@kleora-io/core 0.0.0 → 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/LICENSE +202 -0
  2. package/README.md +44 -0
  3. package/dist/index.d.ts +363 -0
  4. package/dist/index.js +720 -0
  5. package/dist/index.js.map +1 -0
  6. package/package.json +57 -1
package/dist/index.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"sources":["../src/errors.ts","../src/credentials/store.ts","../src/credentials/device-grant.ts","../src/credentials/issuer.ts","../src/credentials/session.ts","../src/management-client.ts"],"names":[],"mappings":";;;;;;AAiBO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EAChC,IAAA;AAAA,EAET,WAAA,CAAY,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAwB;AACjE,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAkBO,IAAM,QAAA,GAAN,cAAuB,eAAA,CAAgB;AAAA,EACnC,IAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAET,WAAA,CACE,IAAA,EACA,MAAA,EACA,KAAA,EACA,QACA,OAAA,EACA;AACA,IAAA,KAAA,CAAM,WAAA,EAAa,MAAA,IAAU,KAAA,IAAS,IAAI,CAAA;AAC1C,IAAA,IAAA,CAAK,IAAA,GAAO,UAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA;AAAA,EAGA,iBAAA,GAA6C;AAC3C,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,GAAG,KAAK,OAAA,CAAQ;AAAA,KAClB;AAAA,EACF;AACF;AAOO,IAAM,wBAAA,GAAN,cAAuC,eAAA,CAAgB;AAAA,EAC5D,WAAA,CAAY,SAAiB,OAAA,EAAwB;AACnD,IAAA,KAAA,CAAM,4BAAA,EAA8B,SAAS,OAAO,CAAA;AACpD,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AAAA,EACd;AACF;AAMO,IAAM,mBAAA,GAAN,cAAkC,eAAA,CAAgB;AAAA,EACvD,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,iBAAiB,sCAAsC,CAAA;AAC7D,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;ACrDO,SAAS,iBAAiB,IAAA,EAAsB;AACrD,EAAA,OAAO,IAAA,CAAK,OAAA,EAAQ,EAAG,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AACnC;AASA,eAAsB,qBAAA,CAAsB;AAAA,EAC1C,OAAA;AAAA,EACA;AACF,CAAA,EAAqD;AACnD,EAAA,MAAM,SAAA,GAAY,IAAI,mBAAA,CAAoB,SAAS,CAAA;AACnD,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,EAAA,IAAI,OAAA,KAAY,MAAM,OAAO,SAAA;AAC7B,EAAA,OAAO,IAAI,uBAAA,CAAwB,OAAA,EAAS,OAAA,EAAS,SAAS,CAAA;AAChE;AAYA,eAAe,WAAA,GAA6C;AAC1D,EAAA,IAAI;AAKF,IAAA,OAAO,MAAM,OAAO,kBAAkB,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,IAAM,0BAAN,MAAyD;AAAA,EAC9C,OAAA,GAAU,UAAA;AAAA,EACnB,QAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA;AAAA,EAEA,OAAA,GAAU,KAAA;AAAA,EAEV,WAAA,CAAY,OAAA,EAAiB,OAAA,EAAwB,QAAA,EAA+B;AAClF,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAChB,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAChB,IAAA,IAAA,CAAK,SAAA,GAAY,QAAA;AAAA,EACnB;AAAA,EAEA,MAAM,IAAI,OAAA,EAAyC;AACjD,IAAA,IAAI,KAAK,OAAA,EAAS,OAAO,IAAA,CAAK,SAAA,CAAU,IAAI,OAAO,CAAA;AACnD,IAAA,IAAI;AACF,MAAA,MAAM,QAAQ,IAAI,IAAA,CAAK,SAAS,UAAA,CAAW,IAAA,CAAK,UAAU,OAAO,CAAA;AACjE,MAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,CAAM,WAAA,EAAY;AACtC,MAAA,OAAO,KAAA,IAAS,IAAA;AAAA,IAClB,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AACf,MAAA,OAAO,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAO,CAAA;AAAA,IACnC;AAAA,EACF;AAAA,EAEA,MAAM,GAAA,CAAI,OAAA,EAAiB,YAAA,EAAqC;AAC9D,IAAA,IAAI,KAAK,OAAA,EAAS,OAAO,KAAK,SAAA,CAAU,GAAA,CAAI,SAAS,YAAY,CAAA;AACjE,IAAA,IAAI;AACF,MAAA,MAAM,QAAQ,IAAI,IAAA,CAAK,SAAS,UAAA,CAAW,IAAA,CAAK,UAAU,OAAO,CAAA;AACjE,MAAA,MAAM,KAAA,CAAM,YAAY,YAAY,CAAA;AAAA,IACtC,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AACf,MAAA,MAAM,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,OAAA,EAAS,YAAY,CAAA;AAAA,IAChD;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,OAAA,EAAgC;AAC3C,IAAA,IAAI,KAAK,OAAA,EAAS,OAAO,IAAA,CAAK,SAAA,CAAU,OAAO,OAAO,CAAA;AACtD,IAAA,IAAI;AACF,MAAA,MAAM,QAAQ,IAAI,IAAA,CAAK,SAAS,UAAA,CAAW,IAAA,CAAK,UAAU,OAAO,CAAA;AACjE,MAAA,MAAM,MAAM,gBAAA,EAAiB;AAAA,IAC/B,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AACf,MAAA,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,OAAO,CAAA;AAAA,IACrC;AAAA,EACF;AACF,CAAA;AAQO,IAAM,sBAAN,MAAqD;AAAA,EACjD,OAAA,GAAU,MAAA;AAAA,EACnB,IAAA;AAAA,EAEA,YAAY,GAAA,EAAa;AACvB,IAAA,IAAA,CAAK,IAAA,GAAO,GAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,OAAA,EAAyC;AAC3C,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,YAAA,CAAa,IAAA,CAAK,KAAA,CAAM,OAAO,GAAG,MAAM,CAAA;AACpD,MAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACtC,MAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,IAAQ,kBAAkB,MAAA,EAAQ;AAC7E,QAAA,MAAM,eAAe,MAAA,CAAO,YAAA;AAC5B,QAAA,IAAI,OAAO,YAAA,KAAiB,QAAA,EAAU,OAAO,OAAA,CAAQ,QAAQ,YAAY,CAAA;AAAA,MAC3E;AACA,MAAA,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAAA,IAC7B,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,WAAW,KAAK,CAAA,EAAG,OAAO,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAClD,MAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,GAAA,CAAI,SAAiB,YAAA,EAAqC;AACxD,IAAA,IAAI;AACF,MAAA,SAAA,CAAU,KAAK,IAAA,EAAM,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AACrD,MAAA,SAAA,CAAU,IAAA,CAAK,MAAM,GAAK,CAAA;AAC1B,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAG/B,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,YAAY,CAAA,IAAA,CAAA;AACnC,MAAA,aAAA,CAAc,GAAA,EAAK,IAAA,CAAK,SAAA,CAAU,EAAE,YAAA,EAAc,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACpE,MAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACpB,MAAA,UAAA,CAAW,KAAK,IAAI,CAAA;AACpB,MAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,IACzB,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,OAAO,OAAA,EAAgC;AACrC,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,OAAO,CAAC,CAAA;AAC1B,MAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,IACzB,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,UAAA,CAAW,KAAK,CAAA,EAAG,OAAO,QAAQ,OAAA,EAAQ;AAC9C,MAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAM,OAAA,EAAyB;AAI7B,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,EAAM,eAAe,kBAAA,CAAmB,OAAO,CAAC,CAAA,KAAA,CAAO,CAAA;AAAA,EAC1E;AACF;AAEA,SAAS,WAAW,KAAA,EAAyB;AAC3C,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,MAAA,IAAU,KAAA,IAAS,MAAM,IAAA,KAAS,QAAA;AAC1F;AAEA,SAAS,QAAQ,KAAA,EAAuB;AACtC,EAAA,OAAO,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACjE;;;ACrLO,IAAM,UAAA,GAAN,cAAyB,KAAA,CAAM;AAAA,EAC3B,IAAA;AAAA,EACT,WAAA,CAAY,MAAsB,WAAA,EAAiC;AACjE,IAAA,KAAA,CAAM,eAAe,IAAI,CAAA;AACzB,IAAA,IAAA,CAAK,IAAA,GAAO,YAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAgBA,eAAe,QAAA,CACb,GAAA,EACA,IAAA,EACA,SAAA,EACA,SAAA,EACkC;AAClC,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,UAAU,GAAA,EAAK;AAAA,MAC9B,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,mCAAA;AAAA,QAChB,MAAA,EAAQ,kBAAA;AAAA,QACR,YAAA,EAAc;AAAA,OAChB;AAAA,MACA,IAAA,EAAM,IAAI,eAAA,CAAgB,IAAI;AAAA,KAC/B,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,yBAAyB,CAAA,gBAAA,EAAmB,GAAG,IAAI,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,EAC/E;AAEA,EAAA,IAAI,WAAoC,EAAC;AACzC,EAAA,IAAI;AACF,IAAA,QAAA,GAAY,MAAM,SAAS,IAAA,EAAK;AAAA,EAClC,CAAA,CAAA,MAAQ;AAAA,EAGR;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAA,GAAU,OAAO,QAAA,CAAS,OAAO,MAAM,QAAA,GAAW,QAAA,CAAS,OAAO,CAAA,GAAI,OAAA;AAC5E,IAAA,MAAM,IAAA,GAAuB,WAAA,CAAY,OAAO,CAAA,GAAI,OAAA,GAAU,OAAA;AAC9D,IAAA,MAAM,WAAA,GACJ,OAAO,QAAA,CAAS,mBAAmB,MAAM,QAAA,GAAW,QAAA,CAAS,mBAAmB,CAAA,GAAI,MAAA;AACtF,IAAA,MAAM,IAAI,UAAA,CAAW,IAAA,EAAM,WAAW,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,YAAY,KAAA,EAAwC;AAC3D,EAAA,OAAO;AAAA,IACL,uBAAA;AAAA,IACA,WAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACF,CAAE,SAAS,KAAK,CAAA;AAClB;AAGA,eAAsB,wBAAA,CAAyB;AAAA,EAC7C,MAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,KAAA,EAAO;AACT,CAAA,EAAqD;AACnD,EAAA,MAAM,WAAW,MAAM,QAAA;AAAA,IACrB,GAAG,MAAM,CAAA,2BAAA,CAAA;AAAA,IACT,EAAE,WAAW,QAAA,EAAS;AAAA,IACtB,SAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,aAAA,CAAc,QAAA,EAAU,aAAa,CAAA;AAAA,IACjD,QAAA,EAAU,aAAA,CAAc,QAAA,EAAU,WAAW,CAAA;AAAA,IAC7C,eAAA,EAAiB,aAAA,CAAc,QAAA,EAAU,kBAAkB,CAAA;AAAA,IAC3D,uBAAA,EACE,OAAO,QAAA,CAAS,2BAA2B,CAAA,KAAM,QAAA,GAC7C,QAAA,CAAS,2BAA2B,CAAA,GACpC,aAAA,CAAc,QAAA,EAAU,kBAAkB,CAAA;AAAA,IAChD,SAAA,EAAW,aAAA,CAAc,QAAA,EAAU,YAAY,CAAA;AAAA,IAC/C,QAAA,EAAU,OAAO,QAAA,CAAS,UAAU,MAAM,QAAA,GAAW,QAAA,CAAS,UAAU,CAAA,GAAI;AAAA,GAC9E;AACF;AASA,eAAsB,eAAA,CAAgB;AAAA,EACpC,MAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,KAAA,EAAO;AACT,CAAA,EAAiE;AAC/D,EAAA,MAAM,WAAW,MAAM,QAAA;AAAA,IACrB,GAAG,MAAM,CAAA,YAAA,CAAA;AAAA,IACT;AAAA,MACE,UAAA,EAAY,8CAAA;AAAA,MACZ,WAAA,EAAa,UAAA;AAAA,MACb,SAAA,EAAW;AAAA,KACb;AAAA,IACA,SAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,OAAO,SAAS,QAAQ,CAAA;AAC1B;AAGA,eAAsB,kBAAA,CAAmB;AAAA,EACvC,MAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,KAAA,EAAO;AACT,CAAA,EAAmE;AACjE,EAAA,MAAM,WAAW,MAAM,QAAA;AAAA,IACrB,GAAG,MAAM,CAAA,YAAA,CAAA;AAAA,IACT,EAAE,UAAA,EAAY,eAAA,EAAiB,aAAA,EAAe,YAAA,EAAc,WAAW,QAAA,EAAS;AAAA,IAChF,SAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,OAAO,SAAS,QAAQ,CAAA;AAC1B;AAaA,eAAsB,kBAAA,CAAmB;AAAA,EACvC,MAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,KAAA,EAAO;AACT,CAAA,EAAiE;AAC/D,EAAA,MAAM,QAAA;AAAA,IACJ,GAAG,MAAM,CAAA,aAAA,CAAA;AAAA,IACT,EAAE,KAAA,EAAO,YAAA,EAAc,eAAA,EAAiB,eAAA,EAAiB,WAAW,QAAA,EAAS;AAAA,IAC7E,SAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,SAAS,QAAA,EAA2C;AAC3D,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,aAAA,CAAc,QAAA,EAAU,cAAc,CAAA;AAAA,IACnD,YAAA,EAAc,OAAO,QAAA,CAAS,eAAe,MAAM,QAAA,GAAW,QAAA,CAAS,eAAe,CAAA,GAAI,MAAA;AAAA,IAC1F,SAAA,EAAW,aAAA,CAAc,QAAA,EAAU,YAAY;AAAA,GACjD;AACF;AAEA,SAAS,aAAA,CAAc,UAAmC,GAAA,EAAqB;AAC7E,EAAA,MAAM,KAAA,GAAQ,SAAS,GAAG,CAAA;AAC1B,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU,MAAM,IAAI,wBAAA,CAAyB,CAAA,8BAAA,EAAiC,GAAG,CAAA,CAAA,CAAG,CAAA;AACzG,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,aAAA,CAAc,UAAmC,GAAA,EAAqB;AAC7E,EAAA,MAAM,KAAA,GAAQ,SAAS,GAAG,CAAA;AAC1B,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU,MAAM,IAAI,wBAAA,CAAyB,CAAA,8BAAA,EAAiC,GAAG,CAAA,CAAA,CAAG,CAAA;AACzG,EAAA,OAAO,KAAA;AACT;;;ACzMO,IAAM,aAAA,GAAgB;AAgB7B,eAAsB,cAAA,CAAe;AAAA,EACnC,OAAA;AAAA,EACA,SAAA;AAAA,EACA,KAAA,EAAO,YAAY,UAAA,CAAW;AAChC,CAAA,EAA4C;AAC1C,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,OAAO,CAAA,EAAG,aAAa,CAAA,CAAA;AACtC,EAAA,MAAM,IAAA,GAAO,wDAAA;AACb,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,UAAU,GAAA,EAAK;AAAA,MAC9B,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAoB,cAAc,SAAA;AAAU,KAChE,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,gBAAA,EAAmB,GAAG,CAAA,qBAAA,EAAwB,IAAI,CAAA,CAAA,EAAI;AAAA,MACvF,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AACA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,wBAAA;AAAA,MACR,CAAA,EAAG,GAAG,CAAA,UAAA,EAAa,MAAA,CAAO,SAAS,MAAM,CAAC,+BAA+B,IAAI,CAAA;AAAA,KAC/E;AAAA,EACF;AAEA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,SAAS,IAAA,EAAK;AAAA,EACjC,CAAA,CAAA,MAAQ;AACN,IAAA,QAAA,GAAW,IAAA;AAAA,EACb;AACA,EAAA,MAAM,MAAA,GACJ,OAAO,QAAA,KAAa,QAAA,IAAY,aAAa,IAAA,GACxC,QAAA,CAAqC,QAAQ,CAAA,GAC9C,MAAA;AACN,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,SAAA,CAAU,MAAM,CAAA,EAAG;AACpD,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,EAAG,GAAG,CAAA,yBAAA,EAA4B,IAAI,CAAA,CAAE,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,MAAA,CAAO,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAClC;AAWO,SAAS,cAAA,CACd,UACA,OAAA,EACuB;AACvB,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,MAAM,KAAA,GAAQ,QAAA;AACd,IAAA,OAAO,MAAM,OAAA,CAAQ,OAAA,CAAQ,KAAK,CAAA;AAAA,EACpC;AACA,EAAA,IAAI,OAAA,GAAkC,IAAA;AACtC,EAAA,OAAO,MAAM;AACX,IAAA,OAAA,KAAY,cAAA,CAAe,OAAO,CAAA,CAAE,KAAA,CAAM,CAAC,KAAA,KAAmB;AAC5D,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,KAAA;AAAA,IACR,CAAC,CAAA;AACD,IAAA,OAAO,OAAA;AAAA,EACT,CAAA;AACF;AAEA,SAAS,UAAU,KAAA,EAAwB;AACzC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACzB,IAAA,OAAO,GAAA,CAAI,QAAA,KAAa,QAAA,IAAY,GAAA,CAAI,QAAA,KAAa,OAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;AClDO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EAChC,KAAA;AAAA,EACT,YAAY,KAAA,EAAsB;AAChC,IAAA,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA;AAC1C,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF;AAYO,IAAM,UAAN,MAAc;AAAA,EACV,OAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAET,YAAA,GAA8B,IAAA;AAAA,EAC9B,qBAAA,GAAwB,CAAA;AAAA,EACxB,QAAA,GAA2B,IAAA;AAAA,EAE3B,YAAY,OAAA,EAAyB;AACnC,IAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAO,MAAA,KAAW,QAAA,GAAW,MAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,GAAI,MAAA;AAC5E,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,QAAA;AACzB,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,OAAA;AACxB,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,KAAA;AACtB,IAAA,IAAA,CAAK,aAAa,OAAA,CAAQ,SAAA;AAC1B,IAAA,IAAA,CAAK,MAAA,GAAS,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC1C,IAAA,IAAA,CAAK,OAAA,GAAA,CAAW,OAAA,CAAQ,gBAAA,IAAoB,EAAA,IAAM,GAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,iBAAA,GAA2C;AAC/C,IAAA,IAAI,IAAA,CAAK,iBAAiB,IAAA,IAAQ,IAAA,CAAK,KAAI,GAAI,IAAA,CAAK,qBAAA,GAAwB,IAAA,CAAK,OAAA,EAAS;AACxF,MAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,WAAA,EAAa,KAAK,YAAA,EAAa;AAAA,IAC3D;AAEA,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,oBAAA,EAAqB;AACpD,IAAA,IAAI,WAAA,KAAgB,MAAM,OAAO,WAAA;AAEjC,IAAA,OAAO,KAAK,kBAAA,EAAmB;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,+BAAA,GAA0D;AAC9D,IAAA,IAAI,IAAA,CAAK,iBAAiB,IAAA,IAAQ,IAAA,CAAK,KAAI,GAAI,IAAA,CAAK,qBAAA,GAAwB,IAAA,CAAK,OAAA,EAAS;AACxF,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IACd;AACA,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,oBAAA,EAAqB;AAC9C,IAAA,OAAO,UAAU,IAAA,IAAQ,KAAA,CAAM,MAAA,KAAW,OAAA,GAAU,MAAM,WAAA,GAAc,IAAA;AAAA,EAC1E;AAAA;AAAA,EAGA,UAAA,GAAmB;AACjB,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,qBAAA,GAAwB,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,MAAM,oBAAA,GAAqD;AACzD,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,QAAQ,CAAA;AAClD,IAAA,IAAI,MAAA,KAAW,MAAM,OAAO,IAAA;AAE5B,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAM,kBAAA,CAAmB;AAAA,QAChC,MAAA,EAAQ,MAAM,IAAA,CAAK,OAAA,EAAQ;AAAA,QAC3B,UAAU,IAAA,CAAK,SAAA;AAAA,QACf,YAAA,EAAc,MAAA;AAAA,QACd,WAAW,IAAA,CAAK,UAAA;AAAA,QAChB,OAAO,IAAA,CAAK;AAAA,OACb,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,UAAA,EAAY;AAK/B,QAAA,MAAM,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AACtC,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,MAAM,IAAA,CAAK,aAAa,MAAM,CAAA;AAC9B,IAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,WAAA,EAAa,OAAO,WAAA,EAAY;AAAA,EAC5D;AAAA;AAAA,EAGA,MAAM,kBAAA,GAA4C;AAChD,IAAA,IAAI,IAAA,CAAK,aAAa,IAAA,IAAQ,IAAA,CAAK,KAAI,IAAK,IAAA,CAAK,SAAS,SAAA,EAAW;AACnE,MAAA,MAAM,IAAA,GAAO,MAAM,wBAAA,CAAyB;AAAA,QAC1C,MAAA,EAAQ,MAAM,IAAA,CAAK,OAAA,EAAQ;AAAA,QAC3B,UAAU,IAAA,CAAK,SAAA;AAAA,QACf,WAAW,IAAA,CAAK,UAAA;AAAA,QAChB,OAAO,IAAA,CAAK;AAAA,OACb,CAAA;AACD,MAAA,IAAA,CAAK,QAAA,GAAW;AAAA,QACd,YAAY,IAAA,CAAK,UAAA;AAAA,QACjB,UAAU,IAAA,CAAK,QAAA;AAAA,QACf,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,SAAA,GAAY,GAAA;AAAA,QACzC,iBAAiB,IAAA,CAAK,eAAA;AAAA,QACtB,yBAAyB,IAAA,CAAK,uBAAA;AAAA,QAC9B,UAAU,IAAA,CAAK,QAAA;AAAA,QACf,UAAA,EAAY;AAAA,OACd;AACA,MAAA,OAAO,IAAA,CAAK,aAAA;AAAA,QACV;AAAA,OAEF;AAAA,IACF;AAEA,IAAA,MAAM,UAAU,IAAA,CAAK,QAAA;AAKrB,IAAA,OAAA,CAAQ,UAAA,GAAa,KAAK,GAAA,EAAI;AAC9B,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,eAAA,CAAgB;AAAA,QACnC,MAAA,EAAQ,MAAM,IAAA,CAAK,OAAA,EAAQ;AAAA,QAC3B,UAAU,IAAA,CAAK,SAAA;AAAA,QACf,YAAY,OAAA,CAAQ,UAAA;AAAA,QACpB,WAAW,IAAA,CAAK,UAAA;AAAA,QAChB,OAAO,IAAA,CAAK;AAAA,OACb,CAAA;AACD,MAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,MAAA,MAAM,IAAA,CAAK,aAAa,MAAM,CAAA;AAC9B,MAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,WAAA,EAAa,OAAO,WAAA,EAAY;AAAA,IAC5D,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,EAAE,KAAA,YAAiB,UAAA,CAAA,EAAa,MAAM,KAAA;AAC1C,MAAA,QAAQ,MAAM,IAAA;AAAM,QAClB,KAAK,uBAAA;AACH,UAAA,OAAO,IAAA,CAAK,cAAc,4CAA4C,CAAA;AAAA,QACxE,KAAK,WAAA;AACH,UAAA,OAAA,CAAQ,QAAA,IAAY,CAAA;AACpB,UAAA,OAAO,IAAA,CAAK,aAAA;AAAA,YACV,CAAA,8FAAA;AAAA,WACF;AAAA,QACF,KAAK,eAAA;AACH,UAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,UAAA,OAAO,EAAE,QAAQ,QAAA,EAAS;AAAA,QAC5B,KAAK,eAAA;AAIH,UAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,UAAA,OAAO,KAAK,kBAAA,EAAmB;AAAA,QACjC;AACE,UAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,6BAAA,EAAgC,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI;AAAA,YAC/E,KAAA,EAAO;AAAA,WACR,CAAA;AAAA;AACL,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,MAAA,EAA+B;AAChD,IAAA,IAAA,CAAK,eAAe,MAAA,CAAO,WAAA;AAC3B,IAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,SAAA,GAAY,GAAA;AAC7D,IAAA,IAAI,MAAA,CAAO,iBAAiB,MAAA,EAAW;AAGrC,MAAA,MAAM,KAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,QAAA,EAAU,OAAO,YAAY,CAAA;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,cAAc,OAAA,EAA+B;AAC3C,IAAA,MAAM,UAAU,IAAA,CAAK,QAAA;AACrB,IAAA,IAAI,OAAA,KAAY,IAAA,EAAM,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAC5F,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,wBAAA;AAAA,MACR,iBAAiB,OAAA,CAAQ,eAAA;AAAA,MACzB,yBAAyB,OAAA,CAAQ,uBAAA;AAAA,MACjC,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB;AAAA,KACF;AAAA,EACF;AACF;;;ACtKA,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,sBAAA,GAAyB,CAAA;AAE/B,IAAM,WAAA,GAAc,CAAA;AAMb,IAAM,mBAAN,MAAuB;AAAA,EACnB,OAAA;AAAA,EACA,eAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACT,SAAA,GAAY,CAAA;AAAA,EACZ,SAA4B,EAAC;AAAA,EAE7B,YAAY,OAAA,EAAkC;AAC5C,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,OAAA,CAAQ,QAAQ,EAAE,CAAA;AACjD,IAAA,IAAA,CAAK,kBAAkB,OAAA,CAAQ,cAAA;AAC/B,IAAA,IAAA,CAAK,aAAa,OAAA,CAAQ,SAAA;AAC1B,IAAA,IAAA,CAAK,MAAA,GAAS,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC1C,IAAA,IAAA,CAAK,UAAA,GAAa,QAAQ,SAAA,IAAa,kBAAA;AACvC,IAAA,IAAA,CAAK,cAAA,GAAiB,QAAQ,aAAA,IAAiB,sBAAA;AAC/C,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,OAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,IAAA,CACJ,SAAA,EACA,IAAA,EACA,OAAA,GAAuB,EAAC,EACN;AAClB,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,MAAM,OAAO,CAAA;AAC5D,IAAA,IAAI,SAAS,MAAA,KAAW,GAAA,IAAO,QAAA,CAAS,IAAA,KAAS,IAAI,OAAO,MAAA;AAC5D,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA;AAAA,EACjC;AAAA;AAAA,EAGA,MAAM,OAAA,CACJ,SAAA,EACA,IAAA,EACA,OAAA,GAAuB,EAAC,EACF;AACtB,IAAA,MAAM,KAAK,QAAA,EAAS;AACpB,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,UAAA,CAAW,SAAA,EAAW,IAAA,EAAM,SAAS,CAAC,CAAA;AAAA,IAC1D,CAAA,SAAE;AACA,MAAA,IAAA,CAAK,QAAA,EAAS;AAAA,IAChB;AAAA,EACF;AAAA,EAEA,MAAM,UAAA,CACJ,SAAA,EACA,IAAA,EACA,SACA,OAAA,EACsB;AACtB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,IAAI,CAAA;AACxC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,IAAI,CAAA;AAC1C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,eAAA,EAAgB;AAEzC,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,MAAA,EAAQ,4CAAA;AAAA,MACR,GAAI,OAAA,CAAQ,OAAA,IAAW,EAAC;AAAA,MACxB,aAAA,EAAe,UAAU,KAAK,CAAA,CAAA;AAAA,MAC9B,cAAc,IAAA,CAAK;AAAA,KACrB;AACA,IAAA,IAAI,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAElD,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,MAAA,CAAO,WAAA,EAAY;AAC5C,IAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAC3B,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,GAAA,EAAK;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,GAAI,IAAA,KAAS,KAAA,CAAA,GAAY,EAAC,GAAI,EAAE,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAE;AAAA,QAC3D,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,IAAA,CAAK,UAAU;AAAA,OAC5C,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,QAAA,GAAW;AAAA,QACd,MAAA;AAAA,QACA,IAAA,EAAM,GAAA,CAAI,QAAA,GAAW,GAAA,CAAI,MAAA;AAAA,QACzB,MAAA,EAAQ,IAAA;AAAA,QACR,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,QACzB,SAAA,EAAW,MAAA;AAAA,QACX,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK;AAAA,OAC7D,CAAA;AACD,MAAA,MAAM,IAAI,yBAAyB,CAAA,gBAAA,EAAmB,IAAA,CAAK,OAAO,CAAA,CAAA,EAAI,EAAE,KAAA,EAAO,KAAA,EAAO,CAAA;AAAA,IACxF;AAEA,IAAA,IAAA,CAAK,QAAA,GAAW;AAAA,MACd,MAAA;AAAA,MACA,IAAA,EAAM,GAAA,CAAI,QAAA,GAAW,GAAA,CAAI,MAAA;AAAA,MACzB,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,SAAA,EAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK;AAAA,KACpD,CAAA;AAED,IAAA,IAAI,SAAS,MAAA,KAAW,GAAA,IAAO,UAAU,WAAA,IAAe,OAAA,CAAQ,eAAe,KAAA,EAAO;AACpF,MAAA,MAAM,UAAA,GAAa,kBAAkB,QAAQ,CAAA;AAC7C,MAAA,IAAI,eAAe,IAAA,EAAM;AACvB,QAAA,MAAM,KAAA,CAAM,aAAa,GAAI,CAAA;AAC7B,QAAA,OAAO,KAAK,UAAA,CAAW,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,UAAU,CAAC,CAAA;AAAA,MAC9D;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,QAAA,CAAS,EAAA,EAAI,MAAM,MAAM,WAAW,QAAQ,CAAA;AACjD,IAAA,OAAO;AAAA,MACL,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,MAAM,QAAA,CAAS,MAAA,KAAW,MAAM,EAAA,GAAK,MAAM,SAAS,IAAA,EAAK;AAAA,MACzD,SAAS,QAAA,CAAS;AAAA,KACpB;AAAA,EACF;AAAA,EAEA,OAAA,CAAQ,WAAsB,IAAA,EAA0B;AACtD,IAAA,MAAM,OAAO,SAAA,CAAU,IAAA,CAAK,QAAQ,cAAA,EAAgB,CAAC,GAAG,IAAA,KAAiB;AACvE,MAAA,MAAM,KAAA,GAAQ,KAAK,IAAI,CAAA;AACvB,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA,EAAI;AAI7C,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,UAAU,WAAW,CAAA,0BAAA,EAA6B,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,MACzF;AACA,MAAA,OAAO,mBAAmB,KAAK,CAAA;AAAA,IACjC,CAAC,CAAA;AACD,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,CAAK,UAAU,IAAI,CAAA;AACvC,IAAA,KAAA,MAAW,IAAA,IAAQ,UAAU,WAAA,EAAa;AACxC,MAAA,MAAM,KAAA,GAAQ,KAAK,IAAI,CAAA;AACvB,MAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AAC3C,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAM,OAAA,CAAQ,KAAK,IAAI,KAAA,GAAQ,CAAC,KAAK,CAAA,EAAG;AACzD,QAAA,IAAI,OAAO,SAAS,QAAA,IAAY,OAAO,SAAS,QAAA,IAAY,OAAO,SAAS,SAAA,EAAW;AACrF,UAAA,GAAA,CAAI,YAAA,CAAa,MAAA,CAAO,IAAA,EAAM,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,QAC5C;AAAA,MACF;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,QAAA,CAAS,WAAsB,IAAA,EAA0D;AACvF,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA,EAAS,OAAO,MAAA;AAC/B,IAAA,MAAM,QAAA,mBAAW,IAAI,GAAA,CAAY,CAAC,GAAG,UAAU,UAAA,EAAY,GAAG,SAAA,CAAU,WAAW,CAAC,CAAA;AACpF,IAAA,MAAM,OAAgC,EAAC;AACvC,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,EAAG;AAChD,MAAA,IAAI,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA,EAAG;AACxB,MAAA,IAAI,KAAA,KAAU,MAAA,EAAW,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA;AAAA,IACxC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA,EAGA,QAAA,GAA0B;AACxB,IAAA,IAAI,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,cAAA,EAAgB;AACxC,MAAA,IAAA,CAAK,SAAA,EAAA;AACL,MAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,IACzB;AACA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,MAAA,IAAA,CAAK,MAAA,CAAO,KAAK,MAAM;AACrB,QAAA,IAAA,CAAK,SAAA,EAAA;AACL,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,QAAA,GAAiB;AACf,IAAA,IAAA,CAAK,SAAA,EAAA;AACL,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,KAAA,EAAM;AAC/B,IAAA,IAAI,MAAM,IAAA,EAAK;AAAA,EACjB;AACF;AAEA,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;AAGO,SAAS,kBAAkB,QAAA,EAAmC;AACnE,EAAA,MAAM,MAAM,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,GAAG,IAAA,EAAK;AACtD,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,MAAM,OAAA,GAAU,OAAO,GAAG,CAAA;AAC1B,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,IAAK,OAAA,IAAW,GAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,EAAE,CAAA;AACzE,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACzB,EAAA,IAAI,OAAO,QAAA,CAAS,EAAE,GAAG,OAAO,IAAA,CAAK,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,IAAA,CAAK,KAAA,CAAA,CAAO,KAAK,IAAA,CAAK,GAAA,MAAS,GAAI,CAAC,GAAG,EAAE,CAAA;AAC9F,EAAA,OAAO,IAAA;AACT;AAEA,eAAe,WAAW,QAAA,EAAuC;AAC/D,EAAA,IAAI,WAAoC,EAAC;AACzC,EAAA,IAAI;AACF,IAAA,MAAM,OAAgB,IAAA,CAAK,KAAA,CAAM,MAAM,QAAA,CAAS,MAAM,CAAA;AACtD,IAAA,IAAI,OAAO,SAAS,QAAA,IAAY,IAAA,KAAS,QAAQ,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACrE,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAGR;AACA,EAAA,MAAM,OAAA,GAA0B;AAAA,IAC9B,QAAA;AAAA,IACA,UAAA,EAAY,kBAAkB,QAAQ,CAAA;AAAA,IACtC,SAAA,EACE,OAAO,QAAA,CAAS,YAAY,CAAA,KAAM,QAAA,GAC9B,QAAA,CAAS,YAAY,CAAA,GACpB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK;AAAA,GACjD;AACA,EAAA,OAAO,IAAI,QAAA;AAAA,IACT,OAAO,QAAA,CAAS,MAAM,MAAM,QAAA,GAAW,QAAA,CAAS,MAAM,CAAA,GAAI,aAAA;AAAA,IAC1D,QAAA,CAAS,MAAA;AAAA,IACT,OAAO,QAAA,CAAS,OAAO,MAAM,QAAA,GAAW,QAAA,CAAS,OAAO,CAAA,GAAI,MAAA;AAAA,IAC5D,OAAO,QAAA,CAAS,QAAQ,MAAM,QAAA,GAAW,QAAA,CAAS,QAAQ,CAAA,GAAI,MAAA;AAAA,IAC9D;AAAA,GACF;AACF","file":"index.js","sourcesContent":["/**\n * The error shapes the two local tools throw and pass through.\n *\n * Declared here rather than imported from `@kleora-io/node`: neither tool\n * depends on any published SDK. The tools have no database connection and no\n * service credential of their own, and the same isolation argument applies to\n * code: a process that administers a person's whole\n * Account should not inherit behaviour from a package meant for verifying\n * end-user tokens in someone else's backend).\n *\n * One copy, not two, and that is a correctness requirement rather than\n * tidiness: the MCP server and the CLI both render these, and a second\n * `ApiError` in the dependency graph would make `instanceof` lie in whichever\n * of them imported the other's.\n */\n\n/** Base class for everything these packages throw. */\nexport class KleoraToolError extends Error {\n readonly code: string\n\n constructor(code: string, message: string, options?: ErrorOptions) {\n super(message, options)\n this.name = 'KleoraToolError'\n this.code = code\n }\n}\n\n/**\n * What `ApiError` carries beyond `type`/`status`/`detail` — the same shape\n * `@kleora-io/node` calls `ProblemDetails`.\n */\nexport interface ProblemDetails {\n /** The RFC 9457 document exactly as it arrived, extension members included. */\n document: Record<string, unknown>\n /** `Retry-After` in seconds, falling back to the document's `retry_after`. */\n retryAfter: number | null\n requestId: string | undefined\n}\n\n/**\n * An RFC 9457 problem document from the management API, passed through with\n * its `type`, `title`, `detail` and `status`.\n */\nexport class ApiError extends KleoraToolError {\n readonly type: string\n readonly title: string | undefined\n readonly status: number\n readonly detail: string | undefined\n readonly problem: ProblemDetails\n\n constructor(\n type: string,\n status: number,\n title: string | undefined,\n detail: string | undefined,\n problem: ProblemDetails,\n ) {\n super('api_error', detail ?? title ?? type)\n this.name = 'ApiError'\n this.type = type\n this.status = status\n this.title = title\n this.detail = detail\n this.problem = problem\n }\n\n /** The RFC 9457 document, verbatim plus its four standard fields. */\n toProblemDocument(): Record<string, unknown> {\n return {\n type: this.type,\n title: this.title,\n status: this.status,\n detail: this.detail,\n ...this.problem.document,\n }\n }\n}\n\n/**\n * The management API could not be reached at all — refused, timed out, DNS\n * failure. Deliberately distinguishable from a permission failure: an agent\n * or a script must not read an outage as \"you cannot do that\".\n */\nexport class ManagementApiUnreachable extends KleoraToolError {\n constructor(message: string, options?: ErrorOptions) {\n super('management_api_unreachable', message, options)\n this.name = 'ManagementApiUnreachable'\n }\n}\n\n/**\n * The person denied the device approval (RFC 8628 `access_denied`). Surfaced\n * plainly; nothing is stored.\n */\nexport class AuthorizationDenied extends KleoraToolError {\n constructor() {\n super('access_denied', 'The device authorization was denied.')\n this.name = 'AuthorizationDenied'\n }\n}\n","/**\n * Where the refresh token lives: the OS keychain, falling back to a `0600` file\n * under the user's config directory when there is no keychain. Never an\n * environment variable, never a command-line argument — neither appears\n * anywhere in this module, and nothing in either tool reads a credential from\n * either.\n *\n * Never a file inside the user's project, which is the one placement this\n * module makes structurally impossible: the path is always built from\n * `homedir()`.\n *\n * The access token is never written here at all — it lives in memory only\n * (`session.ts`), for the life of the process.\n */\nimport { randomUUID } from 'node:crypto'\nimport { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\n\n/** One stored credential, keyed by profile. */\nexport interface CredentialStore {\n get(profile: string): Promise<string | null>\n set(profile: string, refreshToken: string): Promise<void>\n delete(profile: string): Promise<void>\n /** For `kleora_whoami` and diagnostics — never the secret itself. */\n readonly backend: 'keychain' | 'file'\n}\n\n/**\n * Which store a tool is asking for. The two tools deliberately do **not**\n * share a stored credential and cannot: a refresh token is bound to the\n * OAuth client it was issued to, and each tool is its own client. What they\n * share is this code.\n *\n * A single `~/.kleora` directory would be tidier and is deliberately not\n * done — moving a live credential store makes every existing MCP user sign in\n * again for no benefit they can see.\n */\nexport interface CredentialStoreOptions {\n /** The keychain service name: `kleora-mcp` or `kleora-cli`. */\n service: string\n /** Where the `0600` fallback lives: `~/.kleora-mcp` or `~/.kleora-cli`. */\n configDir: string\n}\n\n/** `~/.<name>`; overridable for tests, never by a flag a person sets. */\nexport function defaultConfigDir(name: string): string {\n return join(homedir(), `.${name}`)\n}\n\n/**\n * Tries the OS keychain via `@napi-rs/keyring` (an optional dependency); falls\n * back to the file store the moment\n * loading it, or any one call to it, fails. A Linux box with no secret\n * service running is the ordinary case this exists for, not an edge case:\n * the fallback has to work as well as the keychain does, not merely exist.\n */\nexport async function createCredentialStore({\n service,\n configDir,\n}: CredentialStoreOptions): Promise<CredentialStore> {\n const fileStore = new FileCredentialStore(configDir)\n const keyring = await loadKeyring()\n if (keyring === null) return fileStore\n return new KeychainCredentialStore(service, keyring, fileStore)\n}\n\n/** The shape of `@napi-rs/keyring`'s `AsyncEntry` this module actually uses. */\ninterface KeyringModule {\n AsyncEntry: new (service: string, account: string) => {\n // 2.0 resolves a missing entry to `undefined`, 2.1 to `null`; both mean \"none\".\n getPassword(): Promise<string | null | undefined>\n setPassword(password: string): Promise<void>\n deleteCredential(): Promise<boolean>\n }\n}\n\nasync function loadKeyring(): Promise<KeyringModule | null> {\n try {\n // A dynamic import, not a static one: the whole point of an optional\n // dependency is that a platform with no prebuilt binary for it — or no\n // keychain at all — still installs and still runs this server, on the\n // file fallback.\n return await import('@napi-rs/keyring')\n } catch {\n return null\n }\n}\n\nclass KeychainCredentialStore implements CredentialStore {\n readonly backend = 'keychain'\n #service: string\n #keyring: KeyringModule\n #fallback: FileCredentialStore\n /** Set once any call fails, so a dead keychain is not retried per call. */\n #broken = false\n\n constructor(service: string, keyring: KeyringModule, fallback: FileCredentialStore) {\n this.#service = service\n this.#keyring = keyring\n this.#fallback = fallback\n }\n\n async get(profile: string): Promise<string | null> {\n if (this.#broken) return this.#fallback.get(profile)\n try {\n const entry = new this.#keyring.AsyncEntry(this.#service, profile)\n const value = await entry.getPassword()\n return value ?? null\n } catch {\n this.#broken = true\n return this.#fallback.get(profile)\n }\n }\n\n async set(profile: string, refreshToken: string): Promise<void> {\n if (this.#broken) return this.#fallback.set(profile, refreshToken)\n try {\n const entry = new this.#keyring.AsyncEntry(this.#service, profile)\n await entry.setPassword(refreshToken)\n } catch {\n this.#broken = true\n await this.#fallback.set(profile, refreshToken)\n }\n }\n\n async delete(profile: string): Promise<void> {\n if (this.#broken) return this.#fallback.delete(profile)\n try {\n const entry = new this.#keyring.AsyncEntry(this.#service, profile)\n await entry.deleteCredential()\n } catch {\n this.#broken = true\n await this.#fallback.delete(profile)\n }\n }\n}\n\n/**\n * A `0600` file per profile under `configDir`. `mode` on `writeFileSync` is\n * still subject to the process umask, so every write is followed by an\n * explicit `chmodSync` — the guarantee is the final permission bits, not\n * merely the flag passed to the syscall that created the file.\n */\nexport class FileCredentialStore implements CredentialStore {\n readonly backend = 'file'\n #dir: string\n\n constructor(dir: string) {\n this.#dir = dir\n }\n\n // Every one of these is synchronous under the hood (`node:fs`'s sync API,\n // deliberately — this runs at most once per tool call, never in a hot\n // loop) but returns a `Promise` regardless, so `KeychainCredentialStore`\n // can fall back to it without its callers caring which backend answered.\n get(profile: string): Promise<string | null> {\n try {\n const raw = readFileSync(this.#path(profile), 'utf8')\n const parsed: unknown = JSON.parse(raw)\n if (typeof parsed === 'object' && parsed !== null && 'refreshToken' in parsed) {\n const refreshToken = parsed.refreshToken\n if (typeof refreshToken === 'string') return Promise.resolve(refreshToken)\n }\n return Promise.resolve(null)\n } catch (error) {\n if (isNotFound(error)) return Promise.resolve(null)\n return Promise.reject(asError(error))\n }\n }\n\n set(profile: string, refreshToken: string): Promise<void> {\n try {\n mkdirSync(this.#dir, { recursive: true, mode: 0o700 })\n chmodSync(this.#dir, 0o700)\n const path = this.#path(profile)\n // Write beside the target and rename, so a process killed mid-write\n // never leaves a half-written credential file for the next run to parse.\n const tmp = `${path}.${randomUUID()}.tmp`\n writeFileSync(tmp, JSON.stringify({ refreshToken }), { mode: 0o600 })\n chmodSync(tmp, 0o600)\n renameSync(tmp, path)\n return Promise.resolve()\n } catch (error) {\n return Promise.reject(asError(error))\n }\n }\n\n delete(profile: string): Promise<void> {\n try {\n rmSync(this.#path(profile))\n return Promise.resolve()\n } catch (error) {\n if (isNotFound(error)) return Promise.resolve()\n return Promise.reject(asError(error))\n }\n }\n\n #path(profile: string): string {\n // Profile names come from configuration, never from a tool argument or\n // API response, but a filesystem path is still built from a string the\n // person typed — encoded rather than trusted to contain no `/`.\n return join(this.#dir, `credentials-${encodeURIComponent(profile)}.json`)\n }\n}\n\nfunction isNotFound(error: unknown): boolean {\n return typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT'\n}\n\nfunction asError(error: unknown): Error {\n return error instanceof Error ? error : new Error(String(error))\n}\n","/**\n * The OAuth 2.0 device authorization grant (RFC 8628) against the issuer: the\n * credential both the CLI and the MCP server run on.\n */\nimport { ManagementApiUnreachable } from '../errors.js'\n\nexport interface DeviceAuthorization {\n deviceCode: string\n userCode: string\n verificationUri: string\n verificationUriComplete: string\n expiresIn: number\n interval: number\n}\n\nexport interface Tokens {\n accessToken: string\n refreshToken: string | undefined\n expiresIn: number\n}\n\n/** RFC 8628 section 3.2 / RFC 6749 section 5.2 error codes this module distinguishes. */\nexport type OAuthErrorCode =\n | 'authorization_pending'\n | 'slow_down'\n | 'access_denied'\n | 'expired_token'\n | 'invalid_grant'\n | 'unauthorized_client'\n | 'other'\n\nexport class OAuthError extends Error {\n readonly code: OAuthErrorCode\n constructor(code: OAuthErrorCode, description: string | undefined) {\n super(description ?? code)\n this.name = 'OAuthError'\n this.code = code\n }\n}\n\nexport interface DeviceGrantOptions {\n issuer: string\n clientId: string\n /**\n * `kleora-mcp/{version}` or `kleora-cli/{version}`. Passed in rather than\n * read from a constant here, because this module is shared and the whole\n * value of the two tools having their own OAuth client is that an audit event\n * can say which of them acted — a shared `User-Agent` would undo half of that\n * in the request log.\n */\n userAgent: string\n fetch: typeof globalThis.fetch\n}\n\nasync function postForm(\n url: string,\n body: Record<string, string>,\n fetchImpl: typeof globalThis.fetch,\n userAgent: string,\n): Promise<Record<string, unknown>> {\n let response: Response\n try {\n response = await fetchImpl(url, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/x-www-form-urlencoded',\n Accept: 'application/json',\n 'User-Agent': userAgent,\n },\n body: new URLSearchParams(body),\n })\n } catch (error) {\n throw new ManagementApiUnreachable(`could not reach ${url}`, { cause: error })\n }\n\n let document: Record<string, unknown> = {}\n try {\n document = (await response.json()) as Record<string, unknown>\n } catch {\n // fall through with an empty document; the status code alone still tells\n // the caller something.\n }\n\n if (!response.ok) {\n const rawCode = typeof document['error'] === 'string' ? document['error'] : 'other'\n const code: OAuthErrorCode = isKnownCode(rawCode) ? rawCode : 'other'\n const description =\n typeof document['error_description'] === 'string' ? document['error_description'] : undefined\n throw new OAuthError(code, description)\n }\n return document\n}\n\nfunction isKnownCode(value: string): value is OAuthErrorCode {\n return [\n 'authorization_pending',\n 'slow_down',\n 'access_denied',\n 'expired_token',\n 'invalid_grant',\n 'unauthorized_client',\n ].includes(value)\n}\n\n/** RFC 8628 sections 3.1–3.2: `POST /oauth/device_authorization`. */\nexport async function startDeviceAuthorization({\n issuer,\n clientId,\n userAgent,\n fetch: fetchImpl,\n}: DeviceGrantOptions): Promise<DeviceAuthorization> {\n const document = await postForm(\n `${issuer}/oauth/device_authorization`,\n { client_id: clientId },\n fetchImpl,\n userAgent,\n )\n return {\n deviceCode: requireString(document, 'device_code'),\n userCode: requireString(document, 'user_code'),\n verificationUri: requireString(document, 'verification_uri'),\n verificationUriComplete:\n typeof document['verification_uri_complete'] === 'string'\n ? document['verification_uri_complete']\n : requireString(document, 'verification_uri'),\n expiresIn: requireNumber(document, 'expires_in'),\n interval: typeof document['interval'] === 'number' ? document['interval'] : 5,\n }\n}\n\n/**\n * One poll of `POST /oauth/token` with\n * `urn:ietf:params:oauth:grant-type:device_code`. Throws `OAuthError` for\n * every RFC 8628 poll outcome that is not success — the caller\n * (`session.ts`) is what turns `authorization_pending` into \"not an error,\n * this is the sign-in\".\n */\nexport async function pollDeviceToken({\n issuer,\n clientId,\n deviceCode,\n userAgent,\n fetch: fetchImpl,\n}: DeviceGrantOptions & { deviceCode: string }): Promise<Tokens> {\n const document = await postForm(\n `${issuer}/oauth/token`,\n {\n grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n device_code: deviceCode,\n client_id: clientId,\n },\n fetchImpl,\n userAgent,\n )\n return tokensOf(document)\n}\n\n/** `grant_type=refresh_token`, for a stored credential. The refresh token rotates on every use. */\nexport async function refreshAccessToken({\n issuer,\n clientId,\n refreshToken,\n userAgent,\n fetch: fetchImpl,\n}: DeviceGrantOptions & { refreshToken: string }): Promise<Tokens> {\n const document = await postForm(\n `${issuer}/oauth/token`,\n { grant_type: 'refresh_token', refresh_token: refreshToken, client_id: clientId },\n fetchImpl,\n userAgent,\n )\n return tokensOf(document)\n}\n\n/**\n * RFC 7009 section 2.1: `POST /oauth/revoke` with the refresh token, which\n * revokes its whole rotation family and writes one\n * `refresh_token.revoked` audit event.\n *\n * This is the server-side half of \"uninstalling leaves no live credential\n * behind\": deleting the stored token alone would leave the\n * authorization itself alive and refreshable by anyone who had copied the\n * file. An unknown or already-dead token answers `200` with no effect\n * (RFC 7009 section 2.2), so calling this twice is not an error.\n */\nexport async function revokeRefreshToken({\n issuer,\n clientId,\n refreshToken,\n userAgent,\n fetch: fetchImpl,\n}: DeviceGrantOptions & { refreshToken: string }): Promise<void> {\n await postForm(\n `${issuer}/oauth/revoke`,\n { token: refreshToken, token_type_hint: 'refresh_token', client_id: clientId },\n fetchImpl,\n userAgent,\n )\n}\n\nfunction tokensOf(document: Record<string, unknown>): Tokens {\n return {\n accessToken: requireString(document, 'access_token'),\n refreshToken: typeof document['refresh_token'] === 'string' ? document['refresh_token'] : undefined,\n expiresIn: requireNumber(document, 'expires_in'),\n }\n}\n\nfunction requireString(document: Record<string, unknown>, key: string): string {\n const value = document[key]\n if (typeof value !== 'string') throw new ManagementApiUnreachable(`the issuer's response has no '${key}'`)\n return value\n}\n\nfunction requireNumber(document: Record<string, unknown>, key: string): number {\n const value = document[key]\n if (typeof value !== 'number') throw new ManagementApiUnreachable(`the issuer's response has no '${key}'`)\n return value\n}\n","/**\n * Where the device grant runs: the platform issuer, as the management API\n * reports it.\n *\n * Both tools used to *derive* it, by swapping the first DNS label of the API's\n * origin for `id`. The hosted API is on `kleora.io` and every issuer is on\n * `kleora.eu`, so the derivation held only through a hard-coded exception,\n * and would have named a host nobody serves for the next region. Now the tool\n * asks the deployment — `GET {baseUrl}/api/v1/platform`, anonymously, since\n * the answer is where a credential comes from — and uses what it says.\n *\n * An explicit issuer (`--issuer`, `KLEORA_ISSUER`, `KLEORA_MCP_ISSUER`) still\n * wins and makes no request at all: a development topology the deployment\n * cannot describe from the inside is exactly what the override is for.\n */\nimport { ManagementApiUnreachable } from '../errors.js'\n\nexport const PLATFORM_PATH = '/api/v1/platform'\n\nexport interface IssuerDiscoveryOptions {\n /** The management API's origin, e.g. `https://api.kleora.io`, no trailing slash. */\n baseUrl: string\n userAgent: string\n fetch?: typeof globalThis.fetch\n}\n\n/**\n * `GET {baseUrl}/api/v1/platform` → its `issuer`, without a trailing slash.\n *\n * Every failure is a `ManagementApiUnreachable` naming the URL it asked, because\n * the only thing a person can do about any of them is check the base URL or\n * pass the issuer explicitly — and the message says both.\n */\nexport async function discoverIssuer({\n baseUrl,\n userAgent,\n fetch: fetchImpl = globalThis.fetch,\n}: IssuerDiscoveryOptions): Promise<string> {\n const url = `${baseUrl}${PLATFORM_PATH}`\n const hint = 'Check the API base URL, or pass the issuer explicitly.'\n let response: Response\n try {\n response = await fetchImpl(url, {\n headers: { Accept: 'application/json', 'User-Agent': userAgent },\n })\n } catch (error) {\n throw new ManagementApiUnreachable(`could not reach ${url} to find the issuer. ${hint}`, {\n cause: error,\n })\n }\n if (!response.ok) {\n throw new ManagementApiUnreachable(\n `${url} answered ${String(response.status)}, so the issuer is unknown. ${hint}`,\n )\n }\n\n let document: unknown\n try {\n document = await response.json()\n } catch {\n document = null\n }\n const issuer =\n typeof document === 'object' && document !== null\n ? (document as Record<string, unknown>)['issuer']\n : undefined\n if (typeof issuer !== 'string' || !isHttpUrl(issuer)) {\n throw new ManagementApiUnreachable(`${url} did not name an issuer. ${hint}`)\n }\n return issuer.replace(/\\/+$/, '')\n}\n\n/**\n * The issuer to use, asked for at most once: `explicit` when given, otherwise\n * whatever `discoverIssuer` answers.\n *\n * Lazy on purpose. A command that never reaches the issuer — anything run\n * under an API key, `--help`, a usage error — makes no discovery request, and a\n * long-lived MCP server makes one per process rather than one per tool call. A\n * failed discovery is not remembered, so the next call asks again.\n */\nexport function issuerResolver(\n explicit: string | undefined,\n options: IssuerDiscoveryOptions,\n): () => Promise<string> {\n if (explicit !== undefined) {\n const value = explicit\n return () => Promise.resolve(value)\n }\n let pending: Promise<string> | null = null\n return () => {\n pending ??= discoverIssuer(options).catch((error: unknown) => {\n pending = null\n throw error\n })\n return pending\n }\n}\n\nfunction isHttpUrl(value: string): boolean {\n try {\n const url = new URL(value)\n return url.protocol === 'https:' || url.protocol === 'http:'\n } catch {\n return false\n }\n}\n","/**\n * One profile's credential lifecycle.\n *\n * The access token lives in memory only, for the life of this object. The\n * refresh token is read from and written to a `CredentialStore` — never held\n * here longer than one call needs it. There is exactly one thing this class\n * remembers across calls that is not a secret: a pending, unapproved device\n * authorization, so that a retried tool call polls the same code instead of\n * starting a new one every time.\n */\nimport { ManagementApiUnreachable } from '../errors.js'\nimport {\n OAuthError,\n pollDeviceToken,\n refreshAccessToken,\n startDeviceAuthorization,\n type Tokens,\n} from './device-grant.js'\nimport type { CredentialStore } from './store.js'\n\nexport interface SessionOptions {\n /**\n * The platform issuer, or a function that finds it (`issuerResolver`). A\n * function is called only when a request to the issuer is actually about to\n * be made, so a session that never refreshes never asks.\n */\n issuer: string | (() => Promise<string>)\n clientId: string\n profile: string\n store: CredentialStore\n /** `kleora-mcp/{version}` or `kleora-cli/{version}`. */\n userAgent: string\n fetch?: typeof globalThis.fetch\n /** Access tokens are treated as expired this many seconds early. */\n clockSkewSeconds?: number\n}\n\nexport type SessionState =\n | { status: 'ready'; accessToken: string }\n | {\n status: 'authorization_required'\n verificationUri: string\n verificationUriComplete: string\n userCode: string\n message: string\n }\n | { status: 'denied' }\n\nexport type NotReadyState = Exclude<SessionState, { status: 'ready' }>\n\n/**\n * Thrown by the `getAccessToken` callback a `ManagementClient` is built\n * with, when the session is not `ready`. The MCP server catches this and\n * turns it into a tool result that says \"not an error — this is the sign-in\"\n * rather than letting it surface as a protocol-level failure.\n */\nexport class SessionNotReady extends Error {\n readonly state: NotReadyState\n constructor(state: NotReadyState) {\n super(`session not ready: ${state.status}`)\n this.name = 'SessionNotReady'\n this.state = state\n }\n}\n\ninterface Pending {\n deviceCode: string\n interval: number\n expiresAt: number\n verificationUri: string\n verificationUriComplete: string\n userCode: string\n lastPollAt: number\n}\n\nexport class Session {\n readonly #issuer: () => Promise<string>\n readonly #clientId: string\n readonly #profile: string\n readonly #store: CredentialStore\n readonly #userAgent: string\n readonly #fetch: typeof globalThis.fetch\n readonly #skewMs: number\n\n #accessToken: string | null = null\n #accessTokenExpiresAt = 0\n #pending: Pending | null = null\n\n constructor(options: SessionOptions) {\n const issuer = options.issuer\n this.#issuer = typeof issuer === 'string' ? () => Promise.resolve(issuer) : issuer\n this.#clientId = options.clientId\n this.#profile = options.profile\n this.#store = options.store\n this.#userAgent = options.userAgent\n this.#fetch = options.fetch ?? globalThis.fetch\n this.#skewMs = (options.clockSkewSeconds ?? 30) * 1000\n }\n\n /**\n * The access token to call the management API with, or the instructions to\n * show the person instead of a result: \"not an error — this is the\n * sign-in.\"\n */\n async ensureAccessToken(): Promise<SessionState> {\n if (this.#accessToken !== null && Date.now() < this.#accessTokenExpiresAt - this.#skewMs) {\n return { status: 'ready', accessToken: this.#accessToken }\n }\n\n const fromRefresh = await this.#tryStoredCredential()\n if (fromRefresh !== null) return fromRefresh\n\n return this.#advanceDeviceFlow()\n }\n\n /**\n * An access token from the **stored** credential only — never starting a\n * device flow.\n *\n * This is the CLI's entry point rather than `ensureAccessToken` above, and\n * the difference is a deliberate behavioural split rather than a\n * convenience. With no credential for the profile, a CLI command says so\n * and names `kleora login`, exiting `3`. **It does not start a device flow\n * unbidden**: an interactive sign-in in the middle of a piped command is a\n * hang.\n *\n * An MCP host, by contrast, has a place to show a verification URL and a\n * turn to show it on, which is why `ensureAccessToken` may begin one there.\n * `null` means \"nothing stored, or what was stored is dead and has been\n * deleted\" — both of which the caller answers with the same sentence.\n */\n async accessTokenFromStoredCredential(): Promise<string | null> {\n if (this.#accessToken !== null && Date.now() < this.#accessTokenExpiresAt - this.#skewMs) {\n return this.#accessToken\n }\n const state = await this.#tryStoredCredential()\n return state !== null && state.status === 'ready' ? state.accessToken : null\n }\n\n /** Forces the next call to re-authorise, even if a token is cached in memory. */\n invalidate(): void {\n this.#accessToken = null\n this.#accessTokenExpiresAt = 0\n }\n\n /** `null` means \"no usable stored credential — try the device flow instead\". */\n async #tryStoredCredential(): Promise<SessionState | null> {\n const stored = await this.#store.get(this.#profile)\n if (stored === null) return null\n\n let tokens: Tokens\n try {\n tokens = await refreshAccessToken({\n issuer: await this.#issuer(),\n clientId: this.#clientId,\n refreshToken: stored,\n userAgent: this.#userAgent,\n fetch: this.#fetch,\n })\n } catch (error) {\n if (error instanceof OAuthError) {\n // A refresh token that is rejected (revoked, reused or expired): the\n // stored credential is deleted and the next call starts a fresh\n // device flow. A silently retried dead token is a\n // loop this class refuses to run.\n await this.#store.delete(this.#profile)\n return null\n }\n throw error\n }\n await this.#storeTokens(tokens)\n return { status: 'ready', accessToken: tokens.accessToken }\n }\n\n /** Starts a device flow if none is pending, or polls the one already running. */\n async #advanceDeviceFlow(): Promise<SessionState> {\n if (this.#pending === null || Date.now() >= this.#pending.expiresAt) {\n const auth = await startDeviceAuthorization({\n issuer: await this.#issuer(),\n clientId: this.#clientId,\n userAgent: this.#userAgent,\n fetch: this.#fetch,\n })\n this.#pending = {\n deviceCode: auth.deviceCode,\n interval: auth.interval,\n expiresAt: Date.now() + auth.expiresIn * 1000,\n verificationUri: auth.verificationUri,\n verificationUriComplete: auth.verificationUriComplete,\n userCode: auth.userCode,\n lastPollAt: 0,\n }\n return this.#pendingState(\n 'No Kleora credential is authorised yet. Open the verification URL, ' +\n 'enter the code, and approve. Then call this tool again.',\n )\n }\n\n const pending = this.#pending\n // The device grant's own interval is enforced by the issuer\n // (RFC 8628 section 3.5): a poll made sooner just gets `slow_down`,\n // which this branch absorbs by widening the interval rather than\n // treating it as a failure. One HTTP request either way.\n pending.lastPollAt = Date.now()\n try {\n const tokens = await pollDeviceToken({\n issuer: await this.#issuer(),\n clientId: this.#clientId,\n deviceCode: pending.deviceCode,\n userAgent: this.#userAgent,\n fetch: this.#fetch,\n })\n this.#pending = null\n await this.#storeTokens(tokens)\n return { status: 'ready', accessToken: tokens.accessToken }\n } catch (error) {\n if (!(error instanceof OAuthError)) throw error\n switch (error.code) {\n case 'authorization_pending':\n return this.#pendingState('Still waiting for approval in the browser.')\n case 'slow_down':\n pending.interval += 5\n return this.#pendingState(\n `Polling too fast; the issuer asked for a wider interval. Wait a little longer before retrying.`,\n )\n case 'access_denied':\n this.#pending = null\n return { status: 'denied' }\n case 'expired_token':\n // The code timed out with nobody approving it. This is treated\n // the same as a rejected refresh token: start over rather than\n // fail — the next call gets a fresh code immediately.\n this.#pending = null\n return this.#advanceDeviceFlow()\n default:\n throw new ManagementApiUnreachable(`the issuer refused the poll: ${error.code}`, {\n cause: error,\n })\n }\n }\n }\n\n async #storeTokens(tokens: Tokens): Promise<void> {\n this.#accessToken = tokens.accessToken\n this.#accessTokenExpiresAt = Date.now() + tokens.expiresIn * 1000\n if (tokens.refreshToken !== undefined) {\n // The refresh token rotates on every use; the\n // old value is simply overwritten, never appended anywhere.\n await this.#store.set(this.#profile, tokens.refreshToken)\n }\n }\n\n #pendingState(message: string): SessionState {\n const pending = this.#pending\n if (pending === null) throw new Error('invariant: #pendingState called with no pending flow')\n return {\n status: 'authorization_required',\n verificationUri: pending.verificationUri,\n verificationUriComplete: pending.verificationUriComplete,\n userCode: pending.userCode,\n message,\n }\n }\n}\n","/**\n * A thin, generic `fetch` wrapper over the management API's operations — the\n * whole security argument of both local tools, in code: this is the *only*\n * way either the CLI or the MCP server reaches Kleora's data, over HTTPS, with\n * the caller's own bearer token. No ORM, no service credential, no query the\n * API does not already expose.\n *\n * Generic over an `Operation` rather than one method per endpoint, because\n * both callers already know which operation they are invoking — the MCP\n * server from a tool name, the CLI from a noun and a verb — and a second,\n * hand-written switch here would be the same map twice.\n *\n * `Operation` is declared **structurally** rather than imported from either\n * package's generated tree: each generates its own from the management API's\n * OpenAPI document and both shapes satisfy this one, so this module depends on\n * neither generator's output.\n */\nimport { ApiError, ManagementApiUnreachable, type ProblemDetails } from './errors.js'\n\n/** What this client needs to know about an operation in order to call it. */\nexport interface Operation {\n readonly operationId: string\n readonly method: 'get' | 'post' | 'put' | 'patch' | 'delete'\n readonly path: string\n readonly pathParams: readonly string[]\n readonly queryParams: readonly string[]\n readonly hasBody: boolean\n}\n\nexport interface ManagementClientOptions {\n baseUrl: string\n /** Resolves to a fresh bearer token for every call — never cached here. */\n getAccessToken: () => Promise<string>\n /** `kleora-mcp/{version}` or `kleora-cli/{version}`. */\n userAgent: string\n fetch?: typeof globalThis.fetch\n timeoutMs?: number\n /**\n * Concurrent requests this client will have in flight at once: a small\n * number, deliberately. A host that fires several tool calls at once, or a\n * `--all` walk, must not turn a local tool into a burst against the\n * account's own limits.\n */\n maxConcurrent?: number\n /**\n * Called once per attempt, for the CLI's `--debug`, which prints the\n * request method, path, status, duration and `X-Request-Id` of every call\n * to stderr. It is\n * handed no credential and no body, which is what makes `--debug` output\n * safe to paste into a support reply.\n */\n onTrace?: (trace: RequestTrace) => void\n}\n\n/** What `--debug` prints. Deliberately carries nothing secret. */\nexport interface RequestTrace {\n method: string\n /** Path and query only — never the `Authorization` header, never a body. */\n path: string\n /** `null` when nothing answered at all. */\n status: number | null\n durationMs: number\n requestId: string | undefined\n /** Set when the request failed before a status existed. */\n error?: string\n}\n\nexport interface CallOptions {\n /**\n * Extra request headers: `Idempotency-Key` on a write, `X-Request-Id` when\n * the caller wants to correlate one. **Never a credential** — the only\n * `Authorization` header this client sends is the one it builds from\n * `getAccessToken`, and it is applied after these so a caller cannot\n * replace it.\n */\n headers?: Record<string, string>\n /**\n * Whether repeating this request is safe after a `429`. Defaults to `true`.\n * A non-idempotent `POST` is never retried without an `Idempotency-Key`, so\n * a caller making a keyless `POST` passes `false`.\n */\n idempotent?: boolean\n}\n\n/** A response, body included as the bytes that arrived. */\nexport interface RawResponse {\n status: number\n /**\n * The body exactly as it arrived, unparsed. The CLI's `--json` prints the\n * response body as it arrived, not a re-serialisation of a parsed object,\n * which is what lets an older CLI against a newer API pass\n * through fields it has never heard of.\n */\n text: string\n headers: Headers\n}\n\nconst DEFAULT_TIMEOUT_MS = 10_000\nconst DEFAULT_MAX_CONCURRENT = 4\n/** Bounds the `Retry-After` backoff — never an unbounded loop. */\nconst MAX_RETRIES = 3\n\nexport interface OperationArgs {\n [name: string]: unknown\n}\n\nexport class ManagementClient {\n readonly baseUrl: string\n readonly #getAccessToken: () => Promise<string>\n readonly #userAgent: string\n readonly #fetch: typeof globalThis.fetch\n readonly #timeoutMs: number\n readonly #maxConcurrent: number\n readonly #onTrace: ((trace: RequestTrace) => void) | undefined\n #inFlight = 0\n #queue: Array<() => void> = []\n\n constructor(options: ManagementClientOptions) {\n this.baseUrl = options.baseUrl.replace(/\\/+$/, '')\n this.#getAccessToken = options.getAccessToken\n this.#userAgent = options.userAgent\n this.#fetch = options.fetch ?? globalThis.fetch\n this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS\n this.#maxConcurrent = options.maxConcurrent ?? DEFAULT_MAX_CONCURRENT\n this.#onTrace = options.onTrace\n }\n\n /**\n * Calls one operation and parses the body. `args` is a flat argument\n * object; this method is what splits it back into path, query and body using\n * the operation's own metadata — never a lookup this package invents.\n */\n async call(\n operation: Operation,\n args: OperationArgs,\n options: CallOptions = {},\n ): Promise<unknown> {\n const response = await this.request(operation, args, options)\n if (response.status === 204 || response.text === '') return undefined\n return JSON.parse(response.text) as unknown\n }\n\n /** The same call, with the body left as the bytes that arrived. */\n async request(\n operation: Operation,\n args: OperationArgs,\n options: CallOptions = {},\n ): Promise<RawResponse> {\n await this.#acquire()\n try {\n return await this.#withRetry(operation, args, options, 0)\n } finally {\n this.#release()\n }\n }\n\n async #withRetry(\n operation: Operation,\n args: OperationArgs,\n options: CallOptions,\n attempt: number,\n ): Promise<RawResponse> {\n const url = this.#urlFor(operation, args)\n const body = this.#bodyFor(operation, args)\n const token = await this.#getAccessToken()\n\n const headers: Record<string, string> = {\n Accept: 'application/json, application/problem+json',\n ...(options.headers ?? {}),\n Authorization: `Bearer ${token}`,\n 'User-Agent': this.#userAgent,\n }\n if (body !== undefined) headers['Content-Type'] = 'application/json'\n\n const method = operation.method.toUpperCase()\n const startedAt = Date.now()\n let response: Response\n try {\n response = await this.#fetch(url, {\n method,\n headers,\n ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n signal: AbortSignal.timeout(this.#timeoutMs),\n })\n } catch (error) {\n this.#onTrace?.({\n method,\n path: url.pathname + url.search,\n status: null,\n durationMs: Date.now() - startedAt,\n requestId: undefined,\n error: error instanceof Error ? error.message : String(error),\n })\n throw new ManagementApiUnreachable(`could not reach ${this.baseUrl}`, { cause: error })\n }\n\n this.#onTrace?.({\n method,\n path: url.pathname + url.search,\n status: response.status,\n durationMs: Date.now() - startedAt,\n requestId: response.headers.get('x-request-id') ?? undefined,\n })\n\n if (response.status === 429 && attempt < MAX_RETRIES && options.idempotent !== false) {\n const retryAfter = retryAfterSeconds(response)\n if (retryAfter !== null) {\n await sleep(retryAfter * 1000)\n return this.#withRetry(operation, args, options, attempt + 1)\n }\n }\n\n if (!response.ok) throw await toApiError(response)\n return {\n status: response.status,\n text: response.status === 204 ? '' : await response.text(),\n headers: response.headers,\n }\n }\n\n #urlFor(operation: Operation, args: OperationArgs): URL {\n const path = operation.path.replace(/\\{([^}]+)\\}/g, (_, name: string) => {\n const value = args[name]\n if (typeof value !== 'string' || value === '') {\n // Unreachable once the caller has validated `args` — ajv against the\n // tool's schema in the MCP server, the command's own parser in the\n // CLI. This is the backstop, not the primary defence.\n throw new Error(`operation '${operation.operationId}' needs a path parameter '${name}'`)\n }\n return encodeURIComponent(value)\n })\n const url = new URL(this.baseUrl + path)\n for (const name of operation.queryParams) {\n const value = args[name]\n if (value === undefined || value === null) continue\n for (const item of Array.isArray(value) ? value : [value]) {\n if (typeof item === 'string' || typeof item === 'number' || typeof item === 'boolean') {\n url.searchParams.append(name, String(item))\n }\n }\n }\n return url\n }\n\n #bodyFor(operation: Operation, args: OperationArgs): Record<string, unknown> | undefined {\n if (!operation.hasBody) return undefined\n const excluded = new Set<string>([...operation.pathParams, ...operation.queryParams])\n const body: Record<string, unknown> = {}\n for (const [name, value] of Object.entries(args)) {\n if (excluded.has(name)) continue\n if (value !== undefined) body[name] = value\n }\n return body\n }\n\n /** A tiny counting semaphore — no dependency for something this small. */\n #acquire(): Promise<void> {\n if (this.#inFlight < this.#maxConcurrent) {\n this.#inFlight++\n return Promise.resolve()\n }\n return new Promise((resolve) => {\n this.#queue.push(() => {\n this.#inFlight++\n resolve()\n })\n })\n }\n\n #release(): void {\n this.#inFlight--\n const next = this.#queue.shift()\n if (next) next()\n }\n}\n\nfunction sleep(ms: number): Promise<void> {\n return new Promise((resolve) => setTimeout(resolve, ms))\n}\n\n/** `Retry-After` in seconds, from either the delta-seconds or the HTTP-date form. */\nexport function retryAfterSeconds(response: Response): number | null {\n const raw = response.headers.get('retry-after')?.trim()\n if (!raw) return null\n const seconds = Number(raw)\n if (Number.isFinite(seconds) && seconds >= 0) return Math.min(seconds, 60)\n const at = Date.parse(raw)\n if (Number.isFinite(at)) return Math.min(Math.max(0, Math.round((at - Date.now()) / 1000)), 60)\n return null\n}\n\nasync function toApiError(response: Response): Promise<ApiError> {\n let document: Record<string, unknown> = {}\n try {\n const body: unknown = JSON.parse(await response.text())\n if (typeof body === 'object' && body !== null && !Array.isArray(body)) {\n document = body as Record<string, unknown>\n }\n } catch {\n // A non-JSON error body (an intermediary's HTML page) still becomes an\n // `ApiError` carrying the status; see this client's callers.\n }\n const problem: ProblemDetails = {\n document,\n retryAfter: retryAfterSeconds(response),\n requestId:\n typeof document['request_id'] === 'string'\n ? document['request_id']\n : (response.headers.get('x-request-id') ?? undefined),\n }\n return new ApiError(\n typeof document['type'] === 'string' ? document['type'] : 'about:blank',\n response.status,\n typeof document['title'] === 'string' ? document['title'] : undefined,\n typeof document['detail'] === 'string' ? document['detail'] : undefined,\n problem,\n )\n}\n"]}
package/package.json CHANGED
@@ -1 +1,57 @@
1
- {"name":"@kleora-io/core","version":"0.0.0","description":"Name reserved for Kleora. The first release is coming.","license":"Apache-2.0"}
1
+ {
2
+ "name": "@kleora-io/core",
3
+ "version": "0.1.0",
4
+ "type": "module",
5
+ "description": "The credential store, device-grant client, in-memory session and generic management API client shared by the Kleora CLI and the Kleora MCP server.",
6
+ "license": "Apache-2.0",
7
+ "homepage": "https://github.com/kleora-io/kleora-cli/tree/main/packages/core#readme",
8
+ "repository": {
9
+ "type": "git",
10
+ "url": "git+https://github.com/kleora-io/kleora-cli.git",
11
+ "directory": "packages/core"
12
+ },
13
+ "bugs": {
14
+ "url": "https://github.com/kleora-io/kleora-cli/issues"
15
+ },
16
+ "publishConfig": {
17
+ "access": "public"
18
+ },
19
+ "sideEffects": false,
20
+ "engines": {
21
+ "node": ">=20"
22
+ },
23
+ "main": "./dist/index.js",
24
+ "types": "./dist/index.d.ts",
25
+ "exports": {
26
+ ".": {
27
+ "types": "./dist/index.d.ts",
28
+ "import": "./dist/index.js"
29
+ },
30
+ "./package.json": "./package.json"
31
+ },
32
+ "files": [
33
+ "dist",
34
+ "LICENSE",
35
+ "README.md"
36
+ ],
37
+ "optionalDependencies": {
38
+ "@napi-rs/keyring": "^2.0.0"
39
+ },
40
+ "devDependencies": {
41
+ "@eslint/js": "^10.0.1",
42
+ "@types/node": "^24.10.0",
43
+ "eslint": "^10.0.0",
44
+ "tsup": "^8.5.1",
45
+ "typescript": "^5.9.3",
46
+ "typescript-eslint": "^8.68.0",
47
+ "vitest": "^4.1.11"
48
+ },
49
+ "scripts": {
50
+ "build": "tsup",
51
+ "lint": "eslint .",
52
+ "lint:fix": "eslint . --fix",
53
+ "typecheck": "tsc --noEmit",
54
+ "test": "vitest run",
55
+ "test:watch": "vitest"
56
+ }
57
+ }