: 'complete' }>).tokens;\n}\n\n// ---------------------------------------------------------------------------------------\n// Shared\n// ---------------------------------------------------------------------------------------\n\nasync function waitLoop(\n  authorization: { interval: number; expiresAt: number },\n  options: WaitOptions & { signal?: AbortSignal },\n  poll: () => Promise<PollResult>,\n  what: string,\n): Promise<AgentTokens> {\n  const sleep = options.sleep ?? defaultSleep;\n  const now = options.now ?? Date.now;\n  let intervalMs = Math.max(authorization.interval, 0) * 1000;\n  let nextWaitMs = intervalMs;\n\n  for (;;) {\n    throwIfAborted(options.signal);\n\n    if (now() >= authorization.expiresAt) {\n      throw new ExpiredTokenError(`The ${what} expired before it was approved. Start again.`, 'expired_token');\n    }\n\n    await sleep(nextWaitMs, options.signal);\n    // A custom sleep may not honour the signal; check again before spending a request.\n    throwIfAborted(options.signal);\n\n    if (now() >= authorization.expiresAt) {\n      throw new ExpiredTokenError(`The ${what} expired before it was approved. Start again.`, 'expired_token');\n    }\n\n    const result = await poll();\n\n    if (result.status === 'complete') {\n      return result.tokens;\n    }\n\n    if (result.status === 'slow_down') {\n      // Permanently, not for one round (RFC 8628 §3.5, CIBA Core §11): returning to the\n      // refused rate earns the same answer forever.\n      intervalMs += 5000;\n      nextWaitMs = Math.max(intervalMs, (result.retryAfter ?? 0) * 1000);\n      continue;\n    }\n\n    nextWaitMs = intervalMs;\n  }\n}\n\nasync function pollToken(\n  body: URLSearchParams,\n  resource: readonly string[],\n  options: ClientOptions,\n  fallback: string,\n  polling = true,\n): Promise<PollResult> {\n  const metadata = await resolveMetadata(options);\n  const endpoint = requireEndpoint(metadata, 'token_endpoint', 'token requests');\n\n  // The same resource(s) the request started with; Cbox ID refuses a mismatch with\n  // invalid_target.\n  for (const r of resource) {\n    body.append('resource', r);\n  }\n\n  const headers: Record<string, string> = { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' };\n  await applyClientAuth(options.client, body, headers, metadata.token_endpoint);\n\n  const response = await send(endpoint, { method: 'POST', headers, body }, options);\n\n  if (response.ok) {\n    return { status: 'complete', tokens: await tokensFrom(response) };\n  }\n\n  const failure = await readOAuthFailure(response);\n\n  if (polling && failure.error === 'authorization_pending') {\n    return { status: 'pending' };\n  }\n  if (polling && failure.error === 'slow_down') {\n    return { status: 'slow_down', retryAfter: failure.retryAfter ?? null };\n  }\n\n  throw grantError(failure, fallback);\n}\n\nasync function postForm(\n  endpoint: string,\n  body: URLSearchParams,\n  options: ClientOptions,\n  metadata: AuthorizationServerMetadata,\n  fallback: string,\n): Promise<Record<string, unknown>> {\n  const headers: Record<string, string> = { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' };\n  await applyClientAuth(options.client, body, headers, metadata.token_endpoint);\n\n  const response = await send(endpoint, { method: 'POST', headers, body }, options);\n\n  if (!response.ok) {\n    throw grantError(await readOAuthFailure(response), fallback);\n  }\n\n  const payload: unknown = await response.json().catch(() => null);\n  if (typeof payload !== 'object' || payload === null) {\n    throw new AuthenticationError(`${fallback}: the response was not a JSON object.`);\n  }\n  return payload as Record<string, unknown>;\n}\n\nasync function tokensFrom(response: Response): Promise<AgentTokens> {\n  const raw = (await response.json().catch(() => null)) as Record<string, unknown> | null;\n  const accessToken = raw?.['access_token'];\n\n  if (raw === null || typeof accessToken !== 'string' || accessToken === '') {\n    throw new AuthenticationError('The token response carried no access_token.');\n  }\n\n  return {\n    accessToken,\n    tokenType: typeof raw['token_type'] === 'string' ? raw['token_type'] : 'Bearer',\n    expiresIn: typeof raw['expires_in'] === 'number' ? raw['expires_in'] : null,\n    refreshToken: typeof raw['refresh_token'] === 'string' ? raw['refresh_token'] : null,\n    idToken: typeof raw['id_token'] === 'string' ? raw['id_token'] : null,\n    scope: typeof raw['scope'] === 'string' ? raw['scope'] : null,\n    raw,\n  };\n}\n\nfunction resourceList(resource: string | string[] | undefined): string[] {\n  if (resource === undefined) {\n    return [];\n  }\n  const list = typeof resource === 'string' ? [resource] : [...resource];\n  for (const r of list) {\n    // RFC 8707 §2: an absolute URI without a fragment.\n    let url: URL;\n    try {\n      url = new URL(r);\n    } catch {\n      throw new ConfigurationError(`\\`resource\\` must be an absolute URI (got ${r}).`);\n    }\n    if (url.hash !== '') {\n      throw new ConfigurationError('`resource` must not contain a fragment.');\n    }\n  }\n  return list;\n}\n\nfunction positiveNumber(value: unknown): number | null {\n  return typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : null;\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted === true) {\n    throw new GrantCancelledError('The wait for approval was cancelled.');\n  }\n}\n\n/** An interruptible timer: the abort is wired to the timer, so Ctrl-C does not wait out an interval. */\nfunction defaultSleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted === true) {\n      reject(new GrantCancelledError('The wait for approval was cancelled.'));\n      return;\n    }\n    const onAbort = (): void => {\n      clearTimeout(timer);\n      reject(new GrantCancelledError('The wait for approval was cancelled.'));\n    };\n    const timer = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n","import { ConfigurationError } from '../errors.js';\n\n/**\n * Uppercase letters and digits a person cannot confuse when reading them off one screen\n * and matching them on another: no 0/O, 1/I/L, 5/S, 2/Z, 8/B.\n */\nexport const BINDING_CODE_ALPHABET = 'ACDEFGHJKMNPQRTUVWXY34679';\n\n/**\n * A short random code for a CIBA `binding_message`, e.g. `K7QM`.\n *\n * Show it in your terminal and put it in the binding message; Cbox ID shows the message\n * beside Approve, and the person approves only when the two match. That is what stops a\n * prompt somebody else triggered from being approved by reflex. Cbox ID requires a\n * binding message from self-registered clients.\n *\n * Uniform over the alphabet (rejection sampling, WebCrypto randomness).\n */\nexport function createBindingCode(length = 4): string {\n  if (!Number.isInteger(length) || length < 1 || length > 32) {\n    throw new ConfigurationError('A binding code length must be an integer from 1 to 32.');\n  }\n\n  const size = BINDING_CODE_ALPHABET.length;\n  // The largest multiple of `size` that fits in a byte; bytes at or above it are dropped so\n  // every character is equally likely.\n  const limit = 256 - (256 % size);\n  let code = '';\n\n  while (code.length < length) {\n    for (const byte of crypto.getRandomValues(new Uint8Array(length * 2))) {\n      if (byte < limit && code.length < length) {\n        code += BINDING_CODE_ALPHABET[byte % size];\n      }\n    }\n  }\n\n  return code;\n}\n"]}

package/dist/{chunk-YGLMLIKL.js → chunk-T5LCQOLS.js}

@@ -1,26 +1,8 @@
+import { createVerifier, randomToken, challenge } from './chunk-VGQASHTI.js';
 import { assertSecureIssuer } from './chunk-QQW63PGU.js';
 import { CboxIdError, AuthenticationError, ConfigurationError, InvalidStateError, oauthError } from './chunk-SEUD4TE4.js';
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 
-// src/pkce.ts
-function base64url(bytes) {
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCharCode(byte);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function randomToken(bytes = 32) {
-  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));
-}
-function createVerifier() {
-  return randomToken(32);
-}
-async function challenge(verifier) {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-  return base64url(new Uint8Array(digest));
-}
-
 // src/claims.ts
 var ORGANIZATION_ROLES = /* @__PURE__ */ new Set([
   "owner",
@@ -1141,6 +1123,6 @@ function sleep(ms, signal) {
   });
 }
 
-export { CboxIdClient, Discovery, FEATURE_FLAGS_SCOPE, PipeLeaseDeniedError, PipeLeaseError, PipeNotConnectedError, PipeReauthorizationRequiredError, PipeTemporarilyUnavailableError, VaultClient, actor, challenge, createVerifier, featureFlags, hasFeature, hasPermission, hasRole, isSupportSession, organization, permissions, pipeConnectUrl, randomToken, roles, sessionId, verifyStandardWebhook, verifyWebhook, withConnectReturn };
-//# sourceMappingURL=chunk-YGLMLIKL.js.map
-//# sourceMappingURL=chunk-YGLMLIKL.js.map
+export { CboxIdClient, Discovery, FEATURE_FLAGS_SCOPE, PipeLeaseDeniedError, PipeLeaseError, PipeNotConnectedError, PipeReauthorizationRequiredError, PipeTemporarilyUnavailableError, VaultClient, actor, featureFlags, hasFeature, hasPermission, hasRole, isSupportSession, organization, permissions, pipeConnectUrl, roles, sessionId, verifyStandardWebhook, verifyWebhook, withConnectReturn };
+//# sourceMappingURL=chunk-T5LCQOLS.js.map
+//# sourceMappingURL=chunk-T5LCQOLS.js.map

package/dist/chunk-T5LCQOLS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/claims.ts","../src/vault.ts","../src/webhook.ts","../src/discovery.ts","../src/client.ts"],"names":["header","key"],"mappings":";;;;;;AAUA,IAAM,kBAAA,uBAA8C,GAAA,CAAsB;AAAA,EACxE,OAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AA6CM,SAAS,aAAa,MAAA,EAAoD;AAC/E,EAAA,MAAM,MAAA,GAAS,SAAS,MAAM,CAAA;AAC9B,EAAA,MAAM,EAAA,GAAK,OAAO,KAAK,CAAA;AAEvB,EAAA,IAAI,OAAO,EAAA,KAAO,QAAA,IAAY,EAAA,KAAO,EAAA,EAAI;AACvC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,IAAA,GAAO,OAAO,UAAU,CAAA;AAC9B,EAAA,MAAM,IAAA,GAAO,OAAO,UAAU,CAAA;AAE9B,EAAA,OAAO;AAAA,IACL,EAAA;AAAA,IACA,MAAM,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,KAAK,IAAA,GAAO,IAAA;AAAA,IACvD,IAAA,EAAM,OAAO,IAAA,KAAS,QAAA,IAAY,mBAAmB,GAAA,CAAI,IAAI,IAAK,IAAA,GAA4B;AAAA,GAChG;AACF;AAMO,SAAS,MAAM,MAAA,EAAuC;AAC3D,EAAA,OAAO,WAAW,QAAA,CAAS,MAAM,CAAA,CAAE,KAAK,GAAG,CAAC,CAAA;AAC9C;AAWO,SAAS,iBAAiB,MAAA,EAA8B;AAC7D,EAAA,OAAO,KAAA,CAAM,MAAM,CAAA,KAAM,IAAA;AAC3B;AAUO,SAAS,UAAU,MAAA,EAAoC;AAC5D,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,MAAM,CAAA,CAAE,KAAK,CAAA;AAElC,EAAA,OAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,KAAK,GAAA,GAAM,IAAA;AACvD;AAGO,SAAS,MAAM,MAAA,EAA+B;AACnD,EAAA,OAAO,UAAA,CAAW,QAAA,CAAS,MAAM,CAAA,CAAE,OAAO,CAAC,CAAA;AAC7C;AAMO,SAAS,YAAY,MAAA,EAA+B;AACzD,EAAA,OAAO,UAAA,CAAW,QAAA,CAAS,MAAM,CAAA,CAAE,aAAa,CAAC,CAAA;AACnD;AAGO,SAAS,OAAA,CAAQ,QAAqB,IAAA,EAAuB;AAClE,EAAA,OAAO,KAAA,CAAM,MAAM,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA;AACpC;AAOO,SAAS,aAAA,CAAc,QAAqB,UAAA,EAA6B;AAC9E,EAAA,OAAO,WAAA,CAAY,MAAM,CAAA,CAAE,QAAA,CAAS,UAAU,CAAA;AAChD;AAOO,IAAM,mBAAA,GAAsB;AAW5B,SAAS,aAAa,MAAA,EAAsC;AACjE,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,MAAM,CAAA,CAAE,eAAe,CAAA;AAE9C,EAAA,OAAO,MAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,UAAA,CAAW,KAAK,CAAA,GAAI,IAAA;AACpD;AAQO,SAAS,UAAA,CAAW,QAAqB,GAAA,EAAsB;AACpE,EAAA,OAAO,YAAA,CAAa,MAAM,CAAA,EAAG,QAAA,CAAS,GAAG,CAAA,IAAK,KAAA;AAChD;AAOA,IAAM,eAAA,GAAkB,CAAA;AAExB,SAAS,UAAA,CAAW,OAAgB,KAAA,EAAiC;AACnE,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACrD,IAAA,OAAO,EAAE,GAAA,EAAK,IAAA,EAAM,KAAA,EAAO,IAAA,EAAK;AAAA,EAClC;AAEA,EAAA,MAAM,MAAA,GAAS,KAAA;AACf,EAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AAExB,EAAA,OAAO;AAAA,IACL,KAAK,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,KAAK,GAAA,GAAM,IAAA;AAAA,IACnD,KAAA,EAAO,KAAA,GAAQ,CAAA,GAAI,eAAA,GAAkB,UAAA,CAAW,OAAO,KAAK,CAAA,EAAG,KAAA,GAAQ,CAAC,CAAA,GAAI;AAAA,GAC9E;AACF;AAEA,SAAS,WAAW,KAAA,EAA0B;AAC5C,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GACtB,MAAM,MAAA,CAAO,CAAC,KAAA,KAA2B,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAE,IAClF,EAAC;AACP;AAEA,SAAS,SAAS,MAAA,EAAwD;AACxE,EAAA,OAAO,MAAA,CAAO,MAAM,CAAA,GAAI,MAAA,CAAO,MAAA,GAAS,MAAA;AAC1C;AAOA,SAAS,OAAO,MAAA,EAAyC;AACvD,EAAA,OACE,OAAO,MAAA,CAAO,QAAQ,CAAA,KAAM,QAAA,IAC5B,MAAA,CAAO,QAAQ,CAAA,KAAM,IAAA,IACrB,OAAO,MAAA,CAAO,aAAa,CAAA,KAAM,QAAA;AAErC;;;AC/JO,SAAS,iBAAA,CAAkB,UAAA,EAAoB,OAAA,GAA8B,EAAC,EAAW;AAC9F,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,UAAU,CAAA;AAC9B,EAAA,IAAI,QAAQ,QAAA,EAAU,GAAA,CAAI,aAAa,GAAA,CAAI,WAAA,EAAa,QAAQ,QAAQ,CAAA;AACxE,EAAA,IAAI,QAAQ,QAAA,EAAU,GAAA,CAAI,aAAa,GAAA,CAAI,WAAA,EAAa,QAAQ,QAAQ,CAAA;AACxE,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB;AAMO,SAAS,cAAA,CAAe,MAAA,EAAgB,QAAA,EAAiC,OAAA,GAA8B,EAAC,EAAW;AACxH,EAAA,OAAO,iBAAA;AAAA,IACL,CAAA,EAAG,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,4BAAA,EAA+B,kBAAA,CAAmB,QAAQ,CAAC,CAAA,QAAA,CAAA;AAAA,IACvF;AAAA,GACF;AACF;AAaO,IAAM,cAAA,GAAN,cAA6B,WAAA,CAAY;AAAA,EAC9C,YACE,OAAA,EAES,KAAA,EACA,QAEA,UAAA,GAA4B,IAAA,EAE5B,aAA4B,IAAA,EACrC;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAPJ,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAEA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAEA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EAGX;AAAA,EARW,KAAA;AAAA,EACA,MAAA;AAAA,EAEA,UAAA;AAAA,EAEA,UAAA;AAAA;AAAA,EAMX,eAAe,OAAA,EAA4C;AACzD,IAAA,OAAO,KAAK,UAAA,KAAe,IAAA,GAAO,OAAO,iBAAA,CAAkB,IAAA,CAAK,YAAY,OAAO,CAAA;AAAA,EACrF;AACF;AAGO,IAAM,qBAAA,GAAN,cAAoC,cAAA,CAAe;AAE1D;AAMO,IAAM,gCAAA,GAAN,cAA+C,cAAA,CAAe;AAErE;AAGO,IAAM,+BAAA,GAAN,cAA8C,cAAA,CAAe;AAAC;AAO9D,IAAM,oBAAA,GAAN,cAAmC,cAAA,CAAe;AAAC;AAgBnD,IAAM,cAAN,MAAkB;AAAA,EAGvB,WAAA,CACE,MAAA,EACiB,KAAA,EACA,SAAA,GAAY,GAAA,EAC7B;AAFiB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAEjB,IAAA,IAAA,CAAK,OAAO,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,aAAA,CAAA;AAAA,EAC1C;AAAA,EAJmB,KAAA;AAAA,EACA,SAAA;AAAA,EALF,IAAA;AAAA;AAAA,EAWjB,MAAM,KAAA,EAAkD;AACtD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,UAAA,EAAY;AAAA,MACnD,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,YAAY,KAAA,CAAM,SAAA;AAAA,MAClB,UAAU,KAAA,CAAM,OAAA;AAAA,MAChB,YAAY,KAAA,CAAM;AAAA,KACnB,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAA,CAAO,UAAkB,MAAA,EAAyC;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAqB,MAAA,EAAQ,CAAA,SAAA,EAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW,EAAE,MAAA,EAAQ,CAAA;AAAA,EACxG;AAAA;AAAA,EAGA,MAAM,OAAO,QAAA,EAAiC;AAC5C,IAAA,MAAM,KAAK,OAAA,CAAQ,QAAA,EAAU,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,CAAE,CAAA;AAAA,EACzE;AAAA;AAAA,EAGA,KAAA,CACE,QAAA,EACA,QAAA,EACA,aAAA,EAC+E;AAC/E,IAAA,OAAO,KAAK,IAAA,CAAK,MAAA,EAAQ,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,OAAA,CAAA,EAAW;AAAA,MAC1E,SAAA,EAAW,QAAA;AAAA,MACX,eAAA,EAAiB;AAAA,KAClB,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACf,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,UAAU,CAAA,CAAE,SAAA,EAAW,UAAU,CAAA,CAAE,SAAA,EAAW,aAAA,EAAe,CAAA,CAAE,eAAA,EAAgB;AAAA,IAC1F,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,WAAA,CAAY,QAAA,EAAkB,QAAA,EAAiC;AACnE,IAAA,MAAM,IAAA,CAAK,OAAA;AAAA,MACT,QAAA;AAAA,MACA,YAAY,kBAAA,CAAmB,QAAQ,CAAC,CAAA,QAAA,EAAW,kBAAA,CAAmB,QAAQ,CAAC,CAAA;AAAA,KACjF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CAAM,UAAkB,OAAA,EAAsC;AAC5D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,CAAA,SAAA,EAAY,mBAAmB,QAAQ,CAAC,CAAA,MAAA,CAAA,EAAU,EAAE,OAAA,EAAS,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ;AACpG,MAAA,MAAM,CAAA,GAAI,GAAA;AACV,MAAA,OAAO,EAAE,QAAA,EAAU,CAAA,CAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAQ,SAAA,EAAW,CAAA,CAAE,UAAA,EAAW;AAAA,IAClG,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAM,cAAA,CACJ,QAAA,EACA,OAAA,EACoB;AACpB,IAAA,MAAM,IAAA,GAAO,CAAA,OAAA,EAAU,kBAAA,CAAmB,QAAQ,CAAC,CAAA,MAAA,CAAA;AACnD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,QAAQ,IAAA,EAAM;AAAA,MAC7C,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,OAAA,EAAS,OAAA,CAAQ,MAAA,EAAO,GAAI;AAAC,KACnE,CAAA;AAED,IAAA,IAAI,OAAgC,EAAC;AACrC,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAkB,MAAM,QAAA,CAAS,IAAA,EAAK;AAC5C,MAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,KAAW,QAAQ,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC3E,QAAA,IAAA,GAAO,MAAA;AAAA,MACT;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,cAAA,CAAe,UAAU,IAAI,CAAA;AAAA,IACrC;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,EAAU;AACzC,MAAA,MAAM,IAAI,cAAA,CAAe,kDAAA,EAAoD,IAAA,EAAM,SAAS,MAAM,CAAA;AAAA,IACpG;AAEA,IAAA,OAAO;AAAA,MACL,aAAa,IAAA,CAAK,YAAA;AAAA,MAClB,SAAA,EAAW,QAAA;AAAA,MACX,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,QAAA,IAAY,QAAQ,CAAA;AAAA,MAC1C,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA;AAAA,MACjC,YAAA,EAAc,MAAA,CAAO,IAAA,CAAK,aAAA,IAAiB,EAAE,CAAA;AAAA,MAC7C,MAAA,EAAQ,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA,GAAI,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAQ,IAAI,EAAC;AAAA,MACtG,WAAW,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,IAAA;AAAA,MACnE,cAAA,EAAgB,MAAA,CAAO,IAAA,CAAK,gBAAA,IAAoB,EAAE,CAAA;AAAA,MAClD,UAAU,cAAA,CAAe,IAAA,CAAK,QAAQ,CAAA,GAAI,IAAA,CAAK,WAAW;AAAC,KAC7D;AAAA,EACF;AAAA,EAEA,MAAc,IAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAA2C;AAC7F,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,CAAA;AACtD,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,OAAA,CAAQ,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAmD;AACrG,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,MAAM,IAAI,CAAA;AACnD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,oBAAoB,CAAA,MAAA,EAAS,MAAM,IAAI,IAAI,CAAA,oBAAA,EAAuB,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,IAChG;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAc,IAAA,CAAK,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAmD;AAClG,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AACjE,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAoB;AAAA,QACxB,MAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAA,UACnC,GAAI,IAAA,GAAO,EAAE,cAAA,EAAgB,kBAAA,KAAuB;AAAC,SACvD;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACrB;AACA,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,MACjC;AACA,MAAA,OAAO,MAAM,MAAM,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAG,IAAI,IAAI,IAAI,CAAA;AAAA,IAChD,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF;AAEA,SAAS,cAAA,CAAe,UAAoB,IAAA,EAA+C;AACzF,EAAA,MAAM,QAAQ,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,GAAW,KAAK,KAAA,GAAQ,IAAA;AAC5D,EAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,OAAA,KAAY,QAAA,IAAY,IAAA,CAAK,OAAA,KAAY,EAAA,GACjE,IAAA,CAAK,OAAA,GACL,CAAA,kCAAA,EAAqC,QAAA,CAAS,MAAM,CAAA,CAAA,CAAA;AACxD,EAAA,MAAM,UAAA,GAAa,OAAO,IAAA,CAAK,WAAA,KAAgB,YAAY,IAAA,CAAK,WAAA,KAAgB,EAAA,GAAK,IAAA,CAAK,WAAA,GAAc,IAAA;AACxG,EAAA,MAAMA,UAAS,QAAA,CAAS,OAAA,CAAQ,IAAI,aAAa,CAAA,EAAG,MAAK,IAAK,EAAA;AAC9D,EAAA,MAAM,aAAa,OAAA,CAAQ,IAAA,CAAKA,OAAM,CAAA,GAAI,MAAA,CAAOA,OAAM,CAAA,GAAI,IAAA;AAE3D,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,UAAA,KAAe,IAAA,EAAM;AAClD,IAAA,OAAO,IAAI,qBAAA,CAAsB,OAAA,EAAS,KAAA,EAAO,GAAA,EAAK,YAAY,UAAU,CAAA;AAAA,EAC9E;AACA,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,UAAA,KAAe,IAAA,EAAM;AAClD,IAAA,OAAO,IAAI,gCAAA,CAAiC,OAAA,EAAS,KAAA,EAAO,GAAA,EAAK,YAAY,UAAU,CAAA;AAAA,EACzF;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,IAAA,OAAO,IAAI,+BAAA,CAAgC,OAAA,EAAS,KAAA,EAAO,GAAA,EAAK,YAAY,UAAU,CAAA;AAAA,EACxF;AACA,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,KAAA,KAAU,oBAAA,EAAsB;AAC7D,IAAA,OAAO,IAAI,oBAAA,CAAqB,OAAA,EAAS,KAAA,EAAO,GAAA,EAAK,YAAY,UAAU,CAAA;AAAA,EAC7E;AAEA,EAAA,OAAO,IAAI,cAAA,CAAe,OAAA,EAAS,OAAO,QAAA,CAAS,MAAA,EAAQ,YAAY,UAAU,CAAA;AACnF;AAEA,SAAS,eAAe,KAAA,EAAiD;AACvE,EAAA,OACE,OAAO,KAAA,KAAU,QAAA,IACjB,UAAU,IAAA,IACV,CAAC,MAAM,OAAA,CAAQ,KAAK,KACpB,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,KAAM,OAAO,MAAM,QAAQ,CAAA;AAE3D;;;AC5UA,SAAS,eAAA,CAAgB,GAAW,CAAA,EAAoB;AACtD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB;AAEA,SAAS,MAAM,KAAA,EAA4B;AACzC,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA,CACpC,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AACZ;AAgBA,eAAsB,cAAc,OAAA,EAAiD;AACnF,EAAA,MAAM,EAAE,OAAA,EAAS,eAAA,EAAiB,MAAA,EAAO,GAAI,OAAA;AAC7C,EAAA,MAAM,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,GAAA;AACrD,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,IAAO,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAEvD,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,QAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,OAAA,IAAW,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA,EAAG;AAChD,IAAA,MAAM,CAACC,MAAK,KAAK,CAAA,GAAI,QAAQ,IAAA,EAAK,CAAE,KAAA,CAAM,GAAA,EAAK,CAAC,CAAA;AAChD,IAAA,IAAIA,IAAAA,EAAK;AACP,MAAA,KAAA,CAAMA,IAAG,IAAI,KAAA,IAAS,EAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,GAAG,CAAA,IAAK,EAAA;AAChC,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,IAAI,CAAA,IAAK,EAAA;AAEjC,EAAA,IAAI,SAAA,KAAc,MAAM,SAAA,KAAc,EAAA,IAAM,CAAC,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA,EAAG;AACpE,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAK,GAAA,CAAI,GAAA,GAAM,OAAO,SAAS,CAAC,IAAI,gBAAA,EAAkB;AACxD,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAAA,IAC/B,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,QAAA,GAAW,KAAA;AAAA,IACf,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAA,EAAK,IAAI,WAAA,EAAY,CAAE,OAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,OAAO,EAAE,CAAC;AAAA,GAC3F;AAEA,EAAA,OAAO,eAAA,CAAgB,UAAU,SAAS,CAAA;AAC5C;AAsBA,SAAS,MAAA,CAAO,SAAyB,IAAA,EAAkC;AACzE,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,YAAmB,OAAA,EAAS;AAChE,IAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,MAAA;AAAA,EAC9B;AAEA,EAAA,MAAM,MAAA,GAAS,OAAA;AACf,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,EAAY,KAAM,IAAI,CAAA;AACpE,EAAA,MAAM,KAAA,GAAQ,GAAA,KAAQ,MAAA,GAAY,MAAA,GAAY,OAAO,GAAG,CAAA;AAExD,EAAA,OAAO,MAAM,OAAA,CAAQ,KAAK,IAAI,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,GAAK,KAAA;AACnD;AAEA,SAAS,cAAc,KAAA,EAA+C;AACpE,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,KAAK,KAAK,CAAA;AACzB,IAAA,OAAO,UAAA,CAAW,KAAK,MAAA,EAAQ,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAC,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAS,KAAA,EAA4B;AAC5C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAI,UAAA,CAAW,KAAK,CAAA,EAAG;AACxC,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,KAAK,MAAM,CAAA;AACpB;AAWA,eAAsB,sBAAsB,OAAA,EAAyD;AACnG,EAAA,MAAM,EAAE,OAAA,EAAS,OAAA,EAAS,MAAA,EAAO,GAAI,OAAA;AACrC,EAAA,MAAM,gBAAA,GAAmB,QAAQ,gBAAA,IAAoB,GAAA;AACrD,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,IAAO,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAEvD,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,OAAA,EAAS,YAAY,CAAA;AACvC,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,OAAA,EAAS,mBAAmB,CAAA;AACrD,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,OAAA,EAAS,mBAAmB,CAAA;AAEtD,EAAA,IAAI,CAAC,EAAA,IAAM,CAAC,SAAA,IAAa,CAAC,cAAc,CAAC,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA,EAAG;AAChE,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAK,GAAA,CAAI,GAAA,GAAM,OAAO,SAAS,CAAC,IAAI,gBAAA,EAAkB;AACxD,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,WAA2C,MAAA,CAAO,UAAA,CAAW,QAAQ,CAAA,GAAI,cAAc,MAAA,CAAO,KAAA,CAAM,QAAA,CAAS,MAAM,CAAC,CAAA,GAAI,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AAE7J,EAAA,IAAI,QAAA,KAAa,IAAA,IAAQ,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AAC9C,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,MAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,OAAO,QAAA,EAAU,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,SAAA,EAAU,EAAG,KAAA,EAAO,CAAC,MAAM,CAAC,CAAA;AAC7G,EAAA,MAAM,QAAA,GAAW,SAAS,MAAM,MAAA,CAAO,OAAO,IAAA,CAAK,MAAA,EAAQ,KAAK,IAAI,WAAA,GAAc,MAAA,CAAO,CAAA,EAAG,EAAE,CAAA,CAAA,EAAI,SAAS,IAAI,OAAO,CAAA,CAAE,CAAC,CAAC,CAAA;AAG1H,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,KAAA,MAAW,SAAA,IAAa,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,EAAG;AAC7C,IAAA,MAAM,CAAC,OAAA,EAAS,SAAS,IAAI,SAAA,CAAU,KAAA,CAAM,KAAK,CAAC,CAAA;AACnD,IAAA,IAAI,YAAY,IAAA,IAAQ,SAAA,KAAc,UAAa,eAAA,CAAgB,QAAA,EAAU,SAAS,CAAA,EAAG;AACvF,MAAA,KAAA,GAAQ,IAAA;AAAA,IACV;AAAA,EACF;AAEA,EAAA,OAAO,KAAA;AACT;;;ACxKO,IAAM,YAAN,MAAgB;AAAA,EAGrB,YACmB,MAAA,EACA,SAAA,EACA,UAAA,EACA,GAAA,GAAoB,KAAK,GAAA,EAC1C;AAJiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAChB;AAAA,EAJgB,MAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,GAAA;AAAA,EANX,MAAA,GAA+D,IAAA;AAAA,EASvE,MAAM,QAAA,GAAuC;AAC3C,IAAA,IAAI,KAAK,MAAA,IAAU,IAAA,CAAK,OAAO,SAAA,GAAY,IAAA,CAAK,KAAI,EAAG;AACrD,MAAA,OAAO,KAAK,MAAA,CAAO,GAAA;AAAA,IACrB;AAEA,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,SAAA,CAAU,IAAA,CAAK,MAAM,CAAC,CAAA,iCAAA,CAAA;AACrC,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,MAAA,EAAQ,UAAA,CAAW,QAAQ,CAAA;AAC/D,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,qCAAA,EAAwC,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAC1F;AACA,MAAA,GAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,IAC7B,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,mBAAA,EAAqB;AACxC,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,0BAAA,EAA6B,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IAC5E,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,OAAO,GAAA,CAAI,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,WAAW,EAAA,EAAI;AACvD,MAAA,MAAM,IAAI,oBAAoB,+CAA+C,CAAA;AAAA,IAC/E;AAOA,IAAA,IAAI,UAAU,GAAA,CAAI,MAAM,MAAM,SAAA,CAAU,IAAA,CAAK,MAAM,CAAA,EAAG;AACpD,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,kDAAA,EAAqD,IAAI,MAAM,CAAA,EAAA;AAAA,OACjE;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS,EAAE,GAAA,EAAK,SAAA,EAAW,KAAK,GAAA,EAAI,GAAI,KAAK,UAAA,EAAW;AAC7D,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAgD;AAC7D,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA,EAAI;AAC7C,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,kCAAA,EAAqC,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3E;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,iBAAiB,IAAA,EAAuD;AAC5E,IAAA,MAAM,KAAA,GAAA,CAAS,MAAM,IAAA,CAAK,QAAA,IAAY,IAAI,CAAA;AAC1C,IAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,KAAK,KAAA,GAAQ,IAAA;AAAA,EAC7D;AACF;AAGA,SAAS,UAAU,KAAA,EAAuB;AACxC,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACjC;;;ACHO,IAAM,eAAN,MAAmB;AAAA,EAIxB,YAA6B,MAAA,EAAsB;AAAtB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAC3B,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,mBAAmB,sCAAsC,CAAA;AAAA,IACrE;AACA,IAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,MAAA,MAAM,IAAI,mBAAmB,wCAAwC,CAAA;AAAA,IACvE;AACA,IAAA,kBAAA,CAAmB,OAAO,MAAM,CAAA;AAChC,IAAA,IAAA,CAAK,YAAY,IAAI,SAAA;AAAA,MACnB,MAAA,CAAO,MAAA;AAAA,MACP,OAAO,SAAA,IAAa,GAAA;AAAA,MACpB,OAAO,UAAA,IAAc;AAAA,KACvB;AAAA,EACF;AAAA,EAb6B,MAAA;AAAA,EAHZ,SAAA;AAAA,EACA,SAAA,uBAAgB,GAAA,EAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsB3D,MAAM,0BAAA,CAA2B,OAAA,GAAuC,EAAC,EAAkC;AACzG,IAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,MAAM,CAAA;AACzC,IAAA,yBAAA,CAA0B,SAAS,MAAM,CAAA;AAEzC,IAAA,MAAM,eAAe,cAAA,EAAe;AACpC,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,WAAA,CAAY,EAAE,CAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,YAAY,EAAE,CAAA;AAE5B,IAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAEvD,IAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,WAAA,KAAgB,EAAA,EAAI;AAKnD,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MACjC,aAAA,EAAe,MAAA;AAAA,MACf,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,YAAA,EAAc,WAAA;AAAA,MACd,QAAQ,OAAA,CAAQ,MAAA,IAAU,KAAK,MAAA,EAAO,EAAG,KAAK,GAAG,CAAA;AAAA,MACjD,KAAA;AAAA,MACA,KAAA;AAAA,MACA,cAAA,EAAgB,MAAM,SAAA,CAAU,YAAY,CAAA;AAAA,MAC5C,qBAAA,EAAuB;AAAA,KACxB,CAAA;AACD,IAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,MAAA,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IACvC;AACA,IAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,MAAA,MAAA,CAAO,GAAA,CAAI,YAAA,EAAc,OAAA,CAAQ,SAAS,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AACtC,MAAA,MAAA,CAAO,GAAA,CAAI,SAAA,EAAW,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,IAC9C;AACA,IAAA,IAAI,OAAA,CAAQ,iBAAiB,MAAA,EAAW;AACtC,MAAA,MAAA,CAAO,GAAA,CAAI,cAAA,EAAgB,OAAA,CAAQ,YAAY,CAAA;AAAA,IACjD;AACA,IAAA,IAAI,OAAA,CAAQ,qBAAqB,MAAA,EAAW;AAC1C,MAAA,MAAA,CAAO,GAAA,CAAI,mBAAA,EAAqB,OAAA,CAAQ,gBAAgB,CAAA;AAAA,IAC1D;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,OAAO;AAAA,MACL,KAAK,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,UAAU,CAAA,CAAA;AAAA,MACrC,KAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA;AAAA;AAAA;AAAA,MAGA,GAAI,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,GAAW,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO,GAAI,EAAC;AAAA,MACvE,GAAI,QAAQ,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,EAAc,OAAA,CAAQ,YAAA,EAAa,GAAI;AAAC,KACrF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,kBAAA,CACE,cAAA,EACA,OAAA,GAAkF,EAAC,EACpD;AAC/B,IAAA,OAAO,KAAK,0BAAA,CAA2B,EAAE,GAAG,OAAA,EAAS,YAAA,EAAc,gBAAgB,CAAA;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAa,KAAA,EAIG;AACpB,IAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAO,GAAI,KAAA;AAE3B,IAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,qBAAA,CAAsB,MAAA,CAAO,KAAA,EAAO,MAAA,CAAO,KAAK,CAAA,EAAG;AACxF,MAAA,MAAM,IAAI,kBAAkB,0EAAqE,CAAA;AAAA,IACnG;AAEA,IAAA,IAAI,OAAO,KAAA,EAAO;AAIhB,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,2BAAA,EAA8B,MAAA,CAAO,KAAK,CAAA,EAAG,MAAA,CAAO,oBAAoB,CAAA,EAAA,EAAK,MAAA,CAAO,iBAAiB,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,CAAA;AAAA,QAC7G,MAAA,CAAO,KAAA;AAAA,QACP,OAAO,iBAAA,IAAqB;AAAA,OAC9B;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,OAAO,IAAA,EAAM;AAChB,MAAA,MAAM,IAAI,oBAAoB,iDAAiD,CAAA;AAAA,IACjF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA,CAAS,OAAO,IAAA,EAAM,MAAA,CAAO,YAAA,EAAc,KAAA,CAAM,WAAW,CAAA;AAEtF,IAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC/D;AAEA,IAAA,IAAI,WAAoC,EAAC;AAEzC,IAAA,IAAI,OAAO,QAAA,EAAU;AACnB,MAAA,QAAA,GAAW,MAAM,KAAK,aAAA,CAAc,MAAA,CAAO,UAAU,MAAA,CAAO,KAAA,EAAO,OAAO,MAAM,CAAA;AAAA,IAClF,CAAA,MAAA,IAAA,CAAY,OAAO,MAAA,IAAU,IAAA,CAAK,QAAO,EAAG,QAAA,CAAS,QAAQ,CAAA,EAAG;AAQ9D,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF,CAAA,MAAA,IAAW,OAAO,MAAA,CAAO,MAAA,KAAW,QAAA,EAAU;AAG5C,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,YAAA,CAAa,QAAQ,QAAQ,CAAA;AAErD,IAAA,IAAI,OAAO,YAAA,KAAiB,MAAA,IAAa,IAAA,CAAK,cAAA,KAAmB,OAAO,YAAA,EAAc;AACpF,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,yCAAyC,MAAA,CAAO,YAAY,CAAA,yBAAA,EAA4B,IAAA,CAAK,kBAAkB,iBAAiB,CAAA,sDAAA;AAAA,OAClI;AAAA,IACF;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAc,YAAA,CACZ,MAAA,EACA,QAAA,EACmB;AACnB,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,QAAA,CAAS,OAAO,YAAY,CAAA;AAMvD,IAAA,MAAM,WAAA,GAAc,SAAS,KAAK,CAAA;AAClC,IAAA,MAAM,UAAA,GAAa,QAAQ,KAAK,CAAA;AAEhC,IAAA,IAAI,OAAO,WAAA,KAAgB,QAAA,IAAY,OAAO,UAAA,KAAe,YAAY,CAAC,qBAAA,CAAsB,WAAA,EAAa,UAAU,CAAA,EAAG;AACxH,MAAA,MAAM,IAAI,oBAAoB,4DAA4D,CAAA;AAAA,IAC5F;AAMA,IAAA,MAAM,MAAA,GAAkC,EAAE,GAAG,OAAA,EAAS,GAAG,QAAA,EAAS;AAElE,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,EAAA,EAAI;AACzC,MAAA,MAAM,IAAI,oBAAoB,wCAAwC,CAAA;AAAA,IACxE;AAEA,IAAA,MAAM,aAAA,GAAgB,kBAAA,CAAmB,MAAA,CAAO,eAAe,CAAC,CAAA;AAEhE,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,GAAA;AAAA,MACJ,KAAA,EAAO,OAAO,MAAA,CAAO,OAAO,MAAM,QAAA,GAAW,MAAA,CAAO,OAAO,CAAA,GAAI,IAAA;AAAA,MAC/D,IAAA,EAAM,OAAO,MAAA,CAAO,MAAM,MAAM,QAAA,GAAW,MAAA,CAAO,MAAM,CAAA,GAAI,IAAA;AAAA,MAC5D,cAAA,EAAgB,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,IAAA;AAAA,MACpE,YAAA,EAAc,aAAa,MAAM,CAAA;AAAA,MACjC,KAAA,EAAO,MAAM,MAAM,CAAA;AAAA,MACnB,WAAA,EAAa,YAAY,MAAM,CAAA;AAAA,MAC/B,YAAA,EAAc,aAAa,MAAM,CAAA;AAAA,MACjC,KAAA,EAAO,MAAM,MAAM,CAAA;AAAA,MACnB,SAAA,EAAW,UAAU,MAAM,CAAA;AAAA;AAAA,MAE3B,GAAI,aAAA,GAAgB,EAAE,aAAA,KAAkB,EAAC;AAAA,MACzC,MAAA;AAAA,MACA,aAAa,MAAA,CAAO,YAAA;AAAA,MACpB,YAAA,EAAc,OAAO,aAAA,IAAiB,IAAA;AAAA,MACtC,OAAA,EAAS,OAAO,QAAA,IAAY,IAAA;AAAA,MAC5B,WAAW,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,GAAW,OAAO,UAAA,GAAa;AAAA,KACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,2BAA2B,MAAA,EAAiD;AAChF,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,+BAA+B,CAAA;AAEtF,IAAA,IAAI,aAAa,IAAA,EAAM;AACrB,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,QAAQ,MAAA,IAAU,IAAA,CAAK,MAAA,EAAO,EAAG,KAAK,GAAG;AAAA,KAC1C,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,UAAU,IAAI,CAAA;AAC/C,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,MAAM,UAAA,CAAW,QAAA,EAAU,qCAAqC,CAAA;AAAA,IACxE;AAEA,IAAA,MAAM,OAAA,GAAW,MAAM,QAAA,CAAS,IAAA,EAAK;AAErC,IAAA,MAAM,UAAA,GAAa,QAAQ,aAAa,CAAA;AACxC,IAAA,MAAM,QAAA,GAAW,QAAQ,WAAW,CAAA;AACpC,IAAA,MAAM,eAAA,GAAkB,QAAQ,kBAAkB,CAAA;AAElD,IAAA,IAAI,OAAO,eAAe,QAAA,IAAY,OAAO,aAAa,QAAA,IAAY,OAAO,oBAAoB,QAAA,EAAU;AACzG,MAAA,MAAM,IAAI,oBAAoB,mDAAmD,CAAA;AAAA,IACnF;AAEA,IAAA,OAAO;AAAA,MACL,UAAA;AAAA,MACA,QAAA;AAAA,MACA,eAAA;AAAA,MACA,uBAAA,EACE,OAAO,OAAA,CAAQ,2BAA2B,MAAM,QAAA,GAC5C,OAAA,CAAQ,2BAA2B,CAAA,GACnC,IAAA;AAAA,MACN,SAAA,EAAW,OAAO,OAAA,CAAQ,YAAY,MAAM,QAAA,GAAW,OAAA,CAAQ,YAAY,CAAA,GAAI,GAAA;AAAA;AAAA;AAAA,MAG/E,QAAA,EAAU,OAAO,OAAA,CAAQ,UAAU,MAAM,QAAA,GAAW,OAAA,CAAQ,UAAU,CAAA,GAAI;AAAA,KAC5E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,eAAA,CACJ,aAAA,EACA,OAAA,GAAoC,EAAC,EAClB;AACnB,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,gBAAgB,CAAA;AAC/D,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,cAAc,SAAA,GAAY,GAAA;AACxD,IAAA,IAAI,UAAA,GAAa,cAAc,QAAA,GAAW,GAAA;AAE1C,IAAA,WAAS;AACP,MAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,KAAY,IAAA,EAAM;AACpC,QAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,MAC/D;AACA,MAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AACzB,QAAA,MAAM,IAAI,mBAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAEA,MAAA,MAAM,KAAA,CAAM,UAAA,EAAY,OAAA,CAAQ,MAAM,CAAA;AAEtC,MAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,QAC/B,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,aAAA,CAAc,UAAA;AAAA,QAC3B,SAAA,EAAW,KAAK,MAAA,CAAO;AAAA,OACxB,CAAA;AACD,MAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,QAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAAA,MACpD;AAEA,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,UAAU,IAAI,CAAA;AAE/C,MAAA,IAAI,SAAS,EAAA,EAAI;AACf,QAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AAEpC,QAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,UAAA,MAAM,IAAI,oBAAoB,oDAAoD,CAAA;AAAA,QACpF;AAKA,QAAA,MAAM,QAAA,GAAW,MAAA,CAAO,QAAA,GAAW,MAAM,IAAA,CAAK,cAAc,MAAA,CAAO,QAAA,EAAU,EAAE,CAAA,GAAI,EAAC;AAEpF,QAAA,OAAO,MAAM,IAAA,CAAK,YAAA,CAAa,MAAA,EAAQ,QAAQ,CAAA;AAAA,MACjD;AAEA,MAAA,MAAM,OAAA,GAAW,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACvD,MAAA,MAAM,KAAA,GAAQ,OAAO,OAAA,CAAQ,OAAO,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAO,CAAA,GAAI,iBAAA;AAExE,MAAA,IAAI,UAAU,uBAAA,EAAyB;AACrC,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,UAAU,WAAA,EAAa;AAGzB,QAAA,UAAA,IAAc,GAAA;AACd,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,UAAU,eAAA,EAAiB;AAC7B,QAAA,MAAM,IAAI,oBAAoB,uBAAuB,CAAA;AAAA,MACvD;AAEA,MAAA,IAAI,UAAU,eAAA,EAAiB;AAC7B,QAAA,MAAM,IAAI,mBAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAEA,MAAA,MAAM,MAAM,UAAA,CAAW,QAAA,EAAU,uBAAuB,CAAA;AAAA,IAC1D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,YAAA,EAAgD;AAC5D,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,eAAA;AAAA,MACZ,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe;AAAA,KAChB,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAKhB,MAAA,MAAM,MAAM,UAAA,CAAW,QAAA,EAAU,sBAAsB,CAAA;AAAA,IACzD;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AACpC,IAAA,IAAI,CAAC,OAAO,YAAA,EAAc;AACxB,MAAA,MAAM,IAAI,oBAAoB,+CAA+C,CAAA;AAAA,IAC/E;AAQA,IAAA,IAAI,OAAO,QAAA,EAAU;AACnB,MAAA,MAAM,IAAA,CAAK,aAAA,CAAc,MAAA,CAAO,QAAA,EAAU,EAAE,CAAA;AAAA,IAC9C;AAEA,IAAA,OAAO;AAAA,MACL,aAAa,MAAA,CAAO,YAAA;AAAA;AAAA;AAAA,MAGpB,YAAA,EAAc,OAAO,aAAA,IAAiB,YAAA;AAAA,MACtC,OAAA,EAAS,OAAO,QAAA,IAAY,IAAA;AAAA,MAC5B,WAAW,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,GAAW,OAAO,UAAA,GAAa,CAAA;AAAA,MACvE,OAAO,OAAO,MAAA,CAAO,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ;AAAA,KAC3D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,QAAA,EAA2B;AACpC,IAAA,MAAM,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,EAAG,IAAA,CAAK,WAAA,EAAa,CAAA,CAAA;AAC1E,IAAA,OAAO,QAAA,GAAW,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,eAAA,CAAgB,EAAE,SAAA,EAAW,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,CAAA,CAAA,GAAK,IAAA;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,cAAA,CAAe,UAAiC,QAAA,EAA2B;AACzE,IAAA,OAAO,cAAA,CAAe,IAAA,CAAK,MAAA,CAAO,MAAA,EAAQ,QAAA,EAAU;AAAA,MAClD,QAAA,EAAU,KAAK,MAAA,CAAO,QAAA;AAAA,MACtB,GAAI,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,KAAa;AAAC,KAC9C,CAAA;AAAA,EACH;AAAA,EAEA,UAAA,CAAW,OAAA,GAA2E,EAAC,EAAW;AAChG,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,EAAE,SAAA,EAAW,QAAQ,QAAA,IAAY,IAAA,CAAK,MAAA,CAAO,QAAA,EAAU,CAAA;AAC1F,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAA,CAAO,GAAA,CAAI,WAAA,EAAa,OAAA,CAAQ,QAAQ,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,QAAQ,YAAA,EAAc;AACxB,MAAA,MAAA,CAAO,GAAA,CAAI,cAAA,EAAgB,OAAA,CAAQ,YAAY,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,kBAAA,EAAqB,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA;AAAA,EACvF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAM,SAAA,CAAU,QAAA,EAAmB,WAAA,EAA8C;AAC/E,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,sBAAsB,CAAA;AAC7E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,EAAE,WAAW,IAAA,CAAK,MAAA,CAAO,UAAU,CAAA;AACtE,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,MAAA,CAAO,GAAA,CAAI,4BAA4B,QAAQ,CAAA;AAAA,IACjD;AACA,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,MAAA,CAAO,GAAA,CAAI,iBAAiB,WAAW,CAAA;AAAA,IACzC;AACA,IAAA,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,MAAA,CAAO,UAAU,CAAA,CAAA;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAA,CAAa,OAAA,GAAoD,EAAC,EAAoB;AAC1F,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe,KAAK,aAAA;AAAc,KACnC,CAAA;AACD,IAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,EAAG;AAC/C,MAAA,IAAA,CAAK,IAAI,OAAA,EAAS,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,IAAA,CAAK,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACvC;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,MAAM,UAAA,CAAW,QAAA,EAAU,8BAA8B,CAAA;AAAA,IACjE;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,EAAU;AACzC,MAAA,MAAM,IAAI,oBAAoB,yCAAyC,CAAA;AAAA,IACzE;AACA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,SAAS,WAAA,EAAuD;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAC1E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAC;AAAA,IACV;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,gBAAA,CAAiB,QAAA,EAAU;AAAA,MACrD,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA;AAAG,KACnD,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,MAAM,UAAA,CAAW,QAAA,EAAU,yBAAyB,CAAA;AAAA,IAC5D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,KAAA,EAAiD;AAChE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,wBAAwB,CAAA;AACvE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,aAAA,EAAe,CAAA,CAAE,CAAA;AACpE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA;AAAA,MAC1B,QAAA;AAAA,MACA,IAAI,eAAA,CAAgB,EAAE,KAAA,EAAO,CAAA;AAAA,MAC7B,EAAE,aAAA,EAAe,CAAA,MAAA,EAAS,KAAK,CAAA,CAAA;AAAG,KACpC;AACA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,MAAM,UAAA,CAAW,QAAA,EAAU,8BAA8B,CAAA;AAAA,IACjE;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,MAAA,CAAO,KAAA,EAAe,aAAA,EAA8C;AACxE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,qBAAqB,CAAA;AACpE,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB,EAAE,OAAO,SAAA,EAAW,IAAA,CAAK,MAAA,CAAO,QAAA,EAAU,CAAA;AAC3E,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,IAAA,CAAK,GAAA,CAAI,mBAAmB,aAAa,CAAA;AAAA,IAC3C;AAEA,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,MAAA,EAAS,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA,CAAE,CAAC,CAAA,CAAA;AAAA,IAC9F;AAEA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,IAAA,CAAK,QAAA,EAAU,MAAM,OAAO,CAAA;AACxD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,MAAM,UAAA,CAAW,QAAA,EAAU,2BAA2B,CAAA;AAAA,IAC9D;AAAA,EACF;AAAA;AAAA,EAGA,cAAc,OAAA,EAAiD;AAC7D,IAAA,OAAO,cAAc,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAA,EAAkC;AACtC,IAAA,OAAO,IAAI,YAAY,IAAA,CAAK,MAAA,CAAO,QAAQ,WAAA,EAAa,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAAA,EACzF;AAAA,EAEA,MAAc,QAAA,CAAS,IAAA,EAAc,QAAA,EAAkB,WAAA,EAA8C;AACnG,IAAA,MAAM,QAAA,GAAW,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,WAAA;AAE5C,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,KAAa,EAAA,EAAI;AAC7C,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,YAAA,EAAc,QAAA;AAAA,MACd,SAAA,EAAW,KAAK,MAAA,CAAO,QAAA;AAAA,MACvB,aAAA,EAAe;AAAA,KAChB,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC5B,MAAA,IAAA,CAAK,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAAA,IACpD;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,MAAM,KAAK,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG,IAAI,CAAA;AACtF,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,MAAM,UAAA,CAAW,QAAA,EAAU,uBAAuB,CAAA;AAAA,IAC1D;AACA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B;AAAA,EAEA,MAAc,aAAA,CACZ,OAAA,EAIA,KAAA,EACA,MAAA,EACkC;AAClC,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,UAAU,CAAA;AACxD,IAAA,IAAI,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAO,CAAA;AACzC,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,QAAA,GAAW,kBAAA,CAAmB,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA;AAC9C,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAA,EAAS,QAAQ,CAAA;AAAA,IACtC;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAC,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,SAAS,QAAA,EAAU;AAAA,QAChD,MAAA,EAAQ,KAAK,MAAA,CAAO,MAAA;AAAA,QACpB,QAAA,EAAU,KAAK,MAAA,CAAO,QAAA;AAAA;AAAA;AAAA;AAAA,QAItB,UAAA,EAAY,CAAC,OAAA,EAAS,OAAO;AAAA,OAC9B,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,oCAAA,EAAuC,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IACtF;AAEA,IAAA,IAAI,KAAA,IAAS,OAAA,CAAQ,OAAO,CAAA,KAAM,KAAA,EAAO;AACvC,MAAA,MAAM,IAAI,oBAAoB,0DAAqD,CAAA;AAAA,IACrF;AAQA,IAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,MAAA,MAAM,QAAA,GAAW,QAAQ,WAAW,CAAA;AAEpC,MAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAChC,QAAA,MAAM,IAAI,mBAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAEA,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,wBAAA,IAA4B,EAAA;AAC1D,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAA,GAAI,QAAA;AAE5C,MAAA,IAAI,GAAA,GAAM,SAAS,SAAA,EAAW;AAC5B,QAAA,MAAM,IAAI,mBAAA;AAAA,UACR,CAAA,sBAAA,EAAyB,GAAG,CAAA,2BAAA,EAA8B,MAAM,CAAA,0CAAA;AAAA,SAClE;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEQ,MAAA,GAAmB;AACzB,IAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,MAAA;AAC3B,IAAA,OAAO,MAAA,IAAU,OAAO,MAAA,GAAS,CAAA,GAAI,SAAS,CAAC,QAAA,EAAU,WAAW,OAAO,CAAA;AAAA,EAC7E;AAAA,EAEQ,WAAA,GAAsB;AAC5B,IAAA,MAAM,IAAA,GAAO,KAAK,MAAA,CAAO,WAAA;AAIzB,IAAA,OAAO,IAAA,IAAQ,SAAS,EAAA,GAAK,CAAA,CAAA,EAAI,KAAK,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,CAAA,GAAK,UAAA;AAAA,EAC/D;AAAA,EAEQ,aAAA,GAAwB;AAC9B,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc;AAC7B,MAAA,MAAM,IAAI,mBAAmB,8DAA8D,CAAA;AAAA,IAC7F;AACA,IAAA,OAAO,KAAK,MAAA,CAAO,YAAA;AAAA,EACrB;AAAA,EAEQ,IAAA,CAAK,GAAA,EAAa,IAAA,EAAuB,OAAA,GAAkC,EAAC,EAAsB;AACxG,IAAA,OAAO,IAAA,CAAK,iBAAiB,GAAA,EAAK;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,GAAG,OAAA,EAAQ;AAAA,MAC3E;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,gBAAA,CAAiB,GAAA,EAAa,IAAA,EAAsC;AAChF,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,MAAA,CAAO,SAAA,IAAa,GAAM,CAAA;AAClF,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,IAChE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF;AAGA,SAAS,YAAY,MAAA,EAAsE;AACzF,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,MAAA,GAAS,CAAC,GAAG,IAAI,GAAA,CAAI,OAAO,MAAA,KAAW,QAAA,GAAW,CAAC,MAAM,CAAA,GAAI,MAAM,CAAC,CAAA;AAI1E,EAAA,IAAI,OAAO,QAAA,CAAS,MAAM,CAAA,IAAK,MAAA,CAAO,SAAS,CAAA,EAAG;AAChD,IAAA,MAAM,IAAI,mBAAmB,gEAAgE,CAAA;AAAA,EAC/F;AAEA,EAAA,OAAO,MAAA;AACT;AAOA,SAAS,yBAAA,CAA0B,SAAsC,MAAA,EAAqC;AAG5G,EAAA,IAAI,OAAA,CAAQ,iBAAiB,EAAA,EAAI;AAC/B,IAAA,MAAM,IAAI,mBAAmB,iFAAiF,CAAA;AAAA,EAChH;AACA,EAAA,IAAI,OAAA,CAAQ,qBAAqB,EAAA,EAAI;AACnC,IAAA,MAAM,IAAI,mBAAmB,gFAAgF,CAAA;AAAA,EAC/G;AAEA,EAAA,IAAI,OAAA,CAAQ,iBAAiB,MAAA,EAAW;AACtC,IAAA;AAAA,EACF;AAIA,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,qBAAqB,CAAA,EAAG;AAC1C,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,qBAAqB,CAAA,EAAG;AAC1C,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACF;AAGA,SAAS,qBAAA,CAAsB,GAAW,CAAA,EAAoB;AAC5D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,QAAA,IAAY,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,QAAA,KAAa,CAAA;AACtB;AAOA,SAAS,mBAAmB,KAAA,EAAgD;AAC1E,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,OAA2B,EAAC;AAClC,EAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AACzB,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,EAAM;AAC/C,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,KAAA;AACf,IAAA,MAAM,EAAA,GAAK,OAAO,IAAI,CAAA;AACtB,IAAA,MAAM,IAAA,GAAO,OAAO,MAAM,CAAA;AAC1B,IAAA,IAAI,OAAO,OAAO,QAAA,IAAY,EAAA,KAAO,MAAM,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,EAAA,EAAI;AAClF,MAAA,IAAA,CAAK,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,MAAM,OAAO,MAAA,CAAO,MAAM,CAAA,KAAM,QAAA,GAAW,MAAA,CAAO,MAAM,CAAA,GAAI,MAAM,CAAA;AAAA,IAC1F;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AASA,SAAS,KAAA,CAAM,IAAY,MAAA,EAAqC;AAC9D,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,IAAI,MAAA,EAAQ,YAAY,IAAA,EAAM;AAC5B,MAAA,MAAA,CAAO,IAAI,mBAAA,CAAoB,+BAA+B,CAAC,CAAA;AAC/D,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,EAAQ,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAC5C,MAAA,OAAA,EAAQ;AAAA,IACV,GAAG,EAAE,CAAA;AAEL,IAAA,MAAM,UAAU,MAAY;AAC1B,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAA,CAAO,IAAI,mBAAA,CAAoB,+BAA+B,CAAC,CAAA;AAAA,IACjE,CAAA;AAEA,IAAA,MAAA,EAAQ,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC3D,CAAC,CAAA;AACH","file":"chunk-T5LCQOLS.js","sourcesContent":["import type { CboxUser } from './types.js';\n\n/**\n * The membership tier a person holds in the organization a token is bound to — the\n * `org_role` claim. Coarse on purpose: it says who may administer the organization\n * itself (invite, bill, delete). What they may do inside YOUR app is `roles` /\n * `permissions`, which your app declares and Cbox ID assigns.\n */\nexport type OrganizationRole = 'owner' | 'admin' | 'developer' | 'member' | 'viewer';\n\nconst ORGANIZATION_ROLES: ReadonlySet<string> = new Set<OrganizationRole>([\n  'owner',\n  'admin',\n  'developer',\n  'member',\n  'viewer',\n]);\n\n/** The organization a token is bound to: the `org`, `org_name` and `org_role` claims. */\nexport interface CboxActiveOrganization {\n  /** The stable organization id (`org`). */\n  id: string;\n  /** Its display name (`org_name`), when the instance sent one. */\n  name: string | null;\n  /**\n   * The person's membership tier in it (`org_role`). Null when the claim is absent, or\n   * carries a tier this SDK version does not know — an unrecognised tier is never\n   * guessed upward into one that grants something.\n   */\n  role: OrganizationRole | null;\n}\n\n/**\n * Who is actually driving a delegated session — the RFC 8693 §4.1 `act` claim. Cbox ID\n * sets it on the tokens of a SUPPORT SESSION: a staff member acting as one of your users,\n * with a stated reason, for at most an hour, with no refresh token.\n *\n * `sub` is the actor's subject id. It is null when an `act` claim is present but not in\n * the shape RFC 8693 describes — the token is still acted, and saying so matters more\n * than knowing by whom (see {@link isSupportSession}).\n */\nexport interface CboxActor {\n  sub: string | null;\n  /** The prior actor, when delegation was chained (RFC 8693 §4.1 nested `act`). */\n  actor: CboxActor | null;\n}\n\n/**\n * Anything the helpers below can read claims from: a {@link CboxUser} from sign-in, or a\n * claim set you verified yourself — an access token's payload on a resource server, say.\n */\nexport type ClaimSource = CboxUser | Readonly<Record<string, unknown>>;\n\n/**\n * The organization this session is bound to, or null when it is bound to none.\n *\n * ```ts\n * const org = organization(user);\n * if (org?.role === 'owner') showBilling();\n * ```\n */\nexport function organization(source: ClaimSource): CboxActiveOrganization | null {\n  const claims = claimsOf(source);\n  const id = claims['org'];\n\n  if (typeof id !== 'string' || id === '') {\n    return null;\n  }\n\n  const name = claims['org_name'];\n  const role = claims['org_role'];\n\n  return {\n    id,\n    name: typeof name === 'string' && name !== '' ? name : null,\n    role: typeof role === 'string' && ORGANIZATION_ROLES.has(role) ? (role as OrganizationRole) : null,\n  };\n}\n\n/**\n * The actor behind a support session (`act`), or null for an ordinary session in which\n * the person is acting as themselves.\n */\nexport function actor(source: ClaimSource): CboxActor | null {\n  return parseActor(claimsOf(source)['act'], 0);\n}\n\n/**\n * Whether somebody other than the signed-in person is driving this session — a staff\n * member in a support session (the token carries `act`).\n *\n * FAIL-CLOSED. Any `act` claim at all counts, including one whose shape this SDK cannot\n * read: the check exists so an app can show a banner and refuse the things a helper\n * should never do on somebody's behalf (change their password, move their money), and a\n * malformed claim is not evidence that nobody else is at the keyboard.\n */\nexport function isSupportSession(source: ClaimSource): boolean {\n  return actor(source) !== null;\n}\n\n/**\n * The Cbox ID sign-in session this token came from — the ID Token's `sid` claim — or null\n * when the instance sent none.\n *\n * Store it with your own session: an OIDC Back-Channel Logout token names the session it\n * ends by this value, and matching on it is how you end the right one (rather than every\n * session the person has) when they sign out of Cbox ID elsewhere.\n */\nexport function sessionId(source: ClaimSource): string | null {\n  const sid = claimsOf(source)['sid'];\n\n  return typeof sid === 'string' && sid !== '' ? sid : null;\n}\n\n/** The app roles this session holds — the `roles` claim; empty when there are none. */\nexport function roles(source: ClaimSource): string[] {\n  return stringList(claimsOf(source)['roles']);\n}\n\n/**\n * The permissions this session holds — the `permissions` claim, already expanded from\n * `roles` by Cbox ID; empty when there are none.\n */\nexport function permissions(source: ClaimSource): string[] {\n  return stringList(claimsOf(source)['permissions']);\n}\n\n/** Whether the session holds `role`. Exact match; no wildcards. */\nexport function hasRole(source: ClaimSource, role: string): boolean {\n  return roles(source).includes(role);\n}\n\n/**\n * Whether the session holds `permission` (`feature:action`). Exact match; no wildcards\n * — a claim of `invoices:*` does not grant `invoices:delete`, because nothing on the\n * issuing side ever mints one.\n */\nexport function hasPermission(source: ClaimSource, permission: string): boolean {\n  return permissions(source).includes(permission);\n}\n\n/**\n * The scope that puts the `feature_flags` claim on the ID token, the access token and\n * UserInfo. Request it at sign-in (`scopes: ['openid', 'profile', FEATURE_FLAGS_SCOPE]`)\n * and give the app the scope on its Scopes tab.\n */\nexport const FEATURE_FLAGS_SCOPE = 'feature_flags';\n\n/**\n * The keys of the feature flags that are on for this person, in the organization the\n * session is bound to — the `feature_flags` claim, sorted as the server sent it.\n *\n * NULL IS NOT EMPTY. `null` means the claim is absent: the `feature_flags` scope was not\n * requested, or the instance predates it. `[]` means it was asked and nothing is on. A\n * token carries the flags as they were when it was issued; the next refresh, or UserInfo,\n * picks up a change.\n */\nexport function featureFlags(source: ClaimSource): string[] | null {\n  const claim = claimsOf(source)['feature_flags'];\n\n  return Array.isArray(claim) ? stringList(claim) : null;\n}\n\n/**\n * Whether the feature flag `key` is on for this session. Exact match on the key.\n *\n * False when the claim is absent — an app that forgot to request the scope sees every\n * feature off, never every feature on. Use {@link featureFlags} to tell the two apart.\n */\nexport function hasFeature(source: ClaimSource, key: string): boolean {\n  return featureFlags(source)?.includes(key) ?? false;\n}\n\n/**\n * Nesting is bounded: RFC 8693 chains are a handful deep in practice, and a claim nested\n * thousands deep is either a bug or an attempt to exhaust the stack. Past the bound the\n * chain is cut, not dropped — the session is still acted.\n */\nconst MAX_ACTOR_DEPTH = 8;\n\nfunction parseActor(claim: unknown, depth: number): CboxActor | null {\n  if (claim === undefined || claim === null) {\n    return null;\n  }\n\n  if (typeof claim !== 'object' || Array.isArray(claim)) {\n    return { sub: null, actor: null };\n  }\n\n  const record = claim as Record<string, unknown>;\n  const sub = record['sub'];\n\n  return {\n    sub: typeof sub === 'string' && sub !== '' ? sub : null,\n    actor: depth + 1 < MAX_ACTOR_DEPTH ? parseActor(record['act'], depth + 1) : null,\n  };\n}\n\nfunction stringList(claim: unknown): string[] {\n  return Array.isArray(claim)\n    ? claim.filter((value): value is string => typeof value === 'string' && value !== '')\n    : [];\n}\n\nfunction claimsOf(source: ClaimSource): Readonly<Record<string, unknown>> {\n  return isUser(source) ? source.claims : source;\n}\n\n/**\n * A `CboxUser` is told apart by the credential it carries alongside its claims. A raw\n * claim set never has an `accessToken` key — JWT claims are snake_case — so a verified\n * payload is never mistaken for a user and read from the wrong place.\n */\nfunction isUser(source: ClaimSource): source is CboxUser {\n  return (\n    typeof source['claims'] === 'object' &&\n    source['claims'] !== null &&\n    typeof source['accessToken'] === 'string'\n  );\n}\n","import { AuthenticationError, CboxIdError } from './errors.js';\n\n/** A stored vault secret's metadata (never its plaintext). */\nexport interface VaultSecretRef {\n  id: string;\n  name: string;\n  provider: string;\n  ownerType: string | null;\n  ownerId: string | null;\n  expiresAt: string | null;\n  revoked: boolean;\n}\n\n/** A brokered credential — the plaintext, for immediate use. */\nexport interface VaultLease {\n  secretId: string;\n  provider: string;\n  secret: string;\n  expiresAt: string;\n}\n\n/** A provider a pipe can connect to. */\nexport type PipeProvider = 'github' | 'google' | 'microsoft' | 'slack' | 'salesforce' | 'hubspot' | 'linear' | 'notion';\n\n/**\n * A fresh access token for one person's connected account at a provider — what\n * {@link VaultClient.leasePipeToken} returns. Use it, drop it, lease again next time.\n */\nexport interface PipeToken {\n  /** The provider's access token. Send it as a bearer token to the provider's API. */\n  accessToken: string;\n  tokenType: 'Bearer';\n  provider: string;\n  userId: string;\n  connectionId: string;\n  /** What the person consented to. */\n  scopes: string[];\n  /** When the PROVIDER stops accepting it; null for tokens that do not expire. */\n  expiresAt: string | null;\n  /** When to drop it and lease again. */\n  leaseExpiresAt: string;\n  /** What some providers need to be called at all — Salesforce's `instance_url`, Slack's `team.id`. */\n  metadata: Record<string, string>;\n}\n\n/** Where a person connects a provider, and where they come back to afterwards. */\nexport interface PipeConnectOptions {\n  /** Your app's client id — the connect page shows its name and allows its origins. */\n  clientId?: string;\n  /**\n   * Where to land afterwards, with `?provider=…&status=connected|cancelled|failed`. Must be\n   * on one of the app's registered redirect origins, or it is ignored.\n   */\n  returnTo?: string;\n}\n\n/**\n * Add `client_id` and `return_to` to a connect URL — the one a lease error carries, or\n * one built with {@link pipeConnectUrl}.\n */\nexport function withConnectReturn(connectUrl: string, options: PipeConnectOptions = {}): string {\n  const url = new URL(connectUrl);\n  if (options.clientId) url.searchParams.set('client_id', options.clientId);\n  if (options.returnTo) url.searchParams.set('return_to', options.returnTo);\n  return url.toString();\n}\n\n/**\n * The hosted page where the signed-in person connects their account at `provider`:\n * `{issuer}/account/connected-services/{provider}/connect?client_id=…&return_to=…`.\n */\nexport function pipeConnectUrl(issuer: string, provider: PipeProvider | string, options: PipeConnectOptions = {}): string {\n  return withConnectReturn(\n    `${issuer.replace(/\\/$/, '')}/account/connected-services/${encodeURIComponent(provider)}/connect`,\n    options,\n  );\n}\n\n/**\n * A pipe token lease was refused. Catch the subclasses for the cases you can act on:\n *\n *  - {@link PipeNotConnectedError} (404) and {@link PipeReauthorizationRequiredError}\n *    (409) — send the person to `connectUrl`.\n *  - {@link PipeTemporarilyUnavailableError} (503) — retry after `retryAfter` seconds.\n *  - {@link PipeLeaseDeniedError} (403) — a configuration problem: the app is not granted\n *    the pipe, it is disabled, or the person is outside the app's organization.\n *\n * Anything else (401, 422, 429) arrives as this base class with `status` and `error`.\n */\nexport class PipeLeaseError extends CboxIdError {\n  constructor(\n    message: string,\n    /** The server's error code, e.g. `not_connected`. */\n    readonly error: string | null,\n    readonly status: number,\n    /** Where to send the person to (re)connect — set on 404 and 409. */\n    readonly connectUrl: string | null = null,\n    /** Seconds to wait off `Retry-After`, when the server sent one. */\n    readonly retryAfter: number | null = null,\n  ) {\n    super(message);\n  }\n\n  /** `connectUrl` with your `client_id` and `return_to` on it, or null when there is none. */\n  connectUrlWith(options: PipeConnectOptions): string | null {\n    return this.connectUrl === null ? null : withConnectReturn(this.connectUrl, options);\n  }\n}\n\n/** The person has not connected this provider (404 `not_connected`). Send them to `connectUrl`. */\nexport class PipeNotConnectedError extends PipeLeaseError {\n  declare readonly connectUrl: string;\n}\n\n/**\n * The provider stopped accepting the connection — revoked, or the refresh token expired\n * (409 `reauthorization_required`). Send the person to `connectUrl` to connect again.\n */\nexport class PipeReauthorizationRequiredError extends PipeLeaseError {\n  declare readonly connectUrl: string;\n}\n\n/** The provider could not refresh the token just now (503). Retry after `retryAfter`. */\nexport class PipeTemporarilyUnavailableError extends PipeLeaseError {}\n\n/**\n * The lease was denied (403 `lease_denied`): the app is not granted the pipe, the pipe is\n * disabled or missing, the person is not in the app's organization, or `userId` names\n * someone other than the token's person. One answer for every reason, by design.\n */\nexport class PipeLeaseDeniedError extends PipeLeaseError {}\n\nexport interface StoreSecretInput {\n  name: string;\n  provider: string;\n  secret: string;\n  ownerType?: 'organization' | 'user';\n  ownerId?: string;\n  expiresAt?: string;\n}\n\n/**\n * Client for a Cbox ID instance's Token Vault API. Bind it to an access token\n * (obtain one with {@link CboxIdClient.machineToken}, scoped `vault.manage` for\n * provisioning or `vault.lease` for redeeming). All calls are server-to-server.\n */\nexport class VaultClient {\n  private readonly base: string;\n\n  constructor(\n    issuer: string,\n    private readonly token: string,\n    private readonly timeoutMs = 10_000,\n  ) {\n    this.base = `${issuer.replace(/\\/$/, '')}/api/v1/vault`;\n  }\n\n  /** Ingest a downstream credential, sealed at rest (scope `vault.manage`). */\n  store(input: StoreSecretInput): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', '/secrets', {\n      name: input.name,\n      provider: input.provider,\n      secret: input.secret,\n      owner_type: input.ownerType,\n      owner_id: input.ownerId,\n      expires_at: input.expiresAt,\n    });\n  }\n\n  /** Rotate a secret's value, keeping its id and grants (scope `vault.manage`). */\n  rotate(secretId: string, secret: string): Promise<VaultSecretRef> {\n    return this.json<VaultSecretRef>('POST', `/secrets/${encodeURIComponent(secretId)}/rotate`, { secret });\n  }\n\n  /** Revoke a secret permanently (scope `vault.manage`). */\n  async revoke(secretId: string): Promise<void> {\n    await this.request('DELETE', `/secrets/${encodeURIComponent(secretId)}`);\n  }\n\n  /** Authorize an agent client to lease a secret (scope `vault.manage`). */\n  grant(\n    secretId: string,\n    clientId: string,\n    maxTtlSeconds?: number,\n  ): Promise<{ secretId: string; clientId: string; maxTtlSeconds: number | null }> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/grants`, {\n      client_id: clientId,\n      max_ttl_seconds: maxTtlSeconds,\n    }).then((raw) => {\n      const r = raw as { secret_id: string; client_id: string; max_ttl_seconds: number | null };\n      return { secretId: r.secret_id, clientId: r.client_id, maxTtlSeconds: r.max_ttl_seconds };\n    });\n  }\n\n  /** Revoke an agent's authorization (scope `vault.manage`). */\n  async revokeGrant(secretId: string, clientId: string): Promise<void> {\n    await this.request(\n      'DELETE',\n      `/secrets/${encodeURIComponent(secretId)}/grants/${encodeURIComponent(clientId)}`,\n    );\n  }\n\n  /**\n   * Redeem a leased credential for immediate use (scope `vault.lease`). The caller\n   * is identified by the token's client; a lease with no live grant is refused.\n   */\n  lease(secretId: string, purpose: string): Promise<VaultLease> {\n    return this.json('POST', `/secrets/${encodeURIComponent(secretId)}/lease`, { purpose }).then((raw) => {\n      const r = raw as { secret_id: string; provider: string; secret: string; expires_at: string };\n      return { secretId: r.secret_id, provider: r.provider, secret: r.secret, expiresAt: r.expires_at };\n    });\n  }\n\n  /**\n   * Lease a fresh access token for a person's connected account at `provider` (Pipes,\n   * scope `vault.lease`). The token is refreshed first when it is about to expire, so\n   * you never handle a refresh token.\n   *\n   * With a client-credentials token, name the person in `userId`. With a token issued to\n   * your app FOR a person, leave it out — the lease is theirs.\n   *\n   * ```ts\n   * try {\n   *   const { accessToken } = await vault.leasePipeToken('github', { userId, purpose: 'list-repos' })\n   * } catch (e) {\n   *   if (e instanceof PipeNotConnectedError || e instanceof PipeReauthorizationRequiredError) {\n   *     return redirect(e.connectUrlWith({ clientId, returnTo }))\n   *   }\n   *   throw e\n   * }\n   * ```\n   */\n  async leasePipeToken(\n    provider: PipeProvider | string,\n    options: { purpose: string; userId?: string },\n  ): Promise<PipeToken> {\n    const path = `/pipes/${encodeURIComponent(provider)}/token`;\n    const response = await this.send('POST', path, {\n      purpose: options.purpose,\n      ...(options.userId !== undefined ? { user_id: options.userId } : {}),\n    });\n\n    let body: Record<string, unknown> = {};\n    try {\n      const parsed: unknown = await response.json();\n      if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {\n        body = parsed as Record<string, unknown>;\n      }\n    } catch {\n      // Not JSON — a proxy's error page. The status below is all there is.\n    }\n\n    if (!response.ok) {\n      throw pipeLeaseError(response, body);\n    }\n\n    if (typeof body.access_token !== 'string') {\n      throw new PipeLeaseError('The pipe lease answered without an access token.', null, response.status);\n    }\n\n    return {\n      accessToken: body.access_token,\n      tokenType: 'Bearer',\n      provider: String(body.provider ?? provider),\n      userId: String(body.user_id ?? ''),\n      connectionId: String(body.connection_id ?? ''),\n      scopes: Array.isArray(body.scopes) ? body.scopes.filter((s): s is string => typeof s === 'string') : [],\n      expiresAt: typeof body.expires_at === 'string' ? body.expires_at : null,\n      leaseExpiresAt: String(body.lease_expires_at ?? ''),\n      metadata: isStringRecord(body.metadata) ? body.metadata : {},\n    };\n  }\n\n  private async json<T>(method: string, path: string, body: Record<string, unknown>): Promise<T> {\n    const response = await this.request(method, path, body);\n    return (await response.json()) as T;\n  }\n\n  private async request(method: string, path: string, body?: Record<string, unknown>): Promise<Response> {\n    const response = await this.send(method, path, body);\n    if (!response.ok) {\n      throw new AuthenticationError(`Vault ${method} ${path} failed with status ${response.status}.`);\n    }\n    return response;\n  }\n\n  private async send(method: string, path: string, body?: Record<string, unknown>): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n    try {\n      const init: RequestInit = {\n        method,\n        headers: {\n          authorization: `Bearer ${this.token}`,\n          ...(body ? { 'content-type': 'application/json' } : {}),\n        },\n        signal: controller.signal,\n      };\n      if (body) {\n        init.body = JSON.stringify(body);\n      }\n      return await fetch(`${this.base}${path}`, init);\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n\nfunction pipeLeaseError(response: Response, body: Record<string, unknown>): PipeLeaseError {\n  const error = typeof body.error === 'string' ? body.error : null;\n  const message = typeof body.message === 'string' && body.message !== ''\n    ? body.message\n    : `The pipe lease failed with status ${response.status}.`;\n  const connectUrl = typeof body.connect_url === 'string' && body.connect_url !== '' ? body.connect_url : null;\n  const header = response.headers.get('retry-after')?.trim() ?? '';\n  const retryAfter = /^\\d+$/.test(header) ? Number(header) : null;\n\n  if (response.status === 404 && connectUrl !== null) {\n    return new PipeNotConnectedError(message, error, 404, connectUrl, retryAfter);\n  }\n  if (response.status === 409 && connectUrl !== null) {\n    return new PipeReauthorizationRequiredError(message, error, 409, connectUrl, retryAfter);\n  }\n  if (response.status === 503) {\n    return new PipeTemporarilyUnavailableError(message, error, 503, connectUrl, retryAfter);\n  }\n  if (response.status === 403 && error !== 'insufficient_scope') {\n    return new PipeLeaseDeniedError(message, error, 403, connectUrl, retryAfter);\n  }\n\n  return new PipeLeaseError(message, error, response.status, connectUrl, retryAfter);\n}\n\nfunction isStringRecord(value: unknown): value is Record<string, string> {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    !Array.isArray(value) &&\n    Object.values(value).every((v) => typeof v === 'string')\n  );\n}\n","/**\n * Verify a Cbox ID webhook / inline-action signature. The header is\n * `X-Cbox-Signature: t={unix},v1={hex hmac}` — an HMAC-SHA256 over\n * `\"{timestamp}.{raw body}\"`, valid within a freshness window. Built on Web Crypto\n * so it runs on Node, edge and the browser.\n */\n\n/** Constant-time compare of two hex strings. */\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\nfunction toHex(bytes: ArrayBuffer): string {\n  return Array.from(new Uint8Array(bytes))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nexport interface VerifyWebhookOptions {\n  /** The RAW request body — the exact bytes received, not a re-encoded copy. */\n  payload: string;\n  /** The value of the `X-Cbox-Signature` header. */\n  signatureHeader: string | null | undefined;\n  /** The signing secret issued when the webhook/action endpoint was registered. */\n  secret: string;\n  /** Freshness window in seconds. Defaults to 300 (5 minutes). */\n  toleranceSeconds?: number;\n  /** Injectable clock (unix seconds), for tests. Defaults to `Date.now()`. */\n  now?: number;\n}\n\n/** Returns `true` only when the signature is present, fresh and valid. Never throws. */\nexport async function verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n  const { payload, signatureHeader, secret } = options;\n  const toleranceSeconds = options.toleranceSeconds ?? 300;\n  const now = options.now ?? Math.floor(Date.now() / 1000);\n\n  if (!signatureHeader) {\n    return false;\n  }\n\n  const parts: Record<string, string> = {};\n  for (const segment of signatureHeader.split(',')) {\n    const [key, value] = segment.trim().split('=', 2);\n    if (key) {\n      parts[key] = value ?? '';\n    }\n  }\n\n  const timestamp = parts['t'] ?? '';\n  const signature = parts['v1'] ?? '';\n\n  if (timestamp === '' || signature === '' || !/^\\d+$/.test(timestamp)) {\n    return false;\n  }\n\n  if (Math.abs(now - Number(timestamp)) > toleranceSeconds) {\n    return false;\n  }\n\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  );\n  const expected = toHex(\n    await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(`${timestamp}.${payload}`)),\n  );\n\n  return timingSafeEqual(expected, signature);\n}\n\n/** Headers as a `Headers` object or a plain record (Node's `IncomingHttpHeaders`, a framework's map). */\nexport type WebhookHeaders = Headers | Record<string, string | readonly string[] | undefined>;\n\nexport interface VerifyStandardWebhookOptions {\n  /** The RAW request body — the exact bytes received, not a re-encoded copy. */\n  payload: string;\n  /** The request headers; `webhook-id`, `webhook-timestamp` and `webhook-signature` are read. */\n  headers: WebhookHeaders;\n  /**\n   * The endpoint's secret: a `whsec_…` secret, or the 64-hex secret of an endpoint that\n   * moved from the `cbox` scheme (Cbox ID uses it as `whsec_` + base64 of the hex string,\n   * which keys the HMAC with the same bytes).\n   */\n  secret: string;\n  /** Freshness window in seconds. Defaults to 300 (5 minutes). */\n  toleranceSeconds?: number;\n  /** Injectable clock (unix seconds), for tests. Defaults to `Date.now()`. */\n  now?: number;\n}\n\nfunction header(headers: WebhookHeaders, name: string): string | undefined {\n  if (typeof Headers !== 'undefined' && headers instanceof Headers) {\n    return headers.get(name) ?? undefined;\n  }\n\n  const record = headers as Record<string, string | readonly string[] | undefined>;\n  const key = Object.keys(record).find((k) => k.toLowerCase() === name);\n  const value = key === undefined ? undefined : record[key];\n\n  return Array.isArray(value) ? value.join(' ') : (value as string | undefined);\n}\n\nfunction base64ToBytes(value: string): Uint8Array<ArrayBuffer> | null {\n  try {\n    const binary = atob(value);\n    return Uint8Array.from(binary, (c) => c.charCodeAt(0));\n  } catch {\n    return null;\n  }\n}\n\nfunction toBase64(bytes: ArrayBuffer): string {\n  let binary = '';\n  for (const byte of new Uint8Array(bytes)) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary);\n}\n\n/**\n * Verify a delivery from an endpoint on the `standard_webhooks` signature scheme\n * ([Standard Webhooks](https://www.standardwebhooks.com/)): `webhook-signature` carries one or\n * more space-separated `v1,<base64 HMAC-SHA256 of \"{webhook-id}.{webhook-timestamp}.{body}\">`,\n * and the timestamp must be within the freshness window. Use {@link verifyWebhook} for the\n * default `cbox` scheme (`X-Cbox-Signature`).\n *\n * Returns `true` only when a signature is present, fresh and valid. Never throws.\n */\nexport async function verifyStandardWebhook(options: VerifyStandardWebhookOptions): Promise<boolean> {\n  const { payload, headers, secret } = options;\n  const toleranceSeconds = options.toleranceSeconds ?? 300;\n  const now = options.now ?? Math.floor(Date.now() / 1000);\n\n  const id = header(headers, 'webhook-id');\n  const timestamp = header(headers, 'webhook-timestamp');\n  const signatures = header(headers, 'webhook-signature');\n\n  if (!id || !timestamp || !signatures || !/^\\d+$/.test(timestamp)) {\n    return false;\n  }\n\n  if (Math.abs(now - Number(timestamp)) > toleranceSeconds) {\n    return false;\n  }\n\n  const keyBytes: Uint8Array<ArrayBuffer> | null = secret.startsWith('whsec_') ? base64ToBytes(secret.slice('whsec_'.length)) : new TextEncoder().encode(secret);\n\n  if (keyBytes === null || keyBytes.length === 0) {\n    return false;\n  }\n\n  const key = await crypto.subtle.importKey('raw', keyBytes, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);\n  const expected = toBase64(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(`${id}.${timestamp}.${payload}`)));\n\n  // Several signatures may be sent while a secret rotates; any valid `v1` one is enough.\n  let valid = false;\n  for (const candidate of signatures.split(' ')) {\n    const [version, signature] = candidate.split(',', 2);\n    if (version === 'v1' && signature !== undefined && timingSafeEqual(expected, signature)) {\n      valid = true;\n    }\n  }\n\n  return valid;\n}\n","import { AuthenticationError, ConfigurationError } from './errors.js';\nimport type { DiscoveryDocument } from './types.js';\n\n/**\n * Fetches and caches an instance's OIDC discovery document. One instance of this\n * lives per {@link CboxIdClient}; the document is refetched only after the TTL.\n */\nexport class Discovery {\n  private cached: { doc: DiscoveryDocument; expiresAt: number } | null = null;\n\n  constructor(\n    private readonly issuer: string,\n    private readonly timeoutMs: number,\n    private readonly cacheTtlMs: number,\n    private readonly now: () => number = Date.now,\n  ) {}\n\n  async document(): Promise<DiscoveryDocument> {\n    if (this.cached && this.cached.expiresAt > this.now()) {\n      return this.cached.doc;\n    }\n\n    const url = `${trimSlash(this.issuer)}/.well-known/openid-configuration`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let doc: DiscoveryDocument;\n    try {\n      const response = await fetch(url, { signal: controller.signal });\n      if (!response.ok) {\n        throw new AuthenticationError(`Discovery request failed with status ${response.status}.`);\n      }\n      doc = (await response.json()) as DiscoveryDocument;\n    } catch (error) {\n      if (error instanceof AuthenticationError) {\n        throw error;\n      }\n      throw new AuthenticationError(`Discovery request failed: ${String(error)}`);\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (typeof doc.issuer !== 'string' || doc.issuer === '') {\n      throw new AuthenticationError('The discovery document was missing an issuer.');\n    }\n\n    // RFC 8414 §3.3: the `issuer` in the document MUST match the one it was fetched for.\n    // Without this the SDK sends credentials to whatever endpoints the document names and\n    // verifies tokens against whatever JWKS it points at, while the caller still believes\n    // it is talking to the issuer it configured — so one tenant's host answering with\n    // another tenant's document silently redirects the whole flow.\n    if (trimSlash(doc.issuer) !== trimSlash(this.issuer)) {\n      throw new AuthenticationError(\n        `The discovery document is for a different issuer (${doc.issuer}).`,\n      );\n    }\n\n    this.cached = { doc, expiresAt: this.now() + this.cacheTtlMs };\n    return doc;\n  }\n\n  /** A required endpoint from the discovery document. */\n  async endpoint(name: keyof DiscoveryDocument): Promise<string> {\n    const value = (await this.document())[name];\n    if (typeof value !== 'string' || value === '') {\n      throw new ConfigurationError(`The instance does not advertise a ${name}.`);\n    }\n    return value;\n  }\n\n  /** An optional endpoint, or null when the instance advertises none. */\n  async optionalEndpoint(name: keyof DiscoveryDocument): Promise<string | null> {\n    const value = (await this.document())[name];\n    return typeof value === 'string' && value !== '' ? value : null;\n  }\n}\n\n/** Compare issuers without letting a trailing slash decide identity. */\nfunction trimSlash(value: string): string {\n  return value.replace(/\\/+$/, '');\n}\n","import { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose';\nimport { Discovery } from './discovery.js';\nimport { assertSecureIssuer } from './issuer.js';\nimport { AuthenticationError, ConfigurationError, InvalidStateError, oauthError } from './errors.js';\nimport { challenge, createVerifier, randomToken } from './pkce.js';\nimport { actor, featureFlags, organization, permissions, roles, sessionId } from './claims.js';\nimport { pipeConnectUrl, type PipeProvider } from './vault.js';\nimport type {\n  AuthorizationPrompt,\n  AuthorizationRequest,\n  AuthorizationRequestOptions,\n  CboxIdConfig,\n  DeviceAuthorization,\n  CboxOrganization,\n  CboxUser,\n  RefreshedTokens,\n  TokenResponse,\n  TokenTypeHint,\n} from './types.js';\nimport { VaultClient } from './vault.js';\nimport { verifyWebhook, type VerifyWebhookOptions } from './webhook.js';\n\ntype JwksResolver = ReturnType<typeof createRemoteJWKSet>;\n\n/** Query parameters as they arrive on your callback route. */\nexport interface CallbackParams {\n  code?: string | null;\n  state?: string | null;\n  error?: string | null;\n  error_description?: string | null;\n}\n\n/** The values you persisted from {@link CboxIdClient.createAuthorizationRequest}. */\nexport interface StoredAuthState {\n  state: string;\n  codeVerifier: string;\n  nonce: string;\n  /** The `maxAge` this login demanded, if any. See {@link AuthorizationRequest.maxAge}. */\n  maxAge?: number;\n  /**\n   * The organization this sign-in was bound to, if any. See\n   * {@link AuthorizationRequest.organization}.\n   *\n   * Checked, not trusted: a binding nobody verifies is a binding in name only. An\n   * instance that predates the `organization` parameter ignores it and returns tokens for\n   * whichever organization the session already had — and an app that switched to \"Globex\"\n   * would then show Globex's name over Acme's data.\n   */\n  organization?: string;\n  /**\n   * The scopes THIS authorization asked for, when you overrode the configured set.\n   *\n   * Read so `authenticate()` can judge the response against what was requested rather\n   * than against the config: a login that asked for `openid` and came back without an\n   * id_token is a protocol violation, and one that never asked cannot be held to it.\n   * Omitted, the configured scopes are assumed — which is what a caller who did not\n   * override them actually sent.\n   */\n  scopes?: string[];\n}\n\n/**\n * Turnkey Cbox ID client for JavaScript/TypeScript. It speaks standard OpenID\n * Connect against a Cbox ID instance — so integrating is a redirect and a callback,\n * not a rewrite — and adds the conveniences a hosted-identity product needs: a\n * redirect to the instance's hosted profile page, and back-channel helpers (machine\n * tokens, userinfo, introspection, webhook verification).\n *\n * Login is hardened by default: PKCE (S256), a CSRF state check, a nonce, and full\n * id_token signature + issuer + audience verification against the instance's JWKS\n * (via `jose`).\n *\n * The class is framework-agnostic: {@link createAuthorizationRequest} hands you the\n * `state`, `codeVerifier` and `nonce` to persist however you like, and\n * {@link authenticate} takes them back. For Next.js, the `@cboxdk/id-js/nextjs`\n * entry wires this to cookies for you.\n */\nexport class CboxIdClient {\n  private readonly discovery: Discovery;\n  private readonly jwksByUri = new Map<string, JwksResolver>();\n\n  constructor(private readonly config: CboxIdConfig) {\n    if (!config.issuer) {\n      throw new ConfigurationError('Cbox ID config `issuer` is required.');\n    }\n    if (!config.clientId) {\n      throw new ConfigurationError('Cbox ID config `clientId` is required.');\n    }\n    assertSecureIssuer(config.issuer);\n    this.discovery = new Discovery(\n      config.issuer,\n      config.timeoutMs ?? 10_000,\n      config.cacheTtlMs ?? 3_600_000,\n    );\n  }\n\n  /**\n   * Begin login. Returns the authorize URL plus the `state`, `codeVerifier` and\n   * `nonce` — persist those (signed, httpOnly cookies are ideal) and hand them back\n   * to {@link authenticate} on the callback.\n   */\n  async createAuthorizationRequest(options: AuthorizationRequestOptions = {}): Promise<AuthorizationRequest> {\n    const prompt = promptValue(options.prompt);\n    assertOrganizationOptions(options, prompt);\n\n    const codeVerifier = createVerifier();\n    const state = options.state ?? randomToken(16);\n    const nonce = randomToken(16);\n\n    const redirectUri = options.redirectUri ?? this.config.redirectUri;\n\n    if (redirectUri === undefined || redirectUri === '') {\n      // Checked where it is needed rather than at construction, so a CLI can build a\n      // client at all. An authorize URL without `redirect_uri` would fail at the\n      // authorization server instead, describing a request the caller never knowingly\n      // made — see the device grant, which has no callback to name.\n      throw new ConfigurationError(\n        'A `redirectUri` is required to start the browser sign-in flow. Set it in the config, or pass it to createAuthorizationRequest.',\n      );\n    }\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: redirectUri,\n      scope: (options.scopes ?? this.scopes()).join(' '),\n      state,\n      nonce,\n      code_challenge: await challenge(codeVerifier),\n      code_challenge_method: 'S256',\n    });\n    if (prompt.length > 0) {\n      params.set('prompt', prompt.join(' '));\n    }\n    if (options.loginHint) {\n      params.set('login_hint', options.loginHint);\n    }\n    if (typeof options.maxAge === 'number') {\n      params.set('max_age', String(options.maxAge));\n    }\n    if (options.organization !== undefined) {\n      params.set('organization', options.organization);\n    }\n    if (options.organizationHint !== undefined) {\n      params.set('organization_hint', options.organizationHint);\n    }\n\n    const endpoint = await this.discovery.endpoint('authorization_endpoint');\n    return {\n      url: `${endpoint}?${params.toString()}`,\n      state,\n      codeVerifier,\n      nonce,\n      // Carried through so authenticate() can hold the instance to it. Only present\n      // when requested (exactOptionalPropertyTypes).\n      ...(typeof options.maxAge === 'number' ? { maxAge: options.maxAge } : {}),\n      ...(options.organization !== undefined ? { organization: options.organization } : {}),\n    };\n  }\n\n  /**\n   * Switch the signed-in person to another organization: a new authorization bound to\n   * `organizationId`. Persist and redirect exactly as for\n   * {@link createAuthorizationRequest} — it is one, with `organization` set.\n   *\n   * Cbox ID already holds the person's session, so this is normally a redirect there and\n   * straight back with no sign-in form. The tokens that come back carry the new `org`,\n   * `org_role`, `roles` and `permissions`; replace your session with them rather than\n   * patching the old one, because every one of those can differ between organizations.\n   *\n   * A person who is not (or is no longer) an active member of that organization comes\n   * back with `error=access_denied`, which {@link authenticate} throws as an\n   * `AuthenticationError` with `error === 'access_denied'`.\n   */\n  switchOrganization(\n    organizationId: string,\n    options: Omit<AuthorizationRequestOptions, 'organization' | 'organizationHint'> = {},\n  ): Promise<AuthorizationRequest> {\n    return this.createAuthorizationRequest({ ...options, organization: organizationId });\n  }\n\n  /**\n   * Complete login on your callback route: verify state, exchange the code with the\n   * PKCE verifier, verify the id_token, and return the authenticated user.\n   *\n   * @throws InvalidStateError when state does not match (forged/stale request)\n   * @throws AuthenticationError on any other failure\n   */\n  async authenticate(input: {\n    params: CallbackParams;\n    stored: StoredAuthState;\n    redirectUri?: string;\n  }): Promise<CboxUser> {\n    const { params, stored } = input;\n\n    if (!params.state || !stored.state || !timingSafeEqualString(params.state, stored.state)) {\n      throw new InvalidStateError('The login state did not match — the request may be forged or stale.');\n    }\n\n    if (params.error) {\n      // The code travels as `error`, not only in the message: `access_denied` after a\n      // switchOrganization() means \"not a member of that organization\", which an app\n      // answers by switching back — not by signing the person out.\n      throw new AuthenticationError(\n        `Cbox ID returned an error: ${params.error}${params.error_description ? ` (${params.error_description})` : ''}`,\n        params.error,\n        params.error_description ?? undefined,\n      );\n    }\n\n    if (!params.code) {\n      throw new AuthenticationError('The callback was missing an authorization code.');\n    }\n\n    const tokens = await this.exchange(params.code, stored.codeVerifier, input.redirectUri);\n\n    if (!tokens.access_token) {\n      throw new AuthenticationError('No access token was returned.');\n    }\n\n    let verified: Record<string, unknown> = {};\n\n    if (tokens.id_token) {\n      verified = await this.verifyIdToken(tokens.id_token, stored.nonce, stored.maxAge);\n    } else if ((stored.scopes ?? this.scopes()).includes('openid')) {\n      // AN `openid` REQUEST WITHOUT AN ID_TOKEN IS A PROTOCOL VIOLATION, and refusing it\n      // is the difference between an authenticated login and a bearer token. Without this\n      // the identity below came from UserInfo alone — a bearer-authenticated endpoint\n      // whose response nothing signed — and the `nonce` pulled from storage was never used.\n      //\n      // Asked of the SCOPES REQUESTED, not of the response: a caller who never asked for\n      // `openid` is running an OAuth flow and is not held to an OIDC rule.\n      throw new AuthenticationError(\n        'An openid login returned no id_token, so the identity could not be verified.',\n      );\n    } else if (typeof stored.maxAge === 'number') {\n      // No id_token means no auth_time, and therefore no evidence the demanded\n      // re-authentication happened. Accepting that silently is the whole defect.\n      throw new AuthenticationError(\n        'A max_age was requested but no id_token was returned, so the authentication age could not be verified.',\n      );\n    }\n\n    const user = await this.identityFrom(tokens, verified);\n\n    if (stored.organization !== undefined && user.organizationId !== stored.organization) {\n      throw new AuthenticationError(\n        `The sign-in was bound to organization ${stored.organization}, but the tokens are for ${user.organizationId ?? 'no organization'}. The instance may not support organization selection.`,\n      );\n    }\n\n    return user;\n  }\n\n  /**\n   * Turn a token response into the verified {@link CboxUser} every flow returns.\n   *\n   * Shared by the browser flow and the device flow rather than written twice: the checks\n   * in here — the UserInfo subject matching the id_token's, the merge that lets UserInfo\n   * enrich but never overwrite signed claims — are the ones that decide whether an\n   * identity is trustworthy. A second copy is a second place for one of them to be\n   * quietly missing, and the flow it was missing from would look exactly as correct.\n   */\n  private async identityFrom(\n    tokens: TokenResponse,\n    verified: Record<string, unknown>,\n  ): Promise<CboxUser> {\n    const profile = await this.userinfo(tokens.access_token);\n\n    // OIDC Core §5.3.2: the UserInfo `sub` MUST match the id_token's, and when it does\n    // not the response MUST NOT be used. UserInfo is fetched with a bearer token and its\n    // body carries no signature, so without this an IdP — or anything able to answer as\n    // one — hands back `{\"sub\":\"somebody-else\"}` and the SDK returns it as the identity.\n    const verifiedSub = verified['sub'];\n    const profileSub = profile['sub'];\n\n    if (typeof verifiedSub === 'string' && typeof profileSub === 'string' && !timingSafeEqualString(verifiedSub, profileSub)) {\n      throw new AuthenticationError('The UserInfo subject does not match the verified id_token.');\n    }\n\n    // ENRICHES, NEVER REPLACES. UserInfo fills in what a minimal id_token omits (email,\n    // name, org) and the verified claims go back on top, so the merge cannot move `sub`,\n    // `iss`, `aud`, `nonce` or anything else the signature covered. The spread used to run\n    // the other way round.\n    const claims: Record<string, unknown> = { ...profile, ...verified };\n\n    const sub = claims['sub'];\n    if (typeof sub !== 'string' || sub === '') {\n      throw new AuthenticationError('The verified token carried no subject.');\n    }\n\n    const organizations = parseOrganizations(claims['organizations']);\n\n    return {\n      id: sub,\n      email: typeof claims['email'] === 'string' ? claims['email'] : null,\n      name: typeof claims['name'] === 'string' ? claims['name'] : null,\n      organizationId: typeof claims['org'] === 'string' ? claims['org'] : null,\n      organization: organization(claims),\n      roles: roles(claims),\n      permissions: permissions(claims),\n      featureFlags: featureFlags(claims),\n      actor: actor(claims),\n      sessionId: sessionId(claims),\n      // Only present when the instance emitted the claim (exactOptionalPropertyTypes).\n      ...(organizations ? { organizations } : {}),\n      claims,\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token ?? null,\n      idToken: tokens.id_token ?? null,\n      expiresIn: typeof tokens.expires_in === 'number' ? tokens.expires_in : 0,\n    };\n  }\n\n  /**\n   * Start the device authorization grant (RFC 8628) — the flow for a program with no\n   * browser of its own: a CLI, a CI job, a container, a TV.\n   *\n   * Print `userCode` and `verificationUri`, then call\n   * {@link CboxIdClient.pollDeviceToken}. If the machine has a desktop you may also open\n   * `verificationUriComplete`, which fills the code in — but print the code anyway: the\n   * machine running your program is often not the one the person is looking at.\n   *\n   * The scopes are bounded by what the app is REGISTERED for. A device request naming one\n   * outside that ceiling is refused with `invalid_scope` rather than quietly reduced,\n   * because no browser is in front of it to notice a smaller grant.\n   *\n   * @throws ConfigurationError when the instance advertises no device endpoint.\n   */\n  async requestDeviceAuthorization(scopes?: string[]): Promise<DeviceAuthorization> {\n    const endpoint = await this.discovery.optionalEndpoint('device_authorization_endpoint');\n\n    if (endpoint === null) {\n      throw new ConfigurationError(\n        'This instance does not advertise a device_authorization_endpoint, so it does not support CLI sign-in.',\n      );\n    }\n\n    const body = new URLSearchParams({\n      client_id: this.config.clientId,\n      scope: (scopes ?? this.scopes()).join(' '),\n    });\n    if (this.config.clientSecret) {\n      body.set('client_secret', this.config.clientSecret);\n    }\n\n    const response = await this.post(endpoint, body);\n    if (!response.ok) {\n      throw await oauthError(response, 'Device authorization request failed');\n    }\n\n    const payload = (await response.json()) as Record<string, unknown>;\n\n    const deviceCode = payload['device_code'];\n    const userCode = payload['user_code'];\n    const verificationUri = payload['verification_uri'];\n\n    if (typeof deviceCode !== 'string' || typeof userCode !== 'string' || typeof verificationUri !== 'string') {\n      throw new AuthenticationError('The device authorization response was incomplete.');\n    }\n\n    return {\n      deviceCode,\n      userCode,\n      verificationUri,\n      verificationUriComplete:\n        typeof payload['verification_uri_complete'] === 'string'\n          ? payload['verification_uri_complete']\n          : null,\n      expiresIn: typeof payload['expires_in'] === 'number' ? payload['expires_in'] : 600,\n      // RFC 8628 §3.2: absent means 5 seconds. Polling faster than the server allows is\n      // answered with `slow_down`, so the default is the one the server assumes too.\n      interval: typeof payload['interval'] === 'number' ? payload['interval'] : 5,\n    };\n  }\n\n  /**\n   * Poll until the person approves, and return them.\n   *\n   * Blocks. It honours the server's `interval`, backs off permanently by five seconds on\n   * `slow_down` (RFC 8628 §3.5), and stops on the three answers that are final: they\n   * declined, the code expired, or tokens arrived. Pass an `AbortSignal` to give up\n   * early — a CLI should let Ctrl-C work.\n   *\n   * @throws AuthenticationError when the person declines or the code expires.\n   */\n  async pollDeviceToken(\n    authorization: DeviceAuthorization,\n    options: { signal?: AbortSignal } = {},\n  ): Promise<CboxUser> {\n    const endpoint = await this.discovery.endpoint('token_endpoint');\n    const deadline = Date.now() + authorization.expiresIn * 1000;\n    let intervalMs = authorization.interval * 1000;\n\n    for (;;) {\n      if (options.signal?.aborted === true) {\n        throw new AuthenticationError('Device sign-in was cancelled.');\n      }\n      if (Date.now() > deadline) {\n        throw new AuthenticationError(\n          'The device code expired before it was approved. Start the sign-in again.',\n        );\n      }\n\n      await sleep(intervalMs, options.signal);\n\n      const body = new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n        device_code: authorization.deviceCode,\n        client_id: this.config.clientId,\n      });\n      if (this.config.clientSecret) {\n        body.set('client_secret', this.config.clientSecret);\n      }\n\n      const response = await this.post(endpoint, body);\n\n      if (response.ok) {\n        const tokens = (await response.json()) as TokenResponse;\n\n        if (!tokens.access_token) {\n          throw new AuthenticationError('The device token response carried no access token.');\n        }\n\n        // No nonce: RFC 8628 has no browser leg to carry one, so there is nothing to\n        // bind. Everything else about the id_token — signature, issuer, audience,\n        // expiry — is verified exactly as it is on the browser flow.\n        const verified = tokens.id_token ? await this.verifyIdToken(tokens.id_token, '') : {};\n\n        return await this.identityFrom(tokens, verified);\n      }\n\n      const payload = (await response.json().catch(() => ({}))) as Record<string, unknown>;\n      const error = typeof payload['error'] === 'string' ? payload['error'] : 'invalid_request';\n\n      if (error === 'authorization_pending') {\n        continue;\n      }\n\n      if (error === 'slow_down') {\n        // Permanently, not for one round: the server is telling us our rate is wrong,\n        // and returning to it next tick earns the same answer forever.\n        intervalMs += 5000;\n        continue;\n      }\n\n      if (error === 'access_denied') {\n        throw new AuthenticationError('Sign-in was declined.');\n      }\n\n      if (error === 'expired_token') {\n        throw new AuthenticationError(\n          'The device code expired before it was approved. Start the sign-in again.',\n        );\n      }\n\n      throw await oauthError(response, 'Device sign-in failed');\n    }\n  }\n\n  /**\n   * Exchange a refresh token for a fresh access token (OAuth 2.0 `refresh_token`\n   * grant). Cbox ID rotates refresh tokens and detects reuse, so ALWAYS persist the\n   * returned `refreshToken` and discard the one you passed — presenting a rotated\n   * token again revokes the entire token family.\n   *\n   * @throws AuthenticationError when the refresh token is invalid, expired, or already rotated.\n   */\n  async refresh(refreshToken: string): Promise<RefreshedTokens> {\n    const body = new URLSearchParams({\n      grant_type: 'refresh_token',\n      client_id: this.config.clientId,\n      refresh_token: refreshToken,\n    });\n    if (this.config.clientSecret) {\n      body.set('client_secret', this.config.clientSecret);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      // The most consequential of these: `invalid_grant` means the refresh token is\n      // spent, revoked or replayed and the person must sign in again, while a 5xx or\n      // `temporarily_unavailable` means the same token is still good in a moment. One\n      // message string for both is what makes callers guess.\n      throw await oauthError(response, 'Token refresh failed');\n    }\n\n    const tokens = (await response.json()) as TokenResponse;\n    if (!tokens.access_token) {\n      throw new AuthenticationError('The refresh response carried no access token.');\n    }\n\n    // VERIFIED BEFORE IT IS HANDED BACK. A refresh response carries a fresh id_token, and\n    // this returned it unchecked — so an application that refreshes its session claims\n    // from `refresh().idToken` accepted a forged, expired, wrong-audience or wrong-issuer\n    // token, having verified only the one it got at login. The nonce is not re-checked:\n    // RFC 6749 has no nonce on this leg, and OIDC Core §12.2 says an id_token from a\n    // refresh need not carry one.\n    if (tokens.id_token) {\n      await this.verifyIdToken(tokens.id_token, '');\n    }\n\n    return {\n      accessToken: tokens.access_token,\n      // Keep the presented token when the server does not rotate (OAuth 2.0 §6);\n      // callers persist this value, so it must never come back null.\n      refreshToken: tokens.refresh_token ?? refreshToken,\n      idToken: tokens.id_token ?? null,\n      expiresIn: typeof tokens.expires_in === 'number' ? tokens.expires_in : 0,\n      scope: typeof tokens.scope === 'string' ? tokens.scope : null,\n    };\n  }\n\n  /**\n   * The URL of the instance's hosted account/profile page (self-service password,\n   * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox\n   * ID session; `returnTo` is passed so the page can link back to your app.\n   */\n  profileUrl(returnTo?: string): string {\n    const base = `${this.config.issuer.replace(/\\/$/, '')}${this.accountPath()}`;\n    return returnTo ? `${base}?${new URLSearchParams({ return_to: returnTo }).toString()}` : base;\n  }\n\n  /**\n   * The hosted page where a person creates and revokes API keys for your API — Cbox ID's\n   * `/account/api-keys`, preselected to this app (or `clientId`). Keys made there are\n   * checked with `ApiKeyVerifier` from `@cboxdk/id-js/server`.\n   *\n   * `returnTo` becomes a link back to your app, honoured only for an origin the app\n   * registered. `organization` picks which of the person's organizations the keys act in;\n   * omitted, the page uses the one they are in.\n   */\n  /**\n   * The hosted page where the signed-in person connects their account at `provider`\n   * (Pipes) — `/account/connected-services/{provider}/connect`, preselected to this app.\n   * They come back to `returnTo` with `?provider=…&status=connected|cancelled|failed`,\n   * honoured only on an origin the app registered.\n   */\n  pipeConnectUrl(provider: PipeProvider | string, returnTo?: string): string {\n    return pipeConnectUrl(this.config.issuer, provider, {\n      clientId: this.config.clientId,\n      ...(returnTo !== undefined ? { returnTo } : {}),\n    });\n  }\n\n  apiKeysUrl(options: { clientId?: string; returnTo?: string; organization?: string } = {}): string {\n    const params = new URLSearchParams({ client_id: options.clientId ?? this.config.clientId });\n    if (options.returnTo) {\n      params.set('return_to', options.returnTo);\n    }\n    if (options.organization) {\n      params.set('organization', options.organization);\n    }\n\n    return `${this.config.issuer.replace(/\\/$/, '')}/account/api-keys?${params.toString()}`;\n  }\n\n  /**\n   * The RP-initiated logout URL, or null when the instance advertises none.\n   *\n   * `client_id` is always sent, even without a `returnTo`: the OP validates\n   * `post_logout_redirect_uri` against the registered allow-list of THAT client\n   * (OIDC RP-Initiated Logout 1.0 §2). With no way to name the RP the OP cannot\n   * check the list, so it silently drops the return URL and strands the user on a\n   * bare \"you are signed out\" page. `idTokenHint` — the user's `id_token`, if you\n   * still hold it — is the spec's other way to identify the RP, and additionally\n   * tells the OP which subject is logging out.\n   *\n   * PASS THE HINT IF YOU WANT \"SIGN OUT EVERYWHERE\". Cbox ID revokes every session\n   * the person holds only when a hint it can VERIFY names the subject holding the\n   * browser; with no hint it signs this browser out and leaves their other devices\n   * alone. That is deliberate: the endpoint is unauthenticated and reached by a\n   * redirect, so a request carrying no proof of who it concerns could otherwise be\n   * forged into ending anyone's sessions everywhere. See laravel-id UPGRADING.md\n   * for 1.8.0.\n   */\n  async logoutUrl(returnTo?: string, idTokenHint?: string): Promise<string | null> {\n    const endpoint = await this.discovery.optionalEndpoint('end_session_endpoint');\n    if (!endpoint) {\n      return null;\n    }\n    const params = new URLSearchParams({ client_id: this.config.clientId });\n    if (returnTo) {\n      params.set('post_logout_redirect_uri', returnTo);\n    }\n    if (idTokenHint) {\n      params.set('id_token_hint', idTokenHint);\n    }\n    return `${endpoint}?${params.toString()}`;\n  }\n\n  /**\n   * A machine (client-credentials) access token for calling Cbox ID APIs as your\n   * app, not on a user's behalf. Requires a client secret.\n   */\n  async machineToken(options: { scopes?: string[]; resource?: string } = {}): Promise<string> {\n    const body = new URLSearchParams({\n      grant_type: 'client_credentials',\n      client_id: this.config.clientId,\n      client_secret: this.requireSecret(),\n    });\n    if (options.scopes && options.scopes.length > 0) {\n      body.set('scope', options.scopes.join(' '));\n    }\n    if (options.resource) {\n      body.set('resource', options.resource);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw await oauthError(response, 'Machine token request failed');\n    }\n    const json = (await response.json()) as { access_token?: unknown };\n    if (typeof json.access_token !== 'string') {\n      throw new AuthenticationError('The token response had no access_token.');\n    }\n    return json.access_token;\n  }\n\n  /** The OIDC userinfo claims for an access token. */\n  async userinfo(accessToken: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.optionalEndpoint('userinfo_endpoint');\n    if (!endpoint) {\n      return {};\n    }\n    const response = await this.fetchWithTimeout(endpoint, {\n      headers: { authorization: `Bearer ${accessToken}` },\n    });\n    if (!response.ok) {\n      throw await oauthError(response, 'Userinfo request failed');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /**\n   * RFC 7662 token introspection (confidential-client auth). Returns the raw\n   * response; `active` tells you if the token is currently valid. Requires a secret.\n   */\n  async introspect(token: string): Promise<Record<string, unknown>> {\n    const endpoint = await this.discovery.endpoint('introspection_endpoint');\n    const basic = btoa(`${this.config.clientId}:${this.requireSecret()}`);\n    const response = await this.post(\n      endpoint,\n      new URLSearchParams({ token }),\n      { authorization: `Basic ${basic}` },\n    );\n    if (!response.ok) {\n      throw await oauthError(response, 'Introspection request failed');\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /**\n   * RFC 7009 token revocation. Revokes an access or refresh token; revoking a refresh\n   * token drops the whole token family, so this is what a real \"sign out everywhere\" does.\n   *\n   * **PUBLIC CLIENTS TOO.** This demanded a secret and threw `ConfigurationError` without\n   * one — so the clients that most need it were the ones that could not call it. A PKCE\n   * browser or native app authenticates with `none`, holds no secret, and is exactly the\n   * case where a refresh token sits in storage on a device somebody has just signed out\n   * of. Cbox ID's revocation endpoint accepts a public client, and its discovery document\n   * advertises `none` among the revocation auth methods; RFC 7009 §2.1 scopes every\n   * revocation to the calling client, so the only capability here is \"destroy a token you\n   * are already holding\". The SDK was the half saying no.\n   *\n   * A confidential client still authenticates with Basic; a public one names itself in the\n   * body, the same shape {@link exchange} already uses for the token endpoint.\n   *\n   * Per RFC 7009 the server answers 200 for an unknown or already-revoked token, so\n   * success means \"this token is not valid any more\", not \"it existed\".\n   *\n   * @param tokenTypeHint which store to search first — only a hint, never required.\n   */\n  async revoke(token: string, tokenTypeHint?: TokenTypeHint): Promise<void> {\n    const endpoint = await this.discovery.endpoint('revocation_endpoint');\n    const body = new URLSearchParams({ token, client_id: this.config.clientId });\n    if (tokenTypeHint) {\n      body.set('token_type_hint', tokenTypeHint);\n    }\n\n    const headers: Record<string, string> = {};\n    if (this.config.clientSecret) {\n      headers.authorization = `Basic ${btoa(`${this.config.clientId}:${this.config.clientSecret}`)}`;\n    }\n\n    const response = await this.post(endpoint, body, headers);\n    if (!response.ok) {\n      throw await oauthError(response, 'Revocation request failed');\n    }\n  }\n\n  /** Verify a Cbox ID webhook / inline-action signature. See {@link verifyWebhook}. */\n  verifyWebhook(options: VerifyWebhookOptions): Promise<boolean> {\n    return verifyWebhook(options);\n  }\n\n  /**\n   * A Token Vault client bound to an access token. Obtain the token with\n   * {@link machineToken} (scope `vault.manage` to provision/grant, `vault.lease` to\n   * redeem), then call `store` / `grant` / `lease` etc.\n   */\n  vault(accessToken: string): VaultClient {\n    return new VaultClient(this.config.issuer, accessToken, this.config.timeoutMs ?? 10_000);\n  }\n\n  private async exchange(code: string, verifier: string, redirectUri?: string): Promise<TokenResponse> {\n    const callback = redirectUri ?? this.config.redirectUri;\n\n    if (callback === undefined || callback === '') {\n      throw new ConfigurationError(\n        'A `redirectUri` is required to exchange an authorization code. It must be the same one the authorization request used.',\n      );\n    }\n\n    const body = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: callback,\n      client_id: this.config.clientId,\n      code_verifier: verifier,\n    });\n    if (this.config.clientSecret) {\n      body.set('client_secret', this.config.clientSecret);\n    }\n\n    const response = await this.post(await this.discovery.endpoint('token_endpoint'), body);\n    if (!response.ok) {\n      throw await oauthError(response, 'Token exchange failed');\n    }\n    return (await response.json()) as TokenResponse;\n  }\n\n  private async verifyIdToken(\n    idToken: string,\n    // Empty skips the nonce comparison below, which is what a refresh leg needs: RFC 6749\n    // has no nonce there and OIDC Core §12.2 says the id_token from a refresh need not\n    // carry one. Signature, issuer, audience and expiry are checked either way.\n    nonce: string,\n    maxAge?: number,\n  ): Promise<Record<string, unknown>> {\n    const jwksUri = await this.discovery.endpoint('jwks_uri');\n    let resolver = this.jwksByUri.get(jwksUri);\n    if (!resolver) {\n      resolver = createRemoteJWKSet(new URL(jwksUri));\n      this.jwksByUri.set(jwksUri, resolver);\n    }\n\n    let payload: JWTPayload;\n    try {\n      ({ payload } = await jwtVerify(idToken, resolver, {\n        issuer: this.config.issuer,\n        audience: this.config.clientId,\n        // Pin the accepted signature algorithms explicitly. `jose` already refuses\n        // `alg: none` and key-type confusion, so this is belt-and-braces — but it\n        // states the contract in code rather than relying on a library default.\n        algorithms: ['RS256', 'ES256'],\n      }));\n    } catch (error) {\n      throw new AuthenticationError(`The id_token could not be verified: ${String(error)}`);\n    }\n\n    if (nonce && payload['nonce'] !== nonce) {\n      throw new AuthenticationError('The id_token nonce did not match — possible replay.');\n    }\n\n    // OIDC Core §3.1.3.7 step 12: when max_age was requested, `auth_time` is REQUIRED\n    // and the relying party MUST check it. `max_age` is the control you reach for\n    // before a payment or an admin grant, and the whole point is that the person\n    // authenticated JUST NOW — so a login({maxAge}) whose result is never checked is a\n    // step-up in name only: a day-old session comes back carrying its original\n    // auth_time and nothing anywhere says so.\n    if (typeof maxAge === 'number') {\n      const authTime = payload['auth_time'];\n\n      if (typeof authTime !== 'number') {\n        throw new AuthenticationError(\n          'A max_age was requested but the id_token carried no auth_time, so the authentication age could not be verified.',\n        );\n      }\n\n      const tolerance = this.config.authTimeToleranceSeconds ?? 60;\n      const age = Math.floor(Date.now() / 1000) - authTime;\n\n      if (age > maxAge + tolerance) {\n        throw new AuthenticationError(\n          `The authentication is ${age}s old but max_age required ${maxAge}s — the user did not re-authenticate.`,\n        );\n      }\n    }\n\n    return payload as Record<string, unknown>;\n  }\n\n  private scopes(): string[] {\n    const scopes = this.config.scopes;\n    return scopes && scopes.length > 0 ? scopes : ['openid', 'profile', 'email'];\n  }\n\n  private accountPath(): string {\n    const path = this.config.accountPath;\n    // `/account`, not `/settings`. The latter is the organization-admin page: it\n    // redirects a non-admin to `/account` and drops `return_to` on the way, so a member\n    // following this link arrives at the right screen having lost where they came from.\n    return path && path !== '' ? `/${path.replace(/^\\//, '')}` : '/account';\n  }\n\n  private requireSecret(): string {\n    if (!this.config.clientSecret) {\n      throw new ConfigurationError('This call requires a `clientSecret`, but none is configured.');\n    }\n    return this.config.clientSecret;\n  }\n\n  private post(url: string, body: URLSearchParams, headers: Record<string, string> = {}): Promise<Response> {\n    return this.fetchWithTimeout(url, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded', ...headers },\n      body,\n    });\n  }\n\n  private async fetchWithTimeout(url: string, init: RequestInit): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.config.timeoutMs ?? 10_000);\n    try {\n      return await fetch(url, { ...init, signal: controller.signal });\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n\n/** Normalise `prompt` to a de-duplicated list, refusing what the server would refuse. */\nfunction promptValue(prompt: AuthorizationRequestOptions['prompt']): AuthorizationPrompt[] {\n  if (prompt === undefined) {\n    return [];\n  }\n\n  const values = [...new Set(typeof prompt === 'string' ? [prompt] : prompt)];\n\n  // OIDC Core §3.1.2.1: `none` with any other value is an error. Failing here names the\n  // call that built it; failing at the server names nothing the caller can find.\n  if (values.includes('none') && values.length > 1) {\n    throw new ConfigurationError(\"`prompt: 'none'` cannot be combined with another prompt value.\");\n  }\n\n  return values;\n}\n\n/**\n * Refuse organization options that contradict each other. Each of these would reach the\n * server as a request with two incompatible meanings and come back as a generic error\n * after a full redirect — far from the line that built it.\n */\nfunction assertOrganizationOptions(options: AuthorizationRequestOptions, prompt: AuthorizationPrompt[]): void {\n  // An empty id is not \"no organization\" at the server — it is a parameter that is\n  // present and names nothing. Omit the option instead.\n  if (options.organization === '') {\n    throw new ConfigurationError('`organization` is empty. Omit it to sign in without binding to an organization.');\n  }\n  if (options.organizationHint === '') {\n    throw new ConfigurationError('`organizationHint` is empty. Omit it when you have no organization to suggest.');\n  }\n\n  if (options.organization === undefined) {\n    return;\n  }\n\n  // `organization` binds to an existing organization; both prompts below ask the person\n  // to choose or create one. Sending both leaves the server to guess which you meant.\n  if (prompt.includes('select_organization')) {\n    throw new ConfigurationError(\n      \"`organization` binds the sign-in to one organization, so `prompt: 'select_organization'` has nothing to choose. Use `organizationHint` to preselect an organization in the picker instead.\",\n    );\n  }\n  if (prompt.includes('create_organization')) {\n    throw new ConfigurationError(\n      \"`organization` binds the sign-in to an existing organization and `prompt: 'create_organization'` creates a new one. Send one or the other.\",\n    );\n  }\n}\n\n/** Constant-time string compare, so state validation doesn't leak via timing. */\nfunction timingSafeEqualString(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\n/**\n * Parse an `organizations` claim into typed orgs, ignoring anything malformed. The\n * claim is optional and instance-specific; absent or non-array → undefined, so\n * callers can tell \"no claim\" from \"empty\".\n */\nfunction parseOrganizations(claim: unknown): CboxOrganization[] | undefined {\n  if (!Array.isArray(claim)) {\n    return undefined;\n  }\n  const orgs: CboxOrganization[] = [];\n  for (const entry of claim) {\n    if (typeof entry !== 'object' || entry === null) {\n      continue;\n    }\n    const record = entry as Record<string, unknown>;\n    const id = record['id'];\n    const name = record['name'];\n    if (typeof id === 'string' && id !== '' && typeof name === 'string' && name !== '') {\n      orgs.push({ id, name, role: typeof record['role'] === 'string' ? record['role'] : null });\n    }\n  }\n  return orgs;\n}\n\n/**\n * Wait, but stay interruptible.\n *\n * A CLI that ignores Ctrl-C for five seconds at a time feels broken, and a bare\n * `setTimeout` promise cannot be cancelled — so the abort is wired to the same timer\n * rather than checked after it.\n */\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted === true) {\n      reject(new AuthenticationError('Device sign-in was cancelled.'));\n      return;\n    }\n\n    const timer = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n\n    const onAbort = (): void => {\n      clearTimeout(timer);\n      reject(new AuthenticationError('Device sign-in was cancelled.'));\n    };\n\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n"]}

package/dist/chunk-VGQASHTI.js

@@ -0,0 +1,22 @@
+// src/pkce.ts
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken(bytes = 32) {
+  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+function createVerifier() {
+  return randomToken(32);
+}
+async function challenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64url(new Uint8Array(digest));
+}
+
+export { challenge, createVerifier, randomToken };
+//# sourceMappingURL=chunk-VGQASHTI.js.map
+//# sourceMappingURL=chunk-VGQASHTI.js.map

package/dist/chunk-VGQASHTI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/pkce.ts"],"names":[],"mappings":";AAKA,SAAS,UAAU,KAAA,EAA2B;AAC5C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;AAGO,SAAS,WAAA,CAAY,QAAQ,EAAA,EAAY;AAC9C,EAAA,OAAO,UAAU,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,KAAK,CAAC,CAAC,CAAA;AAChE;AAGO,SAAS,cAAA,GAAyB;AACvC,EAAA,OAAO,YAAY,EAAE,CAAA;AACvB;AAGA,eAAsB,UAAU,QAAA,EAAmC;AACjE,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA;AACvF,EAAA,OAAO,SAAA,CAAU,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACzC","file":"chunk-VGQASHTI.js","sourcesContent":["/**\n * PKCE (RFC 7636) and the random values the login flow needs, built on Web Crypto\n * (`globalThis.crypto`) so the same code runs on Node, edge runtimes and browsers.\n */\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** A URL-safe random token of `bytes` bytes (default 32), for state and nonce. */\nexport function randomToken(bytes = 32): string {\n  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));\n}\n\n/** A high-entropy PKCE code verifier. */\nexport function createVerifier(): string {\n  return randomToken(32);\n}\n\n/** The S256 code challenge for a verifier. */\nexport async function challenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));\n  return base64url(new Uint8Array(digest));\n}\n"]}

package/dist/index.js

@@ -1,6 +1,7 @@
-import { Discovery } from './chunk-YGLMLIKL.js';
-export { CboxIdClient, FEATURE_FLAGS_SCOPE, PipeLeaseDeniedError, PipeLeaseError, PipeNotConnectedError, PipeReauthorizationRequiredError, PipeTemporarilyUnavailableError, VaultClient, actor, challenge, createVerifier, featureFlags, hasFeature, hasPermission, hasRole, isSupportSession, organization, permissions, pipeConnectUrl, randomToken, roles, sessionId, verifyStandardWebhook, verifyWebhook, withConnectReturn } from './chunk-YGLMLIKL.js';
+import { Discovery } from './chunk-T5LCQOLS.js';
+export { CboxIdClient, FEATURE_FLAGS_SCOPE, PipeLeaseDeniedError, PipeLeaseError, PipeNotConnectedError, PipeReauthorizationRequiredError, PipeTemporarilyUnavailableError, VaultClient, actor, featureFlags, hasFeature, hasPermission, hasRole, isSupportSession, organization, permissions, pipeConnectUrl, roles, sessionId, verifyStandardWebhook, verifyWebhook, withConnectReturn } from './chunk-T5LCQOLS.js';
 export { PermissionDecision, checkPermissions } from './chunk-EVZ6RB3K.js';
+export { challenge, createVerifier, randomToken } from './chunk-VGQASHTI.js';
 import { assertSecureIssuer } from './chunk-QQW63PGU.js';
 import { ConfigurationError, FrontendApiError, AuthenticationError } from './chunk-SEUD4TE4.js';
 export { AuthenticationError, CboxIdError, ConfigurationError, FrontendApiError, InvalidStateError } from './chunk-SEUD4TE4.js';