@datalayer/personal-agent-protocol 0.3.1 → 0.3.2

package/README.md

@@ -8,52 +8,62 @@
 
 # 🤖 🌸 Personal Agent Protocol
 
-Python and TypeScript SDKs for [Personal Agent Protocol](https://personalagentprotocol.org),
-currently targeting [draft 0.1](https://personalagentprotocol.org/docs/spec).
-
-The first implemented slice provides:
-
-- forward-compatible discovery, OAuth metadata, client metadata, conversation
-  messages/events, and Operations v1 models in Python and TypeScript;
-- company discovery at `/.well-known/poppy.json`;
-- validation of the requested company domain, OAuth issuer, and
-  `poppy_domains` relationship;
-- HTTPS-only redirects, bounded response sizes, and a public-address preflight
-  guard in the Python discovery client;
-- Reactor-backed protocol profiles, discovery transports, URL-safety policies,
-  extension handlers, clocks, randomness, signing, protected keys, token
-  storage, pairwise identity, caches, and browser-handoff contribution points
-  in both SDKs;
-- redacted session-token values, random pairwise user-ID generation and atomic
-  file-backed reference persistence, PAP 4.2 assertion claims, and JWT-bearer
-  request forms;
-- signed-out session start and renewal over HTTP, with Reactor-provided signing
-  and DPoP proof generation, in both SDKs;
-- asymmetric ES256/RS256 JOSE signers and RFC 9449 DPoP creation and
-  verification, including nonce, request, token-hash, freshness, and replay
-  checks, in both SDKs;
-- Direct Sign-In state, S256 PKCE, callback validation, and redacted exchange
-  forms plus one-use browser and token-exchange orchestration in both SDKs;
-- duplicate JSON member rejection at Python and TypeScript trust boundaries;
-- a Reactor-extensible `pap` CLI with non-secret profiles, verified company
-  discovery, extension diagnostics, versioned JSON, and a safe live-session
-  discovery command;
-- one shared set of fixtures exercised by both SDKs.
-
-Managed key custody and durable replay storage, device/mediated sign-in,
-conversations, and the Operations client/server are not implemented yet.
-Direct Sign-In requires host-provided authorization-state, browser, signer, and
-DPoP contributions; the SDK does not open a browser or persist state through an
-implicit global service.
-
-Session requests fail closed unless the host contributes signer and
-DPoP providers backed by suitable key custody.
-
-## Python
+![Personal Agent Protocol demo](https://images.datalayer.io/products/personal-agent-protocol/pap-demo.gif)
+
+Python and TypeScript SDKs for the
+[Personal Agent Protocol](https://personalagentprotocol.org), currently
+targeting [draft 0.1](https://personalagentprotocol.org/docs/spec).
+
+PAP lets a personal agent discover and talk to a company's agent on behalf of
+a person. The company remains responsible for its identity, authorization,
+data, and actions; the personal agent does not need the person's company
+password or a copy of their account data.
+
+## Understand PAP in one minute
+
+A typical interaction has five parts:
+
+1. **Discover** — the personal agent reads the company's public
+   `/.well-known/poppy.json` document.
+1. **Start a Session** — the two agents establish a pairwise, initially
+   signed-out relationship.
+1. **Converse** — the personal agent can ask questions without disclosing the
+   person's company identity.
+1. **Sign in when required** — the company opens its own authorization page.
+   Credentials remain between the person and the company.
+1. **Continue safely** — the same conversation resumes with proof-bound access
+   and the scopes the person approved.
+
+```mermaid
+sequenceDiagram
+    actor Person
+    participant PA as Personal agent
+    participant Company as Company agent
+    participant Auth as Company authorization server
+
+    PA->>Company: Discover /.well-known/poppy.json
+    Company-->>PA: Agent, Session, and authorization endpoints
+    PA->>Auth: Start a signed-out Session
+    Auth-->>PA: DPoP-bound Session Token
+    PA->>Company: Start a conversation
+    Company-->>PA: Sign-in required for account data
+    PA-->>Person: Open the company's sign-in page
+    Person->>Auth: Sign in and approve scopes
+    Auth-->>PA: Signed-in Session
+    PA->>Company: Continue the same conversation
+    Company-->>PA: Account-aware response
+```
+
+The SDKs implement these protocol and security mechanics. They do not decide
+what an agent should say, which model it should use, or whether a proposed
+action is appropriate for a person.
+
+## Install and discover a company
+
+### Python
 
 ```bash
-python -m pip install -e '.[test,lint,typing]'
-python -m pytest tests
+python -m pip install personal-agent-protocol
 ```
 
 ```python
@@ -66,28 +76,159 @@ async def main() -> None:
     async with DiscoveryClient() as client:
         company = await client.discover("example.com")
         print(company.document.organization.name)
+        print(company.document.agent.protocols)
 
 
 asyncio.run(main())
 ```
 
-`DiscoveryClient(reactor=platform)` accepts an existing Reactor
-`PluginPlatform`. The default `build_pap_reactor()` host contributes the HTTPX
-transport, public-network safety policy, and PAP 0.1 profile. A plugin can
-replace a default by contributing at a lower order; equal highest priorities
-fail closed as ambiguous.
+### TypeScript
+
+```bash
+npm install @datalayer/personal-agent-protocol
+```
+
+```typescript
+import { discoverCompany } from '@datalayer/personal-agent-protocol';
+
+const company = await discoverCompany('example.com');
+console.log(company.document.organization.name);
+console.log(company.document.agent.protocols);
+```
+
+Discovery is deliberately a small first example. Production Session,
+sign-in, and conversation flows also require host-owned signing keys, DPoP
+proof generation, token storage, and browser handoff. Those capabilities are
+provided through Reactor rather than hidden global state.
+
+## Reactor is the extension foundation
+
+Both SDKs are built on
+[Datalayer Reactor](https://github.com/datalayer/reactor), a typed plugin and
+contribution system. An application assembles a PAP host from explicit
+contributions for:
+
+- discovery transport and URL-safety policy;
+- protocol profiles and extension handlers;
+- clocks and cryptographic randomness;
+- signing, protected keys, and DPoP proofs;
+- pairwise identity, token storage, and caching;
+- browser handoff and authorization-state storage;
+- CLI commands supplied by PAP or third-party extensions.
+
+This architecture keeps the protocol core portable while allowing a desktop
+application, browser application, server, or test harness to provide the
+security and platform behavior appropriate to its environment. Missing or
+ambiguous security contributions fail closed.
+
+Python accepts a host-assembled Reactor `PluginPlatform`:
+
+```python
+from reactor import PluginManifest
+
+from personal_agent_protocol import DiscoveryClient, build_pap_reactor
+
+
+async def discover_with_host() -> None:
+    platform, owned_http = build_pap_reactor(
+        plugins=[
+            (PluginManifest(name="my-security", version="1"), my_security_plugin)
+        ]
+    )
+    try:
+        async with DiscoveryClient(reactor=platform) as client:
+            company = await client.discover("example.com")
+            print(company.document.organization.name)
+    finally:
+        platform.stop()
+        if owned_http is not None:
+            await owned_http.aclose()
+```
+
+TypeScript can build a host or receive an existing `ReactorPlatformView`:
+
+```typescript
+import {
+  buildPapReactor,
+  discoverCompany,
+} from '@datalayer/personal-agent-protocol';
+
+const reactor = buildPapReactor({}, [mySecurityPlugin]);
+const company = await discoverCompany('example.com', { reactor });
+```
+
+See the [Reactor repository](https://github.com/datalayer/reactor) for the
+plugin model and contribution lifecycle.
+
+## What is implemented
+
+Python and TypeScript share fixtures and cover the same principal protocol
+surface:
+
+| Area            | Current support                                                                                                                   |
+| --------------- | --------------------------------------------------------------------------------------------------------------------------------- |
+| Models          | Forward-compatible discovery, OAuth metadata, client metadata, messages, events, and Operations v1 models                         |
+| Discovery       | `poppy.json`, company-domain and issuer validation, `poppy_domains`, bounded responses, and redirect controls                     |
+| Sessions        | Pairwise user IDs, PAP 4.2 assertions, signed-out start and renewal, redacted tokens, and DPoP nonce retry                        |
+| Cryptography    | ES256/RS256 JOSE, RFC 9449 DPoP creation and verification, freshness, token hash, nonce, and replay checks                        |
+| Direct Sign-In  | State, S256 PKCE, callback validation, browser handoff, and one-use token exchange orchestration                                  |
+| Browser Session | Assertion creation, controlled form POST, replay-safe verification, and company-domain return validation                          |
+| Transport       | Host-owned authorization headers, fresh redirect-bound proofs, one nonce retry, and cross-origin credential isolation             |
+| Conversations   | Start and continue, random user-global message IDs, ordered long polling, cursor recovery, duplicate suppression, and safe errors |
+| Extensibility   | Reactor contribution points for platform, security, protocol, storage, and CLI behavior                                           |
+| CLI             | Non-secret profiles, company verification, extension diagnostics, and versioned JSON output                                       |
+
+Python additionally provides a SQLite pairwise-identity reference provider.
+The portable TypeScript entry rejects obvious local and private literal
+addresses. Its explicit server entry adds `NodeUrlSafetyPolicy`, `JoseSigner`,
+and DPoP verification with A/AAAA resolution checks:
+
+```typescript
+import {
+  JoseSigner,
+  NodeUrlSafetyPolicy,
+} from '@datalayer/personal-agent-protocol/server';
+```
+
+Duplicate JSON members are rejected at Python and TypeScript trust boundaries.
+
+## What is not implemented yet
+
+The following work remains before the SDKs cover the complete planned PAP
+surface:
+
+- managed key custody and durable replay storage;
+- Account Token exchange;
+- resource-bound MCP Bearer transport;
+- device and mediated sign-in;
+- conversation SSE streaming, handoff, and explicit close requests;
+- the Operations client and server;
+- transport-level address pinning to close the DNS-rebinding interval.
 
-The core also contributes UTC time and operating-system randomness. It does
-not provide insecure fallbacks for signing, DPoP proof generation, protected
-keys, token storage, cache, or browser handoff. A flow requiring one fails
-closed until its host contributes it. This also applies to pairwise identity;
-Python includes an explicit SQLite reference provider, but the core does not
-silently install it.
+Models for Operations v1 exist, but a complete Operations workflow does not.
+Applications should not infer client support from model availability alone.
 
-### Command line
+## Security boundary
 
-The Python package installs an extensible `pap` command. Its command groups are
-provided through Reactor's `datalayer.reactor.cli` entry-point contract.
+PAP credentials belong to the host, not to an agent model or tool call.
+
+- Session Tokens, Account Tokens, proofs, nonces, authorization codes, and
+  pairwise identifiers must not enter prompts or model-visible tool results.
+- Direct Sign-In requires host-provided state storage, browser handoff,
+  signing, and DPoP contributions.
+- Session requests fail closed until suitable signer and DPoP providers are
+  installed.
+- Redirects receive fresh, target-bound proofs; caller-supplied
+  `Authorization` and `DPoP` headers are rejected.
+- CLI profiles store configuration only—never tokens or private keys.
+
+The guides explain these boundaries at each flow rather than treating them as
+application conventions.
+
+## Command line
+
+The Python distribution installs an extensible `pap` command. Its command
+groups use Reactor's `datalayer.reactor.cli` entry-point contract.
 
 ```bash
 pap config set domain example.com --profile work
@@ -96,54 +237,67 @@ pap company verify --profile work --json
 pap extensions list --profile work
 ```
 
-Only non-secret settings belong in CLI profiles. See the
-[CLI guide](https://personalagentprotocol.org/docs/guides/cli) for precedence,
-security boundaries, machine output, and third-party extension examples.
+See the [CLI guide](https://personalagentprotocol.org/docs/guides/cli) for
+configuration precedence, security boundaries, machine-readable output, and
+third-party extensions.
 
-## TypeScript
+## Examples and first consumer
 
-The TypeScript package lives at the repository root: sources are in
-[`src/`](./src), tests in [`test/`](./test), and emitted package files in
-`lib/`.
+The [`examples/pydantic-ai`](./examples/pydantic-ai/) directory contains small,
+focused Python examples. Each example teaches one feature—discovery, identity,
+Sessions, Direct Sign-In, Browser Session, cryptography, conversations, or
+proof-bound transport—without giving protocol secrets to the model.
 
-```bash
-npm install
-npm test
-```
+[Datalayer Agent Runtimes](https://github.com/datalayer/agent-runtimes) is the
+first consumer of these SDKs. Its Personal Agent Protocol gallery turns the
+same features into interactive Reactor/Loop applications, including a guided
+person-to-company journey rendered with the runtime's real message UI. The
+gallery's local company simulators are deterministic and clearly identified;
+the PAP clients, transports, validation, and parsed exchanges are real.
 
-```typescript
-import { discoverCompany } from "@datalayer/personal-agent-protocol";
+Each implemented feature should have all three learning layers:
 
-const company = await discoverCompany("example.com");
-console.log(company.document.organization.name);
-```
+1. a focused SDK example in this repository;
+1. a Docusaurus guide with an explanation and Mermaid sequence diagram;
+1. an interactive Agent Runtimes example when a UI materially clarifies the
+   flow.
 
-Use `buildPapReactor(options, plugins)` to assemble the TypeScript host, or
-pass an existing `ReactorPlatformView` as `discoverCompany(..., { reactor })`.
-The package bundles Reactor's framework-neutral core in its ESM entry so it can
-run directly in Node as well as through a browser bundler.
+## Develop the SDKs
 
-Server-side TypeScript callers can import `NodeUrlSafetyPolicy`, `JoseSigner`,
-and DPoP verification from the explicit
-`@datalayer/personal-agent-protocol/server` entry. The portable entry excludes
-those server APIs and rejects obvious local/private literal addresses; the Node
-policy additionally checks every resolved A and AAAA address.
+Clone the repository, then install the dependencies for the SDK you are
+changing.
 
-The Python and Node preflights reject a host if any resolved address is
-non-public. Transport-level address pinning, required to close the
-DNS-rebinding interval, is still part of the security work before the first
-beta.
+### Python
 
-## Examples
+```bash
+python -m pip install -e '.[test,lint,typing,examples]'
+python -m pytest personal_agent_protocol/__tests__
+```
 
-The [`examples/`](./examples/) directory includes an Agent Runtimes Python
-application that discovers a PAP company over HTTPS while exposing only
-verified, non-secret capability metadata to the model. Authorization and token
-handling remain outside the agent tool boundary.
+### TypeScript
 
-## Protocol sources
+The TypeScript package is at the repository root. Sources and tests live under
+`src/`; published JavaScript and declarations are emitted to `lib/`.
 
+```bash
+npm install
+npm test
+```
+
+The shared fixtures are in `fixtures/`. Documentation is a Docusaurus site in
+`docs/`.
+
+## Learn more
+
+- [Documentation](https://personalagentprotocol.org/docs)
 - [Overview](https://personalagentprotocol.org/docs/overview)
 - [Specification](https://personalagentprotocol.org/docs/spec)
 - [Implementation guides](https://personalagentprotocol.org/docs/guides)
-- [Operations extension](https://personalagentprotocol.org/docs/extensions/operations)
+- [Extensions](https://personalagentprotocol.org/docs/extensions)
+- [Open topics](https://personalagentprotocol.org/docs/open-topics)
+- [Datalayer Reactor](https://github.com/datalayer/reactor)
+- [Datalayer Agent Runtimes](https://github.com/datalayer/agent-runtimes)
+
+## License
+
+BSD 3-Clause. See [`LICENSE`](./LICENSE).

package/lib/browser-server.d.ts

@@ -0,0 +1,26 @@
+import { type KeyInput } from "jose";
+import { SecretValue } from "./secret.js";
+export interface BrowserAssertionReplayCache {
+    markOnce(key: string, options: {
+        readonly expiresAt: Date;
+    }): Promise<boolean>;
+}
+export interface VerifyBrowserAssertionOptions {
+    readonly publicKey: KeyInput | Uint8Array;
+    readonly expectedEndpoint: string;
+    readonly companyDomain: string;
+    readonly expectedClientId: string;
+    readonly expectedPairwiseUserId: string;
+    readonly expectedSessionId: string;
+    readonly replayCache: BrowserAssertionReplayCache;
+    readonly now?: Date;
+}
+export interface VerifiedBrowserAssertion {
+    readonly clientId: string;
+    readonly pairwiseUserId: string;
+    readonly sessionId: string;
+    readonly returnTo: string;
+    readonly expiresAt: Date;
+}
+export declare function verifyBrowserAssertion(assertion: SecretValue | string, options: VerifyBrowserAssertionOptions): Promise<VerifiedBrowserAssertion>;
+//# sourceMappingURL=browser-server.d.ts.map

package/lib/browser-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-server.d.ts","sourceRoot":"","sources":["../src/browser-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,QAAQ,EAAE,MAAM,MAAM,CAAC;AAUvE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAC;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,WAAW,GAAG,MAAM,EAC/B,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,wBAAwB,CAAC,CAqDnC"}

package/lib/browser-server.js

@@ -0,0 +1,61 @@
+import { decodeProtectedHeader, jwtVerify } from "jose";
+import { BROWSER_ASSERTION_TYPE, assertCompanyReturnTo, browserAssertionError, validateBrowserClaimIdentity, } from "./browser.js";
+import { BrowserSessionError } from "./errors.js";
+import { SecretValue } from "./secret.js";
+export async function verifyBrowserAssertion(assertion, options) {
+    const compact = assertion instanceof SecretValue ? assertion.reveal() : assertion;
+    let claims;
+    try {
+        const header = decodeProtectedHeader(compact);
+        if (header.typ !== BROWSER_ASSERTION_TYPE || (header.alg !== "ES256" && header.alg !== "RS256")) {
+            throw browserAssertionError();
+        }
+        const verified = await jwtVerify(compact, options.publicKey, {
+            algorithms: [header.alg],
+            typ: BROWSER_ASSERTION_TYPE,
+            requiredClaims: ["iss", "sub", "aud", "session_id", "return_to", "iat", "exp", "jti"],
+            ...(options.now === undefined ? {} : { currentDate: options.now }),
+        });
+        const payload = verified.payload;
+        claims = {
+            iss: validateBrowserClaimIdentity(payload.iss, "iss"),
+            sub: validateBrowserClaimIdentity(payload.sub, "sub"),
+            aud: validateBrowserClaimIdentity(payload.aud, "aud"),
+            session_id: validateBrowserClaimIdentity(payload.session_id, "session_id"),
+            return_to: validateBrowserClaimIdentity(payload.return_to, "return_to"),
+            iat: Number(payload.iat),
+            exp: Number(payload.exp),
+            jti: validateBrowserClaimIdentity(payload.jti, "jti"),
+        };
+    }
+    catch (cause) {
+        if (cause instanceof BrowserSessionError)
+            throw cause;
+        throw browserAssertionError(cause);
+    }
+    const now = options.now ?? new Date();
+    const nowSeconds = Math.floor(now.getTime() / 1000);
+    if (!Number.isInteger(claims.iat) || !Number.isInteger(claims.exp) ||
+        claims.exp <= claims.iat || claims.exp - claims.iat > 60 ||
+        claims.iat > nowSeconds || claims.exp <= nowSeconds) {
+        throw browserAssertionError();
+    }
+    const endpoint = new URL(options.expectedEndpoint).toString();
+    const returnTo = assertCompanyReturnTo(claims.return_to, options.companyDomain);
+    if (claims.aud !== endpoint || claims.iss !== options.expectedClientId ||
+        claims.sub !== options.expectedPairwiseUserId || claims.session_id !== options.expectedSessionId) {
+        throw browserAssertionError();
+    }
+    const expiresAt = new Date(claims.exp * 1000);
+    if (!(await options.replayCache.markOnce(`browser:${claims.iss}:${claims.jti}`, { expiresAt }))) {
+        throw new BrowserSessionError("invalid_browser_assertion", "Browser assertion has already been used");
+    }
+    return {
+        clientId: claims.iss,
+        pairwiseUserId: claims.sub,
+        sessionId: claims.session_id,
+        returnTo,
+        expiresAt,
+    };
+}
+//# sourceMappingURL=browser-server.js.map

package/lib/browser-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-server.js","sourceRoot":"","sources":["../src/browser-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAiB,MAAM,MAAM,CAAC;AAEvE,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,4BAA4B,GAE7B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAyB1C,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA+B,EAC/B,OAAsC;IAEtC,MAAM,OAAO,GAAG,SAAS,YAAY,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,GAAG,KAAK,sBAAsB,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,CAAC;YAChG,MAAM,qBAAqB,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;YAC3D,UAAU,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;YACxB,GAAG,EAAE,sBAAsB;YAC3B,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QACjC,MAAM,GAAG;YACP,GAAG,EAAE,4BAA4B,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;YACrD,GAAG,EAAE,4BAA4B,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;YACrD,GAAG,EAAE,4BAA4B,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;YACrD,UAAU,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC;YAC1E,SAAS,EAAE,4BAA4B,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC;YACvE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YACxB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YACxB,GAAG,EAAE,4BAA4B,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;SACtD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAC;QACtD,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;QAC9D,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,EAAE;QACxD,MAAM,CAAC,GAAG,GAAG,UAAU,IAAI,MAAM,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;QACxD,MAAM,qBAAqB,EAAE,CAAC;IAChC,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,gBAAgB;QAClE,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,sBAAsB,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,iBAAiB,EAAE,CAAC;QACrG,MAAM,qBAAqB,EAAE,CAAC;IAChC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,EAAE,yCAAyC,CAAC,CAAC;IACxG,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,cAAc,EAAE,MAAM,CAAC,GAAG;QAC1B,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,QAAQ;QACR,SAAS;KACV,CAAC;AACJ,CAAC"}

package/lib/browser.d.ts

@@ -0,0 +1,43 @@
+import type { ReactorPlatformView } from "@datalayer/reactor";
+import { BrowserSessionError } from "./errors.js";
+import { SecretValue } from "./secret.js";
+export declare const BROWSER_ASSERTION_TYPE = "poppy-browser+jwt";
+export interface BrowserAssertionClaims {
+    readonly iss: string;
+    readonly sub: string;
+    readonly aud: string;
+    readonly session_id: string;
+    readonly return_to: string;
+    readonly iat: number;
+    readonly exp: number;
+    readonly jti: string;
+}
+export interface BrowserAssertionOptions {
+    readonly clientId: string;
+    readonly pairwiseUserId: string;
+    readonly browserSessionEndpoint: string;
+    readonly sessionId: string;
+    readonly returnTo: string;
+    readonly companyDomain: string;
+    readonly now?: Date;
+    readonly lifetimeSeconds?: number;
+    readonly randomBytes?: (length: number) => Uint8Array;
+}
+export declare function buildBrowserAssertionClaims(options: BrowserAssertionOptions): BrowserAssertionClaims;
+export interface BrowserSessionStart {
+    readonly endpoint: string;
+    readonly returnTo: string;
+    readonly expiresAt: Date;
+}
+export declare class BrowserSessionClient {
+    #private;
+    constructor(options: {
+        readonly reactor: ReactorPlatformView;
+    });
+    join(options: Omit<BrowserAssertionOptions, "now" | "randomBytes">): Promise<BrowserSessionStart>;
+}
+export declare function assertCompanyReturnTo(value: string, companyDomain: string): string;
+export declare function browserAssertionError(cause?: unknown): BrowserSessionError;
+export declare function validateBrowserClaimIdentity(value: unknown, label: string): string;
+export declare function redactBrowserAssertion(value: string): SecretValue;
+//# sourceMappingURL=browser.d.ts.map

package/lib/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;CACvD;AAuCD,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,uBAAuB,GAAG,sBAAsB,CA6BpG;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,qBAAa,oBAAoB;;gBAGnB,OAAO,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;KAAE;IAIxD,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,uBAAuB,EAAE,KAAK,GAAG,aAAa,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAkBxG;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAM1E;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGlF;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAEjE"}

package/lib/browser.js

@@ -0,0 +1,103 @@
+import { BrowserSessionError } from "./errors.js";
+import { BrowserFormPosts, Clocks, RandomSources, Signers, firstContribution } from "./reactor.js";
+import { SecretValue } from "./secret.js";
+export const BROWSER_ASSERTION_TYPE = "poppy-browser+jwt";
+function httpsUrl(value, label) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch (cause) {
+        throw new BrowserSessionError("invalid_url", `${label} must be an HTTPS URL`, { cause });
+    }
+    if (url.protocol !== "https:" || url.username || url.password) {
+        throw new BrowserSessionError("invalid_url", `${label} must be an HTTPS URL`);
+    }
+    return url;
+}
+function companyReturnTo(value, companyDomain) {
+    const url = httpsUrl(value, "returnTo");
+    const host = url.hostname.toLowerCase().replace(/\.$/u, "");
+    const domain = companyDomain.toLowerCase().replace(/\.$/u, "");
+    if (!domain || (host !== domain && !host.endsWith(`.${domain}`))) {
+        throw new BrowserSessionError("invalid_return_to", "returnTo must be on the company domain or a subdomain");
+    }
+    return url.toString();
+}
+function defaultRandomBytes(length) {
+    if (!globalThis.crypto)
+        throw new BrowserSessionError("crypto_unavailable", "Web Crypto is required");
+    return globalThis.crypto.getRandomValues(new Uint8Array(length));
+}
+function base64Url(bytes) {
+    let binary = "";
+    for (const value of bytes)
+        binary += String.fromCharCode(value);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+export function buildBrowserAssertionClaims(options) {
+    const lifetime = options.lifetimeSeconds ?? 60;
+    if (!Number.isInteger(lifetime) || lifetime <= 0 || lifetime > 60) {
+        throw new BrowserSessionError("invalid_lifetime", "Browser assertion lifetime must be between 1 and 60 seconds");
+    }
+    if (!/^[A-Za-z0-9_-]{1,256}$/u.test(options.pairwiseUserId)) {
+        throw new BrowserSessionError("invalid_user_id", "Invalid pairwise user ID");
+    }
+    if (!/^[A-Za-z0-9_-]{1,256}$/u.test(options.sessionId)) {
+        throw new BrowserSessionError("invalid_session_id", "Invalid PAP Session ID");
+    }
+    const entropy = (options.randomBytes ?? defaultRandomBytes)(16);
+    if (entropy.byteLength < 16) {
+        throw new BrowserSessionError("weak_randomness", "Browser assertion IDs require 128 random bits");
+    }
+    const iat = Math.floor((options.now ?? new Date()).getTime() / 1000);
+    return {
+        iss: httpsUrl(options.clientId, "clientId").toString(),
+        sub: options.pairwiseUserId,
+        aud: httpsUrl(options.browserSessionEndpoint, "browserSessionEndpoint").toString(),
+        session_id: options.sessionId,
+        return_to: companyReturnTo(options.returnTo, options.companyDomain),
+        iat,
+        exp: iat + lifetime,
+        jti: `jti_${base64Url(entropy)}`,
+    };
+}
+export class BrowserSessionClient {
+    #reactor;
+    constructor(options) {
+        this.#reactor = options.reactor;
+    }
+    async join(options) {
+        const clock = firstContribution(this.#reactor, Clocks, "clock");
+        const random = firstContribution(this.#reactor, RandomSources, "random source");
+        const signer = firstContribution(this.#reactor, Signers, "signer");
+        const browser = firstContribution(this.#reactor, BrowserFormPosts, "browser form POST");
+        const claims = buildBrowserAssertionClaims({
+            ...options,
+            now: clock.now(),
+            randomBytes: length => random.bytes(length),
+        });
+        const assertion = await signer.sign({ ...claims }, { purpose: "browser_assertion" });
+        await browser.post(new URL(claims.aud), { assertion });
+        return {
+            endpoint: claims.aud,
+            returnTo: claims.return_to,
+            expiresAt: new Date(claims.exp * 1000),
+        };
+    }
+}
+export function assertCompanyReturnTo(value, companyDomain) {
+    return companyReturnTo(value, companyDomain);
+}
+export function browserAssertionError(cause) {
+    return new BrowserSessionError("invalid_browser_assertion", "Browser assertion signature or claims are invalid", cause === undefined ? {} : { cause });
+}
+export function validateBrowserClaimIdentity(value, label) {
+    if (typeof value !== "string" || !value)
+        throw browserAssertionError(new TypeError(`${label} is invalid`));
+    return value;
+}
+export function redactBrowserAssertion(value) {
+    return new SecretValue(value);
+}
+//# sourceMappingURL=browser.js.map

package/lib/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAyB1D,SAAS,QAAQ,CAAC,KAAa,EAAE,KAAa;IAC5C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,aAAqB;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,mBAAmB,CAC3B,mBAAmB,EACnB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,EAAE,wBAAwB,CAAC,CAAC;IACtG,OAAO,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAgC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,IAAI,QAAQ,GAAG,EAAE,EAAE,CAAC;QAClE,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,EAClB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,EAAE,wBAAwB,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACrE,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE;QACtD,GAAG,EAAE,OAAO,CAAC,cAAc;QAC3B,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC,QAAQ,EAAE;QAClF,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC;QACnE,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,QAAQ;QACnB,GAAG,EAAE,OAAO,SAAS,CAAC,OAAO,CAAC,EAAE;KACjC,CAAC;AACJ,CAAC;AAQD,MAAM,OAAO,oBAAoB;IACtB,QAAQ,CAAsB;IAEvC,YAAY,OAAkD;QAC5D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAA6D;QACtE,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,2BAA2B,CAAC;YACzC,GAAG,OAAO;YACV,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;YAChB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACrF,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACvD,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;SACvC,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,aAAqB;IACxE,OAAO,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAe;IACnD,OAAO,IAAI,mBAAmB,CAC5B,2BAA2B,EAC3B,mDAAmD,EACnD,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc,EAAE,KAAa;IACxE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,MAAM,qBAAqB,CAAC,IAAI,SAAS,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC;IAC3G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC"}