@keycardai/eve 0.1.0

package/dist/esm/connections.d.ts

@@ -0,0 +1,48 @@
+import type { ConnectionPrincipal, NonInteractiveAuthorizationDefinition } from "eve/connections";
+import { type KeycardConnectionOptions } from "./config.js";
+/** Options for {@link impersonate}. */
+export interface KeycardImpersonateOptions extends KeycardConnectionOptions {
+    /**
+     * The user the agent acts for. A function receives the connection principal,
+     * so a session-scoped identifier can be read from the turn's current auth.
+     */
+    userIdentifier: string | ((principal: ConnectionPrincipal) => string);
+}
+/**
+ * Connection auth that runs client credentials under the agent's own identity.
+ *
+ * App-scoped: eve resolves `{ type: "app" }` and never asks the session for a
+ * user, so this works on schedules and subagent turns. No exchange and no
+ * impersonation, so nothing about the caller reaches the zone.
+ */
+export declare function asSelf(options: KeycardConnectionOptions): NonInteractiveAuthorizationDefinition;
+/**
+ * Connection auth that exchanges the caller's token for a resource token.
+ *
+ * User-scoped, so eve resolves the principal from the active turn's
+ * `ctx.session.auth.current` and fails with `principal_required` before this
+ * runs when there is no authenticated user. The subject token exchanged is the
+ * one `keycardAuth` verified for that same principal.
+ *
+ * Nothing here falls back to the agent's authority. A run without a user
+ * principal, a turn whose subject token was never retained, and an expired
+ * subject token all fail, each with its own reason: `principal_required`,
+ * `subject_token_unavailable`, and `subject_token_expired`. The last one is
+ * the sign-in signal, decided by a decode-only expiry check so an already
+ * dead token never costs an exchange round trip.
+ */
+export declare function onBehalfOf(options: KeycardConnectionOptions): NonInteractiveAuthorizationDefinition;
+/**
+ * Connection auth that acts for a named user the agent holds no token for.
+ *
+ * Uses the zone's substitute-user exchange, authenticated by the application
+ * credential: no subject token is involved, so this is the pattern for
+ * back-office and batch work rather than for a user's own request.
+ *
+ * The principal type follows the identifier. A function needs the turn's
+ * current user, so the connection is user-scoped and inherits eve's
+ * `principal_required` rejection; a fixed identifier needs no caller, so the
+ * connection is app-scoped and runs on schedules.
+ */
+export declare function impersonate(options: KeycardImpersonateOptions): NonInteractiveAuthorizationDefinition;
+//# sourceMappingURL=connections.d.ts.map

package/dist/esm/connections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../src/connections.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,mBAAmB,EACnB,qCAAqC,EAEtC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAsC,KAAK,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAKhG,uCAAuC;AACvC,MAAM,WAAW,yBAA0B,SAAQ,wBAAwB;IACzE;;;OAGG;IACH,cAAc,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,mBAAmB,KAAK,MAAM,CAAC,CAAC;CACvE;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,wBAAwB,GAChC,qCAAqC,CAmBvC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,wBAAwB,GAChC,qCAAqC,CAmDvC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,yBAAyB,GACjC,qCAAqC,CAuCvC"}

package/dist/esm/connections.js

@@ -0,0 +1,167 @@
+import { AuthProviderConfigurationError, TokenType, } from "@keycardai/oauth";
+import { expiresAt, resolveConnectionConfig } from "./config.js";
+import { AuthorizationFailedError, FailureReason } from "./errors.js";
+import { subjectTokenExpired } from "./expiry.js";
+import { principalKey, readSubjectToken } from "./subjectTokens.js";
+/**
+ * Connection auth that runs client credentials under the agent's own identity.
+ *
+ * App-scoped: eve resolves `{ type: "app" }` and never asks the session for a
+ * user, so this works on schedules and subagent turns. No exchange and no
+ * impersonation, so nothing about the caller reaches the zone.
+ */
+export function asSelf(options) {
+    const config = resolveConnectionConfig(options, "asSelf");
+    return {
+        principalType: "app",
+        displayName: config.connectionName,
+        async getToken() {
+            const request = {
+                resource: config.resource,
+                ...(config.scope ? { scope: config.scope } : {}),
+                ...(await config.clientAuthFields()),
+            };
+            return tokenResult(await acquire(config.connectionName, () => config.zoneClient().clientCredentialsGrant(request)));
+        },
+    };
+}
+/**
+ * Connection auth that exchanges the caller's token for a resource token.
+ *
+ * User-scoped, so eve resolves the principal from the active turn's
+ * `ctx.session.auth.current` and fails with `principal_required` before this
+ * runs when there is no authenticated user. The subject token exchanged is the
+ * one `keycardAuth` verified for that same principal.
+ *
+ * Nothing here falls back to the agent's authority. A run without a user
+ * principal, a turn whose subject token was never retained, and an expired
+ * subject token all fail, each with its own reason: `principal_required`,
+ * `subject_token_unavailable`, and `subject_token_expired`. The last one is
+ * the sign-in signal, decided by a decode-only expiry check so an already
+ * dead token never costs an exchange round trip.
+ */
+export function onBehalfOf(options) {
+    const config = resolveConnectionConfig(options, "onBehalfOf");
+    return {
+        principalType: "user",
+        displayName: config.connectionName,
+        async getToken({ principal }) {
+            requireUser(principal, config.connectionName);
+            const subjectToken = readSubjectToken(principal, config.subjectTokens);
+            if (!subjectToken) {
+                throw new AuthorizationFailedError(config.connectionName, {
+                    message: "No Keycard subject token is retained for this turn's principal. Add " +
+                        "keycardAuth() to the channel's auth array, or use retainSubjectToken: " +
+                        '"attributes" when connections run outside the process that authenticated ' +
+                        "the request.",
+                    reason: FailureReason.SUBJECT_TOKEN_UNAVAILABLE,
+                    retryable: false,
+                });
+            }
+            if (subjectTokenExpired(subjectToken)) {
+                config.subjectTokens.delete(principalKey(principal));
+                throw new AuthorizationFailedError(config.connectionName, {
+                    message: "The Keycard subject token for this turn has expired. Sign in again to continue.",
+                    reason: FailureReason.SUBJECT_TOKEN_EXPIRED,
+                    retryable: false,
+                });
+            }
+            let request;
+            if (config.credential) {
+                request = await config.credential.prepareTokenExchangeRequest(subjectToken, config.resource);
+            }
+            else {
+                request = {
+                    subjectToken,
+                    resource: config.resource,
+                    subjectTokenType: TokenType.ACCESS_TOKEN,
+                };
+            }
+            if (config.scope)
+                request = { ...request, scope: config.scope };
+            return tokenResult(await acquire(config.connectionName, () => config.zoneClient().exchangeToken(request)));
+        },
+    };
+}
+/**
+ * Connection auth that acts for a named user the agent holds no token for.
+ *
+ * Uses the zone's substitute-user exchange, authenticated by the application
+ * credential: no subject token is involved, so this is the pattern for
+ * back-office and batch work rather than for a user's own request.
+ *
+ * The principal type follows the identifier. A function needs the turn's
+ * current user, so the connection is user-scoped and inherits eve's
+ * `principal_required` rejection; a fixed identifier needs no caller, so the
+ * connection is app-scoped and runs on schedules.
+ */
+export function impersonate(options) {
+    const config = resolveConnectionConfig(options, "impersonate");
+    const identifier = options.userIdentifier;
+    if (typeof identifier === "string" && !identifier.trim()) {
+        throw new AuthProviderConfigurationError("impersonate requires a non-empty user identifier");
+    }
+    return {
+        principalType: typeof identifier === "function" ? "user" : "app",
+        displayName: config.connectionName,
+        async getToken({ principal }) {
+            let userIdentifier;
+            if (typeof identifier === "function") {
+                requireUser(principal, config.connectionName);
+                userIdentifier = identifier(principal);
+            }
+            else {
+                userIdentifier = identifier;
+            }
+            if (!userIdentifier || !userIdentifier.trim()) {
+                throw new AuthorizationFailedError(config.connectionName, {
+                    message: "impersonate resolved an empty user identifier for this turn.",
+                    reason: FailureReason.PRINCIPAL_REQUIRED,
+                    retryable: false,
+                });
+            }
+            return tokenResult(await acquire(config.connectionName, () => config.zoneClient().impersonate({
+                userIdentifier,
+                resource: config.resource,
+                ...(config.scope ? { scope: config.scope } : {}),
+            })));
+        },
+    };
+}
+/**
+ * eve rejects a user-scoped connection with no current user before `getToken`
+ * runs. This repeats the check with eve's own reason so a factory driven
+ * directly, or resolved under an app principal, fails the same way instead of
+ * acquiring under the agent's authority.
+ */
+function requireUser(principal, connectionName) {
+    if (principal.type === "user")
+        return;
+    throw new AuthorizationFailedError(connectionName, {
+        message: "This connection acts for a user, and the current turn has no authenticated " +
+            "user principal.",
+        reason: FailureReason.PRINCIPAL_REQUIRED,
+        retryable: false,
+    });
+}
+/** Wraps a zone failure as an eve authorization failure for this connection. */
+async function acquire(connectionName, request) {
+    try {
+        return await request();
+    }
+    catch (cause) {
+        throw new AuthorizationFailedError(connectionName, {
+            message: cause instanceof Error ? cause.message : "Token acquisition failed",
+            reason: FailureReason.ACQUISITION_FAILED,
+            retryable: false,
+        });
+    }
+}
+function tokenResult(response) {
+    const expiry = expiresAt(response.expiresIn);
+    return {
+        token: response.accessToken,
+        ...(expiry !== undefined ? { expiresAt: expiry } : {}),
+    };
+}
+//# sourceMappingURL=connections.js.map

package/dist/esm/connections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../src/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,SAAS,GAIV,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAiC,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAWpE;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CACpB,OAAiC;IAEjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE1D,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,WAAW,EAAE,MAAM,CAAC,cAAc;QAClC,KAAK,CAAC,QAAQ;YACZ,MAAM,OAAO,GAA6B;gBACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;aACrC,CAAC;YACF,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACxC,MAAM,CAAC,UAAU,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CACpD,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CACxB,OAAiC;IAEjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAE9D,OAAO;QACL,aAAa,EAAE,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,cAAc;QAClC,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAE9C,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YACvE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EACL,sEAAsE;wBACtE,wEAAwE;wBACxE,2EAA2E;wBAC3E,cAAc;oBAChB,MAAM,EAAE,aAAa,CAAC,yBAAyB;oBAC/C,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;gBACrD,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EACL,iFAAiF;oBACnF,MAAM,EAAE,aAAa,CAAC,qBAAqB;oBAC3C,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAA6B,CAAC;YAClC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,2BAA2B,CAC3D,YAAY,EACZ,MAAM,CAAC,QAAQ,CAChB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG;oBACR,YAAY;oBACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,gBAAgB,EAAE,SAAS,CAAC,YAAY;iBACzC,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAEhE,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CACvF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,OAAkC;IAElC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAC1C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,8BAA8B,CACtC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa,EAAE,OAAO,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QAChE,WAAW,EAAE,MAAM,CAAC,cAAc;QAClC,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,IAAI,cAAsB,CAAC;YAC3B,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gBACrC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC9C,cAAc,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,cAAc,GAAG,UAAU,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC9C,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,cAAc,EAAE;oBACxD,OAAO,EAAE,8DAA8D;oBACvE,MAAM,EAAE,aAAa,CAAC,kBAAkB;oBACxC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACxC,MAAM,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC;gBAC9B,cAAc;gBACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC,CACH,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,SAA8B,EAC9B,cAAsB;IAEtB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IACtC,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;QACjD,OAAO,EACL,6EAA6E;YAC7E,iBAAiB;QACnB,MAAM,EAAE,aAAa,CAAC,kBAAkB;QACxC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,OAAO,CACpB,cAAsB,EACtB,OAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;YACjD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;YAC5E,MAAM,EAAE,aAAa,CAAC,kBAAkB;YACxC,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAuB;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,WAAW;QAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/dist/esm/errors.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Errors this package raises into eve's own error channels.
+ *
+ * eve narrows connection authorization errors by `error.name` rather than by
+ * `instanceof` (see `isConnectionAuthorizationRequiredError` in
+ * `eve/connections`), and its `routeAuth` walk recognizes a rejection by the
+ * `response` property carrying a `Response`. Both contracts are structural, so
+ * this package satisfies them without importing eve at runtime: nothing here
+ * loads eve code, which is what keeps the package usable from a Node 22
+ * toolchain even though eve itself requires Node 24.
+ */
+/**
+ * Signals that the user must complete an authorization flow.
+ *
+ * Thrown from an interactive connection's `getToken`. eve emits
+ * `authorization.required`, runs `startAuthorization`, and durably parks the
+ * turn on its own callback webhook.
+ */
+export declare class AuthorizationRequiredError extends Error {
+    readonly connectionName: string;
+    constructor(connectionName: string, options?: {
+        message?: string;
+    });
+}
+/**
+ * Signals that authorization failed.
+ *
+ * `reason` is the stable machine-readable code eve surfaces on the
+ * `authorization.completed` event and on the failed tool result. `retryable`
+ * is `false` for the cases a fresh consent page cannot fix, so eve stops
+ * re-prompting: a run with no user principal, an expired subject token, or a
+ * denied grant.
+ */
+export declare class AuthorizationFailedError extends Error {
+    readonly connectionName: string;
+    readonly reason?: string;
+    readonly retryable: boolean;
+    constructor(connectionName: string, options?: {
+        message?: string;
+        reason?: string;
+        retryable?: boolean;
+    });
+}
+/** Reasons {@link AuthorizationFailedError} carries out of this package. */
+export declare const FailureReason: Readonly<{
+    /**
+     * eve's own reason for a user-scoped connection running without an
+     * authenticated user. Raised here too, so a factory used outside eve's
+     * principal resolution fails the same way instead of falling back to the
+     * agent's authority.
+     */
+    readonly PRINCIPAL_REQUIRED: "principal_required";
+    /** The retained subject token is a JWT whose `exp` has passed. */
+    readonly SUBJECT_TOKEN_EXPIRED: "subject_token_expired";
+    /** No subject token was retained for the principal of this turn. */
+    readonly SUBJECT_TOKEN_UNAVAILABLE: "subject_token_unavailable";
+    /** The zone refused to issue a token for the connection's resource. */
+    readonly ACQUISITION_FAILED: "acquisition_failed";
+    /** The user denied consent, or the provider returned an OAuth error. */
+    readonly ACCESS_DENIED: "access_denied";
+    /** The callback did not carry the state journaled at the begin step. */
+    readonly INVALID_CALLBACK: "invalid_callback";
+}>;
+/**
+ * Rejects a route in eve's ordered auth walk with a structured 401.
+ *
+ * `routeAuth` returns the `response` of a thrown error that carries one, so
+ * the walk stops here instead of continuing to a later, more permissive entry.
+ */
+export declare class RouteRejectedError extends Error {
+    readonly response: Response;
+    constructor(options?: {
+        message?: string;
+        code?: string;
+        error?: string;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/esm/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;CAKnE;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAG1B,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;CAQvE;AAED,4EAA4E;AAC5E,eAAO,MAAM,aAAa;IACxB;;;;;OAKG;;IAEH,kEAAkE;;IAElE,oEAAoE;;IAEpE,uEAAuE;;IAEvE,wEAAwE;;IAExE,wEAAwE;;EAE/D,CAAC;AAEZ;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;gBAEhB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;CAkB1E"}

package/dist/esm/errors.js

@@ -0,0 +1,93 @@
+/**
+ * Errors this package raises into eve's own error channels.
+ *
+ * eve narrows connection authorization errors by `error.name` rather than by
+ * `instanceof` (see `isConnectionAuthorizationRequiredError` in
+ * `eve/connections`), and its `routeAuth` walk recognizes a rejection by the
+ * `response` property carrying a `Response`. Both contracts are structural, so
+ * this package satisfies them without importing eve at runtime: nothing here
+ * loads eve code, which is what keeps the package usable from a Node 22
+ * toolchain even though eve itself requires Node 24.
+ */
+/** eve's name for the authorization-required error. */
+const AUTHORIZATION_REQUIRED_NAME = "ConnectionAuthorizationRequiredError";
+/** eve's name for the authorization-failed error. */
+const AUTHORIZATION_FAILED_NAME = "ConnectionAuthorizationFailedError";
+/** eve's name for a route rejection carrying its own 401 response. */
+const UNAUTHENTICATED_NAME = "UnauthenticatedError";
+/**
+ * Signals that the user must complete an authorization flow.
+ *
+ * Thrown from an interactive connection's `getToken`. eve emits
+ * `authorization.required`, runs `startAuthorization`, and durably parks the
+ * turn on its own callback webhook.
+ */
+export class AuthorizationRequiredError extends Error {
+    constructor(connectionName, options) {
+        super(options?.message ?? `Connection "${connectionName}" requires authorization.`);
+        this.name = AUTHORIZATION_REQUIRED_NAME;
+        this.connectionName = connectionName;
+    }
+}
+/**
+ * Signals that authorization failed.
+ *
+ * `reason` is the stable machine-readable code eve surfaces on the
+ * `authorization.completed` event and on the failed tool result. `retryable`
+ * is `false` for the cases a fresh consent page cannot fix, so eve stops
+ * re-prompting: a run with no user principal, an expired subject token, or a
+ * denied grant.
+ */
+export class AuthorizationFailedError extends Error {
+    constructor(connectionName, options) {
+        super(options?.message ?? `Connection "${connectionName}" authorization failed.`);
+        this.name = AUTHORIZATION_FAILED_NAME;
+        this.connectionName = connectionName;
+        this.reason = options?.reason;
+        this.retryable = options?.retryable ?? true;
+    }
+}
+/** Reasons {@link AuthorizationFailedError} carries out of this package. */
+export const FailureReason = Object.freeze({
+    /**
+     * eve's own reason for a user-scoped connection running without an
+     * authenticated user. Raised here too, so a factory used outside eve's
+     * principal resolution fails the same way instead of falling back to the
+     * agent's authority.
+     */
+    PRINCIPAL_REQUIRED: "principal_required",
+    /** The retained subject token is a JWT whose `exp` has passed. */
+    SUBJECT_TOKEN_EXPIRED: "subject_token_expired",
+    /** No subject token was retained for the principal of this turn. */
+    SUBJECT_TOKEN_UNAVAILABLE: "subject_token_unavailable",
+    /** The zone refused to issue a token for the connection's resource. */
+    ACQUISITION_FAILED: "acquisition_failed",
+    /** The user denied consent, or the provider returned an OAuth error. */
+    ACCESS_DENIED: "access_denied",
+    /** The callback did not carry the state journaled at the begin step. */
+    INVALID_CALLBACK: "invalid_callback",
+});
+/**
+ * Rejects a route in eve's ordered auth walk with a structured 401.
+ *
+ * `routeAuth` returns the `response` of a thrown error that carries one, so
+ * the walk stops here instead of continuing to a later, more permissive entry.
+ */
+export class RouteRejectedError extends Error {
+    constructor(options) {
+        super(options?.message ?? "Authorization is required for this route.");
+        this.name = UNAUTHENTICATED_NAME;
+        const challenge = options?.error
+            ? `Bearer error="${options.error}"`
+            : "Bearer";
+        this.response = Response.json({
+            code: options?.code ?? "unauthorized",
+            error: options?.message ?? "Authorization is required for this route.",
+            ok: false,
+        }, {
+            status: 401,
+            headers: { "cache-control": "no-store", "www-authenticate": challenge },
+        });
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/esm/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,uDAAuD;AACvD,MAAM,2BAA2B,GAAG,sCAAsC,CAAC;AAC3E,qDAAqD;AACrD,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AACvE,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAGnD,YAAY,cAAsB,EAAE,OAA8B;QAChE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,eAAe,cAAc,2BAA2B,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAKjD,YACE,cAAsB,EACtB,OAAoE;QAEpE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,eAAe,cAAc,yBAAyB,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC;IAC9C,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC;;;;;OAKG;IACH,kBAAkB,EAAE,oBAAoB;IACxC,kEAAkE;IAClE,qBAAqB,EAAE,uBAAuB;IAC9C,oEAAoE;IACpE,yBAAyB,EAAE,2BAA2B;IACtD,uEAAuE;IACvE,kBAAkB,EAAE,oBAAoB;IACxC,wEAAwE;IACxE,aAAa,EAAE,eAAe;IAC9B,wEAAwE;IACxE,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAG3C,YAAY,OAA6D;QACvE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,2CAA2C,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK;YAC9B,CAAC,CAAC,iBAAiB,OAAO,CAAC,KAAK,GAAG;YACnC,CAAC,CAAC,QAAQ,CAAC;QACb,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAC3B;YACE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,cAAc;YACrC,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,2CAA2C;YACtE,EAAE,EAAE,KAAK;SACV,EACD;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE;SACxE,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/esm/expiry.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Whether a JWT subject token is already expired.
+ *
+ * Decode-only, no signature verification: the zone remains the authority on
+ * validity. This check exists to route an expiry to a channel sign-in instead
+ * of a consent page that cannot fix it, and to skip an exchange round trip
+ * that is guaranteed to fail. Opaque or malformed tokens, and tokens with no
+ * `exp`, return false and are left for the zone to judge.
+ */
+export declare function subjectTokenExpired(token: string): boolean;
+/**
+ * The unverified claims of a JWT, or null when the value is not a JWT.
+ *
+ * Used for the expiry check above and for the issuer peek that decides whether
+ * an inbound bearer is a caller this package recognizes. Never a substitute
+ * for verification: every claim a decision depends on is re-read from the
+ * verified claims.
+ */
+export declare function decodeClaims(token: string): Record<string, unknown> | null;
+//# sourceMappingURL=expiry.d.ts.map

package/dist/esm/expiry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expiry.d.ts","sourceRoot":"","sources":["../../src/expiry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK1D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAa1E"}

package/dist/esm/expiry.js

@@ -0,0 +1,49 @@
+/**
+ * Whether a JWT subject token is already expired.
+ *
+ * Decode-only, no signature verification: the zone remains the authority on
+ * validity. This check exists to route an expiry to a channel sign-in instead
+ * of a consent page that cannot fix it, and to skip an exchange round trip
+ * that is guaranteed to fail. Opaque or malformed tokens, and tokens with no
+ * `exp`, return false and are left for the zone to judge.
+ */
+export function subjectTokenExpired(token) {
+    const claims = decodeClaims(token);
+    if (claims === null)
+        return false;
+    const exp = claims.exp;
+    return typeof exp === "number" && Number.isFinite(exp) && exp <= Date.now() / 1000;
+}
+/**
+ * The unverified claims of a JWT, or null when the value is not a JWT.
+ *
+ * Used for the expiry check above and for the issuer peek that decides whether
+ * an inbound bearer is a caller this package recognizes. Never a substitute
+ * for verification: every claim a decision depends on is re-read from the
+ * verified claims.
+ */
+export function decodeClaims(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return null;
+    let payload;
+    try {
+        payload = JSON.parse(decodeSegment(parts[1]));
+    }
+    catch {
+        return null;
+    }
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
+        return null;
+    }
+    return payload;
+}
+/** Decode one base64url JWT segment to its UTF-8 text. */
+function decodeSegment(segment) {
+    const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64 + "=".repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(padded);
+    const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+}
+//# sourceMappingURL=expiry.js.map

package/dist/esm/expiry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expiry.js","sourceRoot":"","sources":["../../src/expiry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACrF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAkC,CAAC;AAC5C,CAAC;AAED,0DAA0D;AAC1D,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/esm/index.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Keycard auth for eve agents.
+ *
+ * Three adapters, each plugging into an eve primitive rather than wrapping it:
+ *
+ * - {@link keycardAuth} is an `AuthFn` for a channel's ordered `auth` array.
+ *   It verifies a zone-issued bearer and projects the claims onto eve's
+ *   `SessionAuthContext`.
+ * - {@link Keycard.asSelf}, {@link Keycard.onBehalfOf}, and
+ *   {@link Keycard.impersonate} are connection auth definitions: eve resolves
+ *   the principal from the turn, calls `getToken` at the tool boundary, and
+ *   attaches the bearer itself, so no credential reaches the model.
+ * - {@link Keycard.interactive} is the interactive form. eve emits
+ *   `authorization.required`, parks the turn durably on its own callback, and
+ *   settles it once.
+ */
+export { keycardAuth } from "./auth.js";
+export type { KeycardAuthOptions, SubjectTokenRetention } from "./auth.js";
+export { asSelf, impersonate, onBehalfOf } from "./connections.js";
+export type { KeycardImpersonateOptions } from "./connections.js";
+export { interactive, memoryAuthorizedTokenStore } from "./interactive.js";
+export type { AuthorizedToken, AuthorizedTokenStore, KeycardInteractiveOptions, KeycardResumeState, WebAppFlow, } from "./interactive.js";
+export type { KeycardConnectionOptions } from "./config.js";
+export { AuthorizationFailedError, AuthorizationRequiredError, FailureReason, RouteRejectedError, } from "./errors.js";
+export { decodeClaims, subjectTokenExpired } from "./expiry.js";
+export { requireAuthOnUnauthorized } from "./requireAuth.js";
+export type { RequireAuthContext } from "./requireAuth.js";
+export { defaultSubjectTokenStore, memorySubjectTokenStore, SUBJECT_TOKEN_ATTRIBUTE, } from "./subjectTokens.js";
+export type { SubjectTokenStore } from "./subjectTokens.js";
+export { KeycardZoneClient } from "./zoneClient.js";
+export type { ZoneClient } from "./zoneClient.js";
+import { asSelf, impersonate, onBehalfOf } from "./connections.js";
+import { interactive } from "./interactive.js";
+/**
+ * The connection auth factories, grouped for the common
+ * `auth: Keycard.onBehalfOf({ ... })` call site.
+ */
+export declare const Keycard: Readonly<{
+    asSelf: typeof asSelf;
+    impersonate: typeof impersonate;
+    interactive: typeof interactive;
+    onBehalfOf: typeof onBehalfOf;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,YAAY,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC3E,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,OAAO;;;;;EAKlB,CAAC"}

package/dist/esm/index.js

@@ -0,0 +1,37 @@
+/**
+ * Keycard auth for eve agents.
+ *
+ * Three adapters, each plugging into an eve primitive rather than wrapping it:
+ *
+ * - {@link keycardAuth} is an `AuthFn` for a channel's ordered `auth` array.
+ *   It verifies a zone-issued bearer and projects the claims onto eve's
+ *   `SessionAuthContext`.
+ * - {@link Keycard.asSelf}, {@link Keycard.onBehalfOf}, and
+ *   {@link Keycard.impersonate} are connection auth definitions: eve resolves
+ *   the principal from the turn, calls `getToken` at the tool boundary, and
+ *   attaches the bearer itself, so no credential reaches the model.
+ * - {@link Keycard.interactive} is the interactive form. eve emits
+ *   `authorization.required`, parks the turn durably on its own callback, and
+ *   settles it once.
+ */
+export { keycardAuth } from "./auth.js";
+export { asSelf, impersonate, onBehalfOf } from "./connections.js";
+export { interactive, memoryAuthorizedTokenStore } from "./interactive.js";
+export { AuthorizationFailedError, AuthorizationRequiredError, FailureReason, RouteRejectedError, } from "./errors.js";
+export { decodeClaims, subjectTokenExpired } from "./expiry.js";
+export { requireAuthOnUnauthorized } from "./requireAuth.js";
+export { defaultSubjectTokenStore, memorySubjectTokenStore, SUBJECT_TOKEN_ATTRIBUTE, } from "./subjectTokens.js";
+export { KeycardZoneClient } from "./zoneClient.js";
+import { asSelf, impersonate, onBehalfOf } from "./connections.js";
+import { interactive } from "./interactive.js";
+/**
+ * The connection auth factories, grouped for the common
+ * `auth: Keycard.onBehalfOf({ ... })` call site.
+ */
+export const Keycard = Object.freeze({
+    asSelf,
+    impersonate,
+    interactive,
+    onBehalfOf,
+});
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAW3E,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,MAAM;IACN,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC,CAAC"}