@manta-eu/auth 0.1.8 → 0.1.10

package/README.md

@@ -1,9 +1,12 @@
 # @manta-eu/auth
 
-Keycloak login for the SDK CLIs (`@manta-eu/codegen`, `@manta-eu/upload`): browser and device-code
-login, silent token renewal, and credential storage. It knows nothing about either CLI's own
-purpose — it only mints and renews tokens, and gives each CLI `login`/`logout`/`status` commands to
-register on its own `commander` program.
+Keycloak login for Manta: the SDK CLIs (`@manta-eu/codegen`, `@manta-eu/upload`) and a custom app's
+own server. It mints and renews tokens; it knows nothing about what a caller does with them. The root
+entry adds browser and device-code login with credential storage for the CLIs, and gives each CLI
+`login`/`logout`/`status` commands to register on its own `commander` program.
+
+`@manta-eu/auth/web` runs without Node — in a browser, a Worker, Deno or Bun — and holds the token
+cache, the web-app sign-in below, client credentials, and the issuer helpers.
 
 Documentation: [developers.manta.eu](https://developers.manta.eu)
 
@@ -59,6 +62,66 @@ import { mintWithClientCredentials } from "@manta-eu/auth";
 const accessToken = await mintWithClientCredentials({ baseUrl, realm, clientId, clientSecret, scope });
 ```
 
+## Sign in on your own server
+
+`webLoginRoutes` gives a custom app's server `/login`, `/callback` and `/logout`, and keeps the person's session in
+encrypted cookies, on standard `Request` and `Response`:
+
+```ts
+import { webLoginRoutes } from "@manta-eu/auth/web";
+
+const manta = webLoginRoutes({ client: { clientId, clientSecret }, appUrl, sessionSecret });
+
+const response = await manta.handle(request); // undefined for any other path
+const { accessToken, setCookies } = await manta.session(request); // renewed when about to expire
+```
+
+Or run the steps yourself:
+
+A custom app's server signs its people in with its client ID and secret, through the authorization
+code flow with PKCE, on a redirect URL registered for the app:
+
+```ts
+import { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl } from "@manta-eu/auth/web";
+
+const client = { baseUrl, realm, clientId, clientSecret };
+
+// 1. Send the person to `url`; keep `state` and `verifier` in their session.
+const { url, state, verifier } = await startWebLogin(client, { redirectUri, offlineAccess: true });
+
+// 2. On the redirect, check `state`, then trade the code for tokens.
+const tokens = await finishWebLogin(client, { code, redirectUri, verifier });
+
+// 3. Before the access token's five minutes run out, renew it.
+const renewed = await refreshWebLogin(client, tokens.refreshToken);
+
+// 4. Sign out of your app only, ending even an offline session...
+await endWebLogin(client, renewed.refreshToken);
+// ...or out of Manta too, returning to a redirect URL or the app's home URL.
+const logoutUrl = webLogoutUrl(client, { idToken: renewed.idToken, postLogoutRedirectUri: homeUrl });
+```
+
+Store the refresh token `refreshWebLogin` returns in place of the old one: Manta's realms rotate it,
+and an old one is accepted at most once more. `undefined` means the person signs in again.
+`offlineAccess: true` keeps the session alive while it is used, until 30 idle days or a year.
+
+## Machine access
+
+A custom app with machine access mints its own token, with no person involved:
+
+```ts
+import { cachedToken, mintWithClientCredentials } from "@manta-eu/auth/web";
+
+const getAccessToken = cachedToken(() => mintWithClientCredentials({ baseUrl, realm, clientId, clientSecret }));
+```
+
+Keep the secret on a server; never ship it to a browser.
+
+## Issuer and discovery
+
+`issuerUrl({ baseUrl, realm })` names the realm's issuer, and `discoveryUrl({ baseUrl, realm })` its
+OpenID Connect discovery document, which most OIDC libraries configure themselves from.
+
 ## Renewing on refusal
 
 `withRenewal(token, call)` calls `call` with a fresh access token, and on a 401 specifically calls

package/dist/auth-commands.js

@@ -139,3 +139,4 @@ export function registerAuthCommands(program, { label, store = defaultCredential
             process.exitCode = 1;
     }));
 }
+//# sourceMappingURL=auth-commands.js.map

package/dist/auth-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-commands.js","sourceRoot":"","sources":["../src/auth-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAwB,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,cAAc,EAEd,mBAAmB,EAEnB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAkB,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAA6B,MAAM,YAAY,CAAC;AAI5E,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,GAAG,KAAK,MAAM,CAAC;AACxB,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,UAAU,GAAG,eAAe,CAAC;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,gDAAgD,UAAU,4BAA4B,CAAC;AAInH,MAAM,UAAU,gBAAgB,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAiB;IACtF,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,QAAQ,IAAI,WAAW,CAAC,aAAa,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,KAAK,CAAC,MAAoB;IACjC,OAAO,GAAG,MAAM,CAAC,KAAK,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAoB,EACpB,EACE,KAAK,EACL,aAAa,GAAG,KAAK,EACrB,SAAS,GAAG,KAAK,GACiD;IAEpE,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IAEvC,IAAI,aAAa,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,UAAU,CAAC,CAAC;QAEtF,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,UAAU,KAAK,CAAC,eAAe,uBAAuB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9F,IAAI,YAAY;YAAE,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAEvD,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,YAAY,CAAC,MAAM,EAAE;QAC1B,SAAS;QACT,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,4DAA4D,GAAG,EAAE,CAAC,CAAC;YACzF,aAAa,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAoB,EAAE,MAAoB,EAAE,KAAc;IACnG,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzD,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,kBAAkB,KAAK,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,kEAAkE,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAoB;IAC7D,MAAM,KAAK,GAAG;QACZ,MAAM,CAAC,OAAO,KAAK,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,OAAO,EAAE;QAC3F,MAAM,CAAC,KAAK,KAAK,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,MAAM,CAAC,KAAK,EAAE;QAC3F,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,QAAQ,EAAE;KACvF,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,OAAO,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,KAAK,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAC7B,MAAoB,EACpB,EACE,KAAK,EACL,aAAa,EACb,KAAK,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EACvD,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1C,SAAS,GAAG,KAAK,GAOlB;IAED,OAAO,sBAAsB,CAAC;QAC5B,MAAM;QACN,KAAK;QACL,SAAS;QACT,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;QACnB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC,WAAW;gBAAE,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEnD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;YACnF,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YAEjE,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,OAAO,GAAG,OAAO,WAAW,KAAK,iCAAiC,CAAC;AACrE,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAoB,EACpB,YAAoB,EACpB,YAAuB,KAAK;IAE5B,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEnH,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,MAAoB,EACpB,EACE,KAAK,EACL,aAAa,EACb,KAAK,EACL,SAAS,GAAG,KAAK,GACyE;IAE5F,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IAEnF,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,MAAoB,EACpB,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,GAAG,KAAK,EAAoE;IAErG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAExC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,sBAAsB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACjF,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE3B,OAAO,CAAC,KAAK,CACX,OAAO;QACL,CAAC,CAAC,GAAG,KAAK,mBAAmB,KAAK,CAAC,MAAM,CAAC,EAAE;QAC5C,CAAC,CAAC,GAAG,KAAK,kCAAkC,KAAK,CAAC,MAAM,CAAC,gDAAgD,CAC5G,CAAC;AACJ,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAoB,EACpB,EAAE,KAAK,EAA8B;IAErC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAExC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IAEnF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACrH,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB,EAAE,IAAY,EAAE,WAAmB;IACxE,OAAO,OAAO;SACX,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CAAC,WAAW,CAAC;SACxB,MAAM,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,WAAW,CAAC;SAClF,MAAM,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,aAAa,CAAC;SACrF,MAAM,CAAC,kBAAkB,EAAE,2CAA2C,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,MAA2B;IACxE,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAClC,OAAgB,EAChB,EACE,KAAK,EACL,KAAK,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EACvD,SAAS,GAAG,KAAK,GACiD;IAEpE,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,kEAAkE,CAAC;SAChG,MAAM,CAAC,mBAAmB,EAAE,0EAA0E,CAAC;SACvG,MAAM,CAAC,CAAC,OAAqC,EAAE,EAAE,CAChD,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,CAC3B,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CACpG,CACF,CAAC;IAEJ,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,mDAAmD,CAAC,CAAC,MAAM,CAC1F,CAAC,OAAsB,EAAE,EAAE,CACzB,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAChG,CAAC;IAEF,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAsB,EAAE,EAAE,CACnG,gBAAgB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/browser-login.js

@@ -127,3 +127,4 @@ export async function browserLogin(client, { openUrl, fetchImpl = fetch, scope =
         callback.close();
     }
 }
+//# sourceMappingURL=browser-login.js.map

package/dist/browser-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-login.js","sourceRoot":"","sources":["../src/browser-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAuD,MAAM,mBAAmB,CAAC;AACxG,OAAO,EAAkB,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,iGAAiG;AACjG,MAAM,CAAC,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAElD,MAAM,YAAY,GAAG,WAAW,CAAC;AAEjC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAEjC,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,KAAa;IAClE,OAAO,GAAG,OAAO,WAAW,KAAK,+BAA+B,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAA4E;IAElH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAEzE,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,WAAW;QACzB,KAAK;QACL,KAAK;QACL,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,OAAe;IAC1C,OAAO,CACL,qEAAqE,KAAK,iBAAiB;QAC3F,4GAA4G;QAC5G,kCAAkC,KAAK,WAAW,OAAO,oBAAoB,CAC9E,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,WAA0B;IAChE,OAAO,KAAK,KAAK,eAAe;QAC9B,CAAC,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC;QACpD,CAAC,CAAC,IAAI,KAAK,CAAC,kCAAkC,WAAW,IAAI,KAAK,IAAI,CAAC,CAAC;AAC5E,CAAC;AAID,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,YAAoB,gBAAgB;IACzF,IAAI,MAAuF,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEtF,wGAAwG;IACxG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAE5D,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAClC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,OAAe,EAAE,EAAE,CAChE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QAEvG,sGAAsG;QACtG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,+EAA+E,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE9C,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,0CAA0C,CAAC,CAAC;YACxE,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,MAAM,CAAC,GAAG,EAAE,oBAAoB,EAAE,qDAAqD,CAAC,CAAC;QACzF,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,MAAM,IAAI,KAAK,CAAC,0EAA0E,EAAE;YAC1F,KAAK;SACN,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC,EACnF,SAAS,CACV,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAEjD,OAAO;QACL,WAAW,EAAE,oBAAoB,IAAI,GAAG,YAAY,EAAE;QACtD,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAA2D,EACxF,YAAuB,KAAK;IAE5B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,WAAW,CAAC;QAC1B,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,QAAQ;KACxB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,QAAQ,EACR,QAAQ,CACT,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,kCAAkC,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CACvG,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjH,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAoB,EACpB,GAAW,EACX,YAAuB,KAAK;IAE5B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;IACrF,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAErD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,mDAAmD,QAAQ,CAAC,MAAM,IAAI;YACpE,oBAAoB,MAAM,CAAC,KAAK,OAAO,MAAM,CAAC,OAAO,mBAAmB,MAAM,CAAC,QAAQ,GAAG,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,EACE,OAAO,EACP,SAAS,GAAG,KAAK,EACjB,KAAK,GAAG,UAAU,EAClB,SAAS,GAAG,gBAAgB,EAC5B,IAAI,GAAG,cAAc,EAAE,EACvB,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,GAQ9C;IAED,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAE3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,EAAE;YACnC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK;SACN,CAAC,CAAC;QAEH,MAAM,yBAAyB,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,CAAC;QAEb,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;QAEjC,OAAO,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/browser.js

@@ -25,3 +25,4 @@ export function openInBrowser(url, platform = process.platform) {
         return;
     }
 }
+//# sourceMappingURL=browser.js.map

package/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,UAAU,eAAe,CAC7B,MAA0C,OAAO,CAAC,GAAG,EACrD,WAAmB,OAAO,CAAC,QAAQ;IAEnC,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAE7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,WAAmB,OAAO,CAAC,QAAQ;IAC7E,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,UAAU,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC;IAEpF,OAAO,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,WAAmB,OAAO,CAAC,QAAQ;IAC5E,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;AACH,CAAC"}

package/dist/credential-store.js

@@ -165,3 +165,4 @@ export function defaultCredentialStore({ platform = process.platform, warn = con
         warn: (reason) => warn(`${reason} Stored it in ${path} instead.`),
     });
 }
+//# sourceMappingURL=credential-store.js.map

package/dist/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAW1C,0GAA0G;AAC1G,MAAM,UAAU,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAgB;IACnE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAA0C,OAAO,CAAC,GAAG;IAC7E,OAAO,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA0C,OAAO,CAAC,GAAG;IACvF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAE9D,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAgC,CAAC;IAE7E,OAAO,CACL,OAAO,YAAY,KAAK,QAAQ;QAChC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC;QACxD,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CACvD,CAAC;AACJ,CAAC;AAID,SAAS,aAAa,CAAC,KAAc;IACnC,OAAQ,KAA2C,EAAE,IAAI,KAAK,QAAQ,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,IAAI,IAAY,CAAC;IAEjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC,GAAG,IAAI,yDAAyD,CAAC,CAAC;IAC/F,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAI,MAAsC,EAAE,MAAM,CAAC;IAC/D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,UAAU,CAAC;IAEpE,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAkC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAClG;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAAqB;IACrE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE7D,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAEhE,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,OAAe,mBAAmB,EAAE;IACtE,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,OAAO,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK;YACvB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAE7C,MAAM,oBAAoB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAE9B,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO;YAEjC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;YAChD,MAAM,oBAAoB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAMD,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,MAAM,CAAC,MAAM,WAAW,GAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACtD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7E,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACnE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,SAAS,eAAe,CAAC,MAAoB;IAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnC,uFAAuF;IACvF,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,mBAAmB,CAAC,CAAC;IAErG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1F,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,MAAmB,WAAW;IACpE,KAAK,UAAU,IAAI,CAAC,MAAoB;QACtC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,uBAAuB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAE/G,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK;YACvB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,8BAA8B,eAAe,QAAQ,eAAe,CAAC,MAAM,CAAC,QAAQ,MAAM,IAAI,CAAC;YAE/G,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAE3B,oGAAoG;YACpG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,GAAG,CAAC,CAAC,yBAAyB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,wBAAwB,CACtC,QAAyB,EACzB,IAAqB,EACrB,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,GAAG,EAAE,CAAC,SAAS,KAAgE,EAAE;IAE5G,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aAC7C,CAAC,CAAC;YAEH,uGAAuG;YACvG,OAAO,CAAC,YAAY,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC;QAC7G,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK;YACvB,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;YAE/C,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBAEtE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAClC,IAAI,WAAW;oBAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EACrC,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAC3B,IAAI,GAAG,OAAO,CAAC,KAAK,MACuC,EAAE;IAC7D,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAEvC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEvC,OAAO,wBAAwB,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE;QAC/D,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,MAAM,iBAAiB,IAAI,WAAW,CAAC;KAClE,CAAC,CAAC;AACL,CAAC"}

package/dist/default-deployment.d.ts

@@ -3,4 +3,12 @@ export declare const defaultDeployment: {
     readonly keycloakUrl: "https://auth.hiremanta.com";
     readonly keycloakRealm: "hiremanta-com";
 };
+export type Realm = {
+    baseUrl?: string;
+    realm?: string;
+};
+export declare function realmOrDefault(target?: Realm): {
+    baseUrl: string;
+    realm: string;
+};
 //# sourceMappingURL=default-deployment.d.ts.map

package/dist/default-deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-deployment.d.ts","sourceRoot":"","sources":["../src/default-deployment.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC"}
+{"version":3,"file":"default-deployment.d.ts","sourceRoot":"","sources":["../src/default-deployment.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AAEX,MAAM,MAAM,KAAK,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,wBAAgB,cAAc,CAAC,MAAM,GAAE,KAAU,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAKrF"}

package/dist/default-deployment.js

@@ -4,3 +4,10 @@ export const defaultDeployment = {
     keycloakUrl: "https://auth.hiremanta.com",
     keycloakRealm: "hiremanta-com",
 };
+export function realmOrDefault(target = {}) {
+    return {
+        baseUrl: (target.baseUrl ?? defaultDeployment.keycloakUrl).replace(/\/+$/, ""),
+        realm: target.realm ?? defaultDeployment.keycloakRealm,
+    };
+}
+//# sourceMappingURL=default-deployment.js.map

package/dist/default-deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-deployment.js","sourceRoot":"","sources":["../src/default-deployment.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM,EAAE,2BAA2B;IACnC,WAAW,EAAE,4BAA4B;IACzC,aAAa,EAAE,eAAe;CACtB,CAAC;AAIX,MAAM,UAAU,cAAc,CAAC,SAAgB,EAAE;IAC/C,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9E,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAAC,aAAa;KACvD,CAAC;AACJ,CAAC"}

package/dist/device-login.js

@@ -103,3 +103,4 @@ export async function refreshAccessToken(client, refreshToken, fetchImpl = fetch
         return undefined;
     return { accessToken: body.access_token, refreshToken: body.refresh_token ?? refreshToken };
 }
+//# sourceMappingURL=device-login.js.map

package/dist/device-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login.js","sourceRoot":"","sources":["../src/device-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAkB,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAqB3C,MAAM,eAAe,GAAG,8CAA8C,CAAC;AAEvE,wEAAwE;AACxE,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC,MAAM,QAAQ,GAAU,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAE5E,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,OAAO,GAAG,OAAO,WAAW,KAAK,sCAAsC,CAAC;AAC1E,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc;IAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEvD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAC5F,CAAC;AAWD,SAAS,eAAe,CAAC,IAAyB,EAAE,QAAgB,EAAE,YAAoB;IACxF,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,gBAAgB,CAAC;IAEhF,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,UAAU;QACV,QAAQ;QACR,eAAe;QACf,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,iBAAiB;QACpE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB;QAC1E,YAAY;KACb,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAoB,EACpB,YAAuB,KAAK,EAC5B,OAAiB,cAAc,EAAE,EACjC,KAAc;IAEd,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,WAAW,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;QAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAE5D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,yCAAyC,QAAQ,CAAC,MAAM,IAAI;YACrE,yBAAyB,MAAM,CAAC,QAAQ,8CAA8C,CACzF,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC,MAAM,QAAQ,CAAsB,QAAQ,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAyB,EAAE,MAAc;IACnE,IAAI,KAAK,KAAK,uBAAuB,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACjF,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACzF,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAElG,OAAO,IAAI,KAAK,CAAC,iCAAiC,KAAK,IAAI,MAAM,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB,EAAE,UAAkB,EAAE,YAAoB;IACxF,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,eAAe;QAC3B,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;AACL,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAoB,EACpB,EACE,UAAU,EACV,YAAY,EACZ,UAAU,GAAG,iBAAiB,EAC9B,WAAW,GAAG,kBAAkB,GACiE,EACnG,EACE,SAAS,GAAG,KAAK,EACjB,KAAK,GAAG,QAAQ,EAChB,KAAK,GAAG,IAAI,CAAC,GAAG,MACkD,EAAE;IAEtE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAG,WAAW,CAAC;IACvC,IAAI,IAAI,GAAG,UAAU,CAAC;IAEtB,SAAS,CAAC;QACR,4EAA4E;QAC5E,IAAI,KAAK,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAE7F,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEnH,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjH,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAE3B,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW;YAAE,IAAI,IAAI,cAAc,CAAC;QAEvD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAoB,EACpB,YAAoB,EACpB,YAAuB,KAAK;IAE5B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAE5D,uGAAuG;IACvG,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,sCAAsC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAEnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoD,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEnG,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAEzC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY,EAAE,CAAC;AAC9F,CAAC"}

package/dist/http.js

@@ -38,3 +38,4 @@ export function describeError(error) {
         return String(error);
     return error.cause instanceof Error ? `${error.message}\n  caused by: ${error.cause.message}` : error.message;
 }
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,WAAW,CAAC,MAA8B;IACxD,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAGjC;IAFX,YACE,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAQ;IAGzB,CAAC;CACF;AAED,mGAAmG;AACnG,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAI,QAAkB,EAAE,QAAgB;IACpE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,oBAAoB,QAAQ,CAAC,MAAM,yBAAyB,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,QAAgB,EAAE,IAAiB,EAAE,YAAuB,KAAK;IAC5F,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpD,OAAO,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,kBAAkB,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AAChH,CAAC"}

package/dist/index.d.ts

@@ -6,4 +6,7 @@ export { pollForDeviceTokens, refreshAccessToken, startDeviceLogin, type DeviceL
 export { describeError, isTransientStatus, postTo, readJson, RefusedRequestError, type FetchLike } from "./http.js";
 export { saveLogin, storedLoginTokenSource } from "./stored-login.js";
 export { cachedToken, mintWithClientCredentials, withRenewal, type ClientCredentials, type RenewableTokenSource, type TokenSource, } from "./token.js";
+export { discoveryUrl, issuerUrl, type OidcClient, type Realm } from "./oidc.js";
+export { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl, type StartWebLoginOptions, type WebLoginStart, type WebLogoutOptions, type WebTokens, } from "./web-login.js";
+export { webLoginRoutes, type WebLoginRoutes, type WebLoginRoutesOptions, type WebSession } from "./web-routes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,KAAK,EACL,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,KAAK,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,KAAK,EACL,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,KAAK,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,UAAU,EAAE,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -6,3 +6,7 @@ export { pollForDeviceTokens, refreshAccessToken, startDeviceLogin, } from "./de
 export { describeError, isTransientStatus, postTo, readJson, RefusedRequestError } from "./http.js";
 export { saveLogin, storedLoginTokenSource } from "./stored-login.js";
 export { cachedToken, mintWithClientCredentials, withRenewal, } from "./token.js";
+export { discoveryUrl, issuerUrl } from "./oidc.js";
+export { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl, } from "./web-login.js";
+export { webLoginRoutes } from "./web-routes.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,KAAK,EACL,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,GAKzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,GAMjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAkB,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,SAAS,EAA+B,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,GAKb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAoE,MAAM,iBAAiB,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,15 @@
+import * as oidc from "openid-client";
+import { type Realm } from "./default-deployment.js";
+import type { PublicClient } from "./device-login.js";
+import type { FetchLike } from "./http.js";
+export type { Realm };
+/** A client with a secret is an app's own server; without one it is a public client, like the CLIs. */
+export type OidcClient = Omit<PublicClient, "baseUrl" | "realm"> & Realm & {
+    clientSecret?: string;
+};
+/** The realm's issuer, the `iss` of every token it signs. */
+export declare function issuerUrl(target?: Realm): string;
+/** The OpenID Connect discovery document most libraries configure themselves from. */
+export declare function discoveryUrl(target?: Realm): string;
+export declare function oidcConfiguration(client: OidcClient, fetchImpl?: FetchLike): oidc.Configuration;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,KAAK,KAAK,EAAkB,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,YAAY,EAAE,KAAK,EAAE,CAAC;AAEtB,uGAAuG;AACvG,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,KAAK,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAErG,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAGhD;AAED,sFAAsF;AACtF,wBAAgB,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAEnD;AAGD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,aAAa,CAiB/F"}

package/dist/oidc.js

@@ -0,0 +1,27 @@
+import * as oidc from "openid-client";
+import { realmOrDefault } from "./default-deployment.js";
+/** The realm's issuer, the `iss` of every token it signs. */
+export function issuerUrl(target) {
+    const { baseUrl, realm } = realmOrDefault(target);
+    return `${baseUrl}/realms/${realm}`;
+}
+/** The OpenID Connect discovery document most libraries configure themselves from. */
+export function discoveryUrl(target) {
+    return `${issuerUrl(target)}/.well-known/openid-configuration`;
+}
+// Keycloak's endpoints are fixed under the issuer, so no discovery request precedes each call.
+export function oidcConfiguration(client, fetchImpl) {
+    const issuer = issuerUrl(client);
+    const endpoint = (name) => `${issuer}/protocol/openid-connect/${name}`;
+    const config = new oidc.Configuration({
+        issuer,
+        authorization_endpoint: endpoint("auth"),
+        token_endpoint: endpoint("token"),
+        end_session_endpoint: endpoint("logout"),
+        revocation_endpoint: endpoint("revoke"),
+    }, client.clientId, undefined, client.clientSecret ? oidc.ClientSecretPost(client.clientSecret) : oidc.None());
+    if (fetchImpl)
+        config[oidc.customFetch] = (url, options) => fetchImpl(url, options);
+    return config;
+}
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAc,cAAc,EAAE,MAAM,yBAAyB,CAAC;AASrE,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,GAAG,OAAO,WAAW,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,mCAAmC,CAAC;AACjE,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,MAAkB,EAAE,SAAqB;IACzE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,MAAM,4BAA4B,IAAI,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,CACnC;QACE,MAAM;QACN,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC;QACxC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC;QACjC,oBAAoB,EAAE,QAAQ,CAAC,QAAQ,CAAC;QACxC,mBAAmB,EAAE,QAAQ,CAAC,QAAQ,CAAC;KACxC,EACD,MAAM,CAAC,QAAQ,EACf,SAAS,EACT,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAC/E,CAAC;IACF,IAAI,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAsB,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/stored-login.js

@@ -33,3 +33,4 @@ export function storedLoginTokenSource({ client, store, login, warn = console.er
     }
     return cachedToken(renewOrLogIn, clock);
 }
+//# sourceMappingURL=stored-login.js.map

package/dist/stored-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stored-login.js","sourceRoot":"","sources":["../src/stored-login.ts"],"names":[],"mappings":"AACA,OAAO,EAAwC,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAkB,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAA6B,MAAM,YAAY,CAAC;AAEzF,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAsB,EAAE,MAAoB,EAAE,MAAoB;IAChG,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzD,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAEpG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,sBAAsB,CAAC,EACrC,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,GAAG,OAAO,CAAC,KAAK,EACpB,SAAS,GAAG,KAAK,EACjB,KAAK,GAAG,IAAI,CAAC,GAAG,GAQjB;IACC,2GAA2G;IAC3G,KAAK,UAAU,IAAI,CAAC,MAAoB;QACtC,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAC9D,IAAI,CAAC,mEAAmE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAChG,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,YAAY;QACzB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAExC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAEjF,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;gBACpB,OAAO,OAAO,CAAC,WAAW,CAAC;YAC7B,CAAC;YAED,MAAM,KAAK;iBACR,MAAM,CAAC,MAAM,CAAC;iBACd,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,uCAAuC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QAEnB,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,OAAO,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC"}

package/dist/token.d.ts

@@ -1,14 +1,13 @@
+import { type Realm } from "./default-deployment.js";
 import { type FetchLike } from "./http.js";
-export type ClientCredentials = {
-    baseUrl: string;
-    realm: string;
+export type ClientCredentials = Realm & {
     clientId: string;
     clientSecret: string;
     scope?: string;
 };
 export type TokenSource = () => Promise<string>;
 export type RenewableTokenSource = TokenSource & {
-    renew: () => void;
+    renew: (rejected?: string) => void;
 };
 export declare function withRenewal<T>(token: TokenSource, call: (accessToken: string) => Promise<T>): Promise<T>;
 export declare const tokenExpiryBufferMs = 60000;

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAA4C,MAAM,WAAW,CAAC;AAErF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAGhD,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG;IAAE,KAAK,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC;AAOvE,wBAAsB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAU9G;AAGD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAG1C,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAiBD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI7E;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3E;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/D;AAqBD,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,iBAAiB,EAC9B,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,GAAE,MAAM,MAAiB,GAAG,oBAAoB,CAoBnG"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAkB,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,KAAK,SAAS,EAA4C,MAAM,WAAW,CAAC;AAErF,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAGhD,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG;IAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,CAAC;AAOxF,wBAAsB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAY9G;AAGD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAG1C,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AA0BD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI7E;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3E;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/D;AAqBD,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,iBAAiB,EAC9B,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,GAAE,MAAM,MAAiB,GAAG,oBAAoB,CA6BnG"}

package/dist/token.js

@@ -1,16 +1,19 @@
+import { realmOrDefault } from "./default-deployment.js";
 import { formRequest, postTo, RefusedRequestError } from "./http.js";
 function isRenewable(token) {
     return typeof token.renew === "function";
 }
 // A token revoked or expired early answers 401 once; renewing and retrying once is what Claude Code does for MCP.
 export async function withRenewal(token, call) {
+    let accessToken;
     try {
-        return await call(await token());
+        accessToken = await token();
+        return await call(accessToken);
     }
     catch (error) {
         if (!(error instanceof RefusedRequestError && error.status === 401) || !isRenewable(token))
             throw error;
-        token.renew();
+        token.renew(accessToken);
         return call(await token());
     }
 }
@@ -21,13 +24,21 @@ export const unparsableTokenTtlMs = 30_000;
 export function tokenEndpoint(baseUrl, realm) {
     return `${baseUrl}/realms/${realm}/protocol/openid-connect/token`;
 }
+// atob and TextDecoder, not Buffer, so the token helpers also run in a browser.
+function decodeBase64Url(value) {
+    const base64 = value
+        .replace(/-/g, "+")
+        .replace(/_/g, "/")
+        .padEnd(Math.ceil(value.length / 4) * 4, "=");
+    return new TextDecoder().decode(Uint8Array.from(atob(base64), (char) => char.charCodeAt(0)));
+}
 // Reads the claims without checking the signature: callers only use them to schedule and to label.
 function unverifiedClaims(accessToken) {
     const payload = accessToken.split(".")[1];
     if (!payload)
         return {};
     try {
-        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        const claims = JSON.parse(decodeBase64Url(payload));
         return typeof claims === "object" && claims !== null ? claims : {};
     }
     catch {
@@ -62,7 +73,7 @@ function readAccessToken(body, realm) {
     return accessToken;
 }
 export async function mintWithClientCredentials(credentials, fetchImpl = fetch) {
-    const { baseUrl, realm } = credentials;
+    const { baseUrl, realm } = realmOrDefault(credentials);
     const endpoint = tokenEndpoint(baseUrl, realm);
     const response = await postTo(endpoint, clientCredentialsRequest(credentials), fetchImpl);
     if (!response.ok) {
@@ -73,18 +84,29 @@ export async function mintWithClientCredentials(credentials, fetchImpl = fetch)
 }
 export function cachedToken(mint, clock = Date.now) {
     let held;
-    const source = async () => {
-        const now = clock();
-        if (held && isFresh(held.expiresAt, now))
-            return held.token;
+    // Shared, so callers racing an expired token start one mint: parallel refreshes would spend one refresh token.
+    let minting;
+    const mintOnce = async () => {
         const token = await mint();
         // A device login blocks until the browser answers, so `now` is already stale here.
         held = { token, expiresAt: accessTokenExpiresAt(token, clock()) };
         return token;
     };
+    const source = async () => {
+        if (held && isFresh(held.expiresAt, clock()))
+            return held.token;
+        const current = (minting ??= mintOnce().finally(() => {
+            if (minting === current)
+                minting = undefined;
+        }));
+        return current;
+    };
     return Object.assign(source, {
-        renew: () => {
-            held = undefined;
+        // Keeps an in-flight mint, so racing 401s join it, and a newer token than the one refused.
+        renew: (rejected) => {
+            if (rejected === undefined || held?.token === rejected)
+                held = undefined;
         },
     });
 }
+//# sourceMappingURL=token.js.map

package/dist/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAkB,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAarF,SAAS,WAAW,CAAC,KAAkB;IACrC,OAAO,OAAQ,KAAuC,CAAC,KAAK,KAAK,UAAU,CAAC;AAC9E,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAI,KAAkB,EAAE,IAAyC;IAChG,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,KAAK,EAAE,CAAC;QAC5B,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAExG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAEzB,OAAO,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,KAAa;IAC1D,OAAO,GAAG,OAAO,WAAW,KAAK,gCAAgC,CAAC;AACpE,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,mGAAmG;AACnG,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAE7D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAmB,EAAE,GAAW;IACnE,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC;IAE9C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,GAAG,oBAAoB,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,KAAK,CAAC;IAEvD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,GAAW;IACpD,OAAO,SAAS,GAAG,GAAG,CAAC;AACzB,CAAC;AAED,SAAS,wBAAwB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAqB;IACpF,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;QAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,IAAa,EAAE,KAAa;IACnD,MAAM,WAAW,GAAI,IAAmC,CAAC,YAAY,CAAC;IAEtE,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,2BAA2B,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAA8B,EAC9B,YAAuB,KAAK;IAE5B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;IAE1F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,qDAAqD,KAAK,gBAAgB,QAAQ,CAAC,MAAM,IAAI;YAC3F,8CAA8C,QAAQ,GAAG,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAE,QAAsB,IAAI,CAAC,GAAG;IAC3E,IAAI,IAAsD,CAAC;IAC3D,+GAA+G;IAC/G,IAAI,OAAoC,CAAC;IAEzC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3B,mFAAmF;QACnF,IAAI,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAElE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAEhE,MAAM,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACnD,IAAI,OAAO,KAAK,OAAO;gBAAE,OAAO,GAAG,SAAS,CAAC;QAC/C,CAAC,CAAC,CAAC,CAAC;QAEJ,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3B,2FAA2F;QAC3F,KAAK,EAAE,CAAC,QAAiB,EAAE,EAAE;YAC3B,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,EAAE,KAAK,KAAK,QAAQ;gBAAE,IAAI,GAAG,SAAS,CAAC;QAC3E,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/web-login.d.ts

@@ -0,0 +1,40 @@
+import { type FetchLike } from "./http.js";
+import { type OidcClient } from "./oidc.js";
+export type WebLoginStart = {
+    url: string;
+    state: string;
+    verifier: string;
+};
+export type WebTokens = {
+    accessToken: string;
+    refreshToken?: string;
+    idToken?: string;
+};
+export type StartWebLoginOptions = {
+    redirectUri: string;
+    offlineAccess?: boolean;
+    scope?: string;
+    idpHint?: string;
+};
+export type WebLogoutOptions = {
+    idToken?: string;
+    postLogoutRedirectUri?: string;
+    state?: string;
+};
+/** Starts a sign-in; keep `state` and `verifier` in the person's session for the callback. */
+export declare function startWebLogin(client: OidcClient, options: StartWebLoginOptions): Promise<WebLoginStart>;
+/** Trades the callback for tokens; pass `callbackUrl` and `state` to have them checked too. */
+export declare function finishWebLogin(client: OidcClient, login: {
+    code: string;
+    redirectUri: string;
+    verifier: string;
+    callbackUrl?: string;
+    state?: string;
+}, fetchImpl?: FetchLike): Promise<WebTokens>;
+/** Renews the access token; store the rotated refresh token it returns. `undefined` means sign in again. */
+export declare function refreshWebLogin(client: OidcClient, refreshToken: string, fetchImpl?: FetchLike): Promise<WebTokens | undefined>;
+/** Where to send the browser to sign out of Manta too; pass the latest `idToken` to skip Keycloak's prompt. */
+export declare function webLogoutUrl(client: OidcClient, options?: WebLogoutOptions): string;
+/** Revokes the refresh token, ending this app's session only; `false` when Keycloak did not confirm. */
+export declare function endWebLogin(client: OidcClient, refreshToken: string, fetchImpl?: FetchLike): Promise<boolean>;
+//# sourceMappingURL=web-login.d.ts.map

package/dist/web-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-login.d.ts","sourceRoot":"","sources":["../src/web-login.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,KAAK,UAAU,EAAqB,MAAM,WAAW,CAAC;AAE/D,MAAM,MAAM,aAAa,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,MAAM,MAAM,SAAS,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzF,MAAM,MAAM,oBAAoB,GAAG;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAgBpG,8FAA8F;AAC9F,wBAAsB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAc7G;AAED,+FAA+F;AAC/F,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EACpG,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,SAAS,CAAC,CAWpB;AAED,4GAA4G;AAC5G,wBAAsB,eAAe,CACnC,MAAM,EAAE,UAAU,EAClB,YAAY,EAAE,MAAM,EACpB,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAUhC;AAED,+GAA+G;AAC/G,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,CASvF;AAED,wGAAwG;AACxG,wBAAsB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CASnH"}

package/dist/web-login.js

@@ -0,0 +1,82 @@
+import * as oidc from "openid-client";
+import { isTransientStatus } from "./http.js";
+import { oidcConfiguration } from "./oidc.js";
+function tokensOf(response) {
+    return {
+        accessToken: response.access_token,
+        ...(response.refresh_token ? { refreshToken: response.refresh_token } : {}),
+        ...(response.id_token ? { idToken: response.id_token } : {}),
+    };
+}
+function statusOf(error) {
+    if (error instanceof oidc.ResponseBodyError)
+        return error.status;
+    const cause = error instanceof Error ? error.cause : undefined;
+    return cause instanceof Response ? cause.status : undefined;
+}
+/** Starts a sign-in; keep `state` and `verifier` in the person's session for the callback. */
+export async function startWebLogin(client, options) {
+    const { redirectUri, offlineAccess = false, idpHint } = options;
+    const verifier = oidc.randomPKCECodeVerifier();
+    const state = oidc.randomState();
+    const url = oidc.buildAuthorizationUrl(oidcConfiguration(client), {
+        redirect_uri: redirectUri,
+        scope: options.scope ?? (offlineAccess ? "openid offline_access" : "openid"),
+        state,
+        code_challenge: await oidc.calculatePKCECodeChallenge(verifier),
+        code_challenge_method: "S256",
+        ...(idpHint ? { kc_idp_hint: idpHint } : {}),
+    });
+    return { url: url.toString(), state, verifier };
+}
+/** Trades the callback for tokens; pass `callbackUrl` and `state` to have them checked too. */
+export async function finishWebLogin(client, login, fetchImpl) {
+    const { code, redirectUri, verifier, callbackUrl, state } = login;
+    // The library sends the callback URL without its query as redirect_uri, so the registered one carries the answer.
+    const currentUrl = new URL(redirectUri);
+    currentUrl.search =
+        callbackUrl === undefined ? new URLSearchParams({ code }).toString() : new URL(callbackUrl).search;
+    const response = await oidc.authorizationCodeGrant(oidcConfiguration(client, fetchImpl), currentUrl, {
+        pkceCodeVerifier: verifier,
+        expectedState: state ?? oidc.skipStateCheck,
+    });
+    return tokensOf(response);
+}
+/** Renews the access token; store the rotated refresh token it returns. `undefined` means sign in again. */
+export async function refreshWebLogin(client, refreshToken, fetchImpl) {
+    try {
+        const renewed = tokensOf(await oidc.refreshTokenGrant(oidcConfiguration(client, fetchImpl), refreshToken));
+        return { ...renewed, refreshToken: renewed.refreshToken ?? refreshToken };
+    }
+    catch (error) {
+        const status = statusOf(error);
+        // A refused refresh token is terminal and earns a new login; an overloaded Keycloak must not cost one.
+        if (status === undefined || isTransientStatus(status))
+            throw error;
+        return undefined;
+    }
+}
+/** Where to send the browser to sign out of Manta too; pass the latest `idToken` to skip Keycloak's prompt. */
+export function webLogoutUrl(client, options = {}) {
+    const { idToken, postLogoutRedirectUri, state } = options;
+    return oidc
+        .buildEndSessionUrl(oidcConfiguration(client), {
+        ...(idToken ? { id_token_hint: idToken } : {}),
+        ...(postLogoutRedirectUri ? { post_logout_redirect_uri: postLogoutRedirectUri } : {}),
+        ...(state ? { state } : {}),
+    })
+        .toString();
+}
+/** Revokes the refresh token, ending this app's session only; `false` when Keycloak did not confirm. */
+export async function endWebLogin(client, refreshToken, fetchImpl) {
+    try {
+        await oidc.tokenRevocation(oidcConfiguration(client, fetchImpl), refreshToken, {
+            token_type_hint: "refresh_token",
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=web-login.js.map

package/dist/web-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-login.js","sourceRoot":"","sources":["../src/web-login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAkB,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAmB,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAe/D,SAAS,QAAQ,CAAC,QAAoC;IACpD,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,YAAY;QAClC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,IAAI,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,OAAO,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAkB,EAAE,OAA6B;IACnF,MAAM,EAAE,WAAW,EAAE,aAAa,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;QAChE,YAAY,EAAE,WAAW;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5E,KAAK;QACL,cAAc,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC;QAC/D,qBAAqB,EAAE,MAAM;QAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAkB,EAClB,KAAoG,EACpG,SAAqB;IAErB,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAClE,kHAAkH;IAClH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACxC,UAAU,CAAC,MAAM;QACf,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IACrG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,UAAU,EAAE;QACnG,gBAAgB,EAAE,QAAQ;QAC1B,aAAa,EAAE,KAAK,IAAI,IAAI,CAAC,cAAc;KAC5C,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,YAAoB,EACpB,SAAqB;IAErB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3G,OAAO,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,YAAY,EAAE,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,uGAAuG;QACvG,IAAI,MAAM,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,CAAC;YAAE,MAAM,KAAK,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,YAAY,CAAC,MAAkB,EAAE,UAA4B,EAAE;IAC7E,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1D,OAAO,IAAI;SACR,kBAAkB,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;QAC7C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC;SACD,QAAQ,EAAE,CAAC;AAChB,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAkB,EAAE,YAAoB,EAAE,SAAqB;IAC/F,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE;YAC7E,eAAe,EAAE,eAAe;SACjC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}