@keycardai/eve 0.1.0

package/dist/esm/interactive.d.ts

@@ -0,0 +1,90 @@
+import { type AuthorizationRedirect, type BeginAuthorizationOptions, type CompleteAuthorizationOptions, type TokenResponse } from "@keycardai/oauth";
+import type { InteractiveAuthorizationDefinition, JsonValue } from "eve/connections";
+/**
+ * The state journaled between eve's begin and callback steps.
+ *
+ * Every field is JSON, so the value satisfies eve's `JsonValue` bound and
+ * survives the durable step boundary the park crosses.
+ */
+export interface KeycardResumeState {
+    readonly state: string;
+    readonly codeVerifier: string;
+    readonly resources: readonly string[];
+    readonly callbackUrl: string;
+    readonly [key: string]: JsonValue;
+}
+/** A token this package minted for one principal, plus its advisory expiry. */
+export interface AuthorizedToken {
+    readonly token: string;
+    readonly expiresAt?: number;
+    readonly providerSubject?: string;
+}
+/**
+ * Where completed authorizations live between turns.
+ *
+ * eve caches a resolved bearer for the duration of a step, and reruns
+ * `getToken` after that. This store is what makes a second step reuse the
+ * grant a user already completed instead of parking the turn again. The
+ * default is process-local, so a fresh process re-parks rather than
+ * resurrecting a credential from durable state.
+ */
+export interface AuthorizedTokenStore {
+    get(key: string): AuthorizedToken | undefined;
+    set(key: string, token: AuthorizedToken): void;
+    delete(key: string): void;
+}
+/** The two web-flow calls this adapter makes, as one seam for tests. */
+export interface WebAppFlow {
+    begin(options: BeginAuthorizationOptions): Promise<AuthorizationRedirect>;
+    complete(options: CompleteAuthorizationOptions): Promise<TokenResponse>;
+}
+export interface KeycardInteractiveOptions {
+    /** The resource URL the authorization is scoped to. */
+    resource: string;
+    /** Keycard zone URL (issuer). Required unless `flow` is given. */
+    zoneUrl?: string;
+    /** OAuth client the browser flow runs as. Required unless `flow` is given. */
+    clientId?: string;
+    /** Client secret, for a confidential client. Public clients omit it. */
+    clientSecret?: string;
+    /** Scopes requested in the authorization request. */
+    requestScopes?: string | readonly string[];
+    /** Extra resources authorized alongside `resource`. */
+    additionalResources?: readonly string[];
+    /** Name used in error messages and eve's authorization events. */
+    connectionName?: string;
+    /** Store for completed authorizations. Defaults to a process-local store. */
+    tokens?: AuthorizedTokenStore;
+    /** Web-flow seam. Replaces the zone calls, so tests take no network. */
+    flow?: WebAppFlow;
+}
+/**
+ * Interactive connection auth backed by the zone's web authorization flow.
+ *
+ * The three callbacks eve drives:
+ *
+ * - `getToken` returns a token only when this package holds one for the
+ *   principal. Otherwise it throws `ConnectionAuthorizationRequiredError`, and
+ *   eve emits `authorization.required`, runs `startAuthorization` in a durable
+ *   step, and parks the turn on its own callback webhook.
+ * - `startAuthorization` begins the authorization-code flow with PKCE for the
+ *   connection's resources, against eve's minted callback URL, and returns the
+ *   challenge URL plus the `state` and verifier as resume state.
+ * - `completeAuthorization` redeems the callback against the journaled resume
+ *   state and hands eve the token.
+ *
+ * Resuming without a completed authorization cannot yield a credential.
+ * `getToken` is the only path that returns a token and it reads the store,
+ * which only `completeAuthorization` writes; a denied, mismatched, or failed
+ * callback writes nothing. So a resumed turn either finds a real grant or
+ * throws `Required` again and parks. eve's own settlement makes that terminal
+ * rather than an endless loop: it settles each parked authorization once, and
+ * a `Required` thrown after a completed authorization ends the tool call.
+ *
+ * Discovery is memoized per definition, so the first authorization pays the
+ * metadata round trip and later ones do not.
+ */
+export declare function interactive(options: KeycardInteractiveOptions): InteractiveAuthorizationDefinition<KeycardResumeState>;
+/** A process-local store that drops entries at their advisory expiry. */
+export declare function memoryAuthorizedTokenStore(): AuthorizedTokenStore;
+//# sourceMappingURL=interactive.d.ts.map

package/dist/esm/interactive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive.d.ts","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EAEjC,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAEV,kCAAkC,EAClC,SAAS,EAEV,MAAM,iBAAiB,CAAC;AAUzB;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wEAAwE;AACxE,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC1E,QAAQ,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,yBAAyB;IACxC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC3C,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,wEAAwE;IACxE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,yBAAyB,GACjC,kCAAkC,CAAC,kBAAkB,CAAC,CAiGxD;AAED,yEAAyE;AACzE,wBAAgB,0BAA0B,IAAI,oBAAoB,CAmBjE"}

package/dist/esm/interactive.js

@@ -0,0 +1,190 @@
+import { AuthProviderConfigurationError, AuthorizationDeniedError, beginAuthorization, completeAuthorization, fetchAuthorizationServerMetadata, StateMismatchError, } from "@keycardai/oauth";
+import { expiresAt } from "./config.js";
+import { AuthorizationFailedError, AuthorizationRequiredError, FailureReason, } from "./errors.js";
+import { principalKey } from "./subjectTokens.js";
+/**
+ * Interactive connection auth backed by the zone's web authorization flow.
+ *
+ * The three callbacks eve drives:
+ *
+ * - `getToken` returns a token only when this package holds one for the
+ *   principal. Otherwise it throws `ConnectionAuthorizationRequiredError`, and
+ *   eve emits `authorization.required`, runs `startAuthorization` in a durable
+ *   step, and parks the turn on its own callback webhook.
+ * - `startAuthorization` begins the authorization-code flow with PKCE for the
+ *   connection's resources, against eve's minted callback URL, and returns the
+ *   challenge URL plus the `state` and verifier as resume state.
+ * - `completeAuthorization` redeems the callback against the journaled resume
+ *   state and hands eve the token.
+ *
+ * Resuming without a completed authorization cannot yield a credential.
+ * `getToken` is the only path that returns a token and it reads the store,
+ * which only `completeAuthorization` writes; a denied, mismatched, or failed
+ * callback writes nothing. So a resumed turn either finds a real grant or
+ * throws `Required` again and parks. eve's own settlement makes that terminal
+ * rather than an endless loop: it settles each parked authorization once, and
+ * a `Required` thrown after a completed authorization ends the tool call.
+ *
+ * Discovery is memoized per definition, so the first authorization pays the
+ * metadata round trip and later ones do not.
+ */
+export function interactive(options) {
+    if (!options.resource || !options.resource.trim()) {
+        throw new AuthProviderConfigurationError("interactive requires a resource URL");
+    }
+    if (!options.flow && (!options.zoneUrl || !options.clientId)) {
+        throw new AuthProviderConfigurationError("interactive requires zoneUrl and clientId, or an injected flow");
+    }
+    const connectionName = options.connectionName ?? options.resource;
+    const tokens = options.tokens ?? memoryAuthorizedTokenStore();
+    const flow = options.flow ?? zoneWebAppFlow(options.zoneUrl);
+    const clientId = options.clientId ?? "";
+    const resources = [options.resource, ...(options.additionalResources ?? [])];
+    const scopes = splitScopes(options.requestScopes);
+    return {
+        principalType: "user",
+        displayName: connectionName,
+        async getToken({ principal }) {
+            const key = storeKey(principal, connectionName);
+            const held = tokens.get(key);
+            if (!held) {
+                throw new AuthorizationRequiredError(connectionName);
+            }
+            return toTokenResult(held);
+        },
+        async startAuthorization({ principal, callbackUrl }) {
+            requireUser(principal, connectionName);
+            const redirect = await flow.begin({
+                clientId,
+                redirectUri: callbackUrl,
+                resources,
+                ...(scopes.length > 0 ? { scopes } : {}),
+            });
+            return {
+                challenge: { url: redirect.url, displayName: connectionName },
+                resume: {
+                    state: redirect.state,
+                    codeVerifier: redirect.codeVerifier,
+                    resources: redirect.resources,
+                    callbackUrl,
+                },
+            };
+        },
+        async completeAuthorization({ principal, callbackUrl, resume, callback }) {
+            requireUser(principal, connectionName);
+            if (!resume) {
+                throw new AuthorizationFailedError(connectionName, {
+                    message: "The authorization callback arrived without the state journaled at the " +
+                        "begin step, so it cannot be redeemed.",
+                    reason: FailureReason.INVALID_CALLBACK,
+                    retryable: false,
+                });
+            }
+            let response;
+            try {
+                response = await flow.complete({
+                    callbackParams: { ...callback.params },
+                    state: resume.state,
+                    codeVerifier: resume.codeVerifier,
+                    clientId,
+                    redirectUri: resume.callbackUrl || callbackUrl,
+                    ...(options.clientSecret ? { clientSecret: options.clientSecret } : {}),
+                });
+            }
+            catch (cause) {
+                throw new AuthorizationFailedError(connectionName, {
+                    message: cause instanceof Error ? cause.message : "Authorization failed",
+                    reason: cause instanceof AuthorizationDeniedError
+                        ? FailureReason.ACCESS_DENIED
+                        : cause instanceof StateMismatchError
+                            ? FailureReason.INVALID_CALLBACK
+                            : FailureReason.ACQUISITION_FAILED,
+                    retryable: false,
+                });
+            }
+            const expiry = expiresAt(response.expiresIn);
+            const token = {
+                token: response.accessToken,
+                ...(expiry !== undefined ? { expiresAt: expiry } : {}),
+            };
+            tokens.set(storeKey(principal, connectionName), token);
+            return toTokenResult(token);
+        },
+        /**
+         * eve calls this after a rejected bearer, so the next `getToken` parks the
+         * turn for a fresh grant instead of handing back the same dead token.
+         */
+        evict({ principal }) {
+            tokens.delete(storeKey(principal, connectionName));
+        },
+    };
+}
+/** A process-local store that drops entries at their advisory expiry. */
+export function memoryAuthorizedTokenStore() {
+    const tokens = new Map();
+    return {
+        get(key) {
+            const held = tokens.get(key);
+            if (!held)
+                return undefined;
+            if (held.expiresAt !== undefined && held.expiresAt <= Date.now()) {
+                tokens.delete(key);
+                return undefined;
+            }
+            return held;
+        },
+        set(key, token) {
+            tokens.set(key, token);
+        },
+        delete(key) {
+            tokens.delete(key);
+        },
+    };
+}
+/** The default flow: the zone's web-app endpoints, with discovery memoized. */
+function zoneWebAppFlow(issuer) {
+    let metadata;
+    const discover = () => {
+        if (!metadata)
+            metadata = fetchAuthorizationServerMetadata(issuer);
+        return metadata;
+    };
+    return {
+        async begin(options) {
+            return beginAuthorization(issuer, { ...options, metadata: await discover() });
+        },
+        async complete(options) {
+            return completeAuthorization(issuer, { ...options, metadata: await discover() });
+        },
+    };
+}
+function storeKey(principal, connectionName) {
+    if (principal.type !== "user")
+        return `${connectionName}|app`;
+    return `${connectionName}|${principalKey(principal)}`;
+}
+function toTokenResult(token) {
+    return {
+        token: token.token,
+        ...(token.expiresAt !== undefined ? { expiresAt: token.expiresAt } : {}),
+        ...(token.providerSubject !== undefined
+            ? { providerSubject: token.providerSubject }
+            : {}),
+    };
+}
+function requireUser(principal, connectionName) {
+    if (principal.type === "user")
+        return;
+    throw new AuthorizationFailedError(connectionName, {
+        message: "Interactive authorization needs a user principal, and the current turn has " +
+            "no authenticated user.",
+        reason: FailureReason.PRINCIPAL_REQUIRED,
+        retryable: false,
+    });
+}
+function splitScopes(scopes) {
+    if (scopes === undefined)
+        return [];
+    return Array.isArray(scopes) ? [...scopes] : scopes.split(" ").filter(Boolean);
+}
+//# sourceMappingURL=interactive.js.map

package/dist/esm/interactive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive.js","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,gCAAgC,EAChC,kBAAkB,GAMnB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAiElD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,WAAW,CACzB,OAAkC;IAElC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,8BAA8B,CAAC,qCAAqC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAA8B,CACtC,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,OAAO,CAAC,OAAQ,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAElD,OAAO;QACL,aAAa,EAAE,MAAM;QACrB,WAAW,EAAE,cAAc;QAC3B,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;YACjD,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;gBAChC,QAAQ;gBACR,WAAW,EAAE,WAAW;gBACxB,SAAS;gBACT,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAC,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE;gBAC7D,MAAM,EAAE;oBACN,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,WAAW;iBACZ;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE;YACtE,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EACL,wEAAwE;wBACxE,uCAAuC;oBACzC,MAAM,EAAE,aAAa,CAAC,gBAAgB;oBACtC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,QAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;oBAC7B,cAAc,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE;oBACtC,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,QAAQ;oBACR,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,WAAW;oBAC9C,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxE,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB;oBACxE,MAAM,EACJ,KAAK,YAAY,wBAAwB;wBACvC,CAAC,CAAC,aAAa,CAAC,aAAa;wBAC7B,CAAC,CAAC,KAAK,YAAY,kBAAkB;4BACnC,CAAC,CAAC,aAAa,CAAC,gBAAgB;4BAChC,CAAC,CAAC,aAAa,CAAC,kBAAkB;oBACxC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAoB;gBAC7B,KAAK,EAAE,QAAQ,CAAC,WAAW;gBAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,EAAE,SAAS,EAAE;YACjB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,OAAO;QACL,GAAG,CAAC,GAAG;YACL,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC5B,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACjE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACnB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,GAAG,EAAE,KAAK;YACZ,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,CAAC,GAAG;YACR,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,QAA+D,CAAC;IACpE,MAAM,QAAQ,GAAG,GAA8C,EAAE;QAC/D,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAO;YACjB,OAAO,kBAAkB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,OAAO;YACpB,OAAO,qBAAqB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,SAA8B,EAAE,cAAsB;IACtE,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,GAAG,cAAc,MAAM,CAAC;IAC9D,OAAO,GAAG,cAAc,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAAsB;IAC3C,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,SAA8B,EAAE,cAAsB;IACzE,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IACtC,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;QACjD,OAAO,EACL,6EAA6E;YAC7E,wBAAwB;QAC1B,MAAM,EAAE,aAAa,CAAC,kBAAkB;QACxC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA8C;IACjE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAE,MAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC7F,CAAC"}

package/dist/esm/package.json

@@ -0,0 +1 @@
+{"type": "module"}

package/dist/esm/requireAuth.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The part of eve's tool context this helper needs.
+ *
+ * Declared structurally rather than imported so nothing here loads eve at
+ * runtime. `ctx.requireAuth` never returns: it aborts the tool call and hands
+ * the connection's authorization strategy back to the runtime.
+ */
+export interface RequireAuthContext<Provider> {
+    requireAuth(provider: Provider, options?: {
+        readonly reason?: string;
+    }): never;
+}
+/**
+ * Maps a provider's rejection of the current credential onto
+ * `ctx.requireAuth`.
+ *
+ * A token that verified when it was minted can still be refused downstream
+ * after a revocation or a scope change. eve treats `requireAuth` as the signal
+ * to drop its cached bearer, call the strategy's `evict`, and re-run
+ * authorization, so an authored tool wrapping a `fetch` only needs to forward
+ * the status:
+ *
+ * ```ts
+ * const response = await fetch(url, { headers });
+ * requireAuthOnUnauthorized(response, ctx, auth);
+ * ```
+ *
+ * Returns for every other status, so the tool keeps handling its own errors.
+ */
+export declare function requireAuthOnUnauthorized<Provider>(response: {
+    readonly status: number;
+}, ctx: RequireAuthContext<Provider>, provider: Provider, options?: {
+    readonly reason?: string;
+}): void;
+//# sourceMappingURL=requireAuth.d.ts.map

package/dist/esm/requireAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requireAuth.d.ts","sourceRoot":"","sources":["../../src/requireAuth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB,CAAC,QAAQ;IAC1C,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;CAChF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAChD,QAAQ,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACrC,GAAG,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrC,IAAI,CAON"}

package/dist/esm/requireAuth.js

@@ -0,0 +1,26 @@
+/**
+ * Maps a provider's rejection of the current credential onto
+ * `ctx.requireAuth`.
+ *
+ * A token that verified when it was minted can still be refused downstream
+ * after a revocation or a scope change. eve treats `requireAuth` as the signal
+ * to drop its cached bearer, call the strategy's `evict`, and re-run
+ * authorization, so an authored tool wrapping a `fetch` only needs to forward
+ * the status:
+ *
+ * ```ts
+ * const response = await fetch(url, { headers });
+ * requireAuthOnUnauthorized(response, ctx, auth);
+ * ```
+ *
+ * Returns for every other status, so the tool keeps handling its own errors.
+ */
+export function requireAuthOnUnauthorized(response, ctx, provider, options) {
+    if (response.status !== 401 && response.status !== 403)
+        return;
+    ctx.requireAuth(provider, {
+        reason: options?.reason ??
+            `The provider rejected the connection credential with ${response.status}.`,
+    });
+}
+//# sourceMappingURL=requireAuth.js.map

package/dist/esm/requireAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requireAuth.js","sourceRoot":"","sources":["../../src/requireAuth.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAqC,EACrC,GAAiC,EACjC,QAAkB,EAClB,OAAsC;IAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IAC/D,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE;QACxB,MAAM,EACJ,OAAO,EAAE,MAAM;YACf,wDAAwD,QAAQ,CAAC,MAAM,GAAG;KAC7E,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/subjectTokens.d.ts

@@ -0,0 +1,50 @@
+import type { ConnectionPrincipal } from "eve/connections";
+import type { SessionAuthContext } from "eve/context";
+/**
+ * The attribute name carrying the inbound bearer when retention is
+ * `"attributes"`.
+ *
+ * eve copies `SessionAuthContext.attributes` onto the connection principal, so
+ * an attribute is the only channel eve itself offers between the auth walk and
+ * a connection's `getToken`. It is also durable session state, which is why
+ * this is opt-in rather than the default.
+ */
+export declare const SUBJECT_TOKEN_ATTRIBUTE = "keycard_subject_token";
+/**
+ * Where the verified inbound bearer lives between the auth walk and the
+ * exchange in `onBehalfOf`.
+ *
+ * Two implementations ship: {@link memorySubjectTokenStore} (the default,
+ * process-local, nothing at rest) and the `"attributes"` retention mode, which
+ * puts the token on the eve session instead. Both keep the token out of model
+ * input: neither is a tool argument, a connection schema field, or a message.
+ */
+export interface SubjectTokenStore {
+    get(key: string): string | undefined;
+    set(key: string, token: string): void;
+    delete(key: string): void;
+}
+/**
+ * A process-local store that drops entries once their JWT `exp` has passed.
+ *
+ * Nothing here survives a restart, so a turn that resumes in a fresh process
+ * finds no subject token and fails closed with
+ * `subject_token_unavailable` rather than reaching for the agent's authority.
+ */
+export declare function memorySubjectTokenStore(): SubjectTokenStore;
+/** The default store, shared by `keycardAuth` and the connection factories. */
+export declare const defaultSubjectTokenStore: SubjectTokenStore;
+/**
+ * The store key for one principal.
+ *
+ * Derived from the fields eve projects from the session's current auth onto
+ * the connection principal, so the auth walk and `getToken` compute the same
+ * key without sharing any other state.
+ */
+export declare function principalKey(identity: Pick<SessionAuthContext, "authenticator" | "issuer" | "principalId"> | {
+    readonly id: string;
+    readonly issuer?: string;
+}): string;
+/** The retained subject token for a connection principal, if any. */
+export declare function readSubjectToken(principal: ConnectionPrincipal, store: SubjectTokenStore): string | undefined;
+//# sourceMappingURL=subjectTokens.d.ts.map

package/dist/esm/subjectTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subjectTokens.d.ts","sourceRoot":"","sources":["../../src/subjectTokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAItD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,0BAA0B,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACrC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,CAqB3D;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,EAAE,iBAA6C,CAAC;AAErF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EACJ,IAAI,CAAC,kBAAkB,EAAE,eAAe,GAAG,QAAQ,GAAG,aAAa,CAAC,GACpE;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD,MAAM,CAKR;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,mBAAmB,EAC9B,KAAK,EAAE,iBAAiB,GACvB,MAAM,GAAG,SAAS,CAKpB"}

package/dist/esm/subjectTokens.js

@@ -0,0 +1,73 @@
+import { decodeClaims } from "./expiry.js";
+/**
+ * The attribute name carrying the inbound bearer when retention is
+ * `"attributes"`.
+ *
+ * eve copies `SessionAuthContext.attributes` onto the connection principal, so
+ * an attribute is the only channel eve itself offers between the auth walk and
+ * a connection's `getToken`. It is also durable session state, which is why
+ * this is opt-in rather than the default.
+ */
+export const SUBJECT_TOKEN_ATTRIBUTE = "keycard_subject_token";
+/**
+ * A process-local store that drops entries once their JWT `exp` has passed.
+ *
+ * Nothing here survives a restart, so a turn that resumes in a fresh process
+ * finds no subject token and fails closed with
+ * `subject_token_unavailable` rather than reaching for the agent's authority.
+ */
+export function memorySubjectTokenStore() {
+    const tokens = new Map();
+    return {
+        get(key) {
+            return tokens.get(key);
+        },
+        /**
+         * Expiry is not hidden from readers: `onBehalfOf` distinguishes an expired
+         * subject token from a missing one, and only the first routes to sign-in.
+         * Pruning here keeps the map from growing without bound.
+         */
+        set(key, token) {
+            for (const [existing, value] of tokens) {
+                if (tokenExpired(value))
+                    tokens.delete(existing);
+            }
+            tokens.set(key, token);
+        },
+        delete(key) {
+            tokens.delete(key);
+        },
+    };
+}
+/** The default store, shared by `keycardAuth` and the connection factories. */
+export const defaultSubjectTokenStore = memorySubjectTokenStore();
+/**
+ * The store key for one principal.
+ *
+ * Derived from the fields eve projects from the session's current auth onto
+ * the connection principal, so the auth walk and `getToken` compute the same
+ * key without sharing any other state.
+ */
+export function principalKey(identity) {
+    if ("id" in identity) {
+        return `${identity.issuer ?? ""}|${identity.id}`;
+    }
+    return `${identity.issuer ?? identity.authenticator}|${identity.principalId}`;
+}
+/** The retained subject token for a connection principal, if any. */
+export function readSubjectToken(principal, store) {
+    if (principal.type !== "user")
+        return undefined;
+    const attribute = principal.attributes?.[SUBJECT_TOKEN_ATTRIBUTE];
+    if (typeof attribute === "string" && attribute)
+        return attribute;
+    return store.get(principalKey(principal));
+}
+function tokenExpired(token) {
+    const claims = decodeClaims(token);
+    if (claims === null)
+        return false;
+    const exp = claims.exp;
+    return typeof exp === "number" && Number.isFinite(exp) && exp <= Date.now() / 1000;
+}
+//# sourceMappingURL=subjectTokens.js.map

package/dist/esm/subjectTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subjectTokens.js","sourceRoot":"","sources":["../../src/subjectTokens.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAiB/D;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,OAAO;QACL,GAAG,CAAC,GAAG;YACL,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QACD;;;;WAIG;QACH,GAAG,CAAC,GAAG,EAAE,KAAK;YACZ,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvC,IAAI,YAAY,CAAC,KAAK,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,CAAC,GAAG;YACR,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAsB,uBAAuB,EAAE,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,QAEqD;IAErD,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;QACrB,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;AAChF,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAC9B,SAA8B,EAC9B,KAAwB;IAExB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAClE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACrF,CAAC"}

package/dist/esm/testing/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Offline test helpers.
+ *
+ * Nothing here touches the network: a fake zone client records the requests a
+ * factory made, and the JWT builders produce decode-only fixtures. Import from
+ * `@keycardai/eve/testing`.
+ */
+export { appPrincipal, bearerRequest, connectionContext, expiredJwt, fakeVerifier, fakeZoneClient, sessionAuthContext, unsignedJwt, userPrincipal, validJwt, } from "./testUtils.js";
+export type { FakeZoneClient, FakeZoneClientOptions, ZoneCalls } from "./testUtils.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/esm/testing/index.js

@@ -0,0 +1,9 @@
+/**
+ * Offline test helpers.
+ *
+ * Nothing here touches the network: a fake zone client records the requests a
+ * factory made, and the JWT builders produce decode-only fixtures. Import from
+ * `@keycardai/eve/testing`.
+ */
+export { appPrincipal, bearerRequest, connectionContext, expiredJwt, fakeVerifier, fakeZoneClient, sessionAuthContext, unsignedJwt, userPrincipal, validJwt, } from "./testUtils.js";
+//# sourceMappingURL=index.js.map

package/dist/esm/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,QAAQ,GACT,MAAM,gBAAgB,CAAC"}

package/dist/esm/testing/testUtils.d.ts

@@ -0,0 +1,51 @@
+import type { ClientCredentialsRequest, ImpersonateRequest, JWTClaims, TokenExchangeRequest } from "@keycardai/oauth";
+import type { ConnectionPrincipal } from "eve/connections";
+import type { SessionAuthContext } from "eve/context";
+import type { ZoneClient } from "../zoneClient.js";
+/** Every call a fake zone client saw, in order. */
+export interface ZoneCalls {
+    readonly exchanges: TokenExchangeRequest[];
+    readonly impersonations: ImpersonateRequest[];
+    readonly clientCredentials: ClientCredentialsRequest[];
+}
+export interface FakeZoneClientOptions {
+    /** Fails only these resources, leaving the rest to succeed. */
+    failResources?: Readonly<Record<string, Error>>;
+    /** Fails every call, whatever the resource. */
+    fail?: Error;
+    /** Advisory lifetime on issued tokens, in seconds. */
+    expiresIn?: number;
+}
+/** A fake zone client with recorded calls and no network. */
+export interface FakeZoneClient extends ZoneClient {
+    readonly calls: ZoneCalls;
+}
+/**
+ * A zone client that mints deterministic tokens and records what it was asked
+ * for.
+ *
+ * Covers the three cases the contract requires from a testing seam: successful
+ * acquisition, failure of one resource, and failure of every call.
+ */
+export declare function fakeZoneClient(options?: FakeZoneClientOptions): FakeZoneClient;
+/** An unsigned JWT with the given claims, for decode-only paths. */
+export declare function unsignedJwt(claims: Record<string, unknown>): string;
+/** A JWT that expired `secondsAgo` seconds ago. */
+export declare function expiredJwt(secondsAgo?: number): string;
+/** A JWT that is valid for another `secondsAhead` seconds. */
+export declare function validJwt(secondsAhead?: number, claims?: Record<string, unknown>): string;
+/** A request carrying a bearer token. */
+export declare function bearerRequest(token: string, url?: string): Request;
+/** A verification seam that accepts one token and rejects everything else. */
+export declare function fakeVerifier(accepted: string, claims: JWTClaims): (token: string) => Promise<JWTClaims>;
+/** A user connection principal. */
+export declare function userPrincipal(id?: string, issuer?: string, attributes?: Readonly<Record<string, string | readonly string[]>>): ConnectionPrincipal;
+/** The app connection principal. */
+export declare function appPrincipal(): ConnectionPrincipal;
+/** A session auth context, as `keycardAuth` would return it. */
+export declare function sessionAuthContext(overrides?: Partial<SessionAuthContext>): SessionAuthContext;
+/** The connection metadata eve passes to every authorization callback. */
+export declare function connectionContext(url?: string): {
+    url: string;
+};
+//# sourceMappingURL=testUtils.d.ts.map

package/dist/esm/testing/testUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testUtils.d.ts","sourceRoot":"","sources":["../../../src/testing/testUtils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,kBAAkB,EAClB,SAAS,EACT,oBAAoB,EAErB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,oBAAoB,EAAE,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,EAAE,CAAC;CACxD;AAED,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,+CAA+C;IAC/C,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA6BlF;AAED,oEAAoE;AACpE,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAInE;AAED,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,UAAU,SAAK,GAAG,MAAM,CAElD;AAED,8DAA8D;AAC9D,wBAAgB,QAAQ,CAAC,YAAY,SAAO,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,MAAM,CAM1F;AAED,yCAAyC;AACzC,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAmC,GAAG,OAAO,CAE5F;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,GAChB,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAKvC;AAED,mCAAmC;AACnC,wBAAgB,aAAa,CAC3B,EAAE,SAAW,EACb,MAAM,SAA6B,EACnC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAAC,GAChE,mBAAmB,CAErB;AAED,oCAAoC;AACpC,wBAAgB,YAAY,IAAI,mBAAmB,CAElD;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAChC,SAAS,GAAE,OAAO,CAAC,kBAAkB,CAAM,GAC1C,kBAAkB,CASpB;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,GAAG,SAAgC,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAEtF"}