@keycardai/eve 0.1.0 → 0.3.0

package/README.md

@@ -16,12 +16,19 @@ Three adapters, each one plugging into an eve primitive instead of wrapping it:
 pnpm add @keycardai/eve
 ```
 
-`eve` is a peer dependency, pinned to `>=0.47.3 <0.48.0`. This package was
-built and verified against eve `0.47.3`. eve is in public beta and ships
+`eve` is a peer dependency, pinned to `>=0.54.3 <0.55.0`. This package was
+built and verified against eve `0.54.3`. eve is in public beta and ships
 releases most days, and its connection and auth surfaces are still moving, so
 the range deliberately stops at the next minor rather than tracking `^`. Widen
 it only after re-running this package's tests against the newer eve.
 
+The narrowness is the point rather than an oversight, and so is keeping the
+range current: a consumer who runs a newer eve and installs this anyway —
+`--legacy-peer-deps` — silently loses the check, and the incompatibilities
+surface at build time instead. Two of them are what the 0.47 → 0.54 bump had to
+fix: an `auth` key list that `displayName` is not in, and a `requireAuth`
+options type with no `reason` field.
+
 eve itself declares `engines.node: ">=24"` and is ESM only. This package
 imports eve for types only (`import type { ... } from "eve/connections"`), so
 nothing here pulls eve into the runtime and the package builds and tests on
@@ -139,25 +146,56 @@ export default defineMcpClientConnection({
   description: "Documents the user has authorized.",
   auth: Keycard.interactive({
     zoneUrl: process.env.KEYCARD_ZONE_URL!,
-    clientId: process.env.KEYCARD_CLIENT_ID!,
     resource: "https://docs.example.com",
     requestScopes: ["documents.read"],
+    connectionName: "Docs",
   }),
 });
 ```
 
+**There is no `clientId`, and adding one usually breaks the flow.** eve mints a
+fresh callback URL for every attempt
+(`/eve/v1/connections/:name/callback/:attemptId/:token`) while
+[RFC 9700][rfc9700] requires the authorization server to match `redirect_uri`
+against the client's registered list by exact string comparison. A client
+registered ahead of time cannot name a URL that is generated later, so the
+request is rejected with something like `Unauthorized redirect URI`. Leaving
+`clientId` unset registers a client per attempt instead (RFC 7591), whose
+single redirect URI is the callback that attempt will return to. Each client is
+public and PKCE-bound, so nothing secret enters eve's durable resume state; if
+the server issues a confidential client anyway, the attempt is abandoned rather
+than journaling a secret.
+
+Set `clientId` only when that client's registered redirect URIs already cover
+eve's callback. Note that a Keycard application `identifier` is not a client id:
+zones identify clients by [Client ID Metadata Document][cimd], an HTTPS URL
+with a path serving the client's metadata, so a value like `urn:app:my-agent`
+fails with `Unsupported client identifier prefix: urn`.
+
+Per-attempt clients accumulate in the zone. They hold no secret and their
+callback is single-use, but a server returning `registration_client_uri` and
+`registration_access_token` allows RFC 7592 deletion once a grant settles.
+
+[rfc9700]: https://datatracker.ietf.org/doc/html/rfc9700
+[cimd]: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-02
+
 The definition implements the same three-method form as eve's
 `defineInteractiveAuthorization`, over `@keycardai/oauth`'s v3 web-app flow:
 
-- `getToken` returns a token only when this package holds one for the
-  principal. Otherwise it throws `ConnectionAuthorizationRequiredError`, so eve
-  emits `authorization.required`, runs `startAuthorization` in a durable step,
-  and parks the turn on a framework-owned callback.
-- `startAuthorization` calls `beginAuthorization` for the connection's resource
-  list against eve's minted callback URL, and returns the challenge URL plus
-  the `state` and PKCE verifier as JSON resume state.
+- `getToken` looks up the principal's stored grants and returns the access
+  token of one whose resources cover this connection's `resource` and whose
+  scopes cover `requestScopes`. Within 60 seconds of expiry, a grant holding a
+  refresh token is refreshed first (see below). With no usable grant it throws
+  `ConnectionAuthorizationRequiredError`, so eve emits
+  `authorization.required`, runs `startAuthorization` in a durable step, and
+  parks the turn on a framework-owned callback.
+- `startAuthorization` registers this attempt's client (unless `clientId` is
+  set), calls `beginAuthorization` for the connection's resource list against
+  eve's minted callback URL, and returns the challenge URL plus the `state`,
+  PKCE verifier and client id as JSON resume state.
 - `completeAuthorization` calls `completeAuthorization` with eve's callback
-  params and the journaled resume state, and hands eve the token.
+  params and the journaled resume state, redeeming as the client that attempt's
+  authorization request ran as, and stores the resulting grant.
 
 **Resume without authorization cannot yield a credential.** `getToken` is the
 only path that returns a token, and it reads a store only
@@ -169,6 +207,72 @@ an authorization has settled ends the tool call. User denial is reported as
 `ConnectionAuthorizationFailedError` with `reason: "access_denied"` and
 `retryable: false`, so eve stops re-prompting.
 
+### Grants: what is stored, and for how long
+
+`completeAuthorization` stores a grant, not a bare token: the access token and
+its expiry, the refresh token the zone returned, the client id the grant was
+issued to, and the resources and scopes granted. Grants are keyed by the
+principal, never by `connectionName`, which is display and error text only;
+two `Keycard.interactive()` definitions in one process with the same
+`connectionName` fail at definition time with
+`AuthProviderConfigurationError`. Because a grant is matched on what it covers,
+a connection listing the agent's other resources in `additionalResources`
+yields one sign-in that serves every connection whose resource is in the list.
+
+When a grant is within 60 seconds of expiry and holds a refresh token,
+`getToken` posts `grant_type=refresh_token` to the zone as the grant's own
+client (public, no secret; a per-attempt client registers with
+`refresh_token` among its grant types), stores the rotated access and refresh
+token pair, and returns the new access token without parking. A refresh the
+zone refuses with `invalid_grant` deletes the grant and throws `Required`, so
+the turn parks for a fresh sign-in. A transport or 5xx failure keeps the grant
+and fails the tool call with `retryable: true`. A grant without a refresh token
+parks at expiry, as before.
+
+`evict` removes every grant of the principal that covers this connection's
+resource, leaving grants for other resources in place.
+
+### Plugging a durable grant store
+
+The default store is process-local, so a restarted agent parks once more for
+each user. To keep grants across processes, pass `tokens` an object of this
+shape:
+
+```ts
+import type { AuthorizedGrant, GrantStore } from "@keycardai/eve";
+
+export function redisGrantStore(redis: {
+  hgetall(key: string): Promise<Record<string, string>>;
+  hset(key: string, field: string, value: string): Promise<unknown>;
+  hdel(key: string, field: string): Promise<unknown>;
+}): GrantStore {
+  const key = (principal: string) => `keycard:grants:${principal}`;
+  return {
+    async list(principal) {
+      const rows = await redis.hgetall(key(principal));
+      return Object.values(rows).map((row) => JSON.parse(row) as AuthorizedGrant);
+    },
+    async put(principal, grant) {
+      await redis.hset(key(principal), grant.id, JSON.stringify(grant));
+    },
+    async remove(principal, grantId) {
+      await redis.hdel(key(principal), grantId);
+    },
+  };
+}
+```
+
+Every method is async, and `put` with an `id` already held replaces that grant
+(a refresh rewrites the rotated pair under the same `id`). The same three
+methods map onto Vercel KV's `hgetall`, `hset` and `hdel`, or any other
+key-value backend.
+
+Choosing a durable store puts refresh tokens at rest in that backend. Each one
+is a long-lived credential for the user's resources, so the backend's access
+control and encryption are yours to provide. This package never writes a grant
+into eve's session attributes for that reason: a refresh token must not enter
+eve's durable state.
+
 ## Parity with `@keycardai/langchain`
 
 The two packages implement the same Keycard access model against different
@@ -212,8 +316,12 @@ const auth = Keycard.onBehalfOf({
 `fakeZoneClient()` records every exchange, impersonation, and client
 credentials call, and can fail one resource or every request. `keycardAuth()`
 takes a `verify` seam in place of the JWKS-backed verifier, and
-`Keycard.interactive()` takes a `flow` seam in place of the two web-flow calls.
-An injected `client` or `flow` supersedes `zoneUrl`, so a test needs no zone.
+`Keycard.interactive()` takes a `flow` seam in place of the web-flow calls:
+`begin`, `complete`, `register` for per-attempt clients, and `refresh`. A flow
+without `register` is rejected at construction unless a `clientId` is also
+given, so a test cannot accidentally exercise a combination that cannot work in
+production. An injected `client` or `flow` supersedes `zoneUrl`, so a test needs
+no zone.
 
 ## Not included: the Keycard gateway MCP proxy
 

package/dist/esm/connections.d.ts

@@ -1,5 +1,17 @@
 import type { ConnectionPrincipal, NonInteractiveAuthorizationDefinition } from "eve/connections";
 import { type KeycardConnectionOptions } from "./config.js";
+/**
+ * None of these definitions carry a `displayName`. eve validates an authored
+ * connection's `auth` against a closed key list (`completeAuthorization`,
+ * `evict`, `getToken`, `principalType`, `startAuthorization`, `vercelConnect`),
+ * and a definition carrying any other key fails the build with
+ * `The "auth" field Unknown key "displayName"`. The only consumer of the field
+ * is eve's `stampChallengeDisplayName`, which resolves
+ * `definition.displayName ?? challenge.displayName`, so an interactive
+ * definition names itself on the challenge instead (see {@link interactive}),
+ * a non-interactive one has no challenge to name, and tools name a provider
+ * through `ToolAuthOptions.displayName` at the call site.
+ */
 /** Options for {@link impersonate}. */
 export interface KeycardImpersonateOptions extends KeycardConnectionOptions {
     /**

package/dist/esm/connections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../src/connections.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,mBAAmB,EACnB,qCAAqC,EAEtC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAsC,KAAK,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAKhG,uCAAuC;AACvC,MAAM,WAAW,yBAA0B,SAAQ,wBAAwB;IACzE;;;OAGG;IACH,cAAc,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,mBAAmB,KAAK,MAAM,CAAC,CAAC;CACvE;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,wBAAwB,GAChC,qCAAqC,CAmBvC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,wBAAwB,GAChC,qCAAqC,CAmDvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,yBAAyB,GACjC,qCAAqC,CAuCvC"}
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../src/connections.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,mBAAmB,EACnB,qCAAqC,EAEtC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAsC,KAAK,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAKhG;;;;;;;;;;;GAWG;AAEH,uCAAuC;AACvC,MAAM,WAAW,yBAA0B,SAAQ,wBAAwB;IACzE;;;OAGG;IACH,cAAc,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,mBAAmB,KAAK,MAAM,CAAC,CAAC;CACvE;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,wBAAwB,GAChC,qCAAqC,CAkBvC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,wBAAwB,GAChC,qCAAqC,CAkDvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,yBAAyB,GACjC,qCAAqC,CAsCvC"}

package/dist/esm/connections.js

@@ -14,7 +14,6 @@ export function asSelf(options) {
     const config = resolveConnectionConfig(options, "asSelf");
     return {
         principalType: "app",
-        displayName: config.connectionName,
         async getToken() {
             const request = {
                 resource: config.resource,
@@ -44,7 +43,6 @@ export function onBehalfOf(options) {
     const config = resolveConnectionConfig(options, "onBehalfOf");
     return {
         principalType: "user",
-        displayName: config.connectionName,
         async getToken({ principal }) {
             requireUser(principal, config.connectionName);
             const subjectToken = readSubjectToken(principal, config.subjectTokens);
@@ -103,7 +101,6 @@ export function impersonate(options) {
     }
     return {
         principalType: typeof identifier === "function" ? "user" : "app",
-        displayName: config.connectionName,
         async getToken({ principal }) {
             let userIdentifier;
             if (typeof identifier === "function") {

package/dist/esm/connections.js.map

@@ -1 +1 @@
-{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../src/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,SAAS,GAIV,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAiC,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAWpE;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CACpB,OAAiC;IAEjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE1D,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,WAAW,EAAE,MAAM,CAAC,cAAc;QAClC,KAAK,CAAC,QAAQ;YACZ,MAAM,OAAO,GAA6B;gBACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;aACrC,CAAC;YACF,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACxC,MAAM,CAAC,UAAU,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CACpD,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CACxB,OAAiC;IAEjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAE9D,OAAO;QACL,aAAa,EAAE,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,cAAc;QAClC,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAE9C,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YACvE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EACL,sEAAsE;wBACtE,wEAAwE;wBACxE,2EAA2E;wBAC3E,cAAc;oBAChB,MAAM,EAAE,aAAa,CAAC,yBAAyB;oBAC/C,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;gBACrD,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EACL,iFAAiF;oBACnF,MAAM,EAAE,aAAa,CAAC,qBAAqB;oBAC3C,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAA6B,CAAC;YAClC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,2BAA2B,CAC3D,YAAY,EACZ,MAAM,CAAC,QAAQ,CAChB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG;oBACR,YAAY;oBACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,gBAAgB,EAAE,SAAS,CAAC,YAAY;iBACzC,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAEhE,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CACvF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,OAAkC;IAElC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAC1C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,8BAA8B,CACtC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa,EAAE,OAAO,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QAChE,WAAW,EAAE,MAAM,CAAC,cAAc;QAClC,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,IAAI,cAAsB,CAAC;YAC3B,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gBACrC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC9C,cAAc,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,UAAU,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC9C,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EAAE,8DAA8D;oBACvE,MAAM,EAAE,aAAa,CAAC,kBAAkB;oBACxC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACxC,MAAM,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC;gBAC9B,cAAc;gBACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC,CACH,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,SAA8B,EAC9B,cAAsB;IAEtB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IACtC,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;QACjD,OAAO,EACL,6EAA6E;YAC7E,iBAAiB;QACnB,MAAM,EAAE,aAAa,CAAC,kBAAkB;QACxC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,OAAO,CACpB,cAAsB,EACtB,OAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;YACjD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;YAC5E,MAAM,EAAE,aAAa,CAAC,kBAAkB;YACxC,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAuB;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,WAAW;QAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../src/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,SAAS,GAIV,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAiC,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAwBpE;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CACpB,OAAiC;IAEjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE1D,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,KAAK,CAAC,QAAQ;YACZ,MAAM,OAAO,GAA6B;gBACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;aACrC,CAAC;YACF,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACxC,MAAM,CAAC,UAAU,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CACpD,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CACxB,OAAiC;IAEjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAE9D,OAAO;QACL,aAAa,EAAE,MAAM;QACrB,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAE9C,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YACvE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EACL,sEAAsE;wBACtE,wEAAwE;wBACxE,2EAA2E;wBAC3E,cAAc;oBAChB,MAAM,EAAE,aAAa,CAAC,yBAAyB;oBAC/C,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;gBACrD,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EACL,iFAAiF;oBACnF,MAAM,EAAE,aAAa,CAAC,qBAAqB;oBAC3C,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAA6B,CAAC;YAClC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,2BAA2B,CAC3D,YAAY,EACZ,MAAM,CAAC,QAAQ,CAChB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG;oBACR,YAAY;oBACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,gBAAgB,EAAE,SAAS,CAAC,YAAY;iBACzC,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAEhE,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CACvF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,OAAkC;IAElC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAC1C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,8BAA8B,CACtC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa,EAAE,OAAO,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QAChE,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,IAAI,cAAsB,CAAC;YAC3B,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gBACrC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC9C,cAAc,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,UAAU,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC9C,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EAAE,8DAA8D;oBACvE,MAAM,EAAE,aAAa,CAAC,kBAAkB;oBACxC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACxC,MAAM,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC;gBAC9B,cAAc;gBACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC,CACH,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,SAA8B,EAC9B,cAAsB;IAEtB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IACtC,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;QACjD,OAAO,EACL,6EAA6E;YAC7E,iBAAiB;QACnB,MAAM,EAAE,aAAa,CAAC,kBAAkB;QACxC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,OAAO,CACpB,cAAsB,EACtB,OAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;YACjD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;YAC5E,MAAM,EAAE,aAAa,CAAC,kBAAkB;YACxC,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAuB;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,WAAW;QAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/dist/esm/index.d.ts

@@ -19,7 +19,7 @@ export type { KeycardAuthOptions, SubjectTokenRetention } from "./auth.js";
 export { asSelf, impersonate, onBehalfOf } from "./connections.js";
 export type { KeycardImpersonateOptions } from "./connections.js";
 export { interactive, memoryAuthorizedTokenStore } from "./interactive.js";
-export type { AuthorizedToken, AuthorizedTokenStore, KeycardInteractiveOptions, KeycardResumeState, WebAppFlow, } from "./interactive.js";
+export type { AuthorizedGrant, GrantStore, KeycardInteractiveOptions, KeycardResumeState, RegisterAttemptClientOptions, RegisteredClient, WebAppFlow, } from "./interactive.js";
 export type { KeycardConnectionOptions } from "./config.js";
 export { AuthorizationFailedError, AuthorizationRequiredError, FailureReason, RouteRejectedError, } from "./errors.js";
 export { decodeClaims, subjectTokenExpired } from "./expiry.js";

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,YAAY,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC3E,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,OAAO;;;;;EAKlB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,YAAY,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC3E,YAAY,EACV,eAAe,EACf,UAAU,EACV,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,OAAO;;;;;EAKlB,CAAC"}

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAW3E,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,MAAM;IACN,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAa3E,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,MAAM;IACN,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC,CAAC"}

package/dist/esm/interactive.d.ts

@@ -1,90 +1,188 @@
-import { type AuthorizationRedirect, type BeginAuthorizationOptions, type CompleteAuthorizationOptions, type TokenResponse } from "@keycardai/oauth";
+import { type AuthorizationRedirect, type BeginAuthorizationOptions, type CompleteAuthorizationOptions, type RefreshAuthorizationOptions, type TokenResponse } from "@keycardai/oauth";
 import type { InteractiveAuthorizationDefinition, JsonValue } from "eve/connections";
 /**
  * The state journaled between eve's begin and callback steps.
  *
  * Every field is JSON, so the value satisfies eve's `JsonValue` bound and
- * survives the durable step boundary the park crosses.
+ * survives the durable step boundary the park crosses. `clientId` is journaled
+ * because each attempt may run as its own registered client, and only that
+ * client can redeem the code. Nothing secret is journaled: registered clients
+ * are public and PKCE-bound (see {@link interactive}).
  */
 export interface KeycardResumeState {
     readonly state: string;
     readonly codeVerifier: string;
     readonly resources: readonly string[];
     readonly callbackUrl: string;
+    readonly clientId: string;
     readonly [key: string]: JsonValue;
 }
-/** A token this package minted for one principal, plus its advisory expiry. */
-export interface AuthorizedToken {
-    readonly token: string;
+/**
+ * A completed authorization for one principal.
+ *
+ * `resources` and `scopes` are what the zone granted, and decide which
+ * connections the grant serves. `clientId` is the client the grant was issued
+ * to, and the client a refresh runs as. `id` is stable across refreshes, so a
+ * store can replace the rotated pair in place.
+ */
+export interface AuthorizedGrant {
+    readonly id: string;
+    readonly accessToken: string;
     readonly expiresAt?: number;
-    readonly providerSubject?: string;
+    readonly refreshToken?: string;
+    readonly clientId: string;
+    readonly resources: readonly string[];
+    readonly scopes: readonly string[];
 }
 /**
- * Where completed authorizations live between turns.
+ * Where completed grants live between turns, keyed by principal.
  *
- * eve caches a resolved bearer for the duration of a step, and reruns
- * `getToken` after that. This store is what makes a second step reuse the
- * grant a user already completed instead of parking the turn again. The
- * default is process-local, so a fresh process re-parks rather than
- * resurrecting a credential from durable state.
+ * eve caches a resolved bearer for the duration of a step and reruns
+ * `getToken` after that; this store is what makes a later step reuse the grant
+ * a user already completed instead of parking again. `put` with an `id` the
+ * store already holds replaces that grant. The default is process-local, so a
+ * fresh process re-parks. A durable implementation (Redis, Vercel KV) keeps the
+ * grant, refresh token included, at rest in that backend; eve's session
+ * attributes are never used, so no credential enters eve's durable state.
  */
-export interface AuthorizedTokenStore {
-    get(key: string): AuthorizedToken | undefined;
-    set(key: string, token: AuthorizedToken): void;
-    delete(key: string): void;
+export interface GrantStore {
+    list(principal: string): Promise<readonly AuthorizedGrant[]>;
+    put(principal: string, grant: AuthorizedGrant): Promise<void>;
+    remove(principal: string, grantId: string): Promise<void>;
 }
-/** The two web-flow calls this adapter makes, as one seam for tests. */
+/** What one authorization attempt needs its own OAuth client for. */
+export interface RegisterAttemptClientOptions {
+    /** eve's callback URL for this attempt. The client's only redirect URI. */
+    readonly redirectUri: string;
+    /** Name the zone shows on the consent screen. */
+    readonly clientName?: string;
+    readonly scopes?: readonly string[];
+}
+/** A client the authorization server issued for one attempt. */
+export interface RegisteredClient {
+    readonly clientId: string;
+    /**
+     * Only ever set by a server that ignored the public-client registration
+     * request. {@link interactive} refuses such a client rather than journaling
+     * a secret into eve's durable state.
+     */
+    readonly clientSecret?: string;
+}
+/** The web-flow calls this adapter makes, as one seam for tests. */
 export interface WebAppFlow {
     begin(options: BeginAuthorizationOptions): Promise<AuthorizationRedirect>;
     complete(options: CompleteAuthorizationOptions): Promise<TokenResponse>;
+    /**
+     * Registers the client for one attempt (RFC 7591). Required when no static
+     * `clientId` is configured, and unused when one is.
+     */
+    register?(options: RegisterAttemptClientOptions): Promise<RegisteredClient>;
+    /**
+     * Refreshes a grant at the token endpoint. When absent, a grant near expiry
+     * parks for a fresh sign-in instead.
+     */
+    refresh?(options: RefreshAuthorizationOptions): Promise<TokenResponse>;
 }
 export interface KeycardInteractiveOptions {
     /** The resource URL the authorization is scoped to. */
     resource: string;
     /** Keycard zone URL (issuer). Required unless `flow` is given. */
     zoneUrl?: string;
-    /** OAuth client the browser flow runs as. Required unless `flow` is given. */
+    /**
+     * OAuth client the browser flow runs as.
+     *
+     * Leave this unset unless the client's registered redirect URIs already
+     * cover eve's callback. eve mints a fresh callback URL per attempt
+     * (`/eve/v1/connections/:name/callback/:attemptId/:token`) while RFC 9700
+     * requires the authorization server to match `redirect_uri` by exact string
+     * comparison, so a statically registered client cannot name the URL the next
+     * attempt will use. Unset, the client is registered per attempt instead.
+     *
+     * A Keycard application `identifier` is not a client id. Zones identify
+     * clients by Client ID Metadata Document, an HTTPS URL with a path that
+     * serves the client's metadata, so a value like `urn:app:my-agent` fails
+     * with `Unsupported client identifier prefix: urn`.
+     */
     clientId?: string;
-    /** Client secret, for a confidential client. Public clients omit it. */
+    /** Client secret, for a confidential static client. Public clients omit it. */
     clientSecret?: string;
-    /** Scopes requested in the authorization request. */
+    /**
+     * Name shown on the zone's consent screen for a per-attempt client.
+     * Defaults to `connectionName`.
+     */
+    clientName?: string;
+    /**
+     * Initial access token (RFC 7591 section 3.1) for a zone whose registration
+     * endpoint is authenticated. Unset for an open registration endpoint.
+     */
+    initialAccessToken?: string;
+    /**
+     * Scopes requested in the authorization request, and the scopes a stored
+     * grant must cover to serve this connection.
+     */
     requestScopes?: string | readonly string[];
-    /** Extra resources authorized alongside `resource`. */
+    /**
+     * Extra resources authorized alongside `resource`. The resulting grant
+     * serves every connection whose resource it covers.
+     */
     additionalResources?: readonly string[];
-    /** Name used in error messages and eve's authorization events. */
+    /**
+     * Name used in the challenge, error messages and eve's authorization
+     * events. Display text only, never a store key; two definitions in one
+     * process may not share it.
+     */
     connectionName?: string;
-    /** Store for completed authorizations. Defaults to a process-local store. */
-    tokens?: AuthorizedTokenStore;
+    /** Store for completed grants. Defaults to a process-local store. */
+    tokens?: GrantStore;
     /** Web-flow seam. Replaces the zone calls, so tests take no network. */
     flow?: WebAppFlow;
 }
+/** Forgets every defined connection name. For tests that define many. */
+export declare function resetInteractiveDefinitions(): void;
 /**
  * Interactive connection auth backed by the zone's web authorization flow.
  *
  * The three callbacks eve drives:
  *
- * - `getToken` returns a token only when this package holds one for the
- *   principal. Otherwise it throws `ConnectionAuthorizationRequiredError`, and
- *   eve emits `authorization.required`, runs `startAuthorization` in a durable
- *   step, and parks the turn on its own callback webhook.
- * - `startAuthorization` begins the authorization-code flow with PKCE for the
- *   connection's resources, against eve's minted callback URL, and returns the
- *   challenge URL plus the `state` and verifier as resume state.
- * - `completeAuthorization` redeems the callback against the journaled resume
- *   state and hands eve the token.
+ * - `getToken` returns a token when the store holds a grant for the principal
+ *   whose resources cover this connection's resource and whose scopes cover
+ *   `requestScopes`, refreshing it first when it is near expiry and holds a
+ *   refresh token. Otherwise it throws `ConnectionAuthorizationRequiredError`,
+ *   and eve emits `authorization.required`, runs `startAuthorization` in a
+ *   durable step, and parks the turn on its own callback webhook.
+ * - `startAuthorization` registers the attempt's client, begins the
+ *   authorization-code flow with PKCE for the connection's resources against
+ *   eve's minted callback URL, and returns the challenge URL plus the state,
+ *   verifier, resources, callback URL and client id as resume state.
+ * - `completeAuthorization` redeems the callback as the journaled client and
+ *   stores the resulting grant.
+ *
+ * Resuming without a completed authorization cannot yield a credential: only
+ * `completeAuthorization` writes the store, and a denied, mismatched, or failed
+ * callback writes nothing, so a resumed turn either finds a real grant or parks
+ * again. eve settles each parked authorization once, so that is terminal rather
+ * than a loop.
+ *
+ * The client is registered per attempt unless `clientId` is set. eve mints a
+ * fresh callback URL for every attempt, while RFC 9700 requires the
+ * authorization server to match `redirect_uri` against the client's registered
+ * list by exact string comparison, so no fixed registration can name a URL that
+ * is generated later. Each attempt therefore gets a public, PKCE-bound client
+ * whose one redirect URI is the callback that attempt returns to. Those client
+ * records accumulate in the zone; a server that returns
+ * `registration_client_uri` and `registration_access_token` allows RFC 7592
+ * deletion once a grant settles.
  *
- * Resuming without a completed authorization cannot yield a credential.
- * `getToken` is the only path that returns a token and it reads the store,
- * which only `completeAuthorization` writes; a denied, mismatched, or failed
- * callback writes nothing. So a resumed turn either finds a real grant or
- * throws `Required` again and parks. eve's own settlement makes that terminal
- * rather than an endless loop: it settles each parked authorization once, and
- * a `Required` thrown after a completed authorization ends the tool call.
+ * Grants are keyed by principal, never by `connectionName`, so two connections
+ * never share a token through a shared name and `evict` on one cannot clear the
+ * other's grant. A grant obtained with `additionalResources` serves every
+ * connection whose resource it covers, so listing the agent's resources on one
+ * connection yields one sign-in.
  *
- * Discovery is memoized per definition, so the first authorization pays the
- * metadata round trip and later ones do not.
+ * Discovery is memoized per definition. Registration is not, because the
+ * redirect URI it binds is different every time.
  */
 export declare function interactive(options: KeycardInteractiveOptions): InteractiveAuthorizationDefinition<KeycardResumeState>;
-/** A process-local store that drops entries at their advisory expiry. */
-export declare function memoryAuthorizedTokenStore(): AuthorizedTokenStore;
+/** A process-local store that drops grants once they can no longer mint a token. */
+export declare function memoryAuthorizedTokenStore(): GrantStore;
 //# sourceMappingURL=interactive.d.ts.map

package/dist/esm/interactive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interactive.d.ts","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EAEjC,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAEV,kCAAkC,EAClC,SAAS,EAEV,MAAM,iBAAiB,CAAC;AAUzB;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wEAAwE;AACxE,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC1E,QAAQ,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,yBAAyB;IACxC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC3C,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,wEAAwE;IACxE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,yBAAyB,GACjC,kCAAkC,CAAC,kBAAkB,CAAC,CAiGxD;AAED,yEAAyE;AACzE,wBAAgB,0BAA0B,IAAI,oBAAoB,CAmBjE"}
+{"version":3,"file":"interactive.d.ts","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EAUL,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EAEjC,KAAK,2BAA2B,EAChC,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAEV,kCAAkC,EAClC,SAAS,EAEV,MAAM,iBAAiB,CAAC;AAazB;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED,qEAAqE;AACrE,MAAM,WAAW,4BAA4B;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC1E,QAAQ,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5E;;;OAGG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,yBAAyB;IACxC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC3C;;;OAGG;IACH,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,wEAAwE;IACxE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAKD,yEAAyE;AACzE,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,yBAAyB,GACjC,kCAAkC,CAAC,kBAAkB,CAAC,CA0QxD;AAED,oFAAoF;AACpF,wBAAgB,0BAA0B,IAAI,UAAU,CAwBvD"}

package/dist/esm/interactive.js

@@ -1,61 +1,218 @@
-import { AuthProviderConfigurationError, AuthorizationDeniedError, beginAuthorization, completeAuthorization, fetchAuthorizationServerMetadata, StateMismatchError, } from "@keycardai/oauth";
+import { AuthProviderConfigurationError, AuthorizationDeniedError, beginAuthorization, completeAuthorization, fetchAuthorizationServerMetadata, refreshAuthorization, RefreshGrantError, registerClient, StateMismatchError, } from "@keycardai/oauth";
 import { expiresAt } from "./config.js";
 import { AuthorizationFailedError, AuthorizationRequiredError, FailureReason, } from "./errors.js";
 import { principalKey } from "./subjectTokens.js";
+/** A grant is refreshed once it is this close to its advisory expiry. */
+const REFRESH_SKEW_MS = 60_000;
+/** Connection names taken by `interactive()` definitions in this process. */
+const definedConnectionNames = new Set();
+/** Forgets every defined connection name. For tests that define many. */
+export function resetInteractiveDefinitions() {
+    definedConnectionNames.clear();
+}
 /**
  * Interactive connection auth backed by the zone's web authorization flow.
  *
  * The three callbacks eve drives:
  *
- * - `getToken` returns a token only when this package holds one for the
- *   principal. Otherwise it throws `ConnectionAuthorizationRequiredError`, and
- *   eve emits `authorization.required`, runs `startAuthorization` in a durable
- *   step, and parks the turn on its own callback webhook.
- * - `startAuthorization` begins the authorization-code flow with PKCE for the
- *   connection's resources, against eve's minted callback URL, and returns the
- *   challenge URL plus the `state` and verifier as resume state.
- * - `completeAuthorization` redeems the callback against the journaled resume
- *   state and hands eve the token.
+ * - `getToken` returns a token when the store holds a grant for the principal
+ *   whose resources cover this connection's resource and whose scopes cover
+ *   `requestScopes`, refreshing it first when it is near expiry and holds a
+ *   refresh token. Otherwise it throws `ConnectionAuthorizationRequiredError`,
+ *   and eve emits `authorization.required`, runs `startAuthorization` in a
+ *   durable step, and parks the turn on its own callback webhook.
+ * - `startAuthorization` registers the attempt's client, begins the
+ *   authorization-code flow with PKCE for the connection's resources against
+ *   eve's minted callback URL, and returns the challenge URL plus the state,
+ *   verifier, resources, callback URL and client id as resume state.
+ * - `completeAuthorization` redeems the callback as the journaled client and
+ *   stores the resulting grant.
+ *
+ * Resuming without a completed authorization cannot yield a credential: only
+ * `completeAuthorization` writes the store, and a denied, mismatched, or failed
+ * callback writes nothing, so a resumed turn either finds a real grant or parks
+ * again. eve settles each parked authorization once, so that is terminal rather
+ * than a loop.
+ *
+ * The client is registered per attempt unless `clientId` is set. eve mints a
+ * fresh callback URL for every attempt, while RFC 9700 requires the
+ * authorization server to match `redirect_uri` against the client's registered
+ * list by exact string comparison, so no fixed registration can name a URL that
+ * is generated later. Each attempt therefore gets a public, PKCE-bound client
+ * whose one redirect URI is the callback that attempt returns to. Those client
+ * records accumulate in the zone; a server that returns
+ * `registration_client_uri` and `registration_access_token` allows RFC 7592
+ * deletion once a grant settles.
  *
- * Resuming without a completed authorization cannot yield a credential.
- * `getToken` is the only path that returns a token and it reads the store,
- * which only `completeAuthorization` writes; a denied, mismatched, or failed
- * callback writes nothing. So a resumed turn either finds a real grant or
- * throws `Required` again and parks. eve's own settlement makes that terminal
- * rather than an endless loop: it settles each parked authorization once, and
- * a `Required` thrown after a completed authorization ends the tool call.
+ * Grants are keyed by principal, never by `connectionName`, so two connections
+ * never share a token through a shared name and `evict` on one cannot clear the
+ * other's grant. A grant obtained with `additionalResources` serves every
+ * connection whose resource it covers, so listing the agent's resources on one
+ * connection yields one sign-in.
  *
- * Discovery is memoized per definition, so the first authorization pays the
- * metadata round trip and later ones do not.
+ * Discovery is memoized per definition. Registration is not, because the
+ * redirect URI it binds is different every time.
  */
 export function interactive(options) {
     if (!options.resource || !options.resource.trim()) {
         throw new AuthProviderConfigurationError("interactive requires a resource URL");
     }
-    if (!options.flow && (!options.zoneUrl || !options.clientId)) {
-        throw new AuthProviderConfigurationError("interactive requires zoneUrl and clientId, or an injected flow");
+    if (!options.flow && !options.zoneUrl) {
+        throw new AuthProviderConfigurationError("interactive requires zoneUrl, or an injected flow");
     }
     const connectionName = options.connectionName ?? options.resource;
+    if (definedConnectionNames.has(connectionName)) {
+        throw new AuthProviderConfigurationError(`interactive connectionName "${connectionName}" is already defined in this process. ` +
+            "The name is display text, not a token key, so give each connection its own.");
+    }
     const tokens = options.tokens ?? memoryAuthorizedTokenStore();
-    const flow = options.flow ?? zoneWebAppFlow(options.zoneUrl);
-    const clientId = options.clientId ?? "";
+    const flow = options.flow ??
+        zoneWebAppFlow(options.zoneUrl, {
+            ...(options.initialAccessToken !== undefined
+                ? { initialAccessToken: options.initialAccessToken }
+                : {}),
+        });
+    const staticClientId = options.clientId ?? "";
+    const clientName = options.clientName ?? connectionName;
     const resources = [options.resource, ...(options.additionalResources ?? [])];
     const scopes = splitScopes(options.requestScopes);
+    if (!staticClientId && !flow.register) {
+        throw new AuthProviderConfigurationError("interactive was given no clientId, so it registers a client per attempt, but the " +
+            "injected flow has no register()");
+    }
+    definedConnectionNames.add(connectionName);
+    const covers = (grant) => grant.resources.includes(options.resource) &&
+        scopes.every((scope) => grant.scopes.includes(scope));
+    /**
+     * The client this attempt runs as: the configured one, or a fresh public
+     * client whose single redirect URI is this attempt's callback.
+     */
+    const clientForAttempt = async (callbackUrl) => {
+        if (staticClientId)
+            return staticClientId;
+        let registered;
+        try {
+            registered = await flow.register({
+                redirectUri: callbackUrl,
+                clientName,
+                ...(scopes.length > 0 ? { scopes } : {}),
+            });
+        }
+        catch (cause) {
+            throw new AuthorizationFailedError(connectionName, {
+                message: cause instanceof Error
+                    ? `Registering the OAuth client for this authorization failed: ${cause.message}`
+                    : "Registering the OAuth client for this authorization failed",
+                reason: FailureReason.ACQUISITION_FAILED,
+                retryable: true,
+            });
+        }
+        if (registered.clientSecret) {
+            throw new AuthorizationFailedError(connectionName, {
+                message: "The authorization server issued a confidential client for an authorization " +
+                    "registered as public. Redeeming it would mean journaling a client secret into " +
+                    "eve's durable resume state, so the attempt was abandoned instead. Configure a " +
+                    "static clientId for this connection.",
+                reason: FailureReason.ACQUISITION_FAILED,
+                retryable: false,
+            });
+        }
+        return registered.clientId;
+    };
+    /** A per-attempt client is public; only the static client can hold a secret. */
+    const secretFor = (clientId) => staticClientId && clientId === staticClientId && options.clientSecret
+        ? { clientSecret: options.clientSecret }
+        : {};
+    /**
+     * Refreshes a near-expiry grant as the client it was issued to. A refused
+     * refresh drops the grant so the caller parks for a fresh sign-in.
+     */
+    const refreshGrant = async (principal, grant) => {
+        let response;
+        try {
+            response = await flow.refresh({
+                refreshToken: grant.refreshToken,
+                clientId: grant.clientId,
+                resources: grant.resources,
+                ...(grant.scopes.length > 0 ? { scopes: grant.scopes } : {}),
+                ...secretFor(grant.clientId),
+            });
+        }
+        catch (cause) {
+            if (cause instanceof RefreshGrantError &&
+                cause.errorCode === "invalid_grant") {
+                // A concurrent step may have rotated this grant first, in which case
+                // the refresh token we sent is the stale one and the stored grant is
+                // the good one.
+                const current = (await tokens.list(principal)).find((candidate) => candidate.id === grant.id);
+                if (current && current.refreshToken !== grant.refreshToken) {
+                    return current;
+                }
+                await tokens.remove(principal, grant.id);
+                throw new AuthorizationRequiredError(connectionName, {
+                    message: `Connection "${connectionName}" requires authorization: the zone refused to ` +
+                        `refresh the grant (${cause.message}).`,
+                });
+            }
+            throw new AuthorizationFailedError(connectionName, {
+                message: cause instanceof Error
+                    ? `Refreshing the grant failed: ${cause.message}`
+                    : "Refreshing the grant failed",
+                reason: FailureReason.ACQUISITION_FAILED,
+                retryable: cause instanceof RefreshGrantError ? cause.retryable : true,
+            });
+        }
+        const rotated = grantFromResponse(response, {
+            id: grant.id,
+            clientId: grant.clientId,
+            resources: grant.resources,
+            scopes: grant.scopes,
+            // A server that rotates nothing leaves the old refresh token valid.
+            refreshToken: grant.refreshToken,
+        });
+        await tokens.put(principal, rotated);
+        return rotated;
+    };
     return {
         principalType: "user",
-        displayName: connectionName,
+        /**
+         * No definition-level `displayName`: eve validates an authored connection's
+         * `auth` against a closed key list (`completeAuthorization`, `evict`,
+         * `getToken`, `principalType`, `startAuthorization`, `vercelConnect`) that
+         * omits it. The name rides on the challenge instead, where eve's
+         * `stampChallengeDisplayName` falls back to it.
+         */
         async getToken({ principal }) {
-            const key = storeKey(principal, connectionName);
-            const held = tokens.get(key);
-            if (!held) {
+            const key = storeKey(principal);
+            const now = Date.now();
+            const held = (await tokens.list(key)).filter(covers);
+            // A grant is usable while its access token is live or while it holds a
+            // refresh token that can mint a new one; an expired grant with no refresh
+            // token is dead.
+            const usable = held.filter((candidate) => !dead(candidate, now));
+            let grant = usable.find((candidate) => !expired(candidate, now)) ?? usable[0];
+            if (!grant) {
+                await Promise.all(held.map((stale) => tokens.remove(key, stale.id)));
+                throw new AuthorizationRequiredError(connectionName);
+            }
+            if (nearExpiry(grant, now) && grant.refreshToken && flow.refresh) {
+                grant = await refreshGrant(key, {
+                    ...grant,
+                    refreshToken: grant.refreshToken,
+                });
+            }
+            else if (expired(grant, now)) {
+                // Expired, and this flow cannot refresh it.
+                await tokens.remove(key, grant.id);
                 throw new AuthorizationRequiredError(connectionName);
             }
-            return toTokenResult(held);
+            return toTokenResult(grant);
         },
         async startAuthorization({ principal, callbackUrl }) {
             requireUser(principal, connectionName);
+            const attemptClientId = await clientForAttempt(callbackUrl);
             const redirect = await flow.begin({
-                clientId,
+                clientId: attemptClientId,
                 redirectUri: callbackUrl,
                 resources,
                 ...(scopes.length > 0 ? { scopes } : {}),
@@ -67,6 +224,7 @@ export function interactive(options) {
                     codeVerifier: redirect.codeVerifier,
                     resources: redirect.resources,
                     callbackUrl,
+                    clientId: attemptClientId,
                 },
             };
         },
@@ -80,6 +238,9 @@ export function interactive(options) {
                     retryable: false,
                 });
             }
+            // The attempt's own client, falling back to the configured one for a
+            // resume journaled before clientId existed.
+            const clientId = resume.clientId || staticClientId;
             let response;
             try {
                 response = await flow.complete({
@@ -88,7 +249,7 @@ export function interactive(options) {
                     codeVerifier: resume.codeVerifier,
                     clientId,
                     redirectUri: resume.callbackUrl || callbackUrl,
-                    ...(options.clientSecret ? { clientSecret: options.clientSecret } : {}),
+                    ...secretFor(clientId),
                 });
             }
             catch (cause) {
@@ -102,47 +263,59 @@ export function interactive(options) {
                     retryable: false,
                 });
             }
-            const expiry = expiresAt(response.expiresIn);
-            const token = {
-                token: response.accessToken,
-                ...(expiry !== undefined ? { expiresAt: expiry } : {}),
-            };
-            tokens.set(storeKey(principal, connectionName), token);
-            return toTokenResult(token);
+            const grant = grantFromResponse(response, {
+                id: crypto.randomUUID(),
+                clientId,
+                resources: resume.resources.length > 0 ? resume.resources : resources,
+                scopes,
+            });
+            await tokens.put(storeKey(principal), grant);
+            return toTokenResult(grant);
         },
         /**
-         * eve calls this after a rejected bearer, so the next `getToken` parks the
-         * turn for a fresh grant instead of handing back the same dead token.
+         * eve calls this after a rejected bearer. Every grant covering this
+         * connection's resource goes, so the next `getToken` parks for a fresh one;
+         * grants for other resources stay.
          */
-        evict({ principal }) {
-            tokens.delete(storeKey(principal, connectionName));
+        async evict({ principal }) {
+            const key = storeKey(principal);
+            const held = await tokens.list(key);
+            await Promise.all(held
+                .filter((grant) => grant.resources.includes(options.resource))
+                .map((grant) => tokens.remove(key, grant.id)));
         },
     };
 }
-/** A process-local store that drops entries at their advisory expiry. */
+/** A process-local store that drops grants once they can no longer mint a token. */
 export function memoryAuthorizedTokenStore() {
-    const tokens = new Map();
+    const grants = new Map();
     return {
-        get(key) {
-            const held = tokens.get(key);
+        async list(principal) {
+            const held = grants.get(principal);
             if (!held)
-                return undefined;
-            if (held.expiresAt !== undefined && held.expiresAt <= Date.now()) {
-                tokens.delete(key);
-                return undefined;
+                return [];
+            const now = Date.now();
+            for (const [id, grant] of held) {
+                if (dead(grant, now))
+                    held.delete(id);
             }
-            return held;
+            return [...held.values()];
         },
-        set(key, token) {
-            tokens.set(key, token);
+        async put(principal, grant) {
+            let held = grants.get(principal);
+            if (!held) {
+                held = new Map();
+                grants.set(principal, held);
+            }
+            held.set(grant.id, grant);
         },
-        delete(key) {
-            tokens.delete(key);
+        async remove(principal, grantId) {
+            grants.get(principal)?.delete(grantId);
         },
     };
 }
 /** The default flow: the zone's web-app endpoints, with discovery memoized. */
-function zoneWebAppFlow(issuer) {
+function zoneWebAppFlow(issuer, options = {}) {
     let metadata;
     const discover = () => {
         if (!metadata)
@@ -150,26 +323,88 @@ function zoneWebAppFlow(issuer) {
         return metadata;
     };
     return {
-        async begin(options) {
-            return beginAuthorization(issuer, { ...options, metadata: await discover() });
+        async begin(beginOptions) {
+            return beginAuthorization(issuer, {
+                ...beginOptions,
+                metadata: await discover(),
+            });
+        },
+        async complete(completeOptions) {
+            return completeAuthorization(issuer, {
+                ...completeOptions,
+                metadata: await discover(),
+            });
         },
-        async complete(options) {
-            return completeAuthorization(issuer, { ...options, metadata: await discover() });
+        async refresh(refreshOptions) {
+            return refreshAuthorization(issuer, {
+                ...refreshOptions,
+                metadata: await discover(),
+            });
+        },
+        /**
+         * One public, PKCE-bound client per authorization, holding the single
+         * redirect URI that attempt will come back to. `token_endpoint_auth_method:
+         * "none"` keeps the resume state free of credentials, and `refresh_token`
+         * is requested so a long-lived grant can be renewed without sending the
+         * user back through the browser.
+         */
+        async register({ redirectUri, clientName, scopes }) {
+            const registered = await registerClient(issuer, {
+                ...(clientName !== undefined ? { clientName } : {}),
+                redirectUris: [redirectUri],
+                grantTypes: ["authorization_code", "refresh_token"],
+                responseTypes: ["code"],
+                tokenEndpointAuthMethod: "none",
+                ...(scopes && scopes.length > 0 ? { scope: scopes.join(" ") } : {}),
+            }, options.initialAccessToken !== undefined
+                ? { initialAccessToken: options.initialAccessToken }
+                : undefined);
+            return {
+                clientId: registered.clientId,
+                ...(registered.clientSecret !== undefined
+                    ? { clientSecret: registered.clientSecret }
+                    : {}),
+            };
         },
     };
 }
-function storeKey(principal, connectionName) {
+/**
+ * The grant a token response settles. The server's `scope` is authoritative
+ * when present; otherwise the scopes are the ones requested (RFC 6749 section
+ * 5.1 lets the server omit `scope` when it granted exactly those).
+ */
+function grantFromResponse(response, issued) {
+    const expiry = expiresAt(response.expiresIn);
+    const refreshToken = response.refreshToken ?? issued.refreshToken;
+    return {
+        id: issued.id,
+        accessToken: response.accessToken,
+        ...(expiry !== undefined ? { expiresAt: expiry } : {}),
+        ...(refreshToken !== undefined ? { refreshToken } : {}),
+        clientId: issued.clientId,
+        resources: [...issued.resources],
+        scopes: response.scope ? splitScopes(response.scope) : [...issued.scopes],
+    };
+}
+function expired(grant, now) {
+    return grant.expiresAt !== undefined && grant.expiresAt <= now;
+}
+/** Expired with no refresh token: nothing can mint a new access token. */
+function dead(grant, now) {
+    return expired(grant, now) && !grant.refreshToken;
+}
+function nearExpiry(grant, now) {
+    return (grant.expiresAt !== undefined && grant.expiresAt - REFRESH_SKEW_MS <= now);
+}
+function storeKey(principal) {
     if (principal.type !== "user")
-        return `${connectionName}|app`;
-    return `${connectionName}|${principalKey(principal)}`;
+        return "app";
+    return principalKey(principal);
 }
-function toTokenResult(token) {
+function toTokenResult(grant) {
     return {
-        token: token.token,
-        ...(token.expiresAt !== undefined ? { expiresAt: token.expiresAt } : {}),
-        ...(token.providerSubject !== undefined
-            ? { providerSubject: token.providerSubject }
-            : {}),
+        token: grant.accessToken,
+        ...(grant.expiresAt !== undefined ? { expiresAt: grant.expiresAt } : {}),
     };
 }
 function requireUser(principal, connectionName) {
@@ -185,6 +420,8 @@ function requireUser(principal, connectionName) {
 function splitScopes(scopes) {
     if (scopes === undefined)
         return [];
-    return Array.isArray(scopes) ? [...scopes] : scopes.split(" ").filter(Boolean);
+    return Array.isArray(scopes)
+        ? [...scopes]
+        : scopes.split(" ").filter(Boolean);
 }
 //# sourceMappingURL=interactive.js.map

package/dist/esm/interactive.js.map

@@ -1 +1 @@
-{"version":3,"file":"interactive.js","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,gCAAgC,EAChC,kBAAkB,GAMnB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAiElD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,WAAW,CACzB,OAAkC;IAElC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,8BAA8B,CAAC,qCAAqC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAA8B,CACtC,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,OAAO,CAAC,OAAQ,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAElD,OAAO;QACL,aAAa,EAAE,MAAM;QACrB,WAAW,EAAE,cAAc;QAC3B,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;YACjD,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;gBAChC,QAAQ;gBACR,WAAW,EAAE,WAAW;gBACxB,SAAS;gBACT,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAC,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE;gBAC7D,MAAM,EAAE;oBACN,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,WAAW;iBACZ;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE;YACtE,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EACL,wEAAwE;wBACxE,uCAAuC;oBACzC,MAAM,EAAE,aAAa,CAAC,gBAAgB;oBACtC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,QAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;oBAC7B,cAAc,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE;oBACtC,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,QAAQ;oBACR,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,WAAW;oBAC9C,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxE,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB;oBACxE,MAAM,EACJ,KAAK,YAAY,wBAAwB;wBACvC,CAAC,CAAC,aAAa,CAAC,aAAa;wBAC7B,CAAC,CAAC,KAAK,YAAY,kBAAkB;4BACnC,CAAC,CAAC,aAAa,CAAC,gBAAgB;4BAChC,CAAC,CAAC,aAAa,CAAC,kBAAkB;oBACxC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAoB;gBAC7B,KAAK,EAAE,QAAQ,CAAC,WAAW;gBAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,EAAE,SAAS,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,OAAO;QACL,GAAG,CAAC,GAAG;YACL,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC5B,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACjE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACnB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,GAAG,EAAE,KAAK;YACZ,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,CAAC,GAAG;YACR,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,QAA+D,CAAC;IACpE,MAAM,QAAQ,GAAG,GAA8C,EAAE;QAC/D,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAO;YACjB,OAAO,kBAAkB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,OAAO;YACpB,OAAO,qBAAqB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,SAA8B,EAAE,cAAsB;IACtE,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,GAAG,cAAc,MAAM,CAAC;IAC9D,OAAO,GAAG,cAAc,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAAsB;IAC3C,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,SAA8B,EAAE,cAAsB;IACzE,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IACtC,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;QACjD,OAAO,EACL,6EAA6E;YAC7E,wBAAwB;QAC1B,MAAM,EAAE,aAAa,CAAC,kBAAkB;QACxC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA8C;IACjE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAE,MAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC7F,CAAC"}
+{"version":3,"file":"interactive.js","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,gCAAgC,EAChC,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,GAOnB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,yEAAyE;AACzE,MAAM,eAAe,GAAG,MAAM,CAAC;AAkJ/B,6EAA6E;AAC7E,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;AAEjD,yEAAyE;AACzE,MAAM,UAAU,2BAA2B;IACzC,sBAAsB,CAAC,KAAK,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,WAAW,CACzB,OAAkC;IAElC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,8BAA8B,CACtC,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,8BAA8B,CACtC,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC;IAClE,IAAI,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,8BAA8B,CACtC,+BAA+B,cAAc,wCAAwC;YACnF,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;IAC9D,MAAM,IAAI,GACR,OAAO,CAAC,IAAI;QACZ,cAAc,CAAC,OAAO,CAAC,OAAQ,EAAE;YAC/B,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACxD,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAElD,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,8BAA8B,CACtC,mFAAmF;YACjF,iCAAiC,CACpC,CAAC;IACJ,CAAC;IACD,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAW,EAAE,CACjD,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAExD;;;OAGG;IACH,MAAM,gBAAgB,GAAG,KAAK,EAAE,WAAmB,EAAmB,EAAE;QACtE,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,IAAI,UAA4B,CAAC;QACjC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,QAAS,CAAC;gBAChC,WAAW,EAAE,WAAW;gBACxB,UAAU;gBACV,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,+DAA+D,KAAK,CAAC,OAAO,EAAE;oBAChF,CAAC,CAAC,4DAA4D;gBAClE,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,6EAA6E;oBAC7E,gFAAgF;oBAChF,gFAAgF;oBAChF,sCAAsC;gBACxC,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,CAAC;IAC7B,CAAC,CAAC;IAEF,gFAAgF;IAChF,MAAM,SAAS,GAAG,CAChB,QAAgB,EACiC,EAAE,CACnD,cAAc,IAAI,QAAQ,KAAK,cAAc,IAAI,OAAO,CAAC,YAAY;QACnE,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;QACxC,CAAC,CAAC,EAAE,CAAC;IAET;;;OAGG;IACH,MAAM,YAAY,GAAG,KAAK,EACxB,SAAiB,EACjB,KAAiD,EACvB,EAAE;QAC5B,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAQ,CAAC;gBAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,iBAAiB;gBAClC,KAAK,CAAC,SAAS,KAAK,eAAe,EACnC,CAAC;gBACD,qEAAqE;gBACrE,qEAAqE;gBACrE,gBAAgB;gBAChB,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CACjD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CACzC,CAAC;gBACF,IAAI,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;oBAC3D,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzC,MAAM,IAAI,0BAA0B,CAAC,cAAc,EAAE;oBACnD,OAAO,EACL,eAAe,cAAc,gDAAgD;wBAC7E,sBAAsB,KAAK,CAAC,OAAO,IAAI;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,gCAAgC,KAAK,CAAC,OAAO,EAAE;oBACjD,CAAC,CAAC,6BAA6B;gBACnC,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,KAAK,YAAY,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;aACvE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE;YAC1C,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oEAAoE;YACpE,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,MAAM;QACrB;;;;;;WAMG;QACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrD,uEAAuE;YACvE,0EAA0E;YAC1E,iBAAiB;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,KAAK,GACP,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrE,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjE,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;oBAC9B,GAAG,KAAK;oBACR,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC/B,4CAA4C;gBAC5C,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACnC,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;YACjD,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;gBAChC,QAAQ,EAAE,eAAe;gBACzB,WAAW,EAAE,WAAW;gBACxB,SAAS;gBACT,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAC,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE;gBAC7D,MAAM,EAAE;oBACN,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,WAAW;oBACX,QAAQ,EAAE,eAAe;iBAC1B;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE;YACtE,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EACL,wEAAwE;wBACxE,uCAAuC;oBACzC,MAAM,EAAE,aAAa,CAAC,gBAAgB;oBACtC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,qEAAqE;YACrE,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,cAAc,CAAC;YACnD,IAAI,QAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;oBAC7B,cAAc,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE;oBACtC,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,QAAQ;oBACR,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,WAAW;oBAC9C,GAAG,SAAS,CAAC,QAAQ,CAAC;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EACL,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB;oBACjE,MAAM,EACJ,KAAK,YAAY,wBAAwB;wBACvC,CAAC,CAAC,aAAa,CAAC,aAAa;wBAC7B,CAAC,CAAC,KAAK,YAAY,kBAAkB;4BACnC,CAAC,CAAC,aAAa,CAAC,gBAAgB;4BAChC,CAAC,CAAC,aAAa,CAAC,kBAAkB;oBACxC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE;gBACxC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,QAAQ;gBACR,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBACrE,MAAM;aACP,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE;YACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,OAAO,CAAC,GAAG,CACf,IAAI;iBACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;iBAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAChD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC/D,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,SAAS;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC/B,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK;YACxB,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO;YAC7B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CACrB,MAAc,EACd,UAA2C,EAAE;IAE7C,IAAI,QAA+D,CAAC;IACpE,MAAM,QAAQ,GAAG,GAA8C,EAAE;QAC/D,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,YAAY;YACtB,OAAO,kBAAkB,CAAC,MAAM,EAAE;gBAChC,GAAG,YAAY;gBACf,QAAQ,EAAE,MAAM,QAAQ,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,eAAe;YAC5B,OAAO,qBAAqB,CAAC,MAAM,EAAE;gBACnC,GAAG,eAAe;gBAClB,QAAQ,EAAE,MAAM,QAAQ,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,cAAc;YAC1B,OAAO,oBAAoB,CAAC,MAAM,EAAE;gBAClC,GAAG,cAAc;gBACjB,QAAQ,EAAE,MAAM,QAAQ,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE;YAChD,MAAM,UAAU,GAAG,MAAM,cAAc,CACrC,MAAM,EACN;gBACE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,YAAY,EAAE,CAAC,WAAW,CAAC;gBAC3B,UAAU,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACnD,aAAa,EAAE,CAAC,MAAM,CAAC;gBACvB,uBAAuB,EAAE,MAAM;gBAC/B,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,EACD,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;gBACpD,CAAC,CAAC,SAAS,CACd,CAAC;YACF,OAAO;gBACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,QAAuB,EACvB,MAMC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;IAClE,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;QAChC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAsB,EAAE,GAAW;IAClD,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC;AACjE,CAAC;AAED,0EAA0E;AAC1E,SAAS,IAAI,CAAC,KAAsB,EAAE,GAAW;IAC/C,OAAO,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB,EAAE,GAAW;IACrD,OAAO,CACL,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,eAAe,IAAI,GAAG,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,SAA8B;IAC9C,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,KAAsB;IAC3C,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,WAAW;QACxB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,SAA8B,EAC9B,cAAsB;IAEtB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IACtC,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;QACjD,OAAO,EACL,6EAA6E;YAC7E,wBAAwB;QAC1B,MAAM,EAAE,aAAa,CAAC,kBAAkB;QACxC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA8C;IACjE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1B,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;QACb,CAAC,CAAE,MAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC"}

package/dist/esm/requireAuth.d.ts

@@ -1,14 +1,19 @@
+import type { ToolAuthOptions } from "eve/tools";
 /**
  * The part of eve's tool context this helper needs.
  *
  * Declared structurally rather than imported so nothing here loads eve at
  * runtime. `ctx.requireAuth` never returns: it aborts the tool call and hands
  * the connection's authorization strategy back to the runtime.
+ *
+ * The options are eve's own `ToolAuthOptions` — imported as a type, which is
+ * erased, so the structural property still holds. Taking the type from eve
+ * rather than restating it is deliberate: the previous hand-written shape
+ * accepted a `reason` field that eve does not have, and a call passing one
+ * failed to typecheck at the call site rather than here.
  */
 export interface RequireAuthContext<Provider> {
-    requireAuth(provider: Provider, options?: {
-        readonly reason?: string;
-    }): never;
+    requireAuth(provider: Provider, options?: ToolAuthOptions): never;
 }
 /**
  * Maps a provider's rejection of the current credential onto
@@ -29,7 +34,5 @@ export interface RequireAuthContext<Provider> {
  */
 export declare function requireAuthOnUnauthorized<Provider>(response: {
     readonly status: number;
-}, ctx: RequireAuthContext<Provider>, provider: Provider, options?: {
-    readonly reason?: string;
-}): void;
+}, ctx: RequireAuthContext<Provider>, provider: Provider, options?: ToolAuthOptions): void;
 //# sourceMappingURL=requireAuth.d.ts.map

package/dist/esm/requireAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requireAuth.d.ts","sourceRoot":"","sources":["../../src/requireAuth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB,CAAC,QAAQ;IAC1C,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;CAChF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAChD,QAAQ,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACrC,GAAG,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrC,IAAI,CAON"}
+{"version":3,"file":"requireAuth.d.ts","sourceRoot":"","sources":["../../src/requireAuth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB,CAAC,QAAQ;IAC1C,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;CACnE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAChD,QAAQ,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACrC,GAAG,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,eAAe,GACxB,IAAI,CAGN"}

package/dist/esm/requireAuth.js

@@ -18,9 +18,6 @@
 export function requireAuthOnUnauthorized(response, ctx, provider, options) {
     if (response.status !== 401 && response.status !== 403)
         return;
-    ctx.requireAuth(provider, {
-        reason: options?.reason ??
-            `The provider rejected the connection credential with ${response.status}.`,
-    });
+    ctx.requireAuth(provider, options);
 }
 //# sourceMappingURL=requireAuth.js.map

package/dist/esm/requireAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"requireAuth.js","sourceRoot":"","sources":["../../src/requireAuth.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAqC,EACrC,GAAiC,EACjC,QAAkB,EAClB,OAAsC;IAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IAC/D,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE;QACxB,MAAM,EACJ,OAAO,EAAE,MAAM;YACf,wDAAwD,QAAQ,CAAC,MAAM,GAAG;KAC7E,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"requireAuth.js","sourceRoot":"","sources":["../../src/requireAuth.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAqC,EACrC,GAAiC,EACjC,QAAkB,EAClB,OAAyB;IAEzB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IAC/D,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC"}

package/dist/esm/testing/index.d.ts

@@ -7,4 +7,5 @@
  */
 export { appPrincipal, bearerRequest, connectionContext, expiredJwt, fakeVerifier, fakeZoneClient, sessionAuthContext, unsignedJwt, userPrincipal, validJwt, } from "./testUtils.js";
 export type { FakeZoneClient, FakeZoneClientOptions, ZoneCalls } from "./testUtils.js";
+export { resetInteractiveDefinitions } from "../interactive.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/testing/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/esm/testing/index.js

@@ -6,4 +6,5 @@
  * `@keycardai/eve/testing`.
  */
 export { appPrincipal, bearerRequest, connectionContext, expiredJwt, fakeVerifier, fakeZoneClient, sessionAuthContext, unsignedJwt, userPrincipal, validJwt, } from "./testUtils.js";
+export { resetInteractiveDefinitions } from "../interactive.js";
 //# sourceMappingURL=index.js.map

package/dist/esm/testing/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,QAAQ,GACT,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,QAAQ,GACT,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keycardai/eve",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "[Preview] Keycard auth adapters for eve agents: a zone token verifier for the channel auth walk, Keycard-backed connection auth, and interactive authorization over the zone's web flow",
   "license": "MIT",
   "repository": {
@@ -30,15 +30,15 @@
     }
   },
   "dependencies": {
-    "@keycardai/oauth": "0.22.0"
+    "@keycardai/oauth": "0.25.0"
   },
   "peerDependencies": {
-    "eve": ">=0.47.3 <0.48.0"
+    "eve": ">=0.54.3 <0.55.0"
   },
   "devDependencies": {
     "@jest/globals": "^30.0.4",
     "@types/node": "^25.6.0",
-    "eve": "0.47.3",
+    "eve": "0.54.3",
     "jest": "^30.0.4",
     "ts-jest": "^29.4.7",
     "typescript": "^5.8.3"