@datalayer/personal-agent-protocol 0.3.2 → 0.3.3

package/lib/device.d.ts

@@ -0,0 +1,44 @@
+import type { ReactorPlatformView } from "@datalayer/reactor";
+import { type SessionToken } from "./sessions.js";
+export declare const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+export interface DeviceSignInStart {
+    readonly reference: string;
+    readonly userCode: string;
+    readonly verificationUri: string;
+    readonly verificationUriComplete?: string;
+    readonly expiresAt: Date;
+    readonly pollInterval: number;
+    readonly requestedScopes: readonly string[];
+}
+export interface DeviceSignInPoll {
+    readonly status: "pending" | "complete";
+    readonly retryAt?: Date;
+    readonly token?: SessionToken;
+    readonly accountTokenReference?: string;
+    readonly grantedScopes: readonly string[];
+    readonly missingScopes: readonly string[];
+}
+export interface DeviceSignInBeginOptions {
+    readonly deviceAuthorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly scopes: readonly string[];
+    readonly tenantId: string;
+    readonly pairwiseUserId: string;
+    readonly sessionId: string;
+    readonly signal?: AbortSignal;
+}
+export interface DeviceSignInClientOptions {
+    readonly reactor: ReactorPlatformView;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly maxResponseBytes?: number;
+}
+/** PAP Device Sign-In with private device codes and Reactor-backed Account Tokens. */
+export declare class DeviceSignInClient {
+    #private;
+    constructor(options: DeviceSignInClientOptions);
+    begin(options: DeviceSignInBeginOptions): Promise<DeviceSignInStart>;
+    poll(reference: string, signal?: AbortSignal): Promise<DeviceSignInPoll>;
+}
+//# sourceMappingURL=device.d.ts.map

package/lib/device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../src/device.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAc9D,OAAO,EAA2C,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAE3F,eAAO,MAAM,iBAAiB,iDAAiD,CAAC;AAmIhF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,sFAAsF;AACtF,qBAAa,kBAAkB;;gBAKjB,OAAO,EAAE,yBAAyB;IAUxC,KAAK,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA4DpE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA8K/E"}

package/lib/device.js

@@ -0,0 +1,327 @@
+import { AuthorizationError } from "./errors.js";
+import { parseJsonStrict } from "./json.js";
+import { AuthorizationStateStores, Clocks, DpopProofProviders, RandomSources, Signers, TokenStores, firstContribution, } from "./reactor.js";
+import { SecretValue } from "./secret.js";
+import { JWT_CLIENT_ASSERTION, parseSessionToken } from "./sessions.js";
+export const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function httpsUrl(value, label) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch (cause) {
+        throw new AuthorizationError("invalid_url", `${label} must be an HTTPS URL`, { cause });
+    }
+    if (parsed.protocol !== "https:" || parsed.username || parsed.password) {
+        throw new AuthorizationError("invalid_url", `${label} must be an HTTPS URL`);
+    }
+    return parsed.toString();
+}
+function scopes(values) {
+    const result = [...new Set(values)];
+    const token = /^[\x21\x23-\x5b\x5d-\x7e]+$/;
+    if (result.length === 0 || result.some((scope) => !token.test(scope))) {
+        throw new AuthorizationError("invalid_scope", "At least one valid OAuth scope is required");
+    }
+    return result;
+}
+function base64Url(bytes) {
+    const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+    let output = "";
+    for (let index = 0; index < bytes.length; index += 3) {
+        const first = bytes[index] ?? 0;
+        const second = bytes[index + 1];
+        const third = bytes[index + 2];
+        output += alphabet[first >>> 2];
+        output += alphabet[((first & 3) << 4) | ((second ?? 0) >>> 4)];
+        if (second !== undefined) {
+            output += alphabet[((second & 15) << 2) | ((third ?? 0) >>> 6)];
+        }
+        if (third !== undefined)
+            output += alphabet[third & 63];
+    }
+    return output;
+}
+function opaqueId(prefix, bytes) {
+    if (bytes.byteLength < 16) {
+        throw new AuthorizationError("weak_entropy", "Device Sign-In requires 128 random bits");
+    }
+    return `${prefix}_${base64Url(bytes)}`;
+}
+function record(value, label) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new AuthorizationError("invalid_device_response", `${label} must be an object`);
+    }
+    return value;
+}
+function string(value, label) {
+    if (typeof value !== "string" || !value) {
+        throw new AuthorizationError("invalid_device_response", `${label} must be a non-empty string`);
+    }
+    return value;
+}
+function parseDeviceAuthorization(value) {
+    const source = record(value, "device authorization response");
+    const expiresIn = source.expires_in;
+    const interval = source.interval ?? 5;
+    if (!Number.isInteger(expiresIn) || expiresIn <= 0 || expiresIn > 3600) {
+        throw new AuthorizationError("invalid_device_response", "expires_in must be 1..3600");
+    }
+    if (!Number.isInteger(interval) || interval <= 0 || interval > 300) {
+        throw new AuthorizationError("invalid_device_response", "interval must be 1..300");
+    }
+    const complete = source.verification_uri_complete;
+    if (complete !== undefined && typeof complete !== "string") {
+        throw new AuthorizationError("invalid_device_response", "verification_uri_complete must be a string");
+    }
+    return {
+        deviceCode: new SecretValue(string(source.device_code, "device_code")),
+        userCode: string(source.user_code, "user_code"),
+        verificationUri: httpsUrl(string(source.verification_uri, "verification_uri"), "verification_uri"),
+        ...(complete === undefined
+            ? {}
+            : { verificationUriComplete: httpsUrl(complete, "verification_uri_complete") }),
+        expiresIn: expiresIn,
+        interval: interval,
+    };
+}
+function isPending(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const pending = value;
+    return (pending.kind === "pap.device-sign-in.v1" &&
+        pending.deviceCode instanceof SecretValue &&
+        pending.expiresAt instanceof Date &&
+        pending.nextPollAt instanceof Date &&
+        typeof pending.tokenEndpoint === "string" &&
+        typeof pending.interval === "number");
+}
+/** PAP Device Sign-In with private device codes and Reactor-backed Account Tokens. */
+export class DeviceSignInClient {
+    #reactor;
+    #fetch;
+    #maxResponseBytes;
+    constructor(options) {
+        const fetcher = options.fetch ?? globalThis.fetch;
+        if (!fetcher)
+            throw new AuthorizationError("fetch_unavailable", "A fetch implementation is required");
+        const limit = options.maxResponseBytes ?? 100 * 1024;
+        if (!Number.isInteger(limit) || limit <= 0)
+            throw new RangeError("maxResponseBytes must be positive");
+        this.#reactor = options.reactor;
+        this.#fetch = fetcher;
+        this.#maxResponseBytes = limit;
+    }
+    async begin(options) {
+        this.#validateContext(options);
+        const clock = firstContribution(this.#reactor, Clocks, "clock");
+        const random = firstContribution(this.#reactor, RandomSources, "random source");
+        const signer = firstContribution(this.#reactor, Signers, "signer");
+        const endpoint = httpsUrl(options.deviceAuthorizationEndpoint, "deviceAuthorizationEndpoint");
+        const tokenEndpoint = httpsUrl(options.tokenEndpoint, "tokenEndpoint");
+        const issuer = httpsUrl(options.issuer, "issuer").replace(/\/$/, "");
+        const clientId = httpsUrl(options.clientId, "clientId");
+        const requestedScopes = scopes(options.scopes);
+        const now = clock.now();
+        const clientAssertion = await signer.sign(this.#claims(clientId, endpoint, now, random.bytes(16)), { purpose: "client_assertion" });
+        const response = await this.#request(endpoint, new URLSearchParams({
+            scope: requestedScopes.join(" "),
+            client_id: clientId,
+            client_assertion_type: JWT_CLIENT_ASSERTION,
+            client_assertion: clientAssertion.reveal(),
+        }), undefined, options.signal);
+        const payload = await this.#decode(response, "Device authorization");
+        if (!response.ok)
+            throw this.#remoteError(response, payload, "Company refused Device Sign-In");
+        const authorization = parseDeviceAuthorization(payload);
+        const expiresAt = new Date(now.getTime() + authorization.expiresIn * 1000);
+        const reference = opaqueId("device", random.bytes(16));
+        const pending = {
+            kind: "pap.device-sign-in.v1",
+            deviceCode: authorization.deviceCode,
+            tokenEndpoint,
+            issuer,
+            clientId,
+            tenantId: options.tenantId,
+            pairwiseUserId: options.pairwiseUserId,
+            sessionId: options.sessionId,
+            scopes: requestedScopes,
+            expiresAt,
+            nextPollAt: new Date(now.getTime() + authorization.interval * 1000),
+            interval: authorization.interval,
+        };
+        const store = firstContribution(this.#reactor, AuthorizationStateStores, "authorization state store");
+        await store.put(reference, pending, { expiresAt });
+        return {
+            reference,
+            userCode: authorization.userCode,
+            verificationUri: authorization.verificationUri,
+            ...(authorization.verificationUriComplete === undefined
+                ? {}
+                : { verificationUriComplete: authorization.verificationUriComplete }),
+            expiresAt,
+            pollInterval: authorization.interval,
+            requestedScopes,
+        };
+    }
+    async poll(reference, signal) {
+        const store = firstContribution(this.#reactor, AuthorizationStateStores, "authorization state store");
+        const pending = await store.take(reference);
+        if (!isPending(pending)) {
+            throw new AuthorizationError("invalid_or_expired_device_session", "Device Sign-In is unknown, expired, complete, or already being polled");
+        }
+        const clock = firstContribution(this.#reactor, Clocks, "clock");
+        const now = clock.now();
+        if (now.getTime() >= pending.expiresAt.getTime()) {
+            throw new AuthorizationError("expired_token", "Device Sign-In has expired");
+        }
+        if (now.getTime() < pending.nextPollAt.getTime()) {
+            await store.put(reference, pending, { expiresAt: pending.expiresAt });
+            return { status: "pending", retryAt: pending.nextPollAt, grantedScopes: [], missingScopes: [] };
+        }
+        try {
+            const result = await this.#pollToken(pending, now, signal);
+            if (result.response.ok)
+                return await this.#complete(result.response, result.payload, pending);
+            const source = typeof result.payload === "object" && result.payload !== null ? result.payload : {};
+            const remote = "error" in source ? source.error : undefined;
+            if (remote === "authorization_pending" || remote === "slow_down") {
+                const interval = pending.interval + (remote === "slow_down" ? 5 : 0);
+                const resumed = { ...pending, interval, nextPollAt: new Date(now.getTime() + interval * 1000) };
+                await store.put(reference, resumed, { expiresAt: pending.expiresAt });
+                return { status: "pending", retryAt: resumed.nextPollAt, grantedScopes: [], missingScopes: [] };
+            }
+            if (remote === "access_denied" || remote === "expired_token") {
+                throw new AuthorizationError(remote, "Device Sign-In ended without authorization");
+            }
+            await store.put(reference, pending, { expiresAt: pending.expiresAt });
+            throw this.#remoteError(result.response, result.payload, "Company refused the device token request");
+        }
+        catch (cause) {
+            if (cause instanceof AuthorizationError && ["access_denied", "expired_token"].includes(cause.code)) {
+                throw cause;
+            }
+            const existing = await store.take(reference);
+            if (existing === undefined)
+                await store.put(reference, pending, { expiresAt: pending.expiresAt });
+            throw cause;
+        }
+    }
+    async #pollToken(pending, now, signal) {
+        const random = firstContribution(this.#reactor, RandomSources, "random source");
+        const signer = firstContribution(this.#reactor, Signers, "signer");
+        const dpop = firstContribution(this.#reactor, DpopProofProviders, "DPoP proof provider");
+        const assertion = await signer.sign(this.#claims(pending.clientId, pending.tokenEndpoint, now, random.bytes(16)), { purpose: "client_assertion" });
+        const proof = await dpop.create({
+            method: "POST",
+            url: pending.tokenEndpoint,
+            tenantId: pending.tenantId,
+            subject: pending.pairwiseUserId,
+            issuer: pending.issuer,
+        });
+        const response = await this.#request(pending.tokenEndpoint, new URLSearchParams({
+            grant_type: DEVICE_CODE_GRANT,
+            device_code: pending.deviceCode.reveal(),
+            session_id: pending.sessionId,
+            client_id: pending.clientId,
+            client_assertion_type: JWT_CLIENT_ASSERTION,
+            client_assertion: assertion.reveal(),
+        }), proof.reveal(), signal);
+        return { response, payload: await this.#decode(response, "Device token") };
+    }
+    async #complete(response, payload, pending) {
+        let token;
+        try {
+            token = parseSessionToken(payload);
+        }
+        catch (cause) {
+            throw new AuthorizationError("invalid_token_response", "Device token response is malformed", {
+                statusCode: response.status,
+                cause,
+            });
+        }
+        if (token.tokenType !== "DPoP" || !token.signedIn || token.sessionId !== pending.sessionId) {
+            throw new AuthorizationError("invalid_token_response", "Device Sign-In must return the signed-in proof-bound Session", { statusCode: response.status });
+        }
+        if (token.scopes.some((scope) => !pending.scopes.includes(scope))) {
+            throw new AuthorizationError("scope_escalation", "Company returned an unrequested scope");
+        }
+        if (!token.accountToken) {
+            throw new AuthorizationError("missing_account_token", "Device Sign-In did not return an Account Token");
+        }
+        const random = firstContribution(this.#reactor, RandomSources, "random source");
+        const accountTokenReference = opaqueId("account", random.bytes(16));
+        const tokens = firstContribution(this.#reactor, TokenStores, "token store");
+        await tokens.put(accountTokenReference, token.accountToken);
+        const { accountToken: _accountToken, ...publicToken } = token;
+        return {
+            status: "complete",
+            token: publicToken,
+            accountTokenReference,
+            grantedScopes: publicToken.scopes,
+            missingScopes: pending.scopes.filter((scope) => !publicToken.scopes.includes(scope)),
+        };
+    }
+    #claims(clientId, audience, now, entropy) {
+        const iat = Math.floor(now.getTime() / 1000);
+        return { iss: clientId, sub: clientId, aud: audience, iat, exp: iat + 60, jti: opaqueId("jti", entropy) };
+    }
+    #validateContext(options) {
+        if (!options.tenantId || options.tenantId.length > 256)
+            throw new RangeError("Invalid tenantId");
+        const identifiers = [
+            ["pairwiseUserId", options.pairwiseUserId],
+            ["sessionId", options.sessionId],
+        ];
+        for (const [label, value] of identifiers) {
+            if (!/^[A-Za-z0-9_-]{1,256}$/.test(value)) {
+                throw new AuthorizationError("invalid_context", `Invalid ${label}`);
+            }
+        }
+    }
+    async #request(url, body, dpop, signal) {
+        try {
+            return await this.#fetch(url, {
+                method: "POST",
+                headers: { Accept: "application/json", ...(dpop === undefined ? {} : { DPoP: dpop }) },
+                body,
+                credentials: "omit",
+                redirect: "error",
+                ...(signal === undefined ? {} : { signal }),
+            });
+        }
+        catch (cause) {
+            throw new AuthorizationError("request_failed", "Device Sign-In request failed", { cause });
+        }
+    }
+    async #decode(response, label) {
+        if (response.headers.get("content-type")?.split(";", 1)[0]?.trim() !== "application/json") {
+            throw new AuthorizationError("invalid_content_type", `${label} endpoint must return JSON`, {
+                statusCode: response.status,
+            });
+        }
+        const body = await response.text();
+        if (new TextEncoder().encode(body).byteLength > this.#maxResponseBytes) {
+            throw new AuthorizationError("response_too_large", `${label} response exceeds size limit`, {
+                statusCode: response.status,
+            });
+        }
+        try {
+            return parseJsonStrict(body);
+        }
+        catch (cause) {
+            throw new AuthorizationError("invalid_json", `${label} endpoint returned invalid JSON`, {
+                statusCode: response.status,
+                cause,
+            });
+        }
+    }
+    #remoteError(response, payload, message) {
+        const source = typeof payload === "object" && payload !== null ? payload : {};
+        const remote = "error" in source ? source.error : undefined;
+        return new AuthorizationError(typeof remote === "string" ? remote : "http_error", message, {
+            statusCode: response.status,
+        });
+    }
+}
+//# sourceMappingURL=device.js.map

package/lib/device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.js","sourceRoot":"","sources":["../src/device.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EACL,wBAAwB,EACxB,MAAM,EACN,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,WAAW,EACX,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAqB,MAAM,eAAe,CAAC;AAE3F,MAAM,CAAC,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AAEhF,SAAS,QAAQ,CAAC,KAAa,EAAE,KAAa;IAC5C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,MAAyB;IACvC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,6BAA6B,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,4CAA4C,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,MAAM,QAAQ,GAAG,kEAAkE,CAAC;IACpF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,KAAiB;IACjD,IAAI,KAAK,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,EAAE,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAWD,SAAS,wBAAwB,CAAC,KAAc;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAK,SAAoB,IAAI,CAAC,IAAK,SAAoB,GAAG,IAAI,EAAE,CAAC;QAC/F,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,EAAE,4BAA4B,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAK,QAAmB,IAAI,CAAC,IAAK,QAAmB,GAAG,GAAG,EAAE,CAAC;QAC3F,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,yBAAyB,CAAC;IAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,kBAAkB,CAC1B,yBAAyB,EACzB,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU,EAAE,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACtE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;QAC/C,eAAe,EAAE,QAAQ,CACvB,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,EACnD,kBAAkB,CACnB;QACD,GAAG,CAAC,QAAQ,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC,EAAE,CAAC;QACjF,SAAS,EAAE,SAAmB;QAC9B,QAAQ,EAAE,QAAkB;KAC7B,CAAC;AACJ,CAAC;AAiBD,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,OAAO,GAAG,KAAqC,CAAC;IACtD,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,uBAAuB;QACxC,OAAO,CAAC,UAAU,YAAY,WAAW;QACzC,OAAO,CAAC,SAAS,YAAY,IAAI;QACjC,OAAO,CAAC,UAAU,YAAY,IAAI;QAClC,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ;QACzC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CACrC,CAAC;AACJ,CAAC;AAuCD,sFAAsF;AACtF,MAAM,OAAO,kBAAkB;IACpB,QAAQ,CAAsB;IAC9B,MAAM,CAA0B;IAChC,iBAAiB,CAAS;IAEnC,YAAY,OAAkC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;QACtG,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,GAAG,IAAI,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;QACtG,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtB,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAiC;QAC3C,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,2BAA2B,EAAE,6BAA6B,CAAC,CAAC;QAC9F,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxD,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACxB,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,IAAI,CACvC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EACvD,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAChC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAClC,QAAQ,EACR,IAAI,eAAe,CAAC;YAClB,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;YAChC,SAAS,EAAE,QAAQ;YACnB,qBAAqB,EAAE,oBAAoB;YAC3C,gBAAgB,EAAE,eAAe,CAAC,MAAM,EAAE;SAC3C,CAAC,EACF,SAAS,EACT,OAAO,CAAC,MAAM,CACf,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,gCAAgC,CAAC,CAAC;QAC/F,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAwB;YACnC,IAAI,EAAE,uBAAuB;YAC7B,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,aAAa;YACb,MAAM;YACN,QAAQ;YACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,eAAe;YACvB,SAAS;YACT,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAC;YACnE,QAAQ,EAAE,aAAa,CAAC,QAAQ;SACjC,CAAC;QACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,2BAA2B,CAAC,CAAC;QACtG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACnD,OAAO;YACL,SAAS;YACT,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,eAAe,EAAE,aAAa,CAAC,eAAe;YAC9C,GAAG,CAAC,aAAa,CAAC,uBAAuB,KAAK,SAAS;gBACrD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,uBAAuB,EAAE,aAAa,CAAC,uBAAuB,EAAE,CAAC;YACvE,SAAS;YACT,YAAY,EAAE,aAAa,CAAC,QAAQ;YACpC,eAAe;SAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,MAAoB;QAChD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,2BAA2B,CAAC,CAAC;QACtG,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,kBAAkB,CAC1B,mCAAmC,EACnC,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACxB,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACtE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAClG,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9F,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,CAAC,CAAC,CAAE,MAA8B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YACrF,IAAI,MAAM,KAAK,uBAAuB,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrE,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC;gBAChG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;gBACtE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;YAClG,CAAC;YACD,IAAI,MAAM,KAAK,eAAe,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;gBAC7D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,4CAA4C,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,0CAA0C,CAAC,CAAC;QACvG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnG,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YAClG,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAA4B,EAAE,GAAS,EAAE,MAAoB;QAC5E,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CACjC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAC5E,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAChC,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC9B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,OAAO,CAAC,aAAa;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,cAAc;YAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAClC,OAAO,CAAC,aAAa,EACrB,IAAI,eAAe,CAAC;YAClB,UAAU,EAAE,iBAAiB;YAC7B,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE;YACxC,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,qBAAqB,EAAE,oBAAoB;YAC3C,gBAAgB,EAAE,SAAS,CAAC,MAAM,EAAE;SACrC,CAAC,EACF,KAAK,CAAC,MAAM,EAAE,EACd,MAAM,CACP,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAkB,EAAE,OAAgB,EAAE,OAA4B;QAChF,IAAI,KAAmB,CAAC;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,oCAAoC,EAAE;gBAC3F,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YAC3F,MAAM,IAAI,kBAAkB,CAC1B,wBAAwB,EACxB,8DAA8D,EAC9D,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,uCAAuC,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,EAAE,gDAAgD,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;QAChF,MAAM,qBAAqB,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAC5E,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5D,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,GAAG,KAAK,CAAC;QAC9D,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,WAAW;YAClB,qBAAqB;YACrB,aAAa,EAAE,WAAW,CAAC,MAAM;YACjC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SACrF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,QAAgB,EAAE,GAAS,EAAE,OAAmB;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;IAC5G,CAAC;IAED,gBAAgB,CAAC,OAAiC;QAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,CAAC,CAAC;QACjG,MAAM,WAAW,GAA6C;YAC5D,CAAC,gBAAgB,EAAE,OAAO,CAAC,cAAc,CAAC;YAC1C,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC;SACjC,CAAC;QACF,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;YACzC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAqB,EAAE,IAAa,EAAE,MAAoB;QACpF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC5B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE;gBACtF,IAAI;gBACJ,WAAW,EAAE,MAAM;gBACnB,QAAQ,EAAE,OAAO;gBACjB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAkB,EAAE,KAAa;QAC7C,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,kBAAkB,EAAE,CAAC;YAC1F,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,EAAE,GAAG,KAAK,4BAA4B,EAAE;gBACzF,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvE,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,GAAG,KAAK,8BAA8B,EAAE;gBACzF,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAAC,cAAc,EAAE,GAAG,KAAK,iCAAiC,EAAE;gBACtF,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,KAAK;aACN,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,YAAY,CAAC,QAAkB,EAAE,OAAgB,EAAE,OAAe;QAChE,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,CAAC,CAAC,CAAE,MAA8B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,OAAO,IAAI,kBAAkB,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE;YACzF,UAAU,EAAE,QAAQ,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;CACF"}

package/lib/index.d.ts

@@ -4,6 +4,7 @@ export { DpopFetchClient, type DpopFetchClientOptions, type DpopFetchRequestOpti
 export { BROWSER_ASSERTION_TYPE, BrowserSessionClient, buildBrowserAssertionClaims, type BrowserAssertionClaims, type BrowserAssertionOptions, type BrowserSessionStart, } from "./browser.js";
 export { JoseDpopProofProvider, type DpopKeyMaterial, type DpopKeyResolver, type JoseAlgorithm, type JoseDpopProofProviderOptions, } from "./crypto.js";
 export { AuthorizationCodeGrant, DirectSignInClient, buildDirectSignInRequest, validateDirectSignInCallback, type AuthorizationCodeGrantOptions, type DirectSignInBeginOptions, type DirectSignInCallback, type DirectSignInClientOptions, type DirectSignInCompleteOptions, type DirectSignInOptions, type DirectSignInRequest, type DirectSignInResult, type DirectSignInStart, } from "./auth.js";
+export { DEVICE_CODE_GRANT, DeviceSignInClient, type DeviceSignInBeginOptions, type DeviceSignInClientOptions, type DeviceSignInPoll, type DeviceSignInStart, } from "./device.js";
 export { discoverCompany, type DiscoveryOptions } from "./discovery.js";
 export { AgentIdentityClient, type AgentIdentityClientOptions, type IdentityRequestOptions, } from "./identity.js";
 export { parseJsonStrict } from "./json.js";

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,0BAA0B,EAC1B,UAAU,EACV,uBAAuB,EACvB,YAAY,EACZ,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,4BAA4B,GAClC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,4BAA4B,EAC5B,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,MAAM,EACN,MAAM,EACN,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,EACT,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,OAAO,EACP,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,KAAK,EACV,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,2BAA2B,EAC3B,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,YAAY,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,YAAY,EACZ,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,0BAA0B,EAC1B,UAAU,EACV,uBAAuB,EACvB,YAAY,EACZ,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,4BAA4B,GAClC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,4BAA4B,EAC5B,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,MAAM,EACN,MAAM,EACN,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,EACT,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,OAAO,EACP,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,KAAK,EACV,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,2BAA2B,EAC3B,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,YAAY,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,YAAY,EACZ,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC"}

package/lib/index.js

@@ -12,6 +12,8 @@ import {
   Clocks,
   ConversationClient,
   ConversationError,
+  DEVICE_CODE_GRANT,
+  DeviceSignInClient,
   DirectSignInClient,
   DiscoveryError,
   DiscoveryTransports,
@@ -58,7 +60,7 @@ import {
   parseSessionToken,
   resolvePairwiseUserId,
   validateDirectSignInCallback
-} from "./chunk-TU6B5MQ7.js";
+} from "./chunk-JIMKKTDT.js";
 export {
   AgentIdentityClient,
   AuthorizationCodeGrant,
@@ -73,6 +75,8 @@ export {
   Clocks,
   ConversationClient,
   ConversationError,
+  DEVICE_CODE_GRANT,
+  DeviceSignInClient,
   DirectSignInClient,
   DiscoveryError,
   DiscoveryTransports,

package/lib/reactor.js

@@ -50,7 +50,7 @@ export function createPapCorePlugin(options = {}) {
     }
     return definePlugin({
         name: "@datalayer/personal-agent-protocol-core",
-        version: "0.3.2",
+        version: "0.3.3",
         contributionPoints: [
             DiscoveryTransports,
             UrlSafetyPolicies,

package/lib/server.js

@@ -10,7 +10,7 @@ import {
   jwtVerify,
   validateBrowserClaimIdentity,
   verifyDpopProof
-} from "./chunk-TU6B5MQ7.js";
+} from "./chunk-JIMKKTDT.js";
 
 // src/server.ts
 import { lookup } from "node:dns/promises";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datalayer/personal-agent-protocol",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "TypeScript SDK for Personal Agent Protocol",
   "repository": {
     "type": "git",