@datalayer/personal-agent-protocol 0.3.0 → 0.3.2

package/lib/index.js

@@ -1,3749 +1,90 @@
-// src/errors.ts
-var PersonalAgentProtocolError = class extends Error {
-  code;
-  statusCode;
-  details;
-  constructor(code, message2, options = {}) {
-    super(message2, { cause: options.cause });
-    this.name = "PersonalAgentProtocolError";
-    this.code = code;
-    this.statusCode = options.statusCode;
-    this.details = options.details ?? {};
-  }
-  toString() {
-    return `${this.code}: ${this.message}`;
-  }
-};
-var ProtocolValidationError = class extends PersonalAgentProtocolError {
-  constructor(code, message2, options = {}) {
-    super(code, message2, options);
-    this.name = "ProtocolValidationError";
-  }
-};
-var DiscoveryError = class extends PersonalAgentProtocolError {
-  constructor(code, message2, options = {}) {
-    super(code, message2, options);
-    this.name = "DiscoveryError";
-  }
-};
-var AuthorizationError = class extends PersonalAgentProtocolError {
-  constructor(code, message2, options = {}) {
-    super(code, message2, options);
-    this.name = "AuthorizationError";
-  }
-};
-var SessionError = class extends PersonalAgentProtocolError {
-  constructor(code, message2, options = {}) {
-    super(code, message2, options);
-    this.name = "SessionError";
-  }
-};
-var ProofError = class extends PersonalAgentProtocolError {
-  constructor(code, message2, options = {}) {
-    super(code, message2, options);
-    this.name = "ProofError";
-  }
-};
-
-// ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
-var encoder = new TextEncoder();
-var decoder = new TextDecoder();
-var strictDecoder = new TextDecoder("utf-8", { fatal: true });
-var MAX_INT32 = 2 ** 32;
-function concat(...buffers) {
-  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
-  let i = 0;
-  for (const buffer of buffers)
-    buf.set(buffer, i), i += buffer.length;
-  return buf;
-}
-var NON_ASCII = /[^\x00-\x7f]/;
-function encode(string2) {
-  if (typeof string2 == "string" && string2.length >= 128) {
-    if (NON_ASCII.test(string2))
-      throw new TypeError("non-ASCII string encountered in encode()");
-    return encoder.encode(string2);
-  }
-  const bytes = new Uint8Array(string2.length);
-  for (let i = 0; i < string2.length; i++) {
-    const code = string2.charCodeAt(i);
-    if (code > 127)
-      throw new TypeError("non-ASCII string encountered in encode()");
-    bytes[i] = code;
-  }
-  return bytes;
-}
-function encodeBase64(input, url = false) {
-  if (Uint8Array.prototype.toBase64)
-    return input.toBase64({ alphabet: url ? "base64url" : "base64", omitPadding: url });
-  const CHUNK_SIZE = 32768, arr = [];
-  for (let i = 0; i < input.length; i += CHUNK_SIZE)
-    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-  const encoded = btoa(arr.join(""));
-  return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
-}
-function decodeBase64(encoded, url = false) {
-  if (Uint8Array.fromBase64)
-    return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
-  if (url) {
-    if (encoded.includes("+") || encoded.includes("/"))
-      throw new TypeError("Invalid base64url");
-    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
-  }
-  const binary = atob(encoded), bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++)
-    bytes[i] = binary.charCodeAt(i);
-  return bytes;
-}
-async function digest(algorithm2, data) {
-  const subtleDigest = `SHA-${algorithm2.slice(-3)}`;
-  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
-}
-
-// ../../node_modules/jose/dist/webapi/util/errors.js
-var JOSEError = class extends Error {
-  static code = "ERR_JOSE_GENERIC";
-  code = "ERR_JOSE_GENERIC";
-  constructor(message2, options) {
-    super(message2, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
-  }
-};
-var JWTClaimValidationFailed = class extends JOSEError {
-  static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
-  code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
-  claim;
-  reason;
-  payload;
-  constructor(message2, payload, claim = "unspecified", reason = "unspecified") {
-    super(message2, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
-  }
-};
-var JWTExpired = class extends JOSEError {
-  static code = "ERR_JWT_EXPIRED";
-  code = "ERR_JWT_EXPIRED";
-  claim;
-  reason;
-  payload;
-  constructor(message2, payload, claim = "unspecified", reason = "unspecified") {
-    super(message2, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
-  }
-};
-var JOSEAlgNotAllowed = class extends JOSEError {
-  static code = "ERR_JOSE_ALG_NOT_ALLOWED";
-  code = "ERR_JOSE_ALG_NOT_ALLOWED";
-};
-var JOSENotSupported = class extends JOSEError {
-  static code = "ERR_JOSE_NOT_SUPPORTED";
-  code = "ERR_JOSE_NOT_SUPPORTED";
-};
-var JWSInvalid = class extends JOSEError {
-  static code = "ERR_JWS_INVALID";
-  code = "ERR_JWS_INVALID";
-};
-var JWTInvalid = class extends JOSEError {
-  static code = "ERR_JWT_INVALID";
-  code = "ERR_JWT_INVALID";
-};
-var JWKInvalid = class extends JOSEError {
-  static code = "ERR_JWK_INVALID";
-  code = "ERR_JWK_INVALID";
-};
-var JWSSignatureVerificationFailed = class extends JOSEError {
-  static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
-  code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
-  constructor(message2 = "signature verification failed", options) {
-    super(message2, options);
-  }
-};
-
-// ../../node_modules/jose/dist/webapi/util/base64url.js
-var invalid = "The input to be decoded is not correctly encoded.";
-function decode(input) {
-  try {
-    return decodeBase64(typeof input == "string" ? input : decoder.decode(input), true);
-  } catch (cause) {
-    throw new TypeError(invalid, { cause });
-  }
-}
-function encode2(input) {
-  return encodeBase64(typeof input == "string" ? encoder.encode(input) : input, true);
-}
-
-// ../../node_modules/jose/dist/webapi/lib/validate.js
-function isObject(input) {
-  if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]")
-    return false;
-  const prototype = Object.getPrototypeOf(input);
-  return prototype === null || Object.getPrototypeOf(prototype) === null;
-}
-function isDisjoint(...headers) {
-  const parameters = /* @__PURE__ */ new Set();
-  for (const header of headers)
-    if (header)
-      for (const parameter of Object.keys(header)) {
-        if (parameters.has(parameter))
-          return false;
-        parameters.add(parameter);
-      }
-  return true;
-}
-function assertNotSet(value, name) {
-  if (value !== void 0)
-    throw new TypeError(`${name} can only be called once`);
-}
-function decodeBase64url(value, label, ErrorClass) {
-  try {
-    return decode(value);
-  } catch {
-    throw new ErrorClass(`Failed to base64url decode the ${label}`);
-  }
-}
-function encodeBase64url(value, label, ErrorClass) {
-  try {
-    return encode(value);
-  } catch {
-    throw new ErrorClass(`The ${label} is not a valid base64url string`);
-  }
-}
-function parseJoseHeader(b64, ErrorClass, message2) {
-  let parsed;
-  try {
-    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
-  } catch {
-    throw new ErrorClass(message2);
-  }
-  if (!isObject(parsed))
-    throw new ErrorClass(message2);
-  return parsed;
-}
-var JWS_RECOGNIZED = { __proto__: null, b64: true };
-function validateAlgorithms(option, algorithms) {
-  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string")))
-    throw new TypeError(`"${option}" option must be an array of strings`);
-  return algorithms === void 0 ? void 0 : new Set(algorithms);
-}
-function validateCritDuplicates(Err, protectedHeader) {
-  const { crit } = protectedHeader ?? {};
-  if (Array.isArray(crit) && new Set(crit).size !== crit.length)
-    throw new Err('"crit" (Critical) Header Parameter MUST NOT contain duplicate values');
-}
-function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)
-    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
-  if (!protectedHeader || protectedHeader.crit === void 0)
-    return [];
-  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0))
-    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
-  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
-  for (const parameter of protectedHeader.crit) {
-    if (!(parameter in recognized))
-      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)
-      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))
-      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-  }
-  return protectedHeader.crit;
-}
-function validateB64(protectedHeader, extensions2) {
-  if (extensions2.includes("b64")) {
-    const b64 = protectedHeader.b64;
-    if (typeof b64 != "boolean")
-      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-    return b64;
-  }
-  return true;
-}
-function serializeJoseHeader(Err, header) {
-  let serialized, parsed;
-  try {
-    serialized = JSON.stringify(header), parsed = JSON.parse(serialized);
-  } catch (cause) {
-    throw new Err("JOSE Header is not valid JSON", { cause });
-  }
-  if (!isObject(parsed))
-    throw new Err("JOSE Header is not a JSON object");
-  return [parsed, serialized];
-}
-
-// ../../node_modules/jose/dist/webapi/lib/key.js
-var tag = (key) => key[Symbol.toStringTag];
-var jwkMatchesOp = (entry, key, usage) => {
-  const { alg } = entry;
-  if (key.use !== void 0) {
-    const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
-    if (key.use !== expected)
-      throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
-  }
-  if (key.alg !== void 0 && key.alg !== alg)
-    throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
-  if (Array.isArray(key.key_ops)) {
-    const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
-    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))
-      throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
-  }
-};
-async function prepareKey(entry, key, usage) {
-  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
-  if (secret && key instanceof Uint8Array)
-    return key;
-  let normalized, keyObject;
-  if (isObject(key)) {
-    if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
-      throw invalidKeyType(alg, key, secret);
-    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0)))
-      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
-    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
-      return decode(normalized.k);
-    if (!Object.isFrozen(key)) {
-      const { key_ops } = key;
-      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
-    }
-  } else {
-    if (!isKeyLike(key))
-      throw invalidKeyType(alg, key, secret);
-    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
-    if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
-      throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
-    if (isCryptoKey(key))
-      return key;
-    if (keyObject = key, keyObject.type === "secret")
-      return keyObject.export();
-  }
-  cache ||= /* @__PURE__ */ new WeakMap();
-  const cacheKey = key;
-  let cached = cache.get(cacheKey);
-  if (cached?.[alg])
-    return cached[alg];
-  if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
-    const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;
-    return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
-  }
-  return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
-}
-var cache;
-var nist = {
-  __proto__: null,
-  prime256v1: "P-256",
-  secp384r1: "P-384",
-  secp521r1: "P-521"
-};
-var isCryptoKey = (key) => {
-  if (key?.[Symbol.toStringTag] === "CryptoKey")
-    return true;
-  try {
-    return key instanceof CryptoKey;
-  } catch {
-    return false;
-  }
-};
-var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
-var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
-function message(msg, actual, ...types) {
-  if (types.length > 2) {
-    const last = types.pop();
-    msg += `one of type ${types.join(", ")}, or ${last}.`;
-  } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
-  return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
-}
-var invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
-function invalidKeyType(alg, actual, secret) {
-  const types = ["CryptoKey", "KeyObject", "JSON Web Key"];
-  return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
-}
-var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-function checkUsage(key, usage) {
-  if (usage && !key.usages.includes(usage))
-    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-function checkModulusLength(alg, key) {
-  const { modulusLength } = key.algorithm;
-  if (typeof modulusLength != "number" || modulusLength < 2048)
-    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-}
-function checkCryptoKey(key, expected, usage) {
-  const algorithm2 = key.algorithm;
-  if (algorithm2.name !== expected.name)
-    throw unusable(expected.name);
-  if (expected.hash && algorithm2.hash?.name !== expected.hash)
-    throw unusable(expected.hash, "algorithm.hash");
-  if (expected.namedCurve && algorithm2.namedCurve !== expected.namedCurve)
-    throw unusable(expected.namedCurve, "algorithm.namedCurve");
-  if (expected.length !== void 0 && algorithm2.length !== expected.length)
-    throw unusable(expected.length, "algorithm.length");
-  checkUsage(key, usage);
-}
-function snapshotJwk(jwk) {
-  return { __proto__: null, ...jwk };
-}
-function normalizeJwk(jwk) {
-  const normalized = snapshotJwk(jwk);
-  if (normalized.ext !== void 0 && typeof normalized.ext != "boolean")
-    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
-  if (normalized.key_ops !== void 0) {
-    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
-    if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length)
-      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
-    normalized.key_ops = keyOps;
-  }
-  return normalized;
-}
-function validateExtractableOption(extractable) {
-  if (extractable !== void 0 && typeof extractable != "boolean")
-    throw new TypeError('"extractable" option must be a boolean');
-  return extractable;
-}
-async function jwkToKey(entry, jwk, extractable) {
-  if (!entry.kty.includes(jwk.kty))
-    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-  const algorithm2 = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };
-  return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm2, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
-}
-async function rawKey(key, expected, usage, extractable = false) {
-  return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
-}
-
-// ../../node_modules/jose/dist/webapi/lib/key_descriptor.js
-function table(entries) {
-  const out = { __proto__: null };
-  for (const alg in entries)
-    out[alg] = { ...entries[alg], alg };
-  return out;
-}
-
-// ../../node_modules/jose/dist/webapi/lib/jwe_algorithms.js
-var wrap = [
-  ["encrypt", "wrapKey"],
-  ["decrypt", "unwrapKey"]
-];
-var derive = [[], ["deriveBits"]];
-var none = [[], []];
-function rsaes(bits) {
-  return {
-    kty: ["RSA"],
-    mode: "key-encryption",
-    subtle: { name: "RSA-OAEP", hash: `SHA-${bits}` },
-    usages: wrap,
-    ops: ["wrapKey", "unwrapKey"]
-  };
-}
-function ecdh(mode) {
-  return {
-    kty: ["EC", "OKP"],
-    mode,
-    subtle: { name: "ECDH" },
-    resolve: ({ kty, crv, asymmetricKeyType }) => {
-      if (crv === "X25519" || asymmetricKeyType === "x25519")
-        return { name: "X25519" };
-      if (kty === "OKP")
-        throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-      return { name: "ECDH", namedCurve: crv };
-    },
-    usages: derive,
-    ops: [void 0, "deriveBits"]
-  };
-}
-function aeskw(bits, gcm = false) {
-  return {
-    kty: ["oct"],
-    mode: "key-wrapping",
-    secret: true,
-    subtle: { name: gcm ? "AES-GCM" : "AES-KW", length: bits },
-    usages: none,
-    ops: gcm ? ["encrypt", "decrypt"] : ["wrapKey", "unwrapKey"]
-  };
-}
-function pbes2() {
-  return {
-    kty: ["oct"],
-    mode: "key-wrapping",
-    secret: true,
-    subtle: { name: "PBKDF2" },
-    usages: none,
-    ops: ["deriveBits", "deriveBits"]
-  };
-}
-var JWE = table({
-  dir: {
-    kty: ["oct"],
-    mode: "direct-encryption",
-    secret: true,
-    subtle: { name: "AES-GCM" },
-    usages: none,
-    ops: ["encrypt", "decrypt"]
-  },
-  "RSA-OAEP": rsaes(1),
-  "RSA-OAEP-256": rsaes(256),
-  "RSA-OAEP-384": rsaes(384),
-  "RSA-OAEP-512": rsaes(512),
-  "ECDH-ES": ecdh("direct-key-agreement"),
-  "ECDH-ES+A128KW": ecdh("key-agreement-with-key-wrapping"),
-  "ECDH-ES+A192KW": ecdh("key-agreement-with-key-wrapping"),
-  "ECDH-ES+A256KW": ecdh("key-agreement-with-key-wrapping"),
-  A128KW: aeskw(128),
-  A192KW: aeskw(192),
-  A256KW: aeskw(256),
-  A128GCMKW: aeskw(128, true),
-  A192GCMKW: aeskw(192, true),
-  A256GCMKW: aeskw(256, true),
-  "PBES2-HS256+A128KW": pbes2(),
-  "PBES2-HS384+A192KW": pbes2(),
-  "PBES2-HS512+A256KW": pbes2()
-});
-var contentOps = ["encrypt", "decrypt"];
-function contentEncryption(bits, cbc = false) {
-  return {
-    kty: ["oct"],
-    secret: true,
-    subtle: { name: cbc ? "AES-CBC" : "AES-GCM", length: bits },
-    usages: none,
-    ops: contentOps,
-    cekBits: bits,
-    ivBits: cbc ? 128 : 96,
-    cbc
-  };
-}
-var ENC = table({
-  A128GCM: contentEncryption(128),
-  A192GCM: contentEncryption(192),
-  A256GCM: contentEncryption(256),
-  "A128CBC-HS256": contentEncryption(256, true),
-  "A192CBC-HS384": contentEncryption(384, true),
-  "A256CBC-HS512": contentEncryption(512, true)
-});
-
-// ../../node_modules/jose/dist/webapi/lib/jws_algorithms.js
-var sig = [["verify"], ["sign"]];
-function hmac(bits) {
-  const subtle = { name: "HMAC", hash: `SHA-${bits}` };
-  return { kty: ["oct"], secret: true, subtle, signing: subtle, usages: sig };
-}
-function rsa(bits, saltLength) {
-  const subtle = { name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5", hash: `SHA-${bits}` };
-  return {
-    kty: ["RSA"],
-    subtle,
-    signing: saltLength ? { ...subtle, saltLength } : subtle,
-    usages: sig,
-    minRsaBits: 2048
-  };
-}
-function ecdsa(crv, bits) {
-  return {
-    kty: ["EC"],
-    crv,
-    subtle: { name: "ECDSA", namedCurve: crv },
-    signing: { name: "ECDSA", hash: `SHA-${bits}` },
-    usages: sig
-  };
-}
-function eddsa() {
-  const subtle = { name: "Ed25519" };
-  return {
-    kty: ["OKP"],
-    crv: "Ed25519",
-    subtle,
-    signing: subtle,
-    usages: sig
-  };
-}
-function mldsa(bits) {
-  const subtle = { name: `ML-DSA-${bits}` };
-  return {
-    kty: ["AKP"],
-    subtle,
-    signing: subtle,
-    usages: sig
-  };
-}
-var JWS = table({
-  HS256: hmac(256),
-  HS384: hmac(384),
-  HS512: hmac(512),
-  RS256: rsa(256),
-  RS384: rsa(384),
-  RS512: rsa(512),
-  PS256: rsa(256, 32),
-  PS384: rsa(384, 48),
-  PS512: rsa(512, 64),
-  ES256: ecdsa("P-256", 256),
-  ES384: ecdsa("P-384", 384),
-  ES512: ecdsa("P-521", 512),
-  EdDSA: eddsa(),
-  Ed25519: eddsa(),
-  "ML-DSA-44": mldsa(44),
-  "ML-DSA-65": mldsa(65),
-  "ML-DSA-87": mldsa(87)
-});
-function jwsAlgorithm(alg) {
-  const entry = typeof alg == "string" ? JWS[alg] : void 0;
-  if (!entry)
-    throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-  return entry;
-}
-
-// ../../node_modules/jose/dist/webapi/lib/jws_verify.js
-function prepareVerify(options) {
-  return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
-}
-function parseProtectedHeader(encodedProtected) {
-  return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
-}
-function encodeCompactUnencodedPayload(payload) {
-  try {
-    return encode(payload);
-  } catch {
-    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
-  }
-}
-async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
-  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
-  if (!isDisjoint(parsedProt, header))
-    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
-  if (typeof alg != "string" || !alg)
-    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-  if (shared[0] && !shared[0].has(alg))
-    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-  if (b64) {
-    if (typeof inputPayload != "string")
-      throw new JWSInvalid("JWS Payload must be a string");
-  } else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array))
-    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
-  const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
-  let resolvedKey = false;
-  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = true);
-  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
-  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
-  let verified = false;
-  try {
-    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
-  } catch {
-  }
-  if (!verified)
-    throw new JWSSignatureVerificationFailed();
-  const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
-  return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
-}
-async function verifyCompact(jws, shared, key) {
-  if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string")
-    throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
-  const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
-  if (length !== 3)
-    throw new JWSInvalid("Invalid Compact JWS");
-  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);
-}
-
-// ../../node_modules/jose/dist/webapi/lib/jwt_claims_set.js
-var epoch = (date) => Math.floor(date.getTime() / 1e3);
-var multipliers = {
-  s: 1,
-  m: 60,
-  h: 3600,
-  d: 86400,
-  w: 604800,
-  y: 31557600
-};
-var REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
-var checkFailed = "check_failed";
-function invalidDuration() {
-  throw new TypeError("Invalid time period format");
-}
-function secs(str) {
-  typeof str != "string" && invalidDuration();
-  const matched = REGEX.exec(str);
-  (!matched || matched[4] && matched[1]) && invalidDuration();
-  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
-}
-function validateInput(label, input) {
-  if (!Number.isFinite(input))
-    throw new TypeError(`Invalid ${label} input`);
-  return input;
-}
-function validateStringClaim(claim, value) {
-  if (typeof value != "string")
-    throw new TypeError(`"${claim}" claim must be a string`);
-}
-function validateAudienceClaim(value) {
-  if (typeof value != "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != "string")))
-    throw new TypeError('"aud" claim must be a string or an array of strings');
-}
-function numericDate(value, label) {
-  return typeof value == "number" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);
-}
-var normalizeTyp = (value) => {
-  const normalized = value.toLowerCase();
-  return value.includes("/") ? normalized : `application/${normalized}`;
-};
-var checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;
-function validateNumericDate(payload, claim, required = false) {
-  const value = payload[claim];
-  if (!(value === void 0 && !required)) {
-    if (typeof value != "number")
-      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
-    return value;
-  }
-}
-function unexpectedClaim(payload, claim) {
-  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
-}
-function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
-  let payload;
-  try {
-    payload = JSON.parse(strictDecoder.decode(encodedPayload));
-  } catch {
-  }
-  if (!isObject(payload))
-    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
-  const { typ } = options;
-  if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
-    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
-  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
-  maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
-  for (const claim of new Set(presenceCheck.reverse()))
-    if (!Object.hasOwn(payload, claim))
-      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
-  const { clockTolerance } = options;
-  let tolerance = 0;
-  if (typeof clockTolerance == "string")
-    tolerance = secs(clockTolerance);
-  else if (clockTolerance !== void 0) {
-    if (typeof clockTolerance != "number")
-      throw new TypeError("Invalid clockTolerance option type");
-    tolerance = clockTolerance;
-  }
-  validateInput("clockTolerance option", tolerance);
-  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
-  if (nbf !== void 0 && nbf > now + tolerance)
-    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
-  const exp = validateNumericDate(payload, "exp");
-  if (exp !== void 0 && exp <= now - tolerance)
-    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
-  if (maxTokenAge !== void 0) {
-    const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
-    if (age - tolerance > max)
-      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
-    if (age < -tolerance)
-      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
-  }
-  return payload;
-}
-var producerPayloads;
-function producerPayload(producer) {
-  return producerPayloads.get(producer);
-}
-function jwtData(producer) {
-  const payload = producerPayload(producer);
-  for (const claim of ["iat", "nbf", "exp"]) {
-    const value = payload[claim];
-    if (typeof value == "number" && !Number.isFinite(value))
-      throw new TypeError(`"${claim}" claim must be a finite number`);
-  }
-  return encoder.encode(JSON.stringify(payload));
-}
-var JWTClaimsBuilder = class {
-  constructor(payload = {}) {
-    if (!isObject(payload))
-      throw new TypeError("JWT Claims Set MUST be an object");
-    (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));
-  }
-  setIssuer(value) {
-    return validateStringClaim("iss", value), producerPayload(this).iss = value, this;
-  }
-  setSubject(value) {
-    return validateStringClaim("sub", value), producerPayload(this).sub = value, this;
-  }
-  setAudience(value) {
-    return validateAudienceClaim(value), producerPayload(this).aud = value, this;
-  }
-  setJti(value) {
-    return validateStringClaim("jti", value), producerPayload(this).jti = value, this;
-  }
-  setNotBefore(value) {
-    return producerPayload(this).nbf = numericDate(value, "setNotBefore"), this;
-  }
-  setExpirationTime(value) {
-    return producerPayload(this).exp = numericDate(value, "setExpirationTime"), this;
-  }
-  setIssuedAt(value) {
-    const payload = producerPayload(this);
-    return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, "setIssuedAt"), this;
-  }
-};
-
-// ../../node_modules/jose/dist/webapi/jwt/verify.js
-async function jwtVerify(jwt, key, options) {
-  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
-  if (!b64)
-    throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
-  return { ...verified, payload };
-}
-
-// ../../node_modules/jose/dist/webapi/lib/jws_sign.js
-async function createSignature(input, key, rejectUnencoded) {
-  let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = "";
-  if (protectedHeader !== void 0) {
-    const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
-    protectedHeader = normalized[0], protectedHeaderString = encode2(normalized[1]);
-  }
-  if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader)
-    throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
-  if (!isDisjoint(protectedHeader, unprotectedHeader))
-    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-  const joseHeader = { ...protectedHeader, ...unprotectedHeader };
-  validateCritDuplicates(JWSInvalid, protectedHeader);
-  const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
-  b64 || rejectUnencoded?.();
-  const { alg } = joseHeader;
-  if (typeof alg != "string" || !alg)
-    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-  const entry = jwsAlgorithm(alg);
-  let payloadS = "", payloadB = payload, data;
-  if (b64) {
-    const encoded = input[4];
-    encoded ? (payloadS = encoded[0] ??= encode2(payload), payloadB = encoded[1] ??= encode(payloadS)) : (payloadS = encode2(payload), data = encoder.encode(`${protectedHeaderString}.${payloadS}`));
-  }
-  data ??= concat(encode(protectedHeaderString), encode("."), payloadB);
-  const k = await rawKey(await prepareKey(entry, key, "sign"), entry.subtle, "sign");
-  entry.minRsaBits && checkModulusLength(entry.alg, k);
-  const jws = {
-    signature: encode2(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),
-    payload: payloadS
-  };
-  return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];
-}
-async function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {
-  const [jws] = await createSignature([payload, protectedHeader, void 0, crit], key, rejectUnencoded);
-  return `${jws.protected}.${jws.payload}.${jws.signature}`;
-}
-
-// ../../node_modules/jose/dist/webapi/jwt/sign.js
-var SignJWT_base = JWTClaimsBuilder;
-var SignJWT = class extends SignJWT_base {
-  #protectedHeader;
-  setProtectedHeader(protectedHeader) {
-    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
-  }
-  async sign(key, options) {
-    return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
-      throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-    });
-  }
-};
-
-// ../../node_modules/jose/dist/webapi/lib/key_algorithm.js
-function unsupportedAlg(source = 'JWK "alg" (Algorithm) Parameter') {
-  throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
-}
-function keyAlgorithm(alg, source) {
-  return (typeof alg == "string" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);
-}
-
-// ../../node_modules/jose/dist/webapi/key/export.js
-async function exportJWK(key) {
-  if (isKeyObject(key))
-    if (key.type === "secret")
-      key = key.export();
-    else
-      return key.export({ format: "jwk" });
-  if (key instanceof Uint8Array)
-    return {
-      kty: "oct",
-      k: encode2(key)
-    };
-  if (!isCryptoKey(key))
-    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
-  if (!key.extractable)
-    throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
-  const jwk = await crypto.subtle.exportKey("jwk", key);
-  delete jwk.ext, delete jwk.key_ops, delete jwk.use, jwk.kty !== "AKP" && delete jwk.alg;
-  for (const parameter of Object.keys(jwk))
-    jwk[parameter] === void 0 && delete jwk[parameter];
-  return jwk;
-}
-
-// ../../node_modules/jose/dist/webapi/jwk/thumbprint.js
-var check = (value, description) => {
-  if (typeof value != "string" || !value)
-    throw new JWKInvalid(`${description} missing or invalid`);
-};
-async function calculateJwkThumbprint(key, digestAlgorithm) {
-  let jwk;
-  if (isObject(key)) {
-    if (jwk = snapshotJwk(key), typeof jwk.kty != "string")
-      throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
-  } else if (isKeyLike(key))
-    jwk = snapshotJwk(await exportJWK(key));
-  else
-    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
-  if (digestAlgorithm ??= "sha256", digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512")
-    throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
-  let components;
-  switch (jwk.kty) {
-    case "AKP":
-      check(jwk.alg, '"alg" (Algorithm) Parameter'), check(jwk.pub, '"pub" (Public key) Parameter'), components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
-      break;
-    case "EC":
-      check(jwk.crv, '"crv" (Curve) Parameter'), check(jwk.x, '"x" (X Coordinate) Parameter'), check(jwk.y, '"y" (Y Coordinate) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
-      break;
-    case "OKP":
-      check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter'), check(jwk.x, '"x" (Public Key) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
-      break;
-    case "RSA":
-      check(jwk.e, '"e" (Exponent) Parameter'), check(jwk.n, '"n" (Modulus) Parameter'), components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
-      break;
-    case "oct":
-      if (typeof jwk.k != "string")
-        throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
-      components = { k: jwk.k, kty: jwk.kty };
-      break;
-    default:
-      throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
-  }
-  const data = encode(JSON.stringify(components));
-  return encode2(await digest(digestAlgorithm, data));
-}
-
-// ../../node_modules/jose/dist/webapi/key/import.js
-async function importJWK(jwk, alg, options) {
-  if (!isObject(jwk))
-    throw new TypeError("JWK must be an object");
-  const normalized = normalizeJwk(jwk), extractable = validateExtractableOption(options?.extractable), { alg: jwkAlg } = normalized;
-  if (alg ??= jwkAlg, normalized.kty !== "oct" && !alg)
-    throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-  switch (normalized.kty) {
-    case "oct":
-      if (typeof normalized.k != "string")
-        throw new TypeError('missing "k" (Key Value) Parameter value');
-      return decode(normalized.k);
-    case "AKP": {
-      if (typeof jwkAlg != "string" || !jwkAlg)
-        throw new TypeError('missing "alg" (Algorithm) Parameter value');
-      if (alg !== jwkAlg)
-        throw new TypeError("JWK alg and alg option value mismatch");
-      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
-    }
-    case "RSA":
-    case "EC":
-    case "OKP":
-      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
-    default:
-      throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
-  }
-}
-
-// ../../node_modules/jose/dist/webapi/util/decode_protected_header.js
-function decodeProtectedHeader(token) {
-  let protectedB64u;
-  if (typeof token == "string") {
-    const parts = token.split(".");
-    (parts.length === 3 || parts.length === 5) && ([protectedB64u] = parts);
-  } else if (typeof token == "object" && token)
-    if ("protected" in token)
-      protectedB64u = token.protected;
-    else
-      throw new TypeError("Token does not contain a Protected Header");
-  const invalid2 = "Invalid Token or Protected Header formatting";
-  if (typeof protectedB64u != "string" || !protectedB64u)
-    throw new TypeError(invalid2);
-  return parseJoseHeader(protectedB64u, TypeError, invalid2);
-}
-
-// src/json.ts
-function parseJsonStrict(source) {
-  return new StrictJsonParser(source).parse();
-}
-var StrictJsonParser = class {
-  constructor(source) {
-    this.source = source;
-  }
-  #offset = 0;
-  parse() {
-    this.#skipWhitespace();
-    const value = this.#parseValue();
-    this.#skipWhitespace();
-    if (this.#offset !== this.source.length) {
-      this.#invalid("Unexpected content after the JSON value");
-    }
-    return value;
-  }
-  #parseValue() {
-    const character = this.source[this.#offset];
-    if (character === "{") return this.#parseObject();
-    if (character === "[") return this.#parseArray();
-    if (character === '"') return this.#parseString();
-    if (character === "t") return this.#parseLiteral("true", true);
-    if (character === "f") return this.#parseLiteral("false", false);
-    if (character === "n") return this.#parseLiteral("null", null);
-    if (character === "-" || character !== void 0 && /[0-9]/.test(character)) {
-      return this.#parseNumber();
-    }
-    this.#invalid("Expected a JSON value");
-  }
-  #parseObject() {
-    this.#offset += 1;
-    this.#skipWhitespace();
-    const result = {};
-    const names = /* @__PURE__ */ new Set();
-    if (this.#consume("}")) return result;
-    while (true) {
-      if (this.source[this.#offset] !== '"') {
-        this.#invalid("Expected a JSON object member name");
-      }
-      const name = this.#parseString();
-      if (names.has(name)) {
-        throw new ProtocolValidationError(
-          "duplicate_json_member",
-          `JSON object contains duplicate member ${JSON.stringify(name)}`
-        );
-      }
-      names.add(name);
-      this.#skipWhitespace();
-      if (!this.#consume(":")) this.#invalid("Expected ':' after an object member name");
-      this.#skipWhitespace();
-      result[name] = this.#parseValue();
-      this.#skipWhitespace();
-      if (this.#consume("}")) return result;
-      if (!this.#consume(",")) this.#invalid("Expected ',' or '}' in a JSON object");
-      this.#skipWhitespace();
-    }
-  }
-  #parseArray() {
-    this.#offset += 1;
-    this.#skipWhitespace();
-    const result = [];
-    if (this.#consume("]")) return result;
-    while (true) {
-      result.push(this.#parseValue());
-      this.#skipWhitespace();
-      if (this.#consume("]")) return result;
-      if (!this.#consume(",")) this.#invalid("Expected ',' or ']' in a JSON array");
-      this.#skipWhitespace();
-    }
-  }
-  #parseString() {
-    const start = this.#offset;
-    this.#offset += 1;
-    while (this.#offset < this.source.length) {
-      const character = this.source[this.#offset];
-      if (character === '"') {
-        this.#offset += 1;
-        const encoded = this.source.slice(start, this.#offset);
-        try {
-          return JSON.parse(encoded);
-        } catch (cause) {
-          this.#invalid("Invalid JSON string", cause);
-        }
-      }
-      if (character === "\\") {
-        this.#offset += 1;
-        if (this.#offset >= this.source.length) this.#invalid("Unterminated JSON escape");
-        if (this.source[this.#offset] === "u") {
-          const digits = this.source.slice(this.#offset + 1, this.#offset + 5);
-          if (!/^[0-9a-fA-F]{4}$/.test(digits)) this.#invalid("Invalid Unicode escape");
-          this.#offset += 4;
-        } else if (!'"\\/bfnrt'.includes(this.source[this.#offset] ?? "")) {
-          this.#invalid("Invalid JSON escape");
-        }
-      } else if (character === void 0 || character.charCodeAt(0) < 32) {
-        this.#invalid("Invalid control character in JSON string");
-      }
-      this.#offset += 1;
-    }
-    this.#invalid("Unterminated JSON string");
-  }
-  #parseNumber() {
-    const remainder = this.source.slice(this.#offset);
-    const match = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/.exec(remainder);
-    if (!match) this.#invalid("Invalid JSON number");
-    this.#offset += match[0].length;
-    const value = Number(match[0]);
-    if (!Number.isFinite(value)) this.#invalid("JSON number is outside the supported range");
-    return value;
-  }
-  #parseLiteral(encoded, value) {
-    if (!this.source.startsWith(encoded, this.#offset)) {
-      this.#invalid("Invalid JSON literal");
-    }
-    this.#offset += encoded.length;
-    return value;
-  }
-  #skipWhitespace() {
-    while (this.#offset < this.source.length && " 	\r\n".includes(this.source[this.#offset] ?? "")) {
-      this.#offset += 1;
-    }
-  }
-  #consume(character) {
-    if (this.source[this.#offset] !== character) return false;
-    this.#offset += 1;
-    return true;
-  }
-  #invalid(message2, cause) {
-    throw new ProtocolValidationError("invalid_json", message2, {
-      cause
-    });
-  }
-};
-
-// ../../node_modules/@datalayer/reactor/lib/core/contributions.js
-function defineContributionPoint(id) {
-  if (!id) {
-    throw new Error("defineContributionPoint: a contribution point needs an id");
-  }
-  return { id };
-}
-function contribution(point, value, options) {
-  return { point, value, options };
-}
-var ContributionRegistry = class {
-  byPoint = /* @__PURE__ */ new Map();
-  byPlugin = /* @__PURE__ */ new Map();
-  seq = 0;
-  /**
-   * Store a contribution and return its disposer. The disposer is idempotent
-   * and is also called automatically when the contributing plugin stops.
-   */
-  add(pluginName, point, value, options = {}) {
-    const entry = {
-      plugin: pluginName,
-      id: options.id ?? pluginName,
-      order: options.order ?? 0,
-      value,
-      seq: this.seq++
-    };
-    const entries = this.byPoint.get(point.id);
-    if (entries) {
-      entries.push(entry);
-    } else {
-      this.byPoint.set(point.id, [entry]);
-    }
-    let disposed = false;
-    const dispose = () => {
-      if (disposed) {
-        return;
-      }
-      disposed = true;
-      const current = this.byPoint.get(point.id);
-      if (current) {
-        const index = current.indexOf(entry);
-        if (index >= 0) {
-          current.splice(index, 1);
-        }
-        if (current.length === 0) {
-          this.byPoint.delete(point.id);
-        }
-      }
-      this.byPlugin.get(pluginName)?.delete(dispose);
-    };
-    const owned = this.byPlugin.get(pluginName);
-    if (owned) {
-      owned.add(dispose);
-    } else {
-      this.byPlugin.set(pluginName, /* @__PURE__ */ new Set([dispose]));
-    }
-    return dispose;
-  }
-  /** Contributions for a point, ordered by `order` then registration order. */
-  get(point) {
-    const entries = this.byPoint.get(point.id);
-    if (!entries || entries.length === 0) {
-      return [];
-    }
-    return [...entries].sort((a, b) => a.order === b.order ? a.seq - b.seq : a.order - b.order).map(({ plugin, id, order, value }) => ({
-      plugin,
-      id,
-      order,
-      value
-    }));
-  }
-  /** Ids of the points that currently hold something. */
-  points() {
-    return [...this.byPoint.keys()].sort();
-  }
-  /**
-   * Every point and what is currently contributed to it.
-   *
-   * For hosts that describe the whole graph rather than read one point — they
-   * have no `ContributionPoint` objects to look things up with, only ids.
-   */
-  describe() {
-    return this.points().map((point) => ({
-      point,
-      contributions: (this.byPoint.get(point) ?? []).slice().sort((a, b) => a.order === b.order ? a.seq - b.seq : a.order - b.order).map(({ plugin, id, order, value }) => ({ plugin, id, order, value }))
-    }));
-  }
-  /** Drop everything one plugin contributed (on `disable`, `stop`). */
-  disposePlugin(pluginName) {
-    const owned = this.byPlugin.get(pluginName);
-    if (!owned) {
-      return;
-    }
-    for (const dispose of [...owned]) {
-      dispose();
-    }
-    this.byPlugin.delete(pluginName);
-  }
-};
-
-// ../../node_modules/@datalayer/reactor/lib/core/commands.js
-var CommandRegistry = class {
-  byId = /* @__PURE__ */ new Map();
-  byPlugin = /* @__PURE__ */ new Map();
-  listeners = /* @__PURE__ */ new Set();
-  seq = 0;
-  /**
-   * Register a command and return its disposer.
-   *
-   * The disposer is idempotent, and is also run when the registering plugin
-   * stops — so the ordinary case needs no disposer at all.
-   *
-   * @throws if `id` is already registered. See {@link ReactorCommand.id}.
-   */
-  add(pluginName, command) {
-    if (!command.id) {
-      throw new Error("CommandRegistry.add: a command needs an id");
-    }
-    const existing = this.byId.get(command.id);
-    if (existing) {
-      throw new Error(`CommandRegistry.add: command '${command.id}' is already registered by plugin '${existing.plugin}'. Command ids must be unique; namespace them with the plugin they belong to.`);
-    }
-    const entry = {
-      plugin: pluginName,
-      seq: this.seq++,
-      command
-    };
-    this.byId.set(command.id, entry);
-    let disposed = false;
-    const dispose = () => {
-      if (disposed) {
-        return;
-      }
-      disposed = true;
-      if (this.byId.get(command.id) === entry) {
-        this.byId.delete(command.id);
-      }
-      this.byPlugin.get(pluginName)?.delete(dispose);
-      this.notify();
-    };
-    const owned = this.byPlugin.get(pluginName);
-    if (owned) {
-      owned.add(dispose);
-    } else {
-      this.byPlugin.set(pluginName, /* @__PURE__ */ new Set([dispose]));
-    }
-    this.notify();
-    return dispose;
-  }
-  /** One command by id, or `undefined`. */
-  get(id) {
-    const entry = this.byId.get(id);
-    return entry ? { ...entry.command, plugin: entry.plugin } : void 0;
-  }
-  /** Every command, ordered by `order` then registration order. */
-  list() {
-    return [...this.byId.values()].sort((a, b) => {
-      const orderA = a.command.order ?? 0;
-      const orderB = b.command.order ?? 0;
-      return orderA === orderB ? a.seq - b.seq : orderA - orderB;
-    }).map((entry) => ({ ...entry.command, plugin: entry.plugin }));
-  }
-  /**
-   * Run a command by id.
-   *
-   * Always async, even for a synchronous command, so a caller never has to ask
-   * which kind it invoked. A command that throws rejects here rather than
-   * taking down the surface that invoked it — the caller decides what a failed
-   * command looks like, because only it knows where to say so. Resolves with
-   * whatever the command returned: nothing for most, the answer for one that
-   * is an agent's tool.
-   *
-   * @throws if no such command is registered, or if it is currently disabled.
-   */
-  async execute(id, argument) {
-    const entry = this.byId.get(id);
-    if (!entry) {
-      throw new Error(`CommandRegistry.execute: no command '${id}' is registered`);
-    }
-    if (entry.command.isEnabled && !entry.command.isEnabled()) {
-      throw new Error(`CommandRegistry.execute: command '${id}' is not available right now`);
-    }
-    return await entry.command.execute(argument);
-  }
-  /**
-   * Be told when the set of commands changes.
-   *
-   * Registration and disposal both wake subscribers; *running* a command does
-   * not. Hosts that already follow the reactor's revision get this for free —
-   * this exists for a surface holding the registry alone.
-   */
-  subscribe(listener) {
-    this.listeners.add(listener);
-    return () => {
-      this.listeners.delete(listener);
-    };
-  }
-  /** Drop every command one plugin registered (on `disable`, `stop`). */
-  disposePlugin(pluginName) {
-    const owned = this.byPlugin.get(pluginName);
-    if (!owned) {
-      return;
-    }
-    for (const dispose of [...owned]) {
-      dispose();
-    }
-    this.byPlugin.delete(pluginName);
-  }
-  notify() {
-    for (const listener of [...this.listeners]) {
-      listener();
-    }
-  }
-};
-
-// ../../node_modules/@datalayer/reactor/lib/core/activation.js
-var ON_STARTUP = "onStartup";
-var ON_ANY = "*";
-function onContributionPoint(point) {
-  return `onContributionPoint:${typeof point === "string" ? point : point.id}`;
-}
-function matchesActivation(declared, event) {
-  if (!declared || declared.length === 0) {
-    return event === ON_STARTUP;
-  }
-  return declared.some((candidate) => candidate === ON_ANY || candidate === event);
-}
-function matchesDeactivation(declared, event) {
-  if (!declared || declared.length === 0) {
-    return false;
-  }
-  return declared.some((candidate) => candidate === ON_ANY || candidate === event);
-}
-function activatesAtStartup(declared) {
-  return matchesActivation(declared, ON_STARTUP);
-}
-
-// ../../node_modules/@datalayer/reactor/lib/core/extension.js
-function isExtension(ref) {
-  return typeof ref === "object" && ref !== null && typeof ref.name === "string" && Array.isArray(ref.plugins);
-}
-
-// ../../node_modules/@datalayer/reactor/lib/core/gates.js
-function isRefusal(answer) {
-  return answer !== true;
-}
-function resolveGate(answers, context) {
-  const refusals = [];
-  for (const answer of answers) {
-    let result;
-    try {
-      result = answer.value.check(context);
-    } catch (error) {
-      result = error instanceof Error ? error.message : String(error);
-    }
-    if (isRefusal(result)) {
-      refusals.push({ plugin: answer.plugin, reason: result });
-    }
-  }
-  const first = refusals[0];
-  return {
-    allowed: refusals.length === 0,
-    reason: first?.reason,
-    blockedBy: first?.plugin,
-    refusals
-  };
-}
-
-// ../../node_modules/@datalayer/reactor/lib/core/reactor.js
-function placeholderFor(ref) {
-  return {
-    name: ref.name,
-    version: ref.version,
-    displayName: ref.displayName,
-    description: ref.description,
-    octicon: ref.octicon,
-    emoji: ref.emoji,
-    dependencies: ref.dependencies,
-    activationEvents: ref.activationEvents,
-    deactivationEvents: ref.deactivationEvents,
-    requiredBackendPlugins: ref.requiredBackendPlugins,
-    optionalBackendPlugins: ref.optionalBackendPlugins,
-    contributionPoints: ref.contributionPoints
-  };
-}
-function mergeLoaded(ref, loaded) {
-  return {
-    ...loaded,
-    displayName: loaded.displayName ?? ref.displayName,
-    description: loaded.description ?? ref.description,
-    octicon: loaded.octicon ?? ref.octicon,
-    emoji: loaded.emoji ?? ref.emoji,
-    version: loaded.version ?? ref.version,
-    activationEvents: loaded.activationEvents ?? ref.activationEvents,
-    deactivationEvents: loaded.deactivationEvents ?? ref.deactivationEvents,
-    requiredBackendPlugins: loaded.requiredBackendPlugins ?? ref.requiredBackendPlugins,
-    optionalBackendPlugins: loaded.optionalBackendPlugins ?? ref.optionalBackendPlugins,
-    contributionPoints: loaded.contributionPoints ?? ref.contributionPoints
-  };
-}
-function shallowMergeConfig(base, override) {
-  return { ...base, ...override };
-}
-function normalizePlugins(input) {
-  const discovered = /* @__PURE__ */ new Map();
-  const lazyByName = /* @__PURE__ */ new Map();
-  const extensionOf = /* @__PURE__ */ new Map();
-  const extensions2 = /* @__PURE__ */ new Map();
-  const queue = input.map((ref) => ({ ref }));
-  while (queue.length > 0) {
-    const entry = queue.shift();
-    if (!entry?.ref) {
-      continue;
-    }
-    const { ref, from } = entry;
-    if (isExtension(ref)) {
-      extensions2.set(ref.name, ref);
-      for (const member of ref.plugins) {
-        queue.push({ ref: member, from: ref.name });
-      }
-      continue;
-    }
-    if (isLazyPluginRef(ref)) {
-      if (!discovered.has(ref.name)) {
-        lazyByName.set(ref.name, ref);
-        discovered.set(ref.name, placeholderFor(ref));
-        if (from) {
-          extensionOf.set(ref.name, from);
-        }
-        for (const dep of ref.dependencies ?? []) {
-          queue.push({ ref: dep });
-        }
-      }
-      continue;
-    }
-    const configured = asConfigured(ref);
-    const plugin = configured.plugin;
-    if (!discovered.has(plugin.name)) {
-      discovered.set(plugin.name, plugin);
-      if (from) {
-        extensionOf.set(plugin.name, from);
-      }
-      for (const dep of plugin.dependencies ?? []) {
-        queue.push({ ref: dep });
-      }
-    }
-  }
-  return { plugins: Array.from(discovered.values()), lazyByName, extensionOf, extensions: extensions2 };
-}
-function topoSort(plugins) {
-  const byName = new Map(plugins.map((plugin) => [plugin.name, plugin]));
-  const temp = /* @__PURE__ */ new Set();
-  const perm = /* @__PURE__ */ new Set();
-  const ordered = [];
-  function visit(name) {
-    if (perm.has(name)) {
-      return;
-    }
-    if (temp.has(name)) {
-      throw new Error(`Circular dependency detected at ${name}`);
-    }
-    temp.add(name);
-    const plugin = byName.get(name);
-    if (!plugin) {
-      throw new Error(`Unknown plugin ${name}`);
-    }
-    for (const dep of plugin.dependencies ?? []) {
-      visit(asConfigured(dep).plugin.name);
-    }
-    temp.delete(name);
-    perm.add(name);
-    ordered.push(plugin);
-  }
-  for (const plugin of plugins) {
-    visit(plugin.name);
-  }
-  return ordered;
-}
-function collectOverrides(input) {
-  const out = /* @__PURE__ */ new Map();
-  const queue = [...input];
-  while (queue.length > 0) {
-    const ref = queue.shift();
-    if (!ref) {
-      continue;
-    }
-    if (isExtension(ref)) {
-      queue.push(...ref.plugins);
-      continue;
-    }
-    if (isLazyPluginRef(ref)) {
-      for (const dep of ref.dependencies ?? []) {
-        queue.push(dep);
-      }
-      continue;
-    }
-    const configured = asConfigured(ref);
-    const name = configured.plugin.name;
-    const previous = out.get(name) ?? {};
-    const merged = shallowMergeConfig(previous, configured.config);
-    out.set(name, merged);
-    for (const dep of configured.plugin.dependencies ?? []) {
-      queue.push(dep);
-    }
-  }
-  return out;
-}
-function buildReactorFromPlugins(pluginsInput, options = {}) {
-  const { plugins: allPlugins, lazyByName, extensionOf, extensions: extensions2 } = normalizePlugins(pluginsInput);
-  const orderedPlugins = topoSort(allPlugins);
-  const byName = new Map(orderedPlugins.map((plugin) => [plugin.name, plugin]));
-  const configOverrides = collectOverrides(pluginsInput);
-  const state = /* @__PURE__ */ new Map();
-  const listeners = /* @__PURE__ */ new Set();
-  const contributions = new ContributionRegistry();
-  const commands = new CommandRegistry();
-  let revision = 0;
-  let mutationDepth = 0;
-  let readyPromise;
-  let started = false;
-  const activating = /* @__PURE__ */ new Map();
-  const firedPoints = /* @__PURE__ */ new Set();
-  const standingDownForBackend = /* @__PURE__ */ new Set();
-  let availableBackendPlugins = /* @__PURE__ */ new Set();
-  function emitChange() {
-    if (mutationDepth > 0) {
-      return;
-    }
-    revision += 1;
-    for (const listener of listeners) {
-      listener();
-    }
-  }
-  function asOneChange(operation) {
-    mutationDepth += 1;
-    try {
-      return operation();
-    } finally {
-      mutationDepth -= 1;
-      if (mutationDepth === 0) {
-        emitChange();
-      }
-    }
-  }
-  for (const plugin of orderedPlugins) {
-    const mergedConfig = mergeWithDefaults(plugin, configOverrides.get(plugin.name) ?? {});
-    state.set(plugin.name, {
-      plugin,
-      config: mergedConfig,
-      enabled: true,
-      activated: false,
-      extension: extensionOf.get(plugin.name),
-      lazy: lazyByName.get(plugin.name),
-      loaded: !lazyByName.has(plugin.name)
-    });
-  }
-  for (const plugin of orderedPlugins) {
-    for (const conflict of plugin.conflictsWith ?? []) {
-      if (byName.has(conflict)) {
-        throw new Error(`Plugin ${plugin.name} conflicts with ${conflict}`);
-      }
-    }
-    for (const peer of plugin.peerDependencies ?? []) {
-      if (!peer.optional && !byName.has(peer.name) && options.strictPeerDependencies) {
-        throw new Error(`Missing required peer dependency ${peer.name} for ${plugin.name}`);
-      }
-    }
-  }
-  function waitingFor(event) {
-    const waiting = [];
-    for (const plugin of orderedPlugins) {
-      const current = state.get(plugin.name);
-      if (!current || current.activated) {
-        continue;
-      }
-      if (matchesActivation(current.plugin.activationEvents, event)) {
-        waiting.push(plugin.name);
-      }
-    }
-    return waiting;
-  }
-  function readContributions(point) {
-    if (!firedPoints.has(point.id)) {
-      firedPoints.add(point.id);
-      const event = onContributionPoint(point);
-      if (waitingFor(event).length > 0) {
-        void Promise.resolve().then(() => activateFor(event));
-      }
-    }
-    return contributions.get(point);
-  }
-  const reactorView = {
-    hasPlugin(name) {
-      return state.has(name);
-    },
-    getOutput(name) {
-      return state.get(name)?.outputValue;
-    },
-    getRequiredBackendPlugins(name) {
-      return state.get(name)?.plugin.requiredBackendPlugins ?? [];
-    },
-    getOptionalBackendPlugins(name) {
-      return state.get(name)?.plugin.optionalBackendPlugins ?? [];
-    },
-    getManifest(name) {
-      const current = state.get(name);
-      if (!current) {
-        return void 0;
-      }
-      const { plugin } = current;
-      return {
-        name: plugin.name,
-        version: plugin.version,
-        // The identifier is the fallback: a host should always have something
-        // to print, and `@music/catalog` beats an empty line.
-        displayName: plugin.displayName ?? plugin.name,
-        description: plugin.description,
-        octicon: plugin.octicon,
-        emoji: plugin.emoji,
-        extension: current.extension,
-        requiredBackendPlugins: plugin.requiredBackendPlugins ?? [],
-        optionalBackendPlugins: plugin.optionalBackendPlugins ?? [],
-        loaded: current.loaded,
-        lazy: Boolean(current.lazy),
-        activated: current.activated,
-        disabledBy: current.enabled ? void 0 : current.disabledBy ?? "user",
-        loadError: current.loadError?.message,
-        activationEvents: plugin.activationEvents ?? [ON_STARTUP],
-        deactivationEvents: plugin.deactivationEvents ?? [],
-        contributionPoints: (plugin.contributionPoints ?? []).map((point) => point.id),
-        // Only what is declared up-front, and only once the module is here: an
-        // imperative `ctx.contribute` is not knowable before it runs, and the
-        // graph reads those from the registry instead.
-        contributesTo: [
-          ...new Set((plugin.contributes ?? []).map((record2) => record2.point.id))
-        ]
-      };
-    },
-    isEnabled(name) {
-      return state.get(name)?.enabled ?? false;
-    },
-    getContributions(point) {
-      return readContributions(point);
-    },
-    checkGate(gate, context) {
-      return resolveGate(readContributions(gate), context);
-    }
-  };
-  function buildPhaseContext(name, current) {
-    return {
-      plugin: current.plugin,
-      config: current.config,
-      state: {
-        getConfig: () => current.config,
-        getInit: () => current.initValue,
-        getOutput: () => current.outputValue
-      },
-      reactor: reactorView,
-      contribute(point, value, options2) {
-        const dispose = contributions.add(name, point, value, options2);
-        emitChange();
-        let disposed = false;
-        return () => {
-          if (disposed) {
-            return;
-          }
-          disposed = true;
-          dispose();
-          emitChange();
-        };
-      },
-      registerCommand(command) {
-        const dispose = commands.add(name, command);
-        emitChange();
-        let disposed = false;
-        return () => {
-          if (disposed) {
-            return;
-          }
-          disposed = true;
-          dispose();
-          emitChange();
-        };
-      }
-    };
-  }
-  function runInitAndBuild(name) {
-    const current = state.get(name);
-    if (!current) {
-      throw new Error(`Unknown plugin ${name}`);
-    }
-    if (!current.loaded) {
-      return;
-    }
-    const ctx = buildPhaseContext(name, current);
-    current.initValue = current.plugin.init?.(ctx);
-    current.outputValue = current.plugin.build?.(ctx);
-  }
-  function runRegister(name) {
-    const current = state.get(name);
-    if (!current || !current.enabled || !current.loaded) {
-      return;
-    }
-    const ctx = buildPhaseContext(name, current);
-    for (const record2 of current.plugin.contributes ?? []) {
-      contributions.add(name, record2.point, record2.value, record2.options);
-    }
-    for (const command of current.plugin.commands ?? []) {
-      commands.add(name, command);
-    }
-    emitChange();
-    current.registerDispose = current.plugin.register?.(ctx) ?? void 0;
-    current.afterDispose = current.plugin.afterRegistration?.(ctx) ?? void 0;
-  }
-  function activateLoaded(name) {
-    const current = state.get(name);
-    if (!current || current.activated || !current.loaded) {
-      return;
-    }
-    current.activated = true;
-    asOneChange(() => {
-      if (current.enabled) {
-        const keepsWhatItBuilt = current.plugin.preserveOutput && current.outputValue !== void 0;
-        if (!keepsWhatItBuilt) {
-          runInitAndBuild(name);
-        }
-        runRegister(name);
-      }
-    });
-  }
-  async function loadModule(name) {
-    const current = state.get(name);
-    if (!current?.lazy || current.loaded) {
-      return;
-    }
-    current.loading ??= Promise.resolve().then(() => current.lazy.load());
-    try {
-      const module = await current.loading;
-      if (current.loaded) {
-        return;
-      }
-      const loaded = module.default ?? module;
-      if (!loaded || typeof loaded !== "object" || !loaded.name) {
-        throw new Error(`Lazy plugin ${name} did not resolve to a plugin`);
-      }
-      current.plugin = mergeLoaded(current.lazy, loaded);
-      current.config = mergeWithDefaults(current.plugin, configOverrides.get(name) ?? {});
-      current.loaded = true;
-    } catch (error) {
-      current.loadError = error instanceof Error ? error : new Error(String(error));
-      emitChange();
-    }
-  }
-  function ensureActivated(name) {
-    const current = state.get(name);
-    if (!current || current.activated) {
-      return Promise.resolve();
-    }
-    const inFlight = activating.get(name);
-    if (inFlight) {
-      return inFlight;
-    }
-    const run = (async () => {
-      for (const dep of current.plugin.dependencies ?? []) {
-        await ensureActivated(asConfigured(dep).plugin.name);
-      }
-      if (current.lazy && !current.loaded) {
-        await loadModule(name);
-      }
-      activateLoaded(name);
-      standingDownForBackend.delete(name);
-    })().finally(() => {
-      activating.delete(name);
-    });
-    activating.set(name, run);
-    return run;
-  }
-  async function activateFor(event) {
-    const waiting = waitingFor(event);
-    if (waiting.length === 0) {
-      return [];
-    }
-    for (const name of waiting) {
-      const current = state.get(name);
-      if (current?.lazy && !current.loaded) {
-        current.loading ??= Promise.resolve().then(() => current.lazy.load());
-      }
-    }
-    for (const name of waiting) {
-      await ensureActivated(name);
-    }
-    return waiting.filter((name) => state.get(name)?.activated);
-  }
-  function dependantsOf(name) {
-    const wanted = /* @__PURE__ */ new Set([name]);
-    for (const plugin of orderedPlugins) {
-      const dependsOnWanted = (plugin.dependencies ?? []).some((dep) => wanted.has(asConfigured(dep).plugin.name));
-      if (dependsOnWanted) {
-        wanted.add(plugin.name);
-      }
-    }
-    wanted.delete(name);
-    return orderedPlugins.map((plugin) => plugin.name).filter((candidate) => wanted.has(candidate)).reverse();
-  }
-  function dependenciesEnabled(name) {
-    const plugin = state.get(name)?.plugin;
-    return (plugin?.dependencies ?? []).every((dep) => state.get(asConfigured(dep).plugin.name)?.enabled ?? true);
-  }
-  function enableOne(name) {
-    const current = state.get(name);
-    if (!current || current.enabled) {
-      return;
-    }
-    current.enabled = true;
-    current.disabledBy = void 0;
-    if (!current.loaded || !current.activated) {
-      return;
-    }
-    const keepsWhatItBuilt = current.plugin.preserveOutput && current.outputValue !== void 0;
-    if (!keepsWhatItBuilt) {
-      runInitAndBuild(name);
-    }
-    runRegister(name);
-  }
-  function deactivatePlugin(name, cause = "other") {
-    const current = state.get(name);
-    if (!current) {
-      throw new Error(`Unknown plugin ${name}`);
-    }
-    if (cause === "other") {
-      standingDownForBackend.delete(name);
-    }
-    if (!current.activated) {
-      return [];
-    }
-    const stoodDown = [];
-    asOneChange(() => {
-      for (const dependant of dependantsOf(name)) {
-        const dependantState = state.get(dependant);
-        if (!dependantState?.activated) {
-          continue;
-        }
-        stopPlugin(dependant);
-        dependantState.activated = false;
-        forgetPointsAwaiting(dependant);
-        stoodDown.push(dependant);
-      }
-      stopPlugin(name);
-      current.activated = false;
-      forgetPointsAwaiting(name);
-      stoodDown.push(name);
-    });
-    if (cause === "other") {
-      for (const stoodDownName of stoodDown) {
-        standingDownForBackend.delete(stoodDownName);
-      }
-    }
-    return stoodDown;
-  }
-  function forgetPointsAwaiting(name) {
-    const events = state.get(name)?.plugin.activationEvents ?? [];
-    for (const event of events) {
-      if (event.startsWith("onContributionPoint:")) {
-        firedPoints.delete(event.slice("onContributionPoint:".length));
-      }
-    }
-  }
-  function deactivateFor(event) {
-    const stoodDown = [];
-    for (const plugin of orderedPlugins) {
-      const current = state.get(plugin.name);
-      if (!current?.activated) {
-        continue;
-      }
-      if (matchesDeactivation(current.plugin.deactivationEvents, event)) {
-        stoodDown.push(...deactivatePlugin(plugin.name));
-      }
-    }
-    return stoodDown;
-  }
-  function stopPlugin(name) {
-    const current = state.get(name);
-    if (!current) {
-      return;
-    }
-    current.afterDispose?.();
-    current.afterDispose = void 0;
-    current.registerDispose?.();
-    current.registerDispose = void 0;
-    contributions.disposePlugin(name);
-    commands.disposePlugin(name);
-  }
-  return {
-    ...reactorView,
-    start() {
-      started = true;
-      asOneChange(() => {
-        const due = orderedPlugins.filter((plugin) => {
-          const current = state.get(plugin.name);
-          return current && current.loaded && !current.activated && activatesAtStartup(current.plugin.activationEvents);
-        });
-        for (const plugin of due) {
-          state.get(plugin.name).activated = true;
-          runInitAndBuild(plugin.name);
-        }
-        for (const plugin of due) {
-          runRegister(plugin.name);
-        }
-      });
-      readyPromise = activateFor(ON_STARTUP).then(() => void 0);
-    },
-    whenReady() {
-      return readyPromise ?? Promise.resolve();
-    },
-    async fire(event) {
-      const deactivated = deactivateFor(event);
-      const activated = await activateFor(event);
-      return { deactivated, activated };
-    },
-    deactivate(name) {
-      deactivatePlugin(name);
-    },
-    async setBackendPlugins(available) {
-      availableBackendPlugins = new Set(available);
-      const satisfied = (name) => (state.get(name)?.plugin.requiredBackendPlugins ?? []).every((backend) => availableBackendPlugins.has(backend));
-      const deactivated = [];
-      for (const plugin of orderedPlugins) {
-        const current = state.get(plugin.name);
-        if (!current?.activated || satisfied(plugin.name)) {
-          continue;
-        }
-        const stoodDown = deactivatePlugin(plugin.name, "backend");
-        for (const name of stoodDown) {
-          standingDownForBackend.add(name);
-        }
-        deactivated.push(...stoodDown);
-      }
-      const activated = [];
-      for (const plugin of orderedPlugins) {
-        const name = plugin.name;
-        if (!standingDownForBackend.has(name) || !satisfied(name)) {
-          continue;
-        }
-        const current = state.get(name);
-        if (!current?.enabled) {
-          continue;
-        }
-        standingDownForBackend.delete(name);
-        await ensureActivated(name);
-        if (state.get(name)?.activated) {
-          activated.push(name);
-        }
-      }
-      return { deactivated, activated };
-    },
-    async install(input) {
-      const incoming = normalizePlugins([input]);
-      const fresh = incoming.plugins.filter((plugin) => !state.has(plugin.name));
-      if (fresh.length === 0) {
-        return [];
-      }
-      for (const plugin of fresh) {
-        for (const conflict of plugin.conflictsWith ?? []) {
-          if (byName.has(conflict) || fresh.some((one) => one.name === conflict)) {
-            throw new Error(`Plugin ${plugin.name} conflicts with ${conflict}`);
-          }
-        }
-      }
-      for (const [name, ref] of incoming.lazyByName) {
-        lazyByName.set(name, ref);
-      }
-      for (const [name, from] of incoming.extensionOf) {
-        extensionOf.set(name, from);
-      }
-      for (const [name, extension] of incoming.extensions) {
-        extensions2.set(name, extension);
-      }
-      const overrides = collectOverrides([input]);
-      for (const plugin of fresh) {
-        byName.set(plugin.name, plugin);
-        state.set(plugin.name, {
-          plugin,
-          config: mergeWithDefaults(plugin, overrides.get(plugin.name) ?? {}),
-          enabled: true,
-          activated: false,
-          extension: extensionOf.get(plugin.name),
-          lazy: lazyByName.get(plugin.name),
-          loaded: !lazyByName.has(plugin.name)
-        });
-      }
-      const reordered = topoSort([...orderedPlugins, ...fresh]);
-      orderedPlugins.splice(0, orderedPlugins.length, ...reordered);
-      emitChange();
-      if (!started) {
-        return fresh.map((plugin) => plugin.name);
-      }
-      const installed = [];
-      for (const plugin of reordered) {
-        if (!fresh.some((one) => one.name === plugin.name)) {
-          continue;
-        }
-        installed.push(plugin.name);
-        if (activatesAtStartup(plugin.activationEvents)) {
-          await ensureActivated(plugin.name);
-        }
-      }
-      return installed;
-    },
-    stop() {
-      started = false;
-      asOneChange(() => {
-        for (const plugin of [...orderedPlugins].reverse()) {
-          stopPlugin(plugin.name);
-          const current = state.get(plugin.name);
-          if (current) {
-            current.activated = false;
-          }
-        }
-        firedPoints.clear();
-      });
-    },
-    enable(name) {
-      const current = state.get(name);
-      if (!current) {
-        throw new Error(`Unknown plugin ${name}`);
-      }
-      if (current.enabled) {
-        return;
-      }
-      asOneChange(() => {
-        enableOne(name);
-        for (const dependant of [...dependantsOf(name)].reverse()) {
-          const dependantState = state.get(dependant);
-          if (!dependantState || dependantState.enabled) {
-            continue;
-          }
-          if (dependantState.disabledBy !== "dependency") {
-            continue;
-          }
-          if (!dependenciesEnabled(dependant)) {
-            continue;
-          }
-          enableOne(dependant);
-        }
-      });
-    },
-    disable(name) {
-      const current = state.get(name);
-      if (!current) {
-        throw new Error(`Unknown plugin ${name}`);
-      }
-      if (!current.enabled) {
-        return;
-      }
-      asOneChange(() => {
-        for (const dependant of dependantsOf(name)) {
-          const dependantState = state.get(dependant);
-          if (!dependantState?.enabled) {
-            continue;
-          }
-          dependantState.enabled = false;
-          dependantState.disabledBy = "dependency";
-          stopPlugin(dependant);
-        }
-        current.enabled = false;
-        current.disabledBy = "user";
-        stopPlugin(name);
-      });
-    },
-    subscribe(listener) {
-      listeners.add(listener);
-      return () => {
-        listeners.delete(listener);
-      };
-    },
-    listPlugins() {
-      return orderedPlugins.map((plugin) => plugin.name);
-    },
-    listExtensions() {
-      return [...extensions2.keys()];
-    },
-    getExtensionManifest(name) {
-      const extension = extensions2.get(name);
-      if (!extension) {
-        return void 0;
-      }
-      return {
-        name: extension.name,
-        version: extension.version,
-        displayName: extension.displayName ?? extension.name,
-        description: extension.description,
-        octicon: extension.octicon,
-        emoji: extension.emoji,
-        // Read back from what was actually registered, not from the
-        // declaration: a plugin that appeared twice is listed once.
-        plugins: orderedPlugins.filter((plugin) => extensionOf.get(plugin.name) === name).map((plugin) => plugin.name)
-      };
-    },
-    getConfig(name) {
-      return state.get(name)?.config;
-    },
-    describeContributions() {
-      return contributions.describe();
-    },
-    listCommands() {
-      return commands.list();
-    },
-    getCommand(id) {
-      return commands.get(id);
-    },
-    executeCommand(id, argument) {
-      return commands.execute(id, argument);
-    },
-    getDependencies(name) {
-      return (state.get(name)?.plugin.dependencies ?? []).map((dep) => asConfigured(dep).plugin.name);
-    },
-    getRevision() {
-      return revision;
-    }
-  };
-}
-
-// ../../node_modules/@datalayer/reactor/lib/core/plugin.js
-function definePlugin(plugin) {
-  return plugin;
-}
-function isLazyPluginRef(ref) {
-  return typeof ref === "object" && ref !== null && typeof ref.load === "function" && typeof ref.name === "string" && !("plugin" in ref);
-}
-function asConfigured(ref) {
-  if ("plugin" in ref) {
-    return ref;
-  }
-  return { plugin: ref, config: {} };
-}
-function mergeWithDefaults(plugin, override) {
-  const defaults = plugin.config ?? {};
-  if (plugin.mergeConfig) {
-    return plugin.mergeConfig(defaults, override);
-  }
-  return shallowMergeConfig(defaults, override);
-}
-
-// ../../node_modules/@datalayer/reactor/lib/core/origins.js
-var ANY_ORIGIN = "*";
-var OriginNotAllowedError = class extends Error {
-  /** The URL that was refused, as it was written. */
-  url;
-  /** The origin it resolved to — which is the thing being refused. */
-  origin;
-  constructor(url, origin, what = "a remote") {
-    super(`Refusing to load ${what} from ${origin}: not an allowed origin. Pass allowedOrigins, or call setAllowedOrigins() from the host, to accept it.`);
-    this.name = "OriginNotAllowedError";
-    this.url = url;
-    this.origin = origin;
-  }
-};
-var LEFTMOST_WILDCARD = /^[a-z][a-z0-9+.-]*:\/\/\*\./i;
-function parseOriginRule(pattern) {
-  const written = pattern.trim();
-  if (written === ANY_ORIGIN) {
-    return { kind: "any" };
-  }
-  try {
-    if (LEFTMOST_WILDCARD.test(written)) {
-      const url = new URL(written.replace("*.", ""));
-      return {
-        kind: "suffix",
-        protocol: url.protocol,
-        suffix: `.${url.hostname}`,
-        port: url.port
-      };
-    }
-    return { kind: "exact", origin: new URL(written).origin };
-  } catch {
-    console.warn(`[reactor] ignoring an unreadable allowed origin: ${JSON.stringify(pattern)}. Write it with a scheme, e.g. https://cdn.example.com or https://*.example.com.`);
-    return void 0;
-  }
-}
-function matches(rule, origin) {
-  if (rule.kind === "any") {
-    return true;
-  }
-  if (rule.kind === "exact") {
-    return rule.origin === origin;
-  }
-  let url;
-  try {
-    url = new URL(origin);
-  } catch {
-    return false;
-  }
-  return url.protocol === rule.protocol && url.port === rule.port && url.hostname.endsWith(rule.suffix);
-}
-var policy = [];
-function resolveOrigin(url) {
-  const base = typeof location !== "undefined" && location?.href ? location.href : void 0;
-  if (base) {
-    return new URL(url, base).origin;
-  }
-  return /^[a-z]+:\/\//i.test(url) ? new URL(url).origin : void 0;
-}
-function pageOrigin() {
-  const href = typeof location !== "undefined" && location?.href ? location.href : void 0;
-  return href ? new URL(href).origin : void 0;
-}
-function isOriginAllowed(url, extra = []) {
-  let origin;
-  try {
-    origin = resolveOrigin(url);
-  } catch {
-    return false;
-  }
-  if (origin === void 0 || origin === pageOrigin()) {
-    return true;
-  }
-  if (origin === "null") {
-    return false;
-  }
-  for (const pattern of [...policy, ...extra]) {
-    const rule = parseOriginRule(pattern);
-    if (rule && matches(rule, origin)) {
-      return true;
-    }
-  }
-  return false;
-}
-function assertOriginAllowed(url, extra = [], what = "a remote") {
-  if (isOriginAllowed(url, extra)) {
-    return;
-  }
-  let origin;
-  try {
-    origin = resolveOrigin(url) ?? url;
-  } catch {
-    throw new OriginNotAllowedError(url, url, what);
-  }
-  throw new OriginNotAllowedError(url, origin, what);
-}
-
-// ../../node_modules/@datalayer/reactor/lib/core/federation.js
-var runtimeOverride;
-var runtimeLoad;
-async function federationRuntime() {
-  if (runtimeOverride) {
-    return runtimeOverride;
-  }
-  if (!runtimeLoad) {
-    const specifier = "@module-federation/runtime";
-    runtimeLoad = import(
-      /* @vite-ignore */
-      /* webpackIgnore: true */
-      specifier
-    ).then((module) => module.default ?? module).catch((error) => {
-      runtimeLoad = void 0;
-      throw new Error(`Loading a Module Federation container needs @module-federation/runtime, which is an optional peer dependency of @datalayer/reactor. Install it, or pass a loader of your own. (${String(error)})`);
-    });
-  }
-  return runtimeLoad;
-}
-var HOST_NAME = "datalayer_reactor_host";
-function sharedFromHost(versions = {}, overrides = {}) {
-  const published = getReactorSharedModules();
-  const shared = {};
-  for (const [name, value] of Object.entries(published)) {
-    const { shareConfig, ...override } = overrides[name] ?? {};
-    shared[name] = {
-      lib: () => value,
-      version: versions[name],
-      ...override,
-      shareConfig: { singleton: true, requiredVersion: false, ...shareConfig }
-    };
-  }
-  return shared;
-}
-var initialised;
-async function initReactorFederation(options = {}) {
-  if (initialised) {
-    return initialised;
-  }
-  const pending = (async () => {
-    const runtime = await federationRuntime();
-    runtime.init({
-      name: options.name ?? HOST_NAME,
-      remotes: options.remotes ?? [],
-      shared: options.shared ?? sharedFromHost(options.versions)
-    });
-    return runtime;
-  })();
-  initialised = pending;
-  pending.catch(() => {
-    if (initialised === pending) {
-      initialised = void 0;
-    }
-  });
-  return pending;
-}
-async function registerFederatedRemote(remote, options = {}) {
-  assertOriginAllowed(remote.entry, options.allowedOrigins, `the container ${remote.name}`);
-  const runtime = await initReactorFederation();
-  runtime.registerRemotes([remote], { force: options.force ?? false });
-}
-function createFederationLoader() {
-  return async (entry, ref) => {
-    const scope = ref?.scope;
-    if (!scope) {
-      throw new Error(`${ref?.name ?? entry}: the federation loader needs a container name \u2014 pass \`scope\` on the remote reference.`);
-    }
-    await registerFederatedRemote({ name: scope, entry, type: ref?.type }, { allowedOrigins: ref?.allowedOrigins });
-    const runtime = await initReactorFederation();
-    const id = `${scope}/${(ref?.module ?? "./plugin").replace(/^\.\//, "")}`;
-    const module = await runtime.loadRemote(id);
-    if (!module) {
-      throw new Error(`${ref?.name ?? scope}: the container at ${entry} exposes no ${id}.`);
-    }
-    return module;
-  };
-}
-var federationLoader = createFederationLoader();
-
-// ../../node_modules/@datalayer/reactor/lib/core/remote.js
-var SHARED_GLOBAL = "__DATALAYER_REACTOR__";
-function getReactorSharedModules() {
-  const target = globalThis;
-  return target[SHARED_GLOBAL]?.shared ?? {};
-}
-
-// ../../node_modules/@datalayer/reactor/lib/core/agentTools.js
-var AgentTools = defineContributionPoint("reactor.agentTools");
-
-// src/reactor.ts
-var DiscoveryTransports = defineContributionPoint(
-  "pap.discoveryTransport"
-);
-var UrlSafetyPolicies = defineContributionPoint(
-  "pap.urlSafetyPolicy"
-);
-var ProtocolProfiles = defineContributionPoint(
-  "pap.protocolProfile"
-);
-var ExtensionHandlers = defineContributionPoint(
-  "pap.extensionHandler"
-);
-var Clocks = defineContributionPoint("pap.clock");
-var RandomSources = defineContributionPoint("pap.randomSource");
-var Signers = defineContributionPoint("pap.signer");
-var KeyStores = defineContributionPoint("pap.keyStore");
-var TokenStores = defineContributionPoint("pap.tokenStore");
-var Caches = defineContributionPoint("pap.cache");
-var BrowserHandoffs = defineContributionPoint(
-  "pap.browserHandoff"
-);
-var DpopProofProviders = defineContributionPoint(
-  "pap.dpopProofProvider"
-);
-var systemClock = { now: () => /* @__PURE__ */ new Date() };
-var systemRandom = {
-  bytes(length) {
-    if (!Number.isInteger(length) || length <= 0) {
-      throw new RangeError("Random byte length must be a positive integer");
-    }
-    if (!globalThis.crypto) {
-      throw new Error("A cryptographically secure random source is required");
-    }
-    return globalThis.crypto.getRandomValues(new Uint8Array(length));
-  }
-};
-function assertObviouslyPublic(url) {
-  if (url.protocol !== "https:" || url.username || url.password) {
-    throw new DiscoveryError("unsafe_url", "Discovery and metadata URLs must use HTTPS");
-  }
-  const host = url.hostname.toLowerCase().replace(/[\[\]]/g, "");
-  if (host === "localhost" || host.endsWith(".localhost") || host === "::1" || /^127\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^169\.254\./.test(host) || /^172\.(1[6-9]|2[0-9]|3[01])\./.test(host)) {
-    throw new DiscoveryError("unsafe_address", "Discovery URL names a private address");
-  }
-}
-function createPapCorePlugin(options = {}) {
-  const fetcher = options.fetch ?? globalThis.fetch;
-  if (!fetcher) {
-    throw new DiscoveryError("fetch_unavailable", "A fetch implementation is required");
-  }
-  return definePlugin({
-    name: "@datalayer/personal-agent-protocol-core",
-    version: "0.3.0",
-    contributionPoints: [
-      DiscoveryTransports,
-      UrlSafetyPolicies,
-      ProtocolProfiles,
-      ExtensionHandlers,
-      Clocks,
-      RandomSources,
-      Signers,
-      KeyStores,
-      TokenStores,
-      Caches,
-      BrowserHandoffs,
-      DpopProofProviders
-    ],
-    contributes: [
-      contribution(
-        DiscoveryTransports,
-        { fetch: (input, init) => fetcher(input, init) },
-        { id: "fetch", order: 100 }
-      ),
-      contribution(
-        UrlSafetyPolicies,
-        {
-          async assertSafe(url) {
-            assertObviouslyPublic(url);
-            await options.assertSafeUrl?.(url);
-          }
-        },
-        { id: "public", order: 100 }
-      ),
-      contribution(ProtocolProfiles, { version: "0.1" }, { id: "0.1", order: 100 }),
-      contribution(Clocks, systemClock, { id: "system", order: 100 }),
-      contribution(RandomSources, systemRandom, { id: "system", order: 100 })
-    ]
-  });
-}
-function buildPapReactor(options = {}, plugins = []) {
-  const reactor = buildReactorFromPlugins([createPapCorePlugin(options), ...plugins]);
-  reactor.start();
-  return reactor;
-}
-function firstContribution(reactor, point, label) {
-  const contributions = reactor.getContributions(point);
-  const selected = contributions[0];
-  if (!selected) {
-    throw new Error(`PAP Reactor has no active ${label} contribution`);
-  }
-  if (contributions[1]?.order === selected.order) {
-    throw new Error(`PAP Reactor has ambiguous ${label} contributions`);
-  }
-  return selected.value;
-}
-
-// src/sessions.ts
-var JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
-var JWT_CLIENT_ASSERTION = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
-var SecretValue = class {
-  #value;
-  constructor(value) {
-    if (!value) {
-      throw new ProtocolValidationError("invalid_secret", "Secret value must not be empty");
-    }
-    this.#value = value;
-  }
-  reveal() {
-    return this.#value;
-  }
-  toString() {
-    return "[REDACTED]";
-  }
-  toJSON() {
-    return "[REDACTED]";
-  }
-};
-function defaultRandomBytes(length) {
-  const cryptoApi = globalThis.crypto;
-  if (!cryptoApi) {
-    throw new Error("A cryptographically secure random source is required");
-  }
-  return cryptoApi.getRandomValues(new Uint8Array(length));
-}
-function base64Url(bytes) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-  let output = "";
-  for (let index = 0; index < bytes.length; index += 3) {
-    const first = bytes[index] ?? 0;
-    const second = bytes[index + 1];
-    const third = bytes[index + 2];
-    output += alphabet[first >>> 2];
-    output += alphabet[(first & 3) << 4 | (second ?? 0) >>> 4];
-    if (second !== void 0) {
-      output += alphabet[(second & 15) << 2 | (third ?? 0) >>> 6];
-    }
-    if (third !== void 0) {
-      output += alphabet[third & 63];
-    }
-  }
-  return output;
-}
-function opaqueId(prefix, randomBytes2) {
-  const bytes = randomBytes2(16);
-  if (bytes.byteLength < 16) {
-    throw new Error("Opaque PAP identifiers require at least 128 random bits");
-  }
-  return `${prefix}_${base64Url(bytes)}`;
-}
-function generatePairwiseUserId(randomBytes2 = defaultRandomBytes) {
-  return opaqueId("usr", randomBytes2);
-}
-function httpsUrl(value, label) {
-  let parsed;
-  try {
-    parsed = new URL(value);
-  } catch (cause) {
-    throw new ProtocolValidationError("invalid_url", `${label} must be an HTTPS URL`, {
-      cause
-    });
-  }
-  if (parsed.protocol !== "https:" || parsed.username || parsed.password) {
-    throw new ProtocolValidationError("invalid_url", `${label} must be an HTTPS URL`);
-  }
-  return value;
-}
-function buildSessionAssertionClaims(options) {
-  const lifetime = options.lifetimeSeconds ?? 60;
-  if (!Number.isInteger(lifetime) || lifetime <= 0) {
-    throw new ProtocolValidationError(
-      "invalid_assertion_lifetime",
-      "Assertion lifetime must be a positive integer"
-    );
-  }
-  if (!/^[A-Za-z0-9_-]{1,256}$/.test(options.pairwiseUserId)) {
-    throw new ProtocolValidationError(
-      "invalid_user_id",
-      "Pairwise user ID must use the URL-safe base64 alphabet"
-    );
-  }
-  const iat = Math.floor((options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
-  return {
-    iss: httpsUrl(options.clientId, "clientId"),
-    sub: options.pairwiseUserId,
-    aud: httpsUrl(options.tokenEndpoint, "tokenEndpoint"),
-    iat,
-    exp: iat + lifetime,
-    jti: opaqueId("jti", options.randomBytes ?? defaultRandomBytes)
-  };
-}
-var SessionGrant = class {
-  assertion;
-  clientId;
-  clientAssertion;
-  sessionId;
-  constructor(options) {
-    this.assertion = new SecretValue(options.assertion);
-    this.clientId = httpsUrl(options.clientId, "clientId");
-    this.clientAssertion = new SecretValue(options.clientAssertion);
-    if (options.sessionId !== void 0 && !/^[A-Za-z0-9_-]{1,256}$/.test(options.sessionId)) {
-      throw new ProtocolValidationError("invalid_session_id", "Invalid PAP session ID");
-    }
-    this.sessionId = options.sessionId;
-  }
-  toForm() {
-    const form = new URLSearchParams({
-      grant_type: JWT_BEARER_GRANT,
-      assertion: this.assertion.reveal(),
-      client_id: this.clientId,
-      client_assertion_type: JWT_CLIENT_ASSERTION,
-      client_assertion: this.clientAssertion.reveal()
-    });
-    if (this.sessionId !== void 0) {
-      form.set("session_id", this.sessionId);
-    }
-    return form;
-  }
-  toJSON() {
-    return {
-      grant_type: JWT_BEARER_GRANT,
-      assertion: this.assertion,
-      client_id: this.clientId,
-      client_assertion_type: JWT_CLIENT_ASSERTION,
-      client_assertion: this.clientAssertion,
-      ...this.sessionId === void 0 ? {} : { session_id: this.sessionId }
-    };
-  }
-};
-function object(value, label) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new ProtocolValidationError("invalid_type", `${label} must be an object`);
-  }
-  return value;
-}
-function nonEmptyString(value, label) {
-  if (typeof value !== "string" || !value) {
-    throw new ProtocolValidationError("invalid_type", `${label} must be a string`);
-  }
-  return value;
-}
-function parseSessionToken(value) {
-  const source = object(value, "session token response");
-  const tokenType = nonEmptyString(source.token_type, "token_type");
-  if (tokenType !== "DPoP" && tokenType !== "Bearer") {
-    throw new ProtocolValidationError("invalid_token_type", "Unsupported token_type");
-  }
-  const expiresIn = source.expires_in;
-  if (!Number.isInteger(expiresIn) || expiresIn <= 0) {
-    throw new ProtocolValidationError("invalid_expiry", "expires_in must be positive");
-  }
-  const sessionId = nonEmptyString(source.session_id, "session_id");
-  if (!/^[A-Za-z0-9_-]{1,256}$/.test(sessionId)) {
-    throw new ProtocolValidationError("invalid_session_id", "Invalid PAP session ID");
-  }
-  if (typeof source.signed_in !== "boolean") {
-    throw new ProtocolValidationError("invalid_type", "signed_in must be boolean");
-  }
-  if (source.scope !== void 0 && typeof source.scope !== "string") {
-    throw new ProtocolValidationError("invalid_type", "scope must be a string");
-  }
-  const scope = source.scope ?? "";
-  return {
-    accessToken: new SecretValue(nonEmptyString(source.access_token, "access_token")),
-    tokenType,
-    expiresIn,
-    scopes: scope.split(" ").filter(Boolean),
-    sessionId,
-    signedIn: source.signed_in,
-    ...source.refresh_token === void 0 ? {} : {
-      accountToken: new SecretValue(
-        nonEmptyString(source.refresh_token, "refresh_token")
-      )
-    }
-  };
-}
-var SessionClient = class {
-  #reactor;
-  #fetch;
-  #maxResponseBytes;
-  constructor(options) {
-    const fetcher = options.fetch ?? globalThis.fetch;
-    if (!fetcher) throw new SessionError("fetch_unavailable", "A fetch implementation is required");
-    const maxResponseBytes = options.maxResponseBytes ?? 100 * 1024;
-    if (!Number.isInteger(maxResponseBytes) || maxResponseBytes <= 0) {
-      throw new RangeError("maxResponseBytes must be a positive integer");
-    }
-    this.#reactor = options.reactor;
-    this.#fetch = fetcher;
-    this.#maxResponseBytes = maxResponseBytes;
-  }
-  start(options) {
-    return this.#request(options);
-  }
-  renew(options) {
-    return this.#request(options, options.sessionId);
-  }
-  async #request(options, sessionId) {
-    const clock = firstContribution(this.#reactor, Clocks, "clock");
-    const random = firstContribution(this.#reactor, RandomSources, "random source");
-    const signer = firstContribution(this.#reactor, Signers, "signer");
-    const dpop = firstContribution(
-      this.#reactor,
-      DpopProofProviders,
-      "DPoP proof provider"
-    );
-    let nonce;
-    for (let attempt = 0; attempt < 2; attempt += 1) {
-      const now = clock.now();
-      const sessionClaims = buildSessionAssertionClaims({
-        clientId: options.clientId,
-        pairwiseUserId: options.pairwiseUserId,
-        tokenEndpoint: options.tokenEndpoint,
-        now,
-        randomBytes: (length) => random.bytes(length)
-      });
-      const iat = Math.floor(now.getTime() / 1e3);
-      const clientId = httpsUrl(options.clientId, "clientId");
-      const tokenEndpoint = httpsUrl(options.tokenEndpoint, "tokenEndpoint");
-      const issuer = httpsUrl(options.issuer, "issuer");
-      const clientClaims = {
-        iss: clientId,
-        sub: clientId,
-        aud: tokenEndpoint,
-        iat,
-        exp: iat + 60,
-        jti: opaqueId("jti", (length) => random.bytes(length))
-      };
-      const assertion = await signer.sign({ ...sessionClaims }, {
-        purpose: "session_assertion"
-      });
-      const clientAssertion = await signer.sign(clientClaims, {
-        purpose: "client_assertion"
-      });
-      const proof = await dpop.create({
-        method: "POST",
-        url: tokenEndpoint,
-        tenantId: options.tenantId,
-        subject: options.pairwiseUserId,
-        issuer,
-        ...nonce === void 0 ? {} : { nonce }
-      });
-      const grant = new SessionGrant({
-        assertion: assertion.reveal(),
-        clientId,
-        clientAssertion: clientAssertion.reveal(),
-        ...sessionId === void 0 ? {} : { sessionId }
-      });
-      let response;
-      try {
-        response = await this.#fetch(tokenEndpoint, {
-          method: "POST",
-          headers: { Accept: "application/json", DPoP: proof.reveal() },
-          body: grant.toForm(),
-          credentials: "omit",
-          redirect: "error",
-          ...options.signal === void 0 ? {} : { signal: options.signal }
-        });
-      } catch (cause) {
-        throw new SessionError("request_failed", "Session token request failed", { cause });
-      }
-      const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim();
-      if (contentType !== "application/json") {
-        throw new SessionError(
-          "invalid_content_type",
-          "Session token endpoint must return JSON",
-          { statusCode: response.status }
-        );
-      }
-      const body = await response.text();
-      if (new TextEncoder().encode(body).byteLength > this.#maxResponseBytes) {
-        throw new SessionError(
-          "response_too_large",
-          "Session token response exceeds size limit",
-          { statusCode: response.status }
-        );
-      }
-      let payload;
-      try {
-        payload = parseJsonStrict(body);
-      } catch (cause) {
-        throw new SessionError("invalid_json", "Session token endpoint returned invalid JSON", {
-          statusCode: response.status,
-          cause
-        });
-      }
-      if (response.ok) {
-        let token;
-        try {
-          token = parseSessionToken(payload);
-        } catch (cause) {
-          throw new SessionError(
-            "invalid_token_response",
-            "Session token response is malformed",
-            { statusCode: response.status, cause }
-          );
-        }
-        if (token.tokenType !== "DPoP") {
-          throw new SessionError(
-            "unexpected_token_type",
-            "A proof-bound session request must return a DPoP token",
-            { statusCode: response.status }
-          );
-        }
-        return token;
-      }
-      const source = typeof payload === "object" && payload !== null ? payload : {};
-      const remoteCode = "error" in source ? source.error : void 0;
-      const code = typeof remoteCode === "string" ? remoteCode : "http_error";
-      if (code === "use_dpop_nonce" && attempt === 0) {
-        nonce = response.headers.get("dpop-nonce") ?? void 0;
-        if (!nonce) {
-          throw new SessionError(
-            "missing_dpop_nonce",
-            "Company requested a DPoP nonce but did not send one",
-            { statusCode: response.status }
-          );
-        }
-        continue;
-      }
-      const retryAfter = response.headers.get("retry-after");
-      throw new SessionError(code, "Company refused the session token request", {
-        statusCode: response.status,
-        ...retryAfter === null ? {} : { details: { retryAfter } }
-      });
-    }
-    throw new SessionError("use_dpop_nonce", "Company rejected the refreshed DPoP proof");
-  }
-};
-
-// src/crypto.ts
-var privateJwkMembers = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth", "k"]);
-function algorithm(value) {
-  if (value !== "ES256" && value !== "RS256") {
-    throw new TypeError("PAP JOSE algorithms must be ES256 or RS256");
-  }
-  return value;
-}
-function publicJwk(value, alg) {
-  for (const member of privateJwkMembers) {
-    if (member in value) {
-      throw new TypeError("DPoP public JWK must not contain private key material");
-    }
-  }
-  const expected = alg === "ES256" ? "EC" : "RSA";
-  if (value.kty !== expected) throw new TypeError(`${alg} requires a ${expected} public JWK`);
-  if (alg === "ES256") {
-    if (value.crv !== "P-256" || !value.x || !value.y) {
-      throw new TypeError("ES256 requires a complete P-256 public JWK");
-    }
-  } else if (!value.n || !value.e) {
-    throw new TypeError("RS256 requires a complete RSA public JWK");
-  }
-  return { ...value };
-}
-function normalizedHtu(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch (cause) {
-    throw new ProofError("invalid_htu", "DPoP target must be an HTTPS URL", { cause });
-  }
-  if (url.protocol !== "https:" || url.username || url.password) {
-    throw new ProofError("invalid_htu", "DPoP target must be an HTTPS URL");
-  }
-  url.search = "";
-  url.hash = "";
-  return url.href;
-}
-function base64Url2(bytes) {
-  let binary = "";
-  for (const value of bytes) binary += String.fromCharCode(value);
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
-}
-function randomBytes(length) {
-  if (!globalThis.crypto) throw new ProofError("crypto_unavailable", "Web Crypto is required");
-  return globalThis.crypto.getRandomValues(new Uint8Array(length));
-}
-async function accessTokenHash(token) {
-  if (!globalThis.crypto) throw new ProofError("crypto_unavailable", "Web Crypto is required");
-  const digest2 = await globalThis.crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(token.reveal())
-  );
-  return base64Url2(new Uint8Array(digest2));
-}
-var JoseSigner = class {
-  #privateKey;
-  #algorithm;
-  #keyId;
-  constructor(options) {
-    this.#privateKey = options.privateKey;
-    this.#algorithm = algorithm(options.algorithm ?? "ES256");
-    this.#keyId = options.keyId;
-  }
-  async sign(claims, _options) {
-    try {
-      const token = await new SignJWT(claims).setProtectedHeader({
-        alg: this.#algorithm,
-        typ: "JWT",
-        ...this.#keyId === void 0 ? {} : { kid: this.#keyId }
-      }).sign(this.#privateKey);
-      return new SecretValue(token);
-    } catch (cause) {
-      throw new ProofError("signing_failed", "Could not sign PAP assertion", { cause });
-    }
-  }
-};
-var JoseDpopProofProvider = class {
-  #resolveKey;
-  #now;
-  #randomBytes;
-  constructor(options) {
-    this.#resolveKey = options.resolveKey;
-    this.#now = options.now ?? (() => /* @__PURE__ */ new Date());
-    this.#randomBytes = options.randomBytes ?? randomBytes;
-  }
-  async create(request) {
-    const material = await this.#resolveKey(request);
-    const alg = algorithm(material.algorithm ?? "ES256");
-    const jwk = publicJwk(material.publicJwk, alg);
-    const entropy2 = this.#randomBytes(16);
-    if (entropy2.byteLength < 16) {
-      throw new ProofError("weak_randomness", "DPoP proof IDs require 128 random bits");
-    }
-    const claims = {
-      jti: base64Url2(entropy2),
-      htm: request.method.toUpperCase(),
-      htu: normalizedHtu(request.url),
-      iat: Math.floor(this.#now().getTime() / 1e3),
-      ...request.nonce === void 0 ? {} : { nonce: request.nonce },
-      ...request.accessToken === void 0 ? {} : { ath: await accessTokenHash(request.accessToken) }
-    };
-    try {
-      const token = await new SignJWT(claims).setProtectedHeader({ typ: "dpop+jwt", alg, jwk }).sign(material.privateKey);
-      return new SecretValue(token);
-    } catch (cause) {
-      throw new ProofError("signing_failed", "Could not sign DPoP proof", { cause });
-    }
-  }
-};
-async function verifyDpopProof(proof, options) {
-  const compact = proof instanceof SecretValue ? proof.reveal() : proof;
-  const now = options.now ?? /* @__PURE__ */ new Date();
-  const windowSeconds = options.acceptanceWindowSeconds ?? 60;
-  if (!Number.isInteger(windowSeconds) || windowSeconds <= 0) {
-    throw new RangeError("acceptanceWindowSeconds must be a positive integer");
-  }
-  let jwk;
-  let payload;
-  try {
-    const header = decodeProtectedHeader(compact);
-    const alg = algorithm(header.alg ?? "");
-    if (header.typ !== "dpop+jwt" || typeof header.jwk !== "object") {
-      throw new ProofError("invalid_dpop_proof", "DPoP protected header is invalid");
-    }
-    jwk = publicJwk(header.jwk, alg);
-    const key = await importJWK(jwk, alg);
-    ({ payload } = await jwtVerify(compact, key, {
-      algorithms: [alg],
-      typ: "dpop+jwt",
-      requiredClaims: ["jti", "htm", "htu", "iat"]
-    }));
-  } catch (cause) {
-    if (cause instanceof ProofError) throw cause;
-    throw new ProofError("invalid_dpop_proof", "DPoP signature or claims are invalid", {
-      cause
-    });
-  }
-  if (typeof payload.jti !== "string" || !payload.jti || typeof payload.iat !== "number") {
-    throw new ProofError("invalid_dpop_proof", "DPoP proof identity is invalid");
-  }
-  const issuedAt = new Date(payload.iat * 1e3);
-  const difference = Math.abs(now.getTime() - issuedAt.getTime());
-  if (difference > windowSeconds * 1e3) {
-    throw new ProofError("invalid_dpop_proof", "DPoP proof is outside the acceptance window");
-  }
-  if (payload.htm !== options.method.toUpperCase() || payload.htu !== normalizedHtu(options.url)) {
-    throw new ProofError("invalid_dpop_proof", "DPoP proof does not match the request");
-  }
-  if (options.nonce !== void 0 && payload.nonce !== options.nonce) {
-    throw new ProofError("use_dpop_nonce", "DPoP proof nonce is missing or invalid");
-  }
-  if (options.accessToken !== void 0) {
-    if (payload.ath !== await accessTokenHash(options.accessToken)) {
-      throw new ProofError("invalid_dpop_proof", "DPoP access-token hash is invalid");
-    }
-  } else if (payload.ath !== void 0) {
-    throw new ProofError(
-      "invalid_dpop_proof",
-      "Token-endpoint DPoP proof must not contain ath"
-    );
-  }
-  const keyThumbprint = await calculateJwkThumbprint(jwk);
-  if (!await options.replayCache.markOnce(`${keyThumbprint}:${payload.jti}`, {
-    expiresAt: new Date(now.getTime() + windowSeconds * 1e3)
-  })) {
-    throw new ProofError("invalid_dpop_proof", "DPoP proof has already been used");
-  }
-  return { jti: payload.jti, issuedAt, publicJwk: jwk, keyThumbprint };
-}
-
-// src/auth.ts
-function defaultRandomBytes2(length) {
-  if (!globalThis.crypto) {
-    throw new AuthorizationError("crypto_unavailable", "Web Crypto is required");
-  }
-  return globalThis.crypto.getRandomValues(new Uint8Array(length));
-}
-function entropy(length, randomBytes2) {
-  const value = randomBytes2(length);
-  if (value.byteLength < length) {
-    throw new AuthorizationError(
-      "weak_entropy",
-      `Authorization requires ${length * 8} random bits`
-    );
-  }
-  return value;
-}
-function base64Url3(bytes) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-  let output = "";
-  for (let index = 0; index < bytes.length; index += 3) {
-    const first = bytes[index] ?? 0;
-    const second = bytes[index + 1];
-    const third = bytes[index + 2];
-    output += alphabet[first >>> 2];
-    output += alphabet[(first & 3) << 4 | (second ?? 0) >>> 4];
-    if (second !== void 0) {
-      output += alphabet[(second & 15) << 2 | (third ?? 0) >>> 6];
-    }
-    if (third !== void 0) {
-      output += alphabet[third & 63];
-    }
-  }
-  return output;
-}
-function httpsUrl2(value, label) {
-  let parsed;
-  try {
-    parsed = new URL(value);
-  } catch (cause) {
-    throw new AuthorizationError("invalid_url", `${label} must be an HTTPS URL`, { cause });
-  }
-  if (parsed.protocol !== "https:" || parsed.username || parsed.password) {
-    throw new AuthorizationError("invalid_url", `${label} must be an HTTPS URL`);
-  }
-  return parsed;
-}
-function validScopes(values) {
-  const scopes2 = [...new Set(values)];
-  const token = /^[\x21\x23-\x5b\x5d-\x7e]+$/;
-  if (scopes2.length === 0 || scopes2.some((scope) => !token.test(scope))) {
-    throw new AuthorizationError("invalid_scope", "At least one valid OAuth scope is required");
-  }
-  return scopes2;
-}
-async function buildDirectSignInRequest(options) {
-  const randomBytes2 = options.randomBytes ?? defaultRandomBytes2;
-  const state = base64Url3(entropy(16, randomBytes2));
-  const verifier = base64Url3(entropy(32, randomBytes2));
-  const challenge = base64Url3(
-    new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)))
-  );
-  const endpoint = httpsUrl2(options.authorizationEndpoint, "authorizationEndpoint");
-  const scopes2 = validScopes(options.scopes);
-  const clientId = httpsUrl2(options.clientId, "clientId").toString();
-  const redirectUri = httpsUrl2(options.redirectUri, "redirectUri").toString();
-  const issuer = httpsUrl2(options.issuer, "issuer").toString().replace(/\/$/, "");
-  endpoint.searchParams.set("response_type", "code");
-  endpoint.searchParams.set("client_id", clientId);
-  endpoint.searchParams.set("redirect_uri", redirectUri);
-  endpoint.searchParams.set("scope", scopes2.join(" "));
-  endpoint.searchParams.set("state", state);
-  endpoint.searchParams.set("code_challenge", challenge);
-  endpoint.searchParams.set("code_challenge_method", "S256");
-  endpoint.hash = "";
-  return {
-    authorizationUrl: new SecretValue(endpoint.toString()),
-    issuer,
-    clientId,
-    redirectUri,
-    scopes: scopes2,
-    state: new SecretValue(state),
-    codeVerifier: new SecretValue(verifier)
-  };
-}
-function equalConstantTime(left, right) {
-  let difference = left.length ^ right.length;
-  const length = Math.max(left.length, right.length);
-  for (let index = 0; index < length; index += 1) {
-    difference |= (left.charCodeAt(index) || 0) ^ (right.charCodeAt(index) || 0);
-  }
-  return difference === 0;
-}
-function validateDirectSignInCallback(request, callbackUrl) {
-  const expected = httpsUrl2(request.redirectUri, "redirectUri");
-  const callback = httpsUrl2(callbackUrl, "callbackUrl");
-  if (callback.hash) {
-    throw new AuthorizationError("invalid_callback", "Authorization callback has a fragment");
-  }
-  if (callback.origin !== expected.origin || callback.pathname !== expected.pathname) {
-    throw new AuthorizationError("redirect_mismatch", "Callback does not match redirect URI");
-  }
-  for (const [key, value] of expected.searchParams) {
-    if (callback.searchParams.get(key) !== value) {
-      throw new AuthorizationError(
-        "redirect_mismatch",
-        "Callback changed redirect URI parameters"
-      );
-    }
-  }
-  for (const key of ["code", "state", "iss", "error"]) {
-    if (callback.searchParams.getAll(key).length > 1) {
-      throw new AuthorizationError(
-        "invalid_callback",
-        "Authorization callback repeats a security parameter"
-      );
-    }
-  }
-  if (callback.searchParams.has("error")) {
-    throw new AuthorizationError("authorization_denied", "Company did not authorize the request");
-  }
-  if (!equalConstantTime(callback.searchParams.get("state") ?? "", request.state.reveal())) {
-    throw new AuthorizationError("state_mismatch", "Authorization state does not match");
-  }
-  if (callback.searchParams.get("iss") !== request.issuer) {
-    throw new AuthorizationError("issuer_mismatch", "Authorization issuer does not match");
-  }
-  const code = callback.searchParams.get("code");
-  if (!code) {
-    throw new AuthorizationError("invalid_callback", "Authorization callback has no code");
-  }
-  return { code: new SecretValue(code), issuer: request.issuer };
-}
-var AuthorizationCodeGrant = class {
-  code;
-  redirectUri;
-  codeVerifier;
-  sessionId;
-  clientId;
-  clientAssertion;
-  constructor(options) {
-    this.code = new SecretValue(options.code);
-    this.redirectUri = httpsUrl2(options.redirectUri, "redirectUri").toString();
-    this.codeVerifier = new SecretValue(options.codeVerifier);
-    if (!/^[A-Za-z0-9_-]{1,256}$/.test(options.sessionId)) {
-      throw new AuthorizationError("invalid_session_id", "Invalid PAP session ID");
-    }
-    this.sessionId = options.sessionId;
-    this.clientId = httpsUrl2(options.clientId, "clientId").toString();
-    this.clientAssertion = new SecretValue(options.clientAssertion);
-  }
-  toForm() {
-    return new URLSearchParams({
-      grant_type: "authorization_code",
-      code: this.code.reveal(),
-      redirect_uri: this.redirectUri,
-      code_verifier: this.codeVerifier.reveal(),
-      session_id: this.sessionId,
-      client_id: this.clientId,
-      client_assertion_type: JWT_CLIENT_ASSERTION,
-      client_assertion: this.clientAssertion.reveal()
-    });
-  }
-  toJSON() {
-    return {
-      grant_type: "authorization_code",
-      code: this.code,
-      redirect_uri: this.redirectUri,
-      code_verifier: this.codeVerifier,
-      session_id: this.sessionId,
-      client_id: this.clientId,
-      client_assertion_type: JWT_CLIENT_ASSERTION,
-      client_assertion: this.clientAssertion
-    };
-  }
-};
-
-// src/models.ts
-function record(value, label) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new ProtocolValidationError("invalid_type", `${label} must be an object`);
-  }
-  return value;
-}
-function string(value, label) {
-  if (typeof value !== "string" || value.length === 0) {
-    throw new ProtocolValidationError("invalid_type", `${label} must be a non-empty string`);
-  }
-  return value;
-}
-function array(value, label) {
-  if (!Array.isArray(value)) {
-    throw new ProtocolValidationError("invalid_type", `${label} must be an array`);
-  }
-  return value;
-}
-function boolean(value, label) {
-  if (typeof value !== "boolean") {
-    throw new ProtocolValidationError("invalid_type", `${label} must be a boolean`);
-  }
-  return value;
-}
-function integer(value, label, minimum = 1) {
-  if (!Number.isInteger(value) || value < minimum) {
-    throw new ProtocolValidationError(
-      "invalid_type",
-      `${label} must be an integer greater than or equal to ${minimum}`
-    );
-  }
-  return value;
-}
-function identifier(value, label) {
-  const result = string(value, label);
-  if (!/^[A-Za-z0-9_-]{1,256}$/.test(result)) {
-    throw new ProtocolValidationError(
-      "invalid_identifier",
-      `${label} must use the URL-safe base64 alphabet`
-    );
-  }
-  return result;
-}
-function timestamp(value, label) {
-  const result = string(value, label);
-  if (!/(?:Z|[+-][0-9]{2}:[0-9]{2})$/u.test(result) || Number.isNaN(Date.parse(result))) {
-    throw new ProtocolValidationError(
-      "invalid_timestamp",
-      `${label} must be an RFC 3339 timestamp with a timezone`
-    );
-  }
-  return result;
-}
-function oneOf(value, values, label) {
-  if (typeof value !== "string" || !values.includes(value)) {
-    throw new ProtocolValidationError(
-      "invalid_value",
-      `${label} must be one of ${values.join(", ")}`
-    );
-  }
-  return value;
-}
-function optionalRecord(value, label) {
-  return value === void 0 ? void 0 : record(value, label);
-}
-function extensions(value, label) {
-  const source = record(value ?? {}, label);
-  return Object.fromEntries(
-    Object.entries(source).map(([name, item]) => {
-      const extension = record(item, `${label}.${name}`);
-      const version = string(extension.version, `${label}.${name}.version`);
-      if (!/^(0|[1-9][0-9]*)$/.test(version)) {
-        throw new ProtocolValidationError(
-          "invalid_extension_version",
-          `${label}.${name}.version must be a major version`
-        );
-      }
-      return [name, { ...extension, version }];
-    })
-  );
-}
-function httpsUrl3(value, label) {
-  const result = string(value, label);
-  let parsed;
-  try {
-    parsed = new URL(result);
-  } catch (cause) {
-    throw new ProtocolValidationError("invalid_url", `${label} must be an HTTPS URL`, {
-      cause
-    });
-  }
-  if (parsed.protocol !== "https:" || parsed.username || parsed.password) {
-    throw new ProtocolValidationError(
-      "invalid_url",
-      `${label} must be an HTTPS URL without user information`
-    );
-  }
-  return result;
-}
-function domain(value, label) {
-  const result = string(value, label).replace(/\.$/, "").toLowerCase();
-  if (!/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(
-    result
-  )) {
-    throw new ProtocolValidationError("invalid_domain", `${label} must be a DNS domain`);
-  }
-  return result;
-}
-function scopes(value, label) {
-  const source = record(value, label);
-  return {
-    ...source,
-    scopes: array(source.scopes ?? [], `${label}.scopes`).map((item) => string(item, "scope"))
-  };
-}
-function stringMap(value, label) {
-  const source = record(value, label);
-  return Object.fromEntries(
-    Object.entries(source).map(([key, item]) => [key, string(item, `${label}.${key}`)])
-  );
-}
-function parseDiscoveryDocument(value) {
-  const source = record(value, "poppy.json");
-  const version = string(source.protocol_version, "protocol_version");
-  const versionMatch = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/.exec(version);
-  if (!versionMatch || versionMatch[1] !== "0") {
-    throw new ProtocolValidationError(
-      "unsupported_protocol_version",
-      "protocol_version must be a supported major.minor version"
-    );
-  }
-  const organizationSource = record(source.organization, "organization");
-  const organization = {
-    ...organizationSource,
-    name: string(organizationSource.name, "organization.name"),
-    domain: domain(organizationSource.domain, "organization.domain")
-  };
-  let auth;
-  if (source.auth !== void 0) {
-    const authSource = record(source.auth, "auth");
-    let mediated;
-    if (authSource.mediated !== void 0) {
-      const mediatedSource = record(authSource.mediated, "auth.mediated");
-      const fields = array(mediatedSource.fields, "auth.mediated.fields").map(
-        (item, index) => {
-          const field = record(item, `auth.mediated.fields[${index}]`);
-          return {
-            ...field,
-            name: string(field.name, `auth.mediated.fields[${index}].name`),
-            label: string(field.label, `auth.mediated.fields[${index}].label`),
-            secret: boolean(field.secret, `auth.mediated.fields[${index}].secret`)
-          };
-        }
-      );
-      if (fields.length === 0) {
-        throw new ProtocolValidationError(
-          "invalid_mediated_sign_in",
-          "auth.mediated.fields must not be empty"
-        );
-      }
-      mediated = {
-        ...mediatedSource,
-        ...scopes(mediatedSource, "auth.mediated"),
-        endpoint: httpsUrl3(mediatedSource.endpoint, "auth.mediated.endpoint"),
-        fields
-      };
-    }
-    auth = {
-      ...authSource,
-      issuer: httpsUrl3(authSource.issuer, "auth.issuer").replace(/\/$/, ""),
-      ...authSource.direct === void 0 ? {} : { direct: scopes(authSource.direct, "auth.direct") },
-      ...authSource.device === void 0 ? {} : { device: scopes(authSource.device, "auth.device") },
-      ...mediated === void 0 ? {} : { mediated },
-      ...authSource.custom_scopes === void 0 ? {} : {
-        custom_scopes: stringMap(authSource.custom_scopes, "auth.custom_scopes")
-      }
-    };
-  }
-  const apis = array(source.apis ?? [], "apis").map((item, index) => {
-    const api = record(item, `apis[${index}]`);
-    return {
-      ...api,
-      type: string(api.type, `apis[${index}].type`),
-      url: httpsUrl3(api.url, `apis[${index}].url`),
-      description: string(api.description, `apis[${index}].description`),
-      ...api.resource === void 0 ? {} : { resource: httpsUrl3(api.resource, `apis[${index}].resource`) }
-    };
-  });
-  let agent;
-  if (source.agent !== void 0) {
-    const agentSource = record(source.agent, "agent");
-    const protocols = array(agentSource.protocols, "agent.protocols").map((item, index) => {
-      const protocol = record(item, `agent.protocols[${index}]`);
-      return {
-        ...protocol,
-        type: string(protocol.type, `agent.protocols[${index}].type`),
-        endpoint: httpsUrl3(protocol.endpoint, `agent.protocols[${index}].endpoint`),
-        ...protocol.resource === void 0 ? {} : {
-          resource: httpsUrl3(
-            protocol.resource,
-            `agent.protocols[${index}].resource`
-          )
-        }
-      };
-    });
-    if (protocols.length === 0) {
-      throw new ProtocolValidationError(
-        "invalid_agent",
-        "agent.protocols must not be empty"
-      );
-    }
-    agent = { ...agentSource, protocols };
-  }
-  let web;
-  if (source.web !== void 0) {
-    const webSource = record(source.web, "web");
-    web = {
-      ...webSource,
-      ...webSource.browser_session_endpoint === void 0 ? {} : {
-        browser_session_endpoint: httpsUrl3(
-          webSource.browser_session_endpoint,
-          "web.browser_session_endpoint"
-        )
-      }
-    };
-  }
-  if (!agent && apis.length === 0 && !web) {
-    throw new ProtocolValidationError(
-      "missing_interface",
-      "one of agent, apis, or web is required"
-    );
-  }
-  if ((agent || apis.length > 0 || web?.browser_session_endpoint) && !auth) {
-    throw new ProtocolValidationError(
-      "missing_auth",
-      "auth is required for sessions, APIs, or conversations"
-    );
-  }
-  const parsedExtensions = extensions(source.extensions, "extensions");
-  return {
-    ...source,
-    protocol_version: version,
-    organization,
-    ...auth ? { auth } : {},
-    ...agent ? { agent } : {},
-    ...web ? { web } : {},
-    apis,
-    extensions: parsedExtensions
-  };
-}
-function parseOAuthServerMetadata(value) {
-  const source = record(value, "OAuth metadata");
-  const poppyDomains = array(source.poppy_domains, "poppy_domains").map(
-    (item) => domain(item, "poppy_domains entry")
-  );
-  if (poppyDomains.length === 0) {
-    throw new ProtocolValidationError(
-      "invalid_oauth_metadata",
-      "poppy_domains must not be empty"
-    );
-  }
-  return {
-    ...source,
-    issuer: httpsUrl3(source.issuer, "issuer").replace(/\/$/, ""),
-    token_endpoint: httpsUrl3(source.token_endpoint, "token_endpoint"),
-    revocation_endpoint: httpsUrl3(source.revocation_endpoint, "revocation_endpoint"),
-    ...source.authorization_endpoint === void 0 ? {} : {
-      authorization_endpoint: httpsUrl3(
-        source.authorization_endpoint,
-        "authorization_endpoint"
-      )
-    },
-    ...source.device_authorization_endpoint === void 0 ? {} : {
-      device_authorization_endpoint: httpsUrl3(
-        source.device_authorization_endpoint,
-        "device_authorization_endpoint"
-      )
-    },
-    poppy_domains: poppyDomains
-  };
-}
-function parseClientMetadata(value) {
-  const source = record(value, "client metadata");
-  const clientId = httpsUrl3(source.client_id, "client_id");
-  const clientDomain = new URL(clientId).hostname;
-  const jwksUri = httpsUrl3(source.jwks_uri, "jwks_uri");
-  const redirectUris = array(source.redirect_uris ?? [], "redirect_uris").map(
-    (item) => httpsUrl3(item, "redirect URI")
-  );
-  if (new URL(jwksUri).hostname !== clientDomain || redirectUris.some((uri) => new URL(uri).hostname !== clientDomain)) {
-    throw new ProtocolValidationError(
-      "client_domain_mismatch",
-      "jwks_uri and redirect_uris must use the client_id domain"
-    );
-  }
-  const authMethod = source.token_endpoint_auth_method ?? "private_key_jwt";
-  if (authMethod !== "private_key_jwt") {
-    throw new ProtocolValidationError(
-      "invalid_client_auth_method",
-      "token_endpoint_auth_method must be private_key_jwt"
-    );
-  }
-  return {
-    ...source,
-    client_id: clientId,
-    client_name: string(source.client_name, "client_name"),
-    ...source.logo_uri === void 0 ? {} : { logo_uri: httpsUrl3(source.logo_uri, "logo_uri") },
-    jwks_uri: jwksUri,
-    redirect_uris: redirectUris,
-    token_endpoint_auth_method: authMethod,
-    extensions: extensions(source.extensions, "extensions")
-  };
-}
-function parseOperation(value) {
-  const source = record(value, "operation");
-  const state = oneOf(
-    source.state,
-    ["proposed", "in_progress", "succeeded", "failed", "cancelled", "expired"],
-    "operation.state"
-  );
-  const revision = integer(source.revision, "operation.revision");
-  let confirmation = null;
-  if (source.confirmation !== void 0 && source.confirmation !== null) {
-    const item = record(source.confirmation, "operation.confirmation");
-    confirmation = {
-      ...item,
-      revision: integer(item.revision, "operation.confirmation.revision"),
-      approved_by: oneOf(
-        item.approved_by,
-        ["user", "standing_permission"],
-        "operation.confirmation.approved_by"
-      ),
-      confirmed_at: timestamp(item.confirmed_at, "operation.confirmation.confirmed_at")
-    };
-  }
-  let result = null;
-  if (source.result !== void 0 && source.result !== null) {
-    const item = record(source.result, "operation.result");
-    result = {
-      ...item,
-      summary: string(item.summary, "operation.result.summary"),
-      ...item.data === void 0 ? {} : { data: record(item.data, "operation.result.data") }
-    };
-  }
-  const expiresAt = source.expires_at === void 0 ? void 0 : timestamp(source.expires_at, "operation.expires_at");
-  if (state === "proposed" && expiresAt === void 0) {
-    throw new ProtocolValidationError(
-      "invalid_operation",
-      "a proposed operation requires expires_at"
-    );
-  }
-  if (state === "proposed" && confirmation !== null) {
-    throw new ProtocolValidationError(
-      "invalid_operation",
-      "a proposed operation cannot be confirmed"
-    );
-  }
-  if (confirmation !== null && confirmation.revision !== revision) {
-    throw new ProtocolValidationError(
-      "invalid_operation",
-      "confirmation must name the current revision"
-    );
-  }
-  if (["succeeded", "failed", "cancelled", "expired"].includes(state) && result === null) {
-    throw new ProtocolValidationError(
-      "invalid_operation",
-      "a final operation requires a result"
-    );
-  }
-  return {
-    ...source,
-    operation_id: identifier(source.operation_id, "operation.operation_id"),
-    revision,
-    state,
-    summary: string(source.summary, "operation.summary"),
-    ...source.terms === void 0 ? {} : { terms: record(source.terms, "operation.terms") },
-    ...expiresAt === void 0 ? {} : { expires_at: expiresAt },
-    user_approval_required: source.user_approval_required === void 0 ? false : boolean(source.user_approval_required, "operation.user_approval_required"),
-    ...source.url === void 0 ? {} : { url: httpsUrl3(source.url, "operation.url") },
-    confirmation,
-    result
-  };
-}
-function parseMessage(value) {
-  const source = record(value, "message");
-  const text = source.text === void 0 ? void 0 : string(source.text, "message.text");
-  const data = optionalRecord(source.data, "message.data");
-  const context = optionalRecord(source.context, "message.context");
-  const operation = source.operation === void 0 ? void 0 : parseOperation(source.operation);
-  if (text === void 0 && data === void 0 && context === void 0 && operation === void 0) {
-    throw new ProtocolValidationError(
-      "invalid_message",
-      "a message requires text, data, context, or operation"
-    );
-  }
-  return {
-    ...source,
-    id: identifier(source.id, "message.id"),
-    sender: oneOf(source.sender, ["agent", "human"], "message.sender"),
-    ...source.role === void 0 ? {} : { role: oneOf(source.role, ["user", "company"], "message.role") },
-    ...text === void 0 ? {} : { text },
-    ...data === void 0 ? {} : { data },
-    ...context === void 0 ? {} : { context },
-    ...operation === void 0 ? {} : { operation }
-  };
-}
-function parseConversationEvent(value) {
-  const source = record(value, "conversation event");
-  const type = string(source.type, "conversation event.type");
-  const parsed = {
-    ...source,
-    id: identifier(source.id, "conversation event.id"),
-    type,
-    created_at: timestamp(source.created_at, "conversation event.created_at"),
-    ...source.message === void 0 ? {} : { message: parseMessage(source.message) },
-    ...source.status === void 0 ? {} : {
-      status: oneOf(
-        source.status,
-        ["working", "idle", "queued", "closed"],
-        "conversation event.status"
-      )
-    },
-    ...source.responder === void 0 ? {} : {
-      responder: oneOf(
-        source.responder,
-        ["agent", "human"],
-        "conversation event.responder"
-      )
-    },
-    ...source.error === void 0 ? {} : {
-      error: oneOf(
-        source.error,
-        ["sign_in_required", "insufficient_scope"],
-        "conversation event.error"
-      )
-    },
-    ...source.scope === void 0 ? {} : { scope: string(source.scope, "conversation event.scope") },
-    ...source.reason === void 0 ? {} : { reason: string(source.reason, "conversation event.reason") },
-    ...source.conversation_id === void 0 ? {} : {
-      conversation_id: identifier(
-        source.conversation_id,
-        "conversation event.conversation_id"
-      )
-    }
-  };
-  if (type === "message" && parsed.message === void 0) {
-    throw new ProtocolValidationError("invalid_event", "a message event requires message");
-  }
-  if (type === "state" && (parsed.status === void 0 || parsed.responder === void 0)) {
-    throw new ProtocolValidationError(
-      "invalid_event",
-      "a state event requires status and responder"
-    );
-  }
-  if (type === "authorization") {
-    if (parsed.error === void 0) {
-      throw new ProtocolValidationError(
-        "invalid_event",
-        "an authorization event requires error"
-      );
-    }
-    if (parsed.error === "insufficient_scope" && parsed.scope === void 0) {
-      throw new ProtocolValidationError(
-        "invalid_event",
-        "insufficient_scope requires scope"
-      );
-    }
-  }
-  if (type === "user_requested" && parsed.reason === void 0) {
-    throw new ProtocolValidationError(
-      "invalid_event",
-      "a user_requested event requires reason"
-    );
-  }
-  if ((type === "direct_opened" || type === "direct_closed") && parsed.conversation_id === void 0) {
-    throw new ProtocolValidationError(
-      "invalid_event",
-      "a direct conversation event requires conversation_id"
-    );
-  }
-  return parsed;
-}
-function parseConversationEventPage(value) {
-  const source = record(value, "conversation event page");
-  return {
-    ...source,
-    conversation_id: identifier(source.conversation_id, "conversation_id"),
-    events: array(source.events, "events").map(parseConversationEvent),
-    cursor: identifier(source.cursor, "cursor"),
-    has_more: boolean(source.has_more, "has_more"),
-    status: oneOf(
-      source.status,
-      ["working", "idle", "queued", "closed"],
-      "status"
-    ),
-    responder: oneOf(source.responder, ["agent", "human"], "responder")
-  };
-}
-
-// src/discovery.ts
-function normalizeDomain(domain2) {
-  const value = domain2.replace(/\.$/, "").toLowerCase();
-  if (!value || value.includes("://") || value.includes("/")) {
-    throw new DiscoveryError("invalid_domain", "Discovery requires a DNS domain name");
-  }
-  return value;
-}
-function metadataUrl(issuer) {
-  const parsed = new URL(issuer);
-  const path = parsed.pathname.replace(/\/$/, "");
-  parsed.pathname = `/.well-known/oauth-authorization-server${path}`;
-  parsed.search = "";
-  parsed.hash = "";
-  return parsed;
-}
-async function readJson(initialUrl, transport, urlPolicy, maxRedirects, maxResponseBytes) {
-  let current = initialUrl;
-  for (let redirects = 0; redirects <= maxRedirects; redirects += 1) {
-    await urlPolicy.assertSafe(current);
-    let response;
-    try {
-      response = await transport.fetch(current, {
-        headers: { Accept: "application/json" },
-        redirect: "manual",
-        credentials: "omit"
-      });
-    } catch (cause) {
-      throw new DiscoveryError("request_failed", "Discovery request failed", { cause });
-    }
-    if (response.status >= 300 && response.status < 400) {
-      if (redirects === maxRedirects) {
-        throw new DiscoveryError("too_many_redirects", "Discovery exceeded redirect limit");
-      }
-      const location2 = response.headers.get("location");
-      if (!location2) {
-        throw new DiscoveryError("invalid_redirect", "Discovery redirect has no location");
-      }
-      current = new URL(location2, current);
-      continue;
-    }
-    if (!response.ok) {
-      throw new DiscoveryError(
-        "http_error",
-        "Discovery endpoint returned an unsuccessful status",
-        { statusCode: response.status }
-      );
-    }
-    const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim();
-    if (contentType !== "application/json" && contentType !== "application/poppy+json") {
-      throw new DiscoveryError("invalid_content_type", "Discovery response must be JSON");
-    }
-    const body = await response.text();
-    if (new TextEncoder().encode(body).byteLength > maxResponseBytes) {
-      throw new DiscoveryError("response_too_large", "Discovery response exceeds size limit");
-    }
-    try {
-      return { value: parseJsonStrict(body), finalUrl: current };
-    } catch (cause) {
-      if (cause instanceof ProtocolValidationError) throw cause;
-      throw new ProtocolValidationError("invalid_json", "Response is not valid JSON", {
-        cause
-      });
-    }
-  }
-  throw new DiscoveryError("too_many_redirects", "Discovery exceeded redirect limit");
-}
-async function discoverCompany(domain2, options = {}) {
-  const requestedDomain = normalizeDomain(domain2);
-  const reactor = options.reactor ?? buildPapReactor(options);
-  const transport = firstContribution(
-    reactor,
-    DiscoveryTransports,
-    "discovery transport"
-  );
-  const urlPolicy = firstContribution(
-    reactor,
-    UrlSafetyPolicies,
-    "URL safety policy"
-  );
-  const maxRedirects = options.maxRedirects ?? 3;
-  const maxBytes = options.maxResponseBytes ?? 100 * 1024;
-  const discovery = await readJson(
-    new URL(`https://${requestedDomain}/.well-known/poppy.json`),
-    transport,
-    urlPolicy,
-    maxRedirects,
-    maxBytes
-  );
-  const document = parseDiscoveryDocument(discovery.value);
-  if (document.organization.domain.replace(/^www\./, "") !== requestedDomain.replace(/^www\./, "")) {
-    throw new DiscoveryError(
-      "organization_domain_mismatch",
-      "Discovery organization domain does not match the requested domain"
-    );
-  }
-  if (!document.auth) {
-    return { discoveryUrl: discovery.finalUrl.toString(), document };
-  }
-  const metadataResponse = await readJson(
-    metadataUrl(document.auth.issuer),
-    transport,
-    urlPolicy,
-    maxRedirects,
-    maxBytes
-  );
-  const oauthMetadata = parseOAuthServerMetadata(metadataResponse.value);
-  if (oauthMetadata.issuer !== document.auth.issuer) {
-    throw new DiscoveryError("issuer_mismatch", "OAuth metadata issuer does not match auth.issuer");
-  }
-  if (!oauthMetadata.poppy_domains.includes(document.organization.domain)) {
-    throw new DiscoveryError(
-      "domain_not_authorized",
-      "OAuth metadata does not authorize the discovered company domain"
-    );
-  }
-  return {
-    discoveryUrl: discovery.finalUrl.toString(),
-    document,
-    oauthMetadata
-  };
-}
+import {
+  AgentIdentityClient,
+  AuthorizationCodeGrant,
+  AuthorizationError,
+  AuthorizationStateStores,
+  BROWSER_ASSERTION_TYPE,
+  BrowserFormPosts,
+  BrowserHandoffs,
+  BrowserSessionClient,
+  BrowserSessionError,
+  Caches,
+  Clocks,
+  ConversationClient,
+  ConversationError,
+  DirectSignInClient,
+  DiscoveryError,
+  DiscoveryTransports,
+  DpopFetchClient,
+  DpopProofProviders,
+  ExtensionHandlers,
+  IdentityError,
+  JWT_BEARER_GRANT,
+  JWT_CLIENT_ASSERTION,
+  JoseDpopProofProvider,
+  KeyStores,
+  PairwiseUserIdStores,
+  PersonalAgentProtocolError,
+  ProofError,
+  ProtocolProfiles,
+  ProtocolValidationError,
+  RandomSources,
+  SecretValue,
+  SessionClient,
+  SessionError,
+  SessionGrant,
+  Signers,
+  TokenStores,
+  TransportError,
+  UrlSafetyPolicies,
+  buildBrowserAssertionClaims,
+  buildDirectSignInRequest,
+  buildPapReactor,
+  buildSessionAssertionClaims,
+  createPapCorePlugin,
+  discoverCompany,
+  firstContribution,
+  generateMessageId,
+  generatePairwiseUserId,
+  parseClientMetadata,
+  parseConversationEvent,
+  parseConversationEventPage,
+  parseDiscoveryDocument,
+  parseJsonStrict,
+  parseJsonWebKeySet,
+  parseMessage,
+  parseOAuthServerMetadata,
+  parseOperation,
+  parseSessionToken,
+  resolvePairwiseUserId,
+  validateDirectSignInCallback
+} from "./chunk-TU6B5MQ7.js";
 export {
+  AgentIdentityClient,
   AuthorizationCodeGrant,
   AuthorizationError,
+  AuthorizationStateStores,
+  BROWSER_ASSERTION_TYPE,
+  BrowserFormPosts,
   BrowserHandoffs,
+  BrowserSessionClient,
+  BrowserSessionError,
   Caches,
   Clocks,
+  ConversationClient,
+  ConversationError,
+  DirectSignInClient,
   DiscoveryError,
   DiscoveryTransports,
+  DpopFetchClient,
   DpopProofProviders,
   ExtensionHandlers,
+  IdentityError,
   JWT_BEARER_GRANT,
   JWT_CLIENT_ASSERTION,
   JoseDpopProofProvider,
-  JoseSigner,
   KeyStores,
+  PairwiseUserIdStores,
   PersonalAgentProtocolError,
   ProofError,
   ProtocolProfiles,
@@ -3755,24 +96,28 @@ export {
   SessionGrant,
   Signers,
   TokenStores,
+  TransportError,
   UrlSafetyPolicies,
+  buildBrowserAssertionClaims,
   buildDirectSignInRequest,
   buildPapReactor,
   buildSessionAssertionClaims,
   createPapCorePlugin,
   discoverCompany,
   firstContribution,
+  generateMessageId,
   generatePairwiseUserId,
   parseClientMetadata,
   parseConversationEvent,
   parseConversationEventPage,
   parseDiscoveryDocument,
   parseJsonStrict,
+  parseJsonWebKeySet,
   parseMessage,
   parseOAuthServerMetadata,
   parseOperation,
   parseSessionToken,
-  validateDirectSignInCallback,
-  verifyDpopProof
+  resolvePairwiseUserId,
+  validateDirectSignInCallback
 };
 //# sourceMappingURL=index.js.map