@grantex/sdk 0.3.13 → 0.4.1

package/dist/oauth-agent.js

@@ -0,0 +1,359 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { calculateJwkThumbprint, exportJWK, generateKeyPair, importJWK, jwtVerify, SignJWT, } from 'jose';
+import { generatePkce } from './pkce.js';
+const TOKEN_EXCHANGE_GRANT = 'urn:ietf:params:oauth:grant-type:token-exchange';
+const ACCESS_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:access_token';
+export async function generateOAuthAgentKey() {
+    const generated = await generateKeyPair('ES256', { extractable: true });
+    const publicJwk = await exportJWK(generated.publicKey);
+    return {
+        privateKey: generated.privateKey,
+        publicJwk,
+        thumbprint: await calculateJwkThumbprint(publicJwk, 'sha256'),
+    };
+}
+export class OAuthAgentClient {
+    metadata;
+    clientId;
+    redirectUri;
+    resource;
+    publicJwk;
+    keyThumbprint;
+    #privateKey;
+    #allowInsecureLoopback;
+    #pending = new Map();
+    constructor(options) {
+        this.metadata = options.metadata;
+        this.clientId = options.clientId;
+        this.redirectUri = options.redirectUri;
+        this.resource = options.resource;
+        this.#privateKey = options.privateKey;
+        this.#allowInsecureLoopback = options.allowInsecureLoopback;
+        this.publicJwk = options.publicJwk;
+        this.keyThumbprint = options.keyThumbprint;
+    }
+    static async create(options) {
+        const expectedIssuer = options.issuer;
+        const allowInsecureLoopback = options.allowInsecureLoopback === true;
+        assertSecureEndpoint(expectedIssuer, allowInsecureLoopback);
+        const issuerUrl = new URL(expectedIssuer);
+        if (issuerUrl.search || issuerUrl.hash) {
+            throw new Error('issuer must not contain a query or fragment');
+        }
+        assertSecureEndpoint(options.redirectUri, allowInsecureLoopback);
+        assertSecureEndpoint(options.resource, allowInsecureLoopback);
+        if (new URL(options.redirectUri).hash || new URL(options.resource).hash) {
+            throw new Error('redirectUri and resource must not contain fragments');
+        }
+        const metadataUrl = authorizationServerMetadataUrl(expectedIssuer);
+        assertSecureEndpoint(metadataUrl, options.allowInsecureLoopback === true);
+        const response = await fetch(metadataUrl, { headers: { Accept: 'application/json' } });
+        if (!response.ok)
+            throw new Error(`Authorization-server metadata request failed with HTTP ${response.status}`);
+        const metadata = response.json();
+        const validatedMetadata = validateMetadata(await metadata, expectedIssuer, allowInsecureLoopback);
+        let privateKey = options.privateKey;
+        let publicJwk = options.publicJwk;
+        if ((privateKey === undefined) !== (publicJwk === undefined)) {
+            throw new Error('privateKey and publicJwk must be provided together');
+        }
+        if (!privateKey || !publicJwk) {
+            const generated = await generateOAuthAgentKey();
+            privateKey = generated.privateKey;
+            publicJwk = generated.publicJwk;
+        }
+        await validateAgentKeyPair(privateKey, publicJwk);
+        const keyThumbprint = await calculateJwkThumbprint(publicJwk, 'sha256');
+        return new OAuthAgentClient({
+            metadata: validatedMetadata,
+            clientId: options.clientId,
+            redirectUri: options.redirectUri,
+            resource: options.resource,
+            privateKey,
+            publicJwk,
+            keyThumbprint,
+            allowInsecureLoopback,
+        });
+    }
+    async beginAuthorization(options) {
+        if (options.scopes.length === 0 || options.scopes.length > 100
+            || new Set(options.scopes).size !== options.scopes.length
+            || options.scopes.some((scope) => scope.length === 0 || scope.length > 256
+                || !/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(scope))) {
+            throw new Error('scopes must be a non-empty set of valid OAuth scope tokens');
+        }
+        if (options.principalHint !== undefined
+            && (options.principalHint.length === 0 || options.principalHint.length > 256)) {
+            throw new Error('principalHint must contain 1 to 256 characters');
+        }
+        const state = randomBytes(32).toString('base64url');
+        const pkce = generatePkce();
+        const params = new URLSearchParams({
+            client_id: this.clientId,
+            response_type: 'code',
+            redirect_uri: this.redirectUri,
+            scope: options.scopes.join(' '),
+            state,
+            code_challenge: pkce.codeChallenge,
+            code_challenge_method: pkce.codeChallengeMethod,
+            resource: this.resource,
+            dpop_jkt: this.keyThumbprint,
+        });
+        if (options.principalHint !== undefined)
+            params.set('login_hint', options.principalHint);
+        if (options.authorizationDetails) {
+            params.set('authorization_details', JSON.stringify(options.authorizationDetails));
+        }
+        const proof = await this.createDpopProof('POST', this.metadata.pushed_authorization_request_endpoint);
+        const response = await fetch(this.metadata.pushed_authorization_request_endpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+                DPoP: proof,
+            },
+            body: params,
+        });
+        const result = await oauthJson(response);
+        this.#pending.set(state, {
+            codeVerifier: pkce.codeVerifier,
+            redirectUri: this.redirectUri,
+            issuer: this.metadata.issuer,
+            consumed: false,
+        });
+        const authorizationUrl = new URL(this.metadata.authorization_endpoint);
+        authorizationUrl.searchParams.set('client_id', this.clientId);
+        authorizationUrl.searchParams.set('request_uri', result.request_uri);
+        return {
+            authorizationUrl: authorizationUrl.toString(),
+            requestUri: result.request_uri,
+            state,
+            expiresIn: result.expires_in,
+        };
+    }
+    async completeAuthorization(callbackUrl) {
+        const callback = new URL(callbackUrl);
+        const state = callback.searchParams.get('state');
+        if (!state)
+            throw new Error('Authorization response is missing state');
+        const pending = this.#pending.get(state);
+        if (!pending || pending.consumed)
+            throw new Error('Authorization response state is unknown or already consumed');
+        assertRedirectResponse(callback, pending.redirectUri);
+        pending.consumed = true;
+        this.#pending.delete(state);
+        const responseIssuer = callback.searchParams.get('iss');
+        if (responseIssuer !== pending.issuer)
+            throw new Error('Authorization response issuer does not match the initiating session');
+        const error = callback.searchParams.get('error');
+        if (error)
+            throw new Error(`Authorization failed: ${error}`);
+        const code = callback.searchParams.get('code');
+        if (!code)
+            throw new Error('Authorization response is missing code');
+        return this.tokenRequest(new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            client_id: this.clientId,
+            redirect_uri: pending.redirectUri,
+            code_verifier: pending.codeVerifier,
+        }));
+    }
+    refresh(refreshToken) {
+        return this.tokenRequest(new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: this.clientId,
+        }));
+    }
+    attenuate(accessToken, scopes) {
+        return this.tokenRequest(new URLSearchParams({
+            grant_type: TOKEN_EXCHANGE_GRANT,
+            client_id: this.clientId,
+            subject_token: accessToken,
+            subject_token_type: ACCESS_TOKEN_TYPE,
+            requested_token_type: ACCESS_TOKEN_TYPE,
+            scope: scopes.join(' '),
+            resource: this.resource,
+        }));
+    }
+    async revoke(token, tokenTypeHint) {
+        const proof = await this.createDpopProof('POST', this.metadata.revocation_endpoint);
+        const params = new URLSearchParams({ client_id: this.clientId, token });
+        if (tokenTypeHint)
+            params.set('token_type_hint', tokenTypeHint);
+        const response = await fetch(this.metadata.revocation_endpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                DPoP: proof,
+            },
+            body: params,
+        });
+        if (!response.ok)
+            await oauthJson(response);
+    }
+    async fetch(input, accessToken, init = {}) {
+        const target = new URL(input);
+        const resource = new URL(this.resource);
+        if (target.origin !== resource.origin) {
+            throw new Error('Protected-resource request origin does not match the configured resource');
+        }
+        assertSecureEndpoint(target.toString(), this.#allowInsecureLoopback);
+        const method = (init.method ?? 'GET').toUpperCase();
+        const proof = await this.createDpopProof(method, target.toString(), accessToken);
+        const headers = new Headers(init.headers);
+        headers.set('Authorization', `DPoP ${accessToken}`);
+        headers.set('DPoP', proof);
+        return fetch(target, { ...init, method, headers });
+    }
+    async createDpopProof(method, targetUri, accessToken) {
+        const target = new URL(targetUri);
+        target.search = '';
+        target.hash = '';
+        return new SignJWT({
+            htm: method.toUpperCase(),
+            htu: target.toString(),
+            jti: randomUUID(),
+            iat: Math.floor(Date.now() / 1000),
+            ...(accessToken
+                ? { ath: createHash('sha256').update(accessToken, 'ascii').digest('base64url') }
+                : {}),
+        })
+            .setProtectedHeader({ typ: 'dpop+jwt', alg: 'ES256', jwk: this.publicJwk })
+            .sign(this.#privateKey);
+    }
+    async tokenRequest(params) {
+        const proof = await this.createDpopProof('POST', this.metadata.token_endpoint);
+        const response = await fetch(this.metadata.token_endpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+                DPoP: proof,
+            },
+            body: params,
+        });
+        const result = await oauthJson(response);
+        return validateTokenResponse(result);
+    }
+}
+function validateMetadata(value, expectedIssuer, allowInsecureLoopback) {
+    if (!value || typeof value !== 'object' || value.issuer !== expectedIssuer) {
+        throw new Error('Authorization-server metadata issuer does not match the configured issuer');
+    }
+    const endpoints = [
+        value.authorization_endpoint,
+        value.token_endpoint,
+        value.jwks_uri,
+        value.revocation_endpoint,
+        value.pushed_authorization_request_endpoint,
+    ];
+    if (endpoints.some((endpoint) => typeof endpoint !== 'string')) {
+        throw new Error('Authorization-server metadata is missing a required endpoint');
+    }
+    for (const endpoint of endpoints)
+        assertSecureEndpoint(endpoint, allowInsecureLoopback);
+    if (value.require_pushed_authorization_requests !== true
+        || value.authorization_response_iss_parameter_supported !== true
+        || !value.response_types_supported?.includes('code')
+        || !value.grant_types_supported?.includes('authorization_code')
+        || !value.grant_types_supported?.includes(TOKEN_EXCHANGE_GRANT)
+        || !value.grant_types_supported?.includes('refresh_token')
+        || !value.code_challenge_methods_supported?.includes('S256')
+        || !value.dpop_signing_alg_values_supported?.includes('ES256')
+        || !value.token_endpoint_auth_methods_supported?.includes('none')
+        || !value.revocation_endpoint_auth_methods_supported?.includes('none')) {
+        throw new Error('Authorization server does not advertise the capabilities required by the agent-grants profile');
+    }
+    return value;
+}
+function assertSecureEndpoint(value, allowInsecureLoopback) {
+    const parsed = new URL(value);
+    const loopback = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1' || parsed.hostname === '[::1]';
+    if (parsed.protocol !== 'https:' && !(allowInsecureLoopback && loopback && parsed.protocol === 'http:')) {
+        throw new Error(`OAuth endpoint must use HTTPS: ${value}`);
+    }
+    if (parsed.username || parsed.password || parsed.hash)
+        throw new Error(`OAuth endpoint is malformed: ${value}`);
+}
+async function validateAgentKeyPair(privateKey, publicJwk) {
+    const privateFields = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k'];
+    if (privateFields.some((field) => publicJwk[field] !== undefined)) {
+        throw new Error('publicJwk must not contain private key material');
+    }
+    if (publicJwk.kty !== 'EC' || publicJwk.crv !== 'P-256'
+        || typeof publicJwk.x !== 'string' || typeof publicJwk.y !== 'string') {
+        throw new Error('OAuthAgentClient requires an ES256 P-256 public JWK');
+    }
+    try {
+        const probe = await new SignJWT({ probe: true })
+            .setProtectedHeader({ alg: 'ES256' })
+            .setIssuedAt()
+            .sign(privateKey);
+        const publicKey = await importJWK(publicJwk, 'ES256');
+        await jwtVerify(probe, publicKey, { algorithms: ['ES256'] });
+    }
+    catch {
+        throw new Error('privateKey does not match publicJwk or cannot sign ES256 proofs');
+    }
+}
+function assertRedirectResponse(callback, registeredRedirectUri) {
+    const registered = new URL(registeredRedirectUri);
+    if (registered.hash || callback.hash || callback.origin !== registered.origin
+        || callback.pathname !== registered.pathname
+        || callback.username || callback.password) {
+        throw new Error('Authorization response URL does not match the registered redirect URI');
+    }
+    for (const [name, value] of registered.searchParams) {
+        if (callback.searchParams.get(name) !== value) {
+            throw new Error('Authorization response URL does not match the registered redirect URI');
+        }
+    }
+    const responseParameters = new Set([
+        'code', 'state', 'iss', 'error', 'error_description', 'error_uri',
+    ]);
+    for (const name of responseParameters) {
+        if (callback.searchParams.getAll(name).length > 1) {
+            throw new Error(`Authorization response parameter ${name} must occur at most once`);
+        }
+    }
+    for (const name of callback.searchParams.keys()) {
+        if (!registered.searchParams.has(name) && !responseParameters.has(name)) {
+            throw new Error('Authorization response contains an unexpected redirect parameter');
+        }
+    }
+}
+function authorizationServerMetadataUrl(issuer) {
+    const parsed = new URL(issuer);
+    const issuerPath = parsed.pathname === '/' ? '' : parsed.pathname.replace(/\/$/, '');
+    parsed.pathname = `/.well-known/oauth-authorization-server${issuerPath}`;
+    parsed.search = '';
+    parsed.hash = '';
+    return parsed.toString();
+}
+function validateTokenResponse(value) {
+    if (!value || typeof value !== 'object'
+        || typeof value.access_token !== 'string' || value.access_token.length === 0
+        || value.token_type !== 'DPoP'
+        || typeof value.expires_in !== 'number' || !Number.isSafeInteger(value.expires_in)
+        || value.expires_in <= 0
+        || typeof value.scope !== 'string' || value.scope.length === 0
+        || (value.refresh_token !== undefined
+            && (typeof value.refresh_token !== 'string' || value.refresh_token.length === 0))
+        || (value.issued_token_type !== undefined
+            && value.issued_token_type !== ACCESS_TOKEN_TYPE)) {
+        throw new Error('Authorization server returned an invalid DPoP token response');
+    }
+    return value;
+}
+async function oauthJson(response) {
+    const body = await response.json().catch(() => null);
+    if (!response.ok) {
+        const error = typeof body?.['error'] === 'string' ? body['error'] : `HTTP ${response.status}`;
+        const description = typeof body?.['error_description'] === 'string' ? body['error_description'] : '';
+        throw new Error(description ? `${error}: ${description}` : error);
+    }
+    return body;
+}
+//# sourceMappingURL=oauth-agent.js.map

package/dist/oauth-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-agent.js","sourceRoot":"","sources":["../src/oauth-agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EACL,sBAAsB,EACtB,SAAS,EACT,eAAe,EACf,SAAS,EACT,SAAS,EACT,OAAO,GAGR,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,oBAAoB,GAAG,iDAAiD,CAAC;AAC/E,MAAM,iBAAiB,GAAG,+CAA+C,CAAC;AAmC1E,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACvD,OAAO;QACL,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,SAAS;QACT,UAAU,EAAE,MAAM,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC;KAC9D,CAAC;AACJ,CAAC;AA+BD,MAAM,OAAO,gBAAgB;IAClB,QAAQ,CAAmC;IAC3C,QAAQ,CAAS;IACjB,WAAW,CAAS;IACpB,QAAQ,CAAS;IACjB,SAAS,CAAM;IACf,aAAa,CAAS;IAEtB,WAAW,CAAY;IACvB,sBAAsB,CAAU;IAChC,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEpD,YAAoB,OASnB;QACC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC;QAC5D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAgC;QAClD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;QACtC,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,KAAK,IAAI,CAAC;QACrE,oBAAoB,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1C,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QACjE,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC9D,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,WAAW,GAAG,8BAA8B,CAAC,cAAc,CAAC,CAAC;QACnE,oBAAoB,CAAC,WAAW,EAAE,OAAO,CAAC,qBAAqB,KAAK,IAAI,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAA+C,CAAC;QAC9E,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,QAAQ,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;QAElG,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACpC,IAAI,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAChD,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;YAClC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;QAClC,CAAC;QACD,MAAM,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACxE,OAAO,IAAI,gBAAgB,CAAC;YAC1B,QAAQ,EAAE,iBAAiB;YAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU;YACV,SAAS;YACT,aAAa;YACb,qBAAqB;SACtB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAuC;QAC9D,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG;eACvD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM;eACtD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;mBACrE,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;eAChC,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM;YACrB,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/B,KAAK;YACL,cAAc,EAAE,IAAI,CAAC,aAAa;YAClC,qBAAqB,EAAE,IAAI,CAAC,mBAAmB;YAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,aAAa;SAC7B,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACzF,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QACtG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE;YAChF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;gBAC1B,IAAI,EAAE,KAAK;aACZ;YACD,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAA8C,QAAQ,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YAC5B,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QACvE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,OAAO;YACL,gBAAgB,EAAE,gBAAgB,CAAC,QAAQ,EAAE;YAC7C,UAAU,EAAE,MAAM,CAAC,WAAW;YAC9B,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,WAAmB;QAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjH,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACtD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE5B,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,cAAc,KAAK,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QAC9H,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAErE,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,eAAe,CAAC;YAC3C,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,aAAa,EAAE,OAAO,CAAC,YAAY;SACpC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,OAAO,CAAC,YAAoB;QAC1B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,eAAe,CAAC;YAC3C,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,SAAS,CAAC,WAAmB,EAAE,MAAgB;QAC7C,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,eAAe,CAAC;YAC3C,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,aAAa,EAAE,WAAW;YAC1B,kBAAkB,EAAE,iBAAiB;YACrC,oBAAoB,EAAE,iBAAiB;YACvC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,aAAgD;QAC1E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,IAAI,aAAa;YAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE;YAC9D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,IAAI,EAAE,KAAK;aACZ;YACD,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAmB,EAAE,WAAmB,EAAE,IAAI,GAAgB,EAAE;QAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QACD,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,WAAW,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,SAAiB,EAAE,WAAoB;QAC3E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACjB,OAAO,IAAI,OAAO,CAAC;YACjB,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE;YACzB,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE;YACtB,GAAG,EAAE,UAAU,EAAE;YACjB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,CAAC,WAAW;gBACb,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;gBAChF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;aACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;aAC1E,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAuB;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;gBAC1B,IAAI,EAAE,KAAK;aACZ;YACD,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAA0B,QAAQ,CAAC,CAAC;QAClE,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;CACF;AAED,SAAS,gBAAgB,CACvB,KAAuC,EACvC,cAAsB,EACtB,qBAA8B;IAE9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,KAAK,CAAC,sBAAsB;QAC5B,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,mBAAmB;QACzB,KAAK,CAAC,qCAAqC;KAC5C,CAAC;IACF,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,oBAAoB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,qCAAqC,KAAK,IAAI;WACjD,KAAK,CAAC,8CAA8C,KAAK,IAAI;WAC7D,CAAC,KAAK,CAAC,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC;WACjD,CAAC,KAAK,CAAC,qBAAqB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;WAC5D,CAAC,KAAK,CAAC,qBAAqB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;WAC5D,CAAC,KAAK,CAAC,qBAAqB,EAAE,QAAQ,CAAC,eAAe,CAAC;WACvD,CAAC,KAAK,CAAC,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC;WACzD,CAAC,KAAK,CAAC,iCAAiC,EAAE,QAAQ,CAAC,OAAO,CAAC;WAC3D,CAAC,KAAK,CAAC,qCAAqC,EAAE,QAAQ,CAAC,MAAM,CAAC;WAC9D,CAAC,KAAK,CAAC,0CAA0C,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,qBAA8B;IACzE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;IACnH,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,qBAAqB,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;AAClH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,UAAqB,EAAE,SAAc;IACvE,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAkB,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,KAAK,OAAO;WAChD,OAAO,SAAS,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,SAAS,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;aAC7C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,WAAW,EAAE;aACb,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAa,EAAE,qBAA6B;IAC1E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;WACtE,QAAQ,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;WACzC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;QACpD,IAAI,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;QACjC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW;KAClE,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,0BAA0B,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CAAC,MAAc;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrF,MAAM,CAAC,QAAQ,GAAG,0CAA0C,UAAU,EAAE,CAAC;IACzE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,qBAAqB,CAAC,KAA8B;IAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;WAChC,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;WACzE,KAAK,CAAC,UAAU,KAAK,MAAM;WAC3B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;WAC/E,KAAK,CAAC,UAAU,IAAI,CAAC;WACrB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;WAC3D,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS;eAChC,CAAC,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;WAChF,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS;eACpC,KAAK,CAAC,iBAAiB,KAAK,iBAAiB,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,SAAS,CAAc,QAAkB;IACtD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAmC,CAAC;IACvF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC9F,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,IAAS,CAAC;AACnB,CAAC"}

package/dist/prepaid-wallets.d.ts

@@ -0,0 +1,179 @@
+import type { OAuthAgentClient } from './oauth-agent.js';
+export type PrepaidCustodyMode = 'sandbox_ledger' | 'external';
+export type PrepaidWalletStatus = 'active' | 'blocked' | 'closed';
+export type WalletAssignmentStatus = 'active' | 'blocked' | 'revoked';
+export interface PrepaidWallet {
+    walletId: string;
+    principalId: string;
+    name: string;
+    custodyMode: PrepaidCustodyMode;
+    provider: string | null;
+    providerWalletId: string | null;
+    walletAddress: string | null;
+    network: string;
+    asset: string;
+    decimals: number;
+    availableAmount: string;
+    reservedAmount: string;
+    lowBalanceThreshold: string;
+    status: PrepaidWalletStatus;
+    blockedAt: string | null;
+    blockedReason: string | null;
+    metadata: Record<string, unknown>;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Agent-visible wallet projection. Custody provider identifiers and metadata are never exposed. */
+export interface AssignedPrepaidWallet {
+    walletId: string;
+    name: string;
+    network: string;
+    asset: string;
+    decimals: number;
+    availableAmount: string;
+    reservedAmount: string;
+    lowBalanceThreshold: string;
+    status: PrepaidWalletStatus;
+    blockedAt: string | null;
+    blockedReason: string | null;
+    assignmentId: string;
+    assignmentStatus: WalletAssignmentStatus;
+    perTransactionLimit: string;
+    cumulativeLimit: string;
+    cumulativePeriodSeconds: number;
+    allowedRecipients: string[];
+    allowedScopes: string[];
+    validFrom: string;
+    validUntil: string | null;
+    allWalletsBlocked: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface WalletAssignment {
+    assignmentId: string;
+    walletId: string;
+    agentId: string;
+    principalId: string;
+    status: WalletAssignmentStatus;
+    perTransactionLimit: string;
+    cumulativeLimit: string;
+    cumulativePeriodSeconds: number;
+    allowedRecipients: string[];
+    allowedScopes: string[];
+    validFrom: string;
+    validUntil: string | null;
+    blockedAt: string | null;
+    blockedReason: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface CreatePrepaidWalletParams {
+    name: string;
+    custodyMode: PrepaidCustodyMode;
+    provider?: string;
+    providerWalletId?: string;
+    walletAddress?: string;
+    network: string;
+    asset: string;
+    decimals?: number;
+    lowBalanceThreshold?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface AssignPrepaidWalletParams {
+    agentId: string;
+    perTransactionLimit: string;
+    cumulativeLimit: string;
+    cumulativePeriodSeconds: number;
+    allowedRecipients?: string[];
+    allowedScopes?: string[];
+    validUntil?: string;
+}
+export interface PrepaidAuthorizationRequest {
+    walletId?: string;
+    amount: string;
+    asset: string;
+    network: string;
+    recipient: string;
+    resource: string;
+    scope: string;
+    maxTimeoutSeconds: number;
+    idempotencyKey: string;
+}
+export interface PrepaidAuthorizationResponse {
+    authorization: string;
+    reservationId: string;
+    walletId: string;
+    assignmentId: string;
+    amount: string;
+    asset: string;
+    network: string;
+    recipient: string;
+    expiresAt: string;
+    remainingAvailable: string;
+    remainingCumulative: string;
+}
+export interface WalletReloadRequest {
+    reloadRequestId: string;
+    walletId: string;
+    assignmentId: string | null;
+    agentId: string | null;
+    amount: string;
+    reason: string | null;
+    status: 'pending' | 'approved' | 'rejected' | 'cancelled' | 'funded';
+    requestedBy: 'agent' | 'principal';
+    externalReference: string | null;
+    createdAt: string;
+    decidedAt: string | null;
+    fundedAt: string | null;
+}
+export interface PrepaidWalletActivity {
+    assignments: WalletAssignment[];
+    reservations: Array<Record<string, unknown>>;
+    reloadRequests: WalletReloadRequest[];
+    ledger: Array<Record<string, unknown>>;
+}
+interface DpopResourceClient {
+    fetch(input: string | URL, accessToken: string, init?: RequestInit): Promise<Response>;
+}
+export declare class PrepaidWalletAgentClient {
+    #private;
+    constructor(options: {
+        oauthClient: OAuthAgentClient | DpopResourceClient;
+        accessToken: string;
+        resourceUrl?: string;
+    });
+    setAccessToken(accessToken: string): void;
+    list(): Promise<AssignedPrepaidWallet[]>;
+    authorizePayment(params: PrepaidAuthorizationRequest): Promise<PrepaidAuthorizationResponse>;
+    requestReload(walletId: string, amount: string, idempotencyKey: string, reason?: string): Promise<WalletReloadRequest>;
+    /** Callback passed directly to @grantex/x402 createX402Agent(). */
+    readonly x402Authorizer: (params: PrepaidAuthorizationRequest) => Promise<PrepaidAuthorizationResponse>;
+}
+export declare class PrincipalPrepaidWalletClient {
+    #private;
+    constructor(options: {
+        baseUrl: string;
+        sessionToken: string;
+    });
+    setSessionToken(sessionToken: string): void;
+    create(params: CreatePrepaidWalletParams): Promise<PrepaidWallet>;
+    list(): Promise<PrepaidWallet[]>;
+    activity(walletId: string): Promise<PrepaidWalletActivity>;
+    assign(walletId: string, params: AssignPrepaidWalletParams): Promise<WalletAssignment>;
+    setAssignmentStatus(assignmentId: string, status: WalletAssignmentStatus, reason?: string): Promise<WalletAssignment>;
+    setWalletStatus(walletId: string, status: PrepaidWalletStatus, reason?: string): Promise<PrepaidWallet>;
+    setAgentBlocked(agentId: string, blocked: boolean, reason?: string): Promise<{
+        agentId: string;
+        allWalletsBlocked: boolean;
+        reason: string | null;
+    }>;
+    reload(walletId: string, amount: string, idempotencyKey: string, externalReference?: string): Promise<WalletReloadRequest>;
+    decideReload(requestId: string, decision: 'approved' | 'rejected'): Promise<WalletReloadRequest>;
+    fundReload(requestId: string, externalReference?: string): Promise<WalletReloadRequest>;
+    releaseReservation(reservationId: string, reason: string): Promise<{
+        reservationId: string;
+        status: 'released';
+    }>;
+}
+export {};
+//# sourceMappingURL=prepaid-wallets.d.ts.map

package/dist/prepaid-wallets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepaid-wallets.d.ts","sourceRoot":"","sources":["../src/prepaid-wallets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG,UAAU,CAAC;AAC/D,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAClE,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oGAAoG;AACpG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC3C,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC;IACrE,WAAW,EAAE,OAAO,GAAG,WAAW,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,cAAc,EAAE,mBAAmB,EAAE,CAAC;IACtC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxC;AAED,UAAU,kBAAkB;IAC1B,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxF;AAED,qBAAa,wBAAwB;;IAKnC,YAAY,OAAO,EAAE;QACnB,WAAW,EAAE,gBAAgB,GAAG,kBAAkB,CAAC;QACnD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,EAWA;IAED,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAGxC;IAEK,IAAI,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAK7C;IAEK,gBAAgB,CAAC,MAAM,EAAE,2BAA2B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAOjG;IAEK,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC,CAO9B;IAED,mEAAmE;IACnE,QAAQ,CAAC,cAAc,WAAY,2BAA2B,2CAAmC;CAClG;AAED,qBAAa,4BAA4B;;IAIvC,YAAY,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EAI7D;IAED,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAG1C;IAED,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,aAAa,CAAC,CAEhE;IAEK,IAAI,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAErC;IAED,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAEzD;IAED,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAKrF;IAED,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAKpH;IAED,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAKtG;IAED,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAKnJ;IAED,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAKzH;IAED,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAK/F;IAED,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAKtF;IAED,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAKhH;CASF"}