@keycardai/eve 0.4.0 → 0.5.0

package/README.md

@@ -246,6 +246,84 @@ parks at expiry, as before.
 `evict` removes every grant of the principal that covers this connection's
 resource, leaving grants for other resources in place.
 
+### Binding the sign-in to the user who asked: `expectedSubject`
+
+A Slack or other chat principal is not a zone identity, and the sign-in link
+eve posts can be completed by whoever opens it, in a browser that may already
+be signed in to the zone as someone else. `expectedSubject` closes that gap.
+It is a host function from eve's `ConnectionPrincipal` to the zone user that
+principal must sign in as, meaning the `sub` the zone's UserInfo endpoint
+returns for that user, or `undefined` when the deployment knows no zone user
+for the principal:
+
+```ts
+import { Keycard } from "@keycardai/eve";
+import type { ConnectionPrincipal } from "eve/connections";
+
+// Your own mapping from the chat identity to the zone's user identifier, for
+// example a directory lookup keyed by the Slack user id in the principal.
+declare function zoneUserFor(principal: ConnectionPrincipal): Promise<string | undefined>;
+
+Keycard.interactive({
+  zoneUrl: process.env.KEYCARD_ZONE_URL!,
+  resource: "https://docs.example.com",
+  requestScopes: ["documents.read"],
+  connectionName: "Docs",
+  expectedSubject: zoneUserFor,
+  prompt: "login",
+});
+```
+
+With it set, the check runs twice around the browser flow and once on every
+use:
+
+- Before the link: `startAuthorization` resolves the expected user first. No
+  value means no client is registered and no link is posted; the attempt fails
+  with `reason: "identity_unverifiable"` and `retryable: false`, since only
+  configuration can fix it. The authorization request then adds the `openid`
+  scope, so the zone issues a token its UserInfo endpoint accepts.
+- After the sign-in: `completeAuthorization` redeems the code, resolves the
+  expected user again (it is never journaled into eve's resume state), asks
+  the zone's UserInfo endpoint who the new token belongs to, and compares that
+  `sub` to the expected value as an exact string. A different user fails with
+  `reason: "identity_mismatch"`; a lookup that returns nothing or throws, a
+  failed UserInfo call, or a response without `sub` fails with
+  `reason: "identity_unverifiable"`. Both are `retryable: false` and store
+  nothing. Who signed in is read from UserInfo, never from the token.
+- On use: `getToken` serves this definition a grant only when the grant's
+  verified `subject` equals the value resolved for the current principal. A
+  grant verified for someone else stays in the store for definitions it does
+  cover; this one parks for a fresh sign-in.
+
+Error messages name neither account, because eve shows them to the model or
+the user. A refresh keeps the verified `subject` without another UserInfo call:
+a refresh continues the same grant, and the zone resolves the user from the
+refresh token itself. A refresh the zone answers with
+`insufficient_authorization` deletes the grant and parks, like `invalid_grant`.
+
+**Setup the check depends on.** Matching works only when the zone's user
+identifier is the value your function returns. Configure a zone identity
+provider with its User Identifier Claim set to that value (for example
+`email`); users created after that setting get it as their identifier, users
+created before it keep their old one, and the Keycard-assigned default never
+matches a host value, so until the zone is configured every check fails closed
+with `identity_unverifiable` or `identity_mismatch`. Using the chat platform
+itself as the zone identity provider is the other route.
+
+Keep `expectedSubject` cheap, or cache it in the host: the package does not
+cache it and calls it on every `getToken`.
+
+`prompt: "login"` sets `prompt=login` on the sign-in URL (OIDC Core 1.0
+section 3.1.2.1), so the browser re-authenticates at the zone instead of
+silently reusing a session that belongs to someone else. It works with or
+without `expectedSubject`; `"login"` is the only accepted value.
+
+One caveat from eve itself: eve 0.71.3 emits `authorization.completed` with
+outcome `authorized` when the turn resumes after the callback, before this
+package's `completeAuthorization` runs. A sign-in the identity check rejects is
+therefore first reported as connected, then fails on first use with the reason
+above. No grant is stored in that case, so the misreport is cosmetic.
+
 ### Plugging a durable grant store
 
 The default store is process-local, so a restarted agent parks once more for
@@ -331,9 +409,10 @@ const auth = Keycard.onBehalfOf({
 credentials call, and can fail one resource or every request. `keycardAuth()`
 takes a `verify` seam in place of the JWKS-backed verifier, and
 `Keycard.interactive()` takes a `flow` seam in place of the web-flow calls:
-`begin`, `complete`, `register` for per-attempt clients, and `refresh`. A flow
-without `register` is rejected at construction unless a `clientId` is also
-given, so a test cannot accidentally exercise a combination that cannot work in
+`begin`, `complete`, `register` for per-attempt clients, `refresh`, and
+`userinfo` for the sign-in identity check. A flow without `register` is rejected
+at construction unless a `clientId` is also given, as is a flow without
+`userinfo` when `expectedSubject` is set, so a test cannot accidentally exercise a combination that cannot work in
 production. An injected `client` or `flow` supersedes `zoneUrl`, so a test needs
 no zone.
 

package/dist/esm/errors.d.ts

@@ -60,6 +60,16 @@ export declare const FailureReason: Readonly<{
     readonly ACCESS_DENIED: "access_denied";
     /** The callback did not carry the state journaled at the begin step. */
     readonly INVALID_CALLBACK: "invalid_callback";
+    /**
+     * The sign-in completed as a zone user other than the one `expectedSubject`
+     * named for the asking principal. Nothing is stored.
+     */
+    readonly IDENTITY_MISMATCH: "identity_mismatch";
+    /**
+     * The asking principal's expected zone user could not be resolved, or the
+     * zone did not say who signed in. Nothing is stored.
+     */
+    readonly IDENTITY_UNVERIFIABLE: "identity_unverifiable";
 }>;
 /**
  * Rejects a route in eve's ordered auth walk with a structured 401.

package/dist/esm/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;CAKnE;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAG1B,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;CAQvE;AAED,4EAA4E;AAC5E,eAAO,MAAM,aAAa;IACxB;;;;;OAKG;;IAEH,kEAAkE;;IAElE,oEAAoE;;IAEpE,uEAAuE;;IAEvE,wEAAwE;;IAExE,wEAAwE;;EAE/D,CAAC;AAEZ;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;gBAEhB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;CAkB1E"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;CAKnE;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAG1B,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;CAQvE;AAED,4EAA4E;AAC5E,eAAO,MAAM,aAAa;IACxB;;;;;OAKG;;IAEH,kEAAkE;;IAElE,oEAAoE;;IAEpE,uEAAuE;;IAEvE,wEAAwE;;IAExE,wEAAwE;;IAExE;;;OAGG;;IAEH;;;OAGG;;EAEM,CAAC;AAEZ;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;gBAEhB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;CAkB1E"}

package/dist/esm/errors.js

@@ -66,6 +66,16 @@ export const FailureReason = Object.freeze({
     ACCESS_DENIED: "access_denied",
     /** The callback did not carry the state journaled at the begin step. */
     INVALID_CALLBACK: "invalid_callback",
+    /**
+     * The sign-in completed as a zone user other than the one `expectedSubject`
+     * named for the asking principal. Nothing is stored.
+     */
+    IDENTITY_MISMATCH: "identity_mismatch",
+    /**
+     * The asking principal's expected zone user could not be resolved, or the
+     * zone did not say who signed in. Nothing is stored.
+     */
+    IDENTITY_UNVERIFIABLE: "identity_unverifiable",
 });
 /**
  * Rejects a route in eve's ordered auth walk with a structured 401.

package/dist/esm/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,uDAAuD;AACvD,MAAM,2BAA2B,GAAG,sCAAsC,CAAC;AAC3E,qDAAqD;AACrD,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AACvE,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAGnD,YAAY,cAAsB,EAAE,OAA8B;QAChE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,eAAe,cAAc,2BAA2B,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAKjD,YACE,cAAsB,EACtB,OAAoE;QAEpE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,eAAe,cAAc,yBAAyB,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC;IAC9C,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC;;;;;OAKG;IACH,kBAAkB,EAAE,oBAAoB;IACxC,kEAAkE;IAClE,qBAAqB,EAAE,uBAAuB;IAC9C,oEAAoE;IACpE,yBAAyB,EAAE,2BAA2B;IACtD,uEAAuE;IACvE,kBAAkB,EAAE,oBAAoB;IACxC,wEAAwE;IACxE,aAAa,EAAE,eAAe;IAC9B,wEAAwE;IACxE,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAG3C,YAAY,OAA6D;QACvE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,2CAA2C,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK;YAC9B,CAAC,CAAC,iBAAiB,OAAO,CAAC,KAAK,GAAG;YACnC,CAAC,CAAC,QAAQ,CAAC;QACb,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAC3B;YACE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,cAAc;YACrC,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,2CAA2C;YACtE,EAAE,EAAE,KAAK;SACV,EACD;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE;SACxE,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,uDAAuD;AACvD,MAAM,2BAA2B,GAAG,sCAAsC,CAAC;AAC3E,qDAAqD;AACrD,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AACvE,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAGnD,YAAY,cAAsB,EAAE,OAA8B;QAChE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,eAAe,cAAc,2BAA2B,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAKjD,YACE,cAAsB,EACtB,OAAoE;QAEpE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,eAAe,cAAc,yBAAyB,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC;IAC9C,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC;;;;;OAKG;IACH,kBAAkB,EAAE,oBAAoB;IACxC,kEAAkE;IAClE,qBAAqB,EAAE,uBAAuB;IAC9C,oEAAoE;IACpE,yBAAyB,EAAE,2BAA2B;IACtD,uEAAuE;IACvE,kBAAkB,EAAE,oBAAoB;IACxC,wEAAwE;IACxE,aAAa,EAAE,eAAe;IAC9B,wEAAwE;IACxE,gBAAgB,EAAE,kBAAkB;IACpC;;;OAGG;IACH,iBAAiB,EAAE,mBAAmB;IACtC;;;OAGG;IACH,qBAAqB,EAAE,uBAAuB;CACtC,CAAC,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAG3C,YAAY,OAA6D;QACvE,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,2CAA2C,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK;YAC9B,CAAC,CAAC,iBAAiB,OAAO,CAAC,KAAK,GAAG;YACnC,CAAC,CAAC,QAAQ,CAAC;QACb,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAC3B;YACE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,cAAc;YACrC,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,2CAA2C;YACtE,EAAE,EAAE,KAAK;SACV,EACD;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE;SACxE,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/esm/index.d.ts

@@ -19,7 +19,7 @@ export type { KeycardAuthOptions, SubjectTokenRetention } from "./auth.js";
 export { asSelf, impersonate, onBehalfOf } from "./connections.js";
 export type { KeycardConnectionAuth, KeycardImpersonateOptions } from "./connections.js";
 export { interactive, memoryAuthorizedTokenStore } from "./interactive.js";
-export type { AuthorizedGrant, GrantStore, KeycardInteractiveOptions, KeycardResumeState, RegisterAttemptClientOptions, RegisteredClient, WebAppFlow, } from "./interactive.js";
+export type { AuthorizedGrant, ExpectedSubjectResolver, GrantStore, KeycardInteractiveOptions, KeycardResumeState, RegisterAttemptClientOptions, RegisteredClient, WebAppFlow, } from "./interactive.js";
 export type { KeycardConnectionOptions } from "./config.js";
 export { AuthorizationFailedError, AuthorizationRequiredError, FailureReason, RouteRejectedError, } from "./errors.js";
 export { decodeClaims, subjectTokenExpired } from "./expiry.js";

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,YAAY,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC3E,YAAY,EACV,eAAe,EACf,UAAU,EACV,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,OAAO;;;;;EAKlB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,YAAY,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC3E,YAAY,EACV,eAAe,EACf,uBAAuB,EACvB,UAAU,EACV,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,OAAO;;;;;EAKlB,CAAC"}

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAa3E,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,MAAM;IACN,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAGxC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAc3E,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,MAAM;IACN,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC,CAAC"}

package/dist/esm/interactive.d.ts

@@ -1,5 +1,5 @@
-import { type AuthorizationRedirect, type BeginAuthorizationOptions, type CompleteAuthorizationOptions, type RefreshAuthorizationOptions, type TokenResponse } from "@keycardai/oauth";
-import type { InteractiveAuthorizationDefinition, JsonValue } from "eve/connections";
+import { type AuthorizationRedirect, type BeginAuthorizationOptions, type CompleteAuthorizationOptions, type RefreshAuthorizationOptions, type TokenResponse, type UserInfoResponse } from "@keycardai/oauth";
+import type { ConnectionPrincipal, InteractiveAuthorizationDefinition, JsonValue } from "eve/connections";
 /**
  * The state journaled between eve's begin and callback steps.
  *
@@ -23,7 +23,8 @@ export interface KeycardResumeState {
  * `resources` and `scopes` are what the zone granted, and decide which
  * connections the grant serves. `clientId` is the client the grant was issued
  * to, and the client a refresh runs as. `id` is stable across refreshes, so a
- * store can replace the rotated pair in place.
+ * store can replace the rotated pair in place. `subject` is the zone user the
+ * sign-in was verified as, set only by a definition with `expectedSubject`.
  */
 export interface AuthorizedGrant {
     readonly id: string;
@@ -33,6 +34,7 @@ export interface AuthorizedGrant {
     readonly clientId: string;
     readonly resources: readonly string[];
     readonly scopes: readonly string[];
+    readonly subject?: string;
 }
 /**
  * Where completed grants live between turns, keyed by principal.
@@ -82,7 +84,19 @@ export interface WebAppFlow {
      * parks for a fresh sign-in instead.
      */
     refresh?(options: RefreshAuthorizationOptions): Promise<TokenResponse>;
+    /**
+     * Fetches the signed-in user's claims for an access token (OIDC Core 1.0
+     * section 5.3). Required when `expectedSubject` is configured.
+     */
+    userinfo?(accessToken: string): Promise<UserInfoResponse>;
 }
+/**
+ * Names the zone user a principal must sign in as: the `sub` the zone's
+ * UserInfo endpoint returns for that user, or nothing when the deployment
+ * knows no zone user for the principal. Called on every `getToken`, so keep it
+ * cheap or cache it in the host.
+ */
+export type ExpectedSubjectResolver = (principal: ConnectionPrincipal) => string | undefined | Promise<string | undefined>;
 export interface KeycardInteractiveOptions {
     /** The resource URL the authorization is scoped to. */
     resource: string;
@@ -136,6 +150,23 @@ export interface KeycardInteractiveOptions {
     tokens?: GrantStore;
     /** Web-flow seam. Replaces the zone calls, so tests take no network. */
     flow?: WebAppFlow;
+    /**
+     * Binds a completed sign-in to the principal that asked. A chat principal is
+     * not a zone identity, and the sign-in link can be completed by whoever
+     * opens it, in a browser already signed in as someone else. With this set,
+     * the authorization request adds the `openid` scope, and after the code is
+     * redeemed the zone's UserInfo `sub` must equal the resolved value exactly,
+     * or nothing is stored. A stored grant is served to this definition only
+     * while its `subject` equals the value resolved for the current principal.
+     * Requires `zoneUrl`, or an injected `flow` with `userinfo`.
+     */
+    expectedSubject?: ExpectedSubjectResolver;
+    /**
+     * `"login"` sets `prompt=login` on the sign-in URL (OIDC Core 1.0 section
+     * 3.1.2.1), so the browser re-authenticates instead of reusing a session
+     * signed in as someone else. The only accepted value.
+     */
+    prompt?: "login";
 }
 /** Forgets every defined connection name. For tests that define many. */
 export declare function resetInteractiveDefinitions(): void;

package/dist/esm/interactive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interactive.d.ts","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EAUL,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EAEjC,KAAK,2BAA2B,EAChC,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAEV,kCAAkC,EAClC,SAAS,EAEV,MAAM,iBAAiB,CAAC;AAazB;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED,qEAAqE;AACrE,MAAM,WAAW,4BAA4B;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC1E,QAAQ,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5E;;;OAGG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,yBAAyB;IACxC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC3C;;;OAGG;IACH,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,wEAAwE;IACxE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAKD,yEAAyE;AACzE,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,yBAAyB,GACjC,kCAAkC,CAAC,kBAAkB,CAAC,CA0QxD;AAED,oFAAoF;AACpF,wBAAgB,0BAA0B,IAAI,UAAU,CAwBvD"}
+{"version":3,"file":"interactive.d.ts","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EAWL,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EAEjC,KAAK,2BAA2B,EAChC,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,mBAAmB,EACnB,kCAAkC,EAClC,SAAS,EAEV,MAAM,iBAAiB,CAAC;AAazB;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED,qEAAqE;AACrE,MAAM,WAAW,4BAA4B;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC1E,QAAQ,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE;;;OAGG;IACH,QAAQ,CAAC,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5E;;;OAGG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACvE;;;OAGG;IACH,QAAQ,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC3D;AAED;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CACpC,SAAS,EAAE,mBAAmB,KAC3B,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAEtD,MAAM,WAAW,yBAAyB;IACxC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC3C;;;OAGG;IACH,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,wEAAwE;IACxE,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAKD,yEAAyE;AACzE,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,yBAAyB,GACjC,kCAAkC,CAAC,kBAAkB,CAAC,CA8YxD;AAED,oFAAoF;AACpF,wBAAgB,0BAA0B,IAAI,UAAU,CAwBvD"}

package/dist/esm/interactive.js

@@ -1,4 +1,4 @@
-import { AuthProviderConfigurationError, AuthorizationDeniedError, beginAuthorization, completeAuthorization, fetchAuthorizationServerMetadata, refreshAuthorization, RefreshGrantError, registerClient, StateMismatchError, } from "@keycardai/oauth";
+import { AuthProviderConfigurationError, AuthorizationDeniedError, beginAuthorization, completeAuthorization, fetchAuthorizationServerMetadata, fetchUserInfo, refreshAuthorization, RefreshGrantError, registerClient, StateMismatchError, } from "@keycardai/oauth";
 import { expiresAt } from "./config.js";
 import { AuthorizationFailedError, AuthorizationRequiredError, FailureReason, } from "./errors.js";
 import { principalKey } from "./subjectTokens.js";
@@ -76,6 +76,19 @@ export function interactive(options) {
     const clientName = options.clientName ?? connectionName;
     const resources = [options.resource, ...(options.additionalResources ?? [])];
     const scopes = splitScopes(options.requestScopes);
+    if (options.prompt !== undefined && options.prompt !== "login") {
+        throw new AuthProviderConfigurationError(`interactive prompt must be "login" when set; got ${JSON.stringify(options.prompt)}`);
+    }
+    const expectedSubject = options.expectedSubject;
+    if (expectedSubject && !flow.userinfo) {
+        throw new AuthProviderConfigurationError("interactive expectedSubject requires a flow with userinfo(); the " +
+            "injected flow has no userinfo()");
+    }
+    // The identity check needs an access token the zone's UserInfo accepts, which
+    // the zone issues when the request carries openid.
+    const authScopes = expectedSubject && !scopes.includes("openid")
+        ? [...scopes, "openid"]
+        : scopes;
     if (!staticClientId && !flow.register) {
         throw new AuthProviderConfigurationError("interactive was given no clientId, so it registers a client per attempt, but the " +
             "injected flow has no register()");
@@ -83,6 +96,70 @@ export function interactive(options) {
     definedConnectionNames.add(connectionName);
     const covers = (grant) => grant.resources.includes(options.resource) &&
         scopes.every((scope) => grant.scopes.includes(scope));
+    /**
+     * The zone user this principal must sign in as, trimmed, or undefined when
+     * the host knows none. A throwing resolver fails `identity_unverifiable`;
+     * that is retryable before anything has been issued and not once the code
+     * is redeemed. The message carries no identifier from either side, because
+     * eve shows it to the model or the user.
+     */
+    const resolveExpectedSubject = async (principal, step) => {
+        let value;
+        try {
+            value = await expectedSubject(principal);
+        }
+        catch {
+            throw new AuthorizationFailedError(connectionName, {
+                message: "The zone identity expected for this user could not be resolved, so the " +
+                    "sign-in cannot be verified.",
+                reason: FailureReason.IDENTITY_UNVERIFIABLE,
+                retryable: step !== "complete",
+            });
+        }
+        const trimmed = typeof value === "string" ? value.trim() : "";
+        return trimmed.length > 0 ? trimmed : undefined;
+    };
+    const noExpectedSubject = () => new AuthorizationFailedError(connectionName, {
+        message: "No zone identity is configured for this user, so the sign-in cannot be " +
+            "verified.",
+        reason: FailureReason.IDENTITY_UNVERIFIABLE,
+        retryable: false,
+    });
+    /**
+     * Asks the zone who the redeemed token belongs to and compares that `sub` to
+     * the expected value as an exact string. The token itself is never decoded
+     * for this (RFC 9068 section 6). Every failure is final: the code is spent.
+     */
+    const verifySignedInUser = async (accessToken, expected) => {
+        let info;
+        try {
+            info = await flow.userinfo(accessToken);
+        }
+        catch {
+            throw new AuthorizationFailedError(connectionName, {
+                message: "The zone did not confirm who completed the sign-in, so it was not kept.",
+                reason: FailureReason.IDENTITY_UNVERIFIABLE,
+                retryable: false,
+            });
+        }
+        const sub = typeof info?.sub === "string" ? info.sub : "";
+        if (sub.length === 0) {
+            throw new AuthorizationFailedError(connectionName, {
+                message: "The zone did not confirm who completed the sign-in, so it was not kept.",
+                reason: FailureReason.IDENTITY_UNVERIFIABLE,
+                retryable: false,
+            });
+        }
+        if (sub !== expected) {
+            throw new AuthorizationFailedError(connectionName, {
+                message: "The sign-in was completed by a different user than the one who asked, " +
+                    "so it was not kept. Sign in again as yourself.",
+                reason: FailureReason.IDENTITY_MISMATCH,
+                retryable: false,
+            });
+        }
+        return sub;
+    };
     /**
      * The client this attempt runs as: the configured one, or a fresh public
      * client whose single redirect URI is this attempt's callback.
@@ -95,7 +172,7 @@ export function interactive(options) {
             registered = await flow.register({
                 redirectUri: callbackUrl,
                 clientName,
-                ...(scopes.length > 0 ? { scopes } : {}),
+                ...(authScopes.length > 0 ? { scopes: authScopes } : {}),
             });
         }
         catch (cause) {
@@ -140,7 +217,8 @@ export function interactive(options) {
         }
         catch (cause) {
             if (cause instanceof RefreshGrantError &&
-                cause.errorCode === "invalid_grant") {
+                (cause.errorCode === "invalid_grant" ||
+                    cause.errorCode === "insufficient_authorization")) {
                 // A concurrent step may have rotated this grant first, in which case
                 // the refresh token we sent is the stale one and the stored grant is
                 // the good one.
@@ -169,6 +247,9 @@ export function interactive(options) {
             scopes: grant.scopes,
             // A server that rotates nothing leaves the old refresh token valid.
             refreshToken: grant.refreshToken,
+            // A refresh continues the same grant (RFC 6749 section 6), so the
+            // verified subject carries over without another UserInfo call.
+            ...(grant.subject !== undefined ? { subject: grant.subject } : {}),
         });
         await tokens.put(principal, rotated);
         return rotated;
@@ -185,7 +266,18 @@ export function interactive(options) {
         async getToken({ principal }) {
             const key = storeKey(principal);
             const now = Date.now();
-            const held = (await tokens.list(key)).filter(covers);
+            const expected = expectedSubject
+                ? await resolveExpectedSubject(principal, "serve")
+                : undefined;
+            // With a check, a grant is covered only when it was verified as the
+            // user this principal must be; no expected value covers no grant, so
+            // the turn parks and startAuthorization reports why.
+            const served = expectedSubject
+                ? (grant) => covers(grant) &&
+                    expected !== undefined &&
+                    grant.subject === expected
+                : covers;
+            const held = (await tokens.list(key)).filter(served);
             // A grant is usable while its access token is live or while it holds a
             // refresh token that can mint a new one; an expired grant with no refresh
             // token is dead.
@@ -210,15 +302,26 @@ export function interactive(options) {
         },
         async startAuthorization({ principal, callbackUrl }) {
             requireUser(principal, connectionName);
+            if (expectedSubject) {
+                const expected = await resolveExpectedSubject(principal, "start");
+                if (expected === undefined)
+                    throw noExpectedSubject();
+            }
             const attemptClientId = await clientForAttempt(callbackUrl);
             const redirect = await flow.begin({
                 clientId: attemptClientId,
                 redirectUri: callbackUrl,
                 resources,
-                ...(scopes.length > 0 ? { scopes } : {}),
+                ...(authScopes.length > 0 ? { scopes: authScopes } : {}),
             });
+            let url = redirect.url;
+            if (options.prompt) {
+                const prompted = new URL(url);
+                prompted.searchParams.set("prompt", options.prompt);
+                url = prompted.toString();
+            }
             return {
-                challenge: { url: redirect.url, displayName: connectionName },
+                challenge: { url, displayName: connectionName },
                 resume: {
                     state: redirect.state,
                     codeVerifier: redirect.codeVerifier,
@@ -263,11 +366,21 @@ export function interactive(options) {
                     retryable: false,
                 });
             }
+            let subject;
+            if (expectedSubject) {
+                // Resolved again rather than read from the resume state, so the
+                // identifier never enters eve's durable state.
+                const expected = await resolveExpectedSubject(principal, "complete");
+                if (expected === undefined)
+                    throw noExpectedSubject();
+                subject = await verifySignedInUser(response.accessToken, expected);
+            }
             const grant = grantFromResponse(response, {
                 id: crypto.randomUUID(),
                 clientId,
                 resources: resume.resources.length > 0 ? resume.resources : resources,
-                scopes,
+                scopes: authScopes,
+                ...(subject !== undefined ? { subject } : {}),
             });
             await tokens.put(storeKey(principal), grant);
             return toTokenResult(grant);
@@ -341,6 +454,9 @@ function zoneWebAppFlow(issuer, options = {}) {
                 metadata: await discover(),
             });
         },
+        async userinfo(accessToken) {
+            return fetchUserInfo(issuer, accessToken, { metadata: await discover() });
+        },
         /**
          * One public, PKCE-bound client per authorization, holding the single
          * redirect URI that attempt will come back to. `token_endpoint_auth_method:
@@ -384,6 +500,7 @@ function grantFromResponse(response, issued) {
         clientId: issued.clientId,
         resources: [...issued.resources],
         scopes: response.scope ? splitScopes(response.scope) : [...issued.scopes],
+        ...(issued.subject !== undefined ? { subject: issued.subject } : {}),
     };
 }
 function expired(grant, now) {

package/dist/esm/interactive.js.map

@@ -1 +1 @@
-{"version":3,"file":"interactive.js","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,gCAAgC,EAChC,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,GAOnB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,yEAAyE;AACzE,MAAM,eAAe,GAAG,MAAM,CAAC;AAkJ/B,6EAA6E;AAC7E,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;AAEjD,yEAAyE;AACzE,MAAM,UAAU,2BAA2B;IACzC,sBAAsB,CAAC,KAAK,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,WAAW,CACzB,OAAkC;IAElC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,8BAA8B,CACtC,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,8BAA8B,CACtC,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC;IAClE,IAAI,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,8BAA8B,CACtC,+BAA+B,cAAc,wCAAwC;YACnF,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;IAC9D,MAAM,IAAI,GACR,OAAO,CAAC,IAAI;QACZ,cAAc,CAAC,OAAO,CAAC,OAAQ,EAAE;YAC/B,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACxD,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAElD,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,8BAA8B,CACtC,mFAAmF;YACjF,iCAAiC,CACpC,CAAC;IACJ,CAAC;IACD,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAW,EAAE,CACjD,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAExD;;;OAGG;IACH,MAAM,gBAAgB,GAAG,KAAK,EAAE,WAAmB,EAAmB,EAAE;QACtE,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,IAAI,UAA4B,CAAC;QACjC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,QAAS,CAAC;gBAChC,WAAW,EAAE,WAAW;gBACxB,UAAU;gBACV,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,+DAA+D,KAAK,CAAC,OAAO,EAAE;oBAChF,CAAC,CAAC,4DAA4D;gBAClE,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,6EAA6E;oBAC7E,gFAAgF;oBAChF,gFAAgF;oBAChF,sCAAsC;gBACxC,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,CAAC;IAC7B,CAAC,CAAC;IAEF,gFAAgF;IAChF,MAAM,SAAS,GAAG,CAChB,QAAgB,EACiC,EAAE,CACnD,cAAc,IAAI,QAAQ,KAAK,cAAc,IAAI,OAAO,CAAC,YAAY;QACnE,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;QACxC,CAAC,CAAC,EAAE,CAAC;IAET;;;OAGG;IACH,MAAM,YAAY,GAAG,KAAK,EACxB,SAAiB,EACjB,KAAiD,EACvB,EAAE;QAC5B,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAQ,CAAC;gBAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,iBAAiB;gBAClC,KAAK,CAAC,SAAS,KAAK,eAAe,EACnC,CAAC;gBACD,qEAAqE;gBACrE,qEAAqE;gBACrE,gBAAgB;gBAChB,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CACjD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CACzC,CAAC;gBACF,IAAI,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;oBAC3D,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzC,MAAM,IAAI,0BAA0B,CAAC,cAAc,EAAE;oBACnD,OAAO,EACL,eAAe,cAAc,gDAAgD;wBAC7E,sBAAsB,KAAK,CAAC,OAAO,IAAI;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,gCAAgC,KAAK,CAAC,OAAO,EAAE;oBACjD,CAAC,CAAC,6BAA6B;gBACnC,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,KAAK,YAAY,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;aACvE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE;YAC1C,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oEAAoE;YACpE,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,MAAM;QACrB;;;;;;WAMG;QACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrD,uEAAuE;YACvE,0EAA0E;YAC1E,iBAAiB;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,KAAK,GACP,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrE,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjE,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;oBAC9B,GAAG,KAAK;oBACR,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC/B,4CAA4C;gBAC5C,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACnC,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;YACjD,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;gBAChC,QAAQ,EAAE,eAAe;gBACzB,WAAW,EAAE,WAAW;gBACxB,SAAS;gBACT,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAC,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE;gBAC7D,MAAM,EAAE;oBACN,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,WAAW;oBACX,QAAQ,EAAE,eAAe;iBAC1B;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE;YACtE,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EACL,wEAAwE;wBACxE,uCAAuC;oBACzC,MAAM,EAAE,aAAa,CAAC,gBAAgB;oBACtC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,qEAAqE;YACrE,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,cAAc,CAAC;YACnD,IAAI,QAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;oBAC7B,cAAc,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE;oBACtC,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,QAAQ;oBACR,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,WAAW;oBAC9C,GAAG,SAAS,CAAC,QAAQ,CAAC;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EACL,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB;oBACjE,MAAM,EACJ,KAAK,YAAY,wBAAwB;wBACvC,CAAC,CAAC,aAAa,CAAC,aAAa;wBAC7B,CAAC,CAAC,KAAK,YAAY,kBAAkB;4BACnC,CAAC,CAAC,aAAa,CAAC,gBAAgB;4BAChC,CAAC,CAAC,aAAa,CAAC,kBAAkB;oBACxC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE;gBACxC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,QAAQ;gBACR,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBACrE,MAAM;aACP,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE;YACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,OAAO,CAAC,GAAG,CACf,IAAI;iBACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;iBAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAChD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC/D,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,SAAS;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC/B,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK;YACxB,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO;YAC7B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CACrB,MAAc,EACd,UAA2C,EAAE;IAE7C,IAAI,QAA+D,CAAC;IACpE,MAAM,QAAQ,GAAG,GAA8C,EAAE;QAC/D,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,YAAY;YACtB,OAAO,kBAAkB,CAAC,MAAM,EAAE;gBAChC,GAAG,YAAY;gBACf,QAAQ,EAAE,MAAM,QAAQ,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,eAAe;YAC5B,OAAO,qBAAqB,CAAC,MAAM,EAAE;gBACnC,GAAG,eAAe;gBAClB,QAAQ,EAAE,MAAM,QAAQ,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,cAAc;YAC1B,OAAO,oBAAoB,CAAC,MAAM,EAAE;gBAClC,GAAG,cAAc;gBACjB,QAAQ,EAAE,MAAM,QAAQ,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE;YAChD,MAAM,UAAU,GAAG,MAAM,cAAc,CACrC,MAAM,EACN;gBACE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,YAAY,EAAE,CAAC,WAAW,CAAC;gBAC3B,UAAU,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACnD,aAAa,EAAE,CAAC,MAAM,CAAC;gBACvB,uBAAuB,EAAE,MAAM;gBAC/B,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,EACD,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;gBACpD,CAAC,CAAC,SAAS,CACd,CAAC;YACF,OAAO;gBACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,QAAuB,EACvB,MAMC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;IAClE,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;QAChC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAsB,EAAE,GAAW;IAClD,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC;AACjE,CAAC;AAED,0EAA0E;AAC1E,SAAS,IAAI,CAAC,KAAsB,EAAE,GAAW;IAC/C,OAAO,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB,EAAE,GAAW;IACrD,OAAO,CACL,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,eAAe,IAAI,GAAG,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,SAA8B;IAC9C,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,KAAsB;IAC3C,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,WAAW;QACxB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,SAA8B,EAC9B,cAAsB;IAEtB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IACtC,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;QACjD,OAAO,EACL,6EAA6E;YAC7E,wBAAwB;QAC1B,MAAM,EAAE,aAAa,CAAC,kBAAkB;QACxC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA8C;IACjE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1B,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;QACb,CAAC,CAAE,MAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"interactive.js","sourceRoot":"","sources":["../../src/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,gCAAgC,EAChC,aAAa,EACb,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,GAQnB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,yEAAyE;AACzE,MAAM,eAAe,GAAG,MAAM,CAAC;AAoL/B,6EAA6E;AAC7E,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;AAEjD,yEAAyE;AACzE,MAAM,UAAU,2BAA2B;IACzC,sBAAsB,CAAC,KAAK,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,WAAW,CACzB,OAAkC;IAElC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,8BAA8B,CACtC,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,8BAA8B,CACtC,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC;IAClE,IAAI,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,8BAA8B,CACtC,+BAA+B,cAAc,wCAAwC;YACnF,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;IAC9D,MAAM,IAAI,GACR,OAAO,CAAC,IAAI;QACZ,cAAc,CAAC,OAAO,CAAC,OAAQ,EAAE;YAC/B,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACxD,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAElD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC/D,MAAM,IAAI,8BAA8B,CACtC,oDAAoD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAChD,IAAI,eAAe,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,8BAA8B,CACtC,mEAAmE;YACjE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,mDAAmD;IACnD,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,QAAQ,CAAC;QACvB,CAAC,CAAC,MAAM,CAAC;IAEb,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,8BAA8B,CACtC,mFAAmF;YACjF,iCAAiC,CACpC,CAAC;IACJ,CAAC;IACD,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAW,EAAE,CACjD,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAExD;;;;;;OAMG;IACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,SAA8B,EAC9B,IAAoC,EACP,EAAE;QAC/B,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,eAAgB,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,yEAAyE;oBACzE,6BAA6B;gBAC/B,MAAM,EAAE,aAAa,CAAC,qBAAqB;gBAC3C,SAAS,EAAE,IAAI,KAAK,UAAU;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,GAA6B,EAAE,CACvD,IAAI,wBAAwB,CAAC,cAAc,EAAE;QAC3C,OAAO,EACL,yEAAyE;YACzE,WAAW;QACb,MAAM,EAAE,aAAa,CAAC,qBAAqB;QAC3C,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;IAEL;;;;OAIG;IACH,MAAM,kBAAkB,GAAG,KAAK,EAC9B,WAAmB,EACnB,QAAgB,EACC,EAAE;QACnB,IAAI,IAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,QAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,yEAAyE;gBAC3E,MAAM,EAAE,aAAa,CAAC,qBAAqB;gBAC3C,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,IAAI,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,yEAAyE;gBAC3E,MAAM,EAAE,aAAa,CAAC,qBAAqB;gBAC3C,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,wEAAwE;oBACxE,gDAAgD;gBAClD,MAAM,EAAE,aAAa,CAAC,iBAAiB;gBACvC,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,gBAAgB,GAAG,KAAK,EAAE,WAAmB,EAAmB,EAAE;QACtE,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,IAAI,UAA4B,CAAC;QACjC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,QAAS,CAAC;gBAChC,WAAW,EAAE,WAAW;gBACxB,UAAU;gBACV,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,+DAA+D,KAAK,CAAC,OAAO,EAAE;oBAChF,CAAC,CAAC,4DAA4D;gBAClE,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,6EAA6E;oBAC7E,gFAAgF;oBAChF,gFAAgF;oBAChF,sCAAsC;gBACxC,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,CAAC;IAC7B,CAAC,CAAC;IAEF,gFAAgF;IAChF,MAAM,SAAS,GAAG,CAChB,QAAgB,EACiC,EAAE,CACnD,cAAc,IAAI,QAAQ,KAAK,cAAc,IAAI,OAAO,CAAC,YAAY;QACnE,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;QACxC,CAAC,CAAC,EAAE,CAAC;IAET;;;OAGG;IACH,MAAM,YAAY,GAAG,KAAK,EACxB,SAAiB,EACjB,KAAiD,EACvB,EAAE;QAC5B,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAQ,CAAC;gBAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,iBAAiB;gBAClC,CAAC,KAAK,CAAC,SAAS,KAAK,eAAe;oBAClC,KAAK,CAAC,SAAS,KAAK,4BAA4B,CAAC,EACnD,CAAC;gBACD,qEAAqE;gBACrE,qEAAqE;gBACrE,gBAAgB;gBAChB,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CACjD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CACzC,CAAC;gBACF,IAAI,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;oBAC3D,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzC,MAAM,IAAI,0BAA0B,CAAC,cAAc,EAAE;oBACnD,OAAO,EACL,eAAe,cAAc,gDAAgD;wBAC7E,sBAAsB,KAAK,CAAC,OAAO,IAAI;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;gBACjD,OAAO,EACL,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,gCAAgC,KAAK,CAAC,OAAO,EAAE;oBACjD,CAAC,CAAC,6BAA6B;gBACnC,MAAM,EAAE,aAAa,CAAC,kBAAkB;gBACxC,SAAS,EAAE,KAAK,YAAY,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;aACvE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE;YAC1C,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oEAAoE;YACpE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kEAAkE;YAClE,+DAA+D;YAC/D,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,MAAM;QACrB;;;;;;WAMG;QACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,eAAe;gBAC9B,CAAC,CAAC,MAAM,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC;gBAClD,CAAC,CAAC,SAAS,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,qDAAqD;YACrD,MAAM,MAAM,GAAG,eAAe;gBAC5B,CAAC,CAAC,CAAC,KAAsB,EAAW,EAAE,CAClC,MAAM,CAAC,KAAK,CAAC;oBACb,QAAQ,KAAK,SAAS;oBACtB,KAAK,CAAC,OAAO,KAAK,QAAQ;gBAC9B,CAAC,CAAC,MAAM,CAAC;YACX,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrD,uEAAuE;YACvE,0EAA0E;YAC1E,iBAAiB;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,KAAK,GACP,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrE,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjE,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;oBAC9B,GAAG,KAAK;oBACR,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC/B,4CAA4C;gBAC5C,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACnC,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;YACjD,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAClE,IAAI,QAAQ,KAAK,SAAS;oBAAE,MAAM,iBAAiB,EAAE,CAAC;YACxD,CAAC;YACD,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;gBAChC,QAAQ,EAAE,eAAe;gBACzB,WAAW,EAAE,WAAW;gBACxB,SAAS;gBACT,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAC,CAAC;YACH,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;YACvB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC9B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBACpD,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC;YACD,OAAO;gBACL,SAAS,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE;gBAC/C,MAAM,EAAE;oBACN,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,WAAW;oBACX,QAAQ,EAAE,eAAe;iBAC1B;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE;YACtE,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EACL,wEAAwE;wBACxE,uCAAuC;oBACzC,MAAM,EAAE,aAAa,CAAC,gBAAgB;oBACtC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,qEAAqE;YACrE,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,cAAc,CAAC;YACnD,IAAI,QAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;oBAC7B,cAAc,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE;oBACtC,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,QAAQ;oBACR,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,WAAW;oBAC9C,GAAG,SAAS,CAAC,QAAQ,CAAC;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,OAAO,EACL,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB;oBACjE,MAAM,EACJ,KAAK,YAAY,wBAAwB;wBACvC,CAAC,CAAC,aAAa,CAAC,aAAa;wBAC7B,CAAC,CAAC,KAAK,YAAY,kBAAkB;4BACnC,CAAC,CAAC,aAAa,CAAC,gBAAgB;4BAChC,CAAC,CAAC,aAAa,CAAC,kBAAkB;oBACxC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAA2B,CAAC;YAChC,IAAI,eAAe,EAAE,CAAC;gBACpB,gEAAgE;gBAChE,+CAA+C;gBAC/C,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBACrE,IAAI,QAAQ,KAAK,SAAS;oBAAE,MAAM,iBAAiB,EAAE,CAAC;gBACtD,OAAO,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE;gBACxC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,QAAQ;gBACR,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBACrE,MAAM,EAAE,UAAU;gBAClB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9C,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE;YACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,OAAO,CAAC,GAAG,CACf,IAAI;iBACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;iBAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAChD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC/D,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,SAAS;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC/B,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK;YACxB,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO;YAC7B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CACrB,MAAc,EACd,UAA2C,EAAE;IAE7C,IAAI,QAA+D,CAAC;IACpE,MAAM,QAAQ,GAAG,GAA8C,EAAE;QAC/D,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,YAAY;YACtB,OAAO,kBAAkB,CAAC,MAAM,EAAE;gBAChC,GAAG,YAAY;gBACf,QAAQ,EAAE,MAAM,QAAQ,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,eAAe;YAC5B,OAAO,qBAAqB,CAAC,MAAM,EAAE;gBACnC,GAAG,eAAe;gBAClB,QAAQ,EAAE,MAAM,QAAQ,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,cAAc;YAC1B,OAAO,oBAAoB,CAAC,MAAM,EAAE;gBAClC,GAAG,cAAc;gBACjB,QAAQ,EAAE,MAAM,QAAQ,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,WAAW;YACxB,OAAO,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE;YAChD,MAAM,UAAU,GAAG,MAAM,cAAc,CACrC,MAAM,EACN;gBACE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,YAAY,EAAE,CAAC,WAAW,CAAC;gBAC3B,UAAU,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACnD,aAAa,EAAE,CAAC,MAAM,CAAC;gBACvB,uBAAuB,EAAE,MAAM;gBAC/B,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,EACD,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;gBACpD,CAAC,CAAC,SAAS,CACd,CAAC;YACF,OAAO;gBACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,QAAuB,EACvB,MAOC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;IAClE,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;QAChC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAsB,EAAE,GAAW;IAClD,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC;AACjE,CAAC;AAED,0EAA0E;AAC1E,SAAS,IAAI,CAAC,KAAsB,EAAE,GAAW;IAC/C,OAAO,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB,EAAE,GAAW;IACrD,OAAO,CACL,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,eAAe,IAAI,GAAG,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,SAA8B;IAC9C,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,KAAsB;IAC3C,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,WAAW;QACxB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,SAA8B,EAC9B,cAAsB;IAEtB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IACtC,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;QACjD,OAAO,EACL,6EAA6E;YAC7E,wBAAwB;QAC1B,MAAM,EAAE,aAAa,CAAC,kBAAkB;QACxC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA8C;IACjE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1B,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;QACb,CAAC,CAAE,MAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keycardai/eve",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "[Preview] Keycard auth adapters for eve agents: a zone token verifier for the channel auth walk, Keycard-backed connection auth, and interactive authorization over the zone's web flow",
   "license": "MIT",
   "repository": {