@nority/bridge-sdk 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nority
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,164 @@
+# @nority/bridge-sdk
+
+TypeScript SDK for building Nority bridge implementations. Works with Node.js and Bun.
+
+A **bridge** connects an external agent runtime (e.g., OpenClaw, LangChain, custom LLM pipelines) to the Nority platform so that conversations flow between the agent and Nority users — with end-to-end encryption, automatic reconnection, and replay.
+
+## Who is this for?
+
+Third-party developers who want to build a bridge for their own agent runtime. You implement a single `AgentAdapter` interface; the SDK handles everything else:
+
+- QR/deeplink pairing flow
+- Bridge-scoped credential storage and Ed25519 challenge-response auth
+- Authenticated WebSocket transport with jittered backoff reconnect
+- Per-conversation X25519 key exchange and AES-256-GCM encryption
+- Replay and deterministic history rebuild after reconnect
+- Ping/pong heartbeat and close-code-aware lifecycle
+
+## Installation
+
+```bash
+npm install @nority/bridge-sdk
+```
+
+<details>
+<summary>Other package managers</summary>
+
+```bash
+pnpm add @nority/bridge-sdk
+yarn add @nority/bridge-sdk
+bun add @nority/bridge-sdk
+```
+
+</details>
+
+## Quick start
+
+### 1. Implement `AgentAdapter`
+
+The adapter is the only code you write. It receives decrypted user messages and yields streamed agent events:
+
+```ts
+import type { AgentAdapter, AgentEvent, InvokeRequest } from "@nority/bridge-sdk";
+
+class MyAdapter implements AgentAdapter {
+  async *invokeAgent(
+    signal: AbortSignal,
+    req: InvokeRequest,
+  ): AsyncIterable<AgentEvent> {
+    // Call your agent runtime with req.inputs and req.history
+    const response = await myAgent.run(req.inputs, { signal });
+
+    for await (const chunk of response) {
+      yield { type: "text_delta", content: chunk.text };
+    }
+
+    yield { type: "run_status", runStatus: "completed" };
+    yield { type: "done" };
+  }
+}
+```
+
+### 2. Start the bridge
+
+```ts
+import { NorityBridge } from "@nority/bridge-sdk";
+
+const bridge = new NorityBridge({
+  backendUrl: "wss://api.nority.ai/v1/bridge",
+  dataDir: "./bridge-data",
+  agent: new MyAdapter(),
+  onPairingToken: (info) => {
+    console.log(`Pair: ${info.deeplinkUrl} (expires ${info.expiresAt})`);
+  },
+});
+
+await bridge.start();
+```
+
+On first run, the SDK generates an Ed25519 identity, enters the pairing flow, and calls `onPairingToken` with a QR/deeplink URL. After the user approves in the Nority app, the bridge receives a durable credential and connects automatically.
+
+On subsequent runs, the SDK loads the stored credential, mints a fresh JWT via challenge-response, reconnects, replays missed events, and resumes normal operation.
+
+## Key concepts
+
+| Concept | Description |
+|---------|-------------|
+| **Bridge credential** | Long-lived secret stored locally. Never the user's JWT. |
+| **Bridge access JWT** | Short-lived token for WebSocket auth. Cached ephemerally. |
+| **Pairing token** | 120-second single-use token displayed as QR/deeplink. Auto-regenerates. |
+| **Conversation key** | Per-conversation AES-256-GCM symmetric key derived via X25519 ECDH + HKDF-SHA3-256. |
+| **Replay** | After reconnect, the SDK requests missed events and rebuilds conversation history deterministically. |
+
+## Agent event types
+
+Your adapter yields `AgentEvent` values. The SDK encrypts and forwards them to the backend:
+
+| Type | Purpose |
+|------|---------|
+| `text_delta` | Streamed text content |
+| `tool_call_start` | Tool invocation started |
+| `tool_call_update` | Partial tool result |
+| `tool_result` | Final tool result |
+| `thinking_start` | Reasoning block started |
+| `thinking_delta` | Streamed reasoning content |
+| `thinking_complete` | Reasoning block finished |
+| `run_status` | Agent lifecycle (`started`, `completed`, `failed`) |
+| `media` | Media reference (multimodal-safe) |
+| `error` | Agent-reported error |
+| `done` | Terminal event — must be the last event yielded |
+
+## Content model
+
+The SDK uses a multimodal-safe content model:
+
+```ts
+type ContentPart =
+  | { kind: "text"; text: string }
+  | { kind: "media"; media: MediaReference };
+
+interface ChatTurn {
+  role: "user" | "assistant";
+  parts: ContentPart[];
+}
+
+interface InvokeRequest {
+  conversationId: string;
+  inputs: ContentPart[];    // Current user turn
+  history: ChatTurn[];      // Previous conversation turns
+}
+```
+
+## Bridge lifecycle states
+
+```
+idle → pairing → connecting → connected
+                     ↕
+              reconnecting → blocked → failed
+                                  ↓
+                               stopped
+```
+
+## Configuration
+
+```ts
+interface BridgeConfig {
+  backendUrl: string;            // Nority backend WebSocket URL
+  dataDir: string;               // Directory for durable state (identity, keys)
+  agent: AgentAdapter;           // Your adapter implementation
+  onPairingToken?: (info) => void;  // Called when pairing token is ready
+  logger?: BridgeLogger;         // Structured logging
+  webSocketFactory?: WebSocketFactory;  // Custom WebSocket creation
+  heartbeatIntervalMs?: number;  // Default: 15000
+  idleTimeoutMs?: number;        // Default: 45000
+}
+```
+
+## Requirements
+
+- **Node.js** >= 20 or **Bun** >= 1.0
+- The adapter-to-agent transport is entirely provider-specific — the SDK makes no assumptions about how your adapter talks to its agent runtime
+
+## License
+
+MIT

package/dist/agent.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Public SDK types for the Nority bridge protocol.
+ * Provider-agnostic — no assumptions about the agent runtime transport.
+ */
+import type { WebSocketFactory } from "./transport/websocket.js";
+export interface MediaReference {
+    mediaId: string;
+    mediaType: string;
+    size: number;
+    thumbnailB64?: string;
+}
+export type ContentPart = {
+    kind: "text";
+    text: string;
+} | {
+    kind: "media";
+    media: MediaReference;
+};
+export interface ChatTurn {
+    role: "user" | "assistant";
+    parts: ContentPart[];
+}
+export interface InvokeRequest {
+    conversationId: string;
+    inputs: ContentPart[];
+    history: ChatTurn[];
+}
+export type AgentEvent = {
+    type: "text_delta";
+    content: string;
+} | {
+    type: "tool_call_start";
+    toolCallId: string;
+    toolName: string;
+    arguments: string;
+    status?: string;
+} | {
+    type: "tool_call_update";
+    toolCallId: string;
+    partialResult?: string;
+    status?: string;
+} | {
+    type: "tool_result";
+    toolCallId: string;
+    result: string;
+    status?: string;
+} | {
+    type: "thinking_start";
+    thinkingBlockId: string;
+} | {
+    type: "thinking_delta";
+    thinkingBlockId: string;
+    content: string;
+} | {
+    type: "thinking_complete";
+    thinkingBlockId: string;
+    content?: string;
+} | {
+    type: "run_status";
+    runStatus: string;
+    reason?: string;
+} | {
+    type: "media";
+    media: MediaReference;
+} | {
+    type: "error";
+    errorCode?: string;
+    errorMessage: string;
+    reason?: string;
+} | {
+    type: "done";
+};
+export interface AgentAdapter {
+    invokeAgent(signal: AbortSignal, req: InvokeRequest): AsyncIterable<AgentEvent>;
+}
+export interface PairingInfo {
+    token: string;
+    deeplinkUrl: string;
+    expiresAt: string;
+}
+export interface BridgeLogger {
+    debug: (msg: string, ...args: unknown[]) => void;
+    info: (msg: string, ...args: unknown[]) => void;
+    warn: (msg: string, ...args: unknown[]) => void;
+    error: (msg: string, ...args: unknown[]) => void;
+}
+export interface BridgeConfig {
+    backendUrl: string;
+    dataDir: string;
+    agent: AgentAdapter;
+    onPairingToken?: (pairing: PairingInfo) => void;
+    logger?: BridgeLogger;
+    fetchImplementation?: typeof fetch;
+    webSocketFactory?: WebSocketFactory;
+    clock?: () => Date;
+    pairingTokenFactory?: () => string;
+    backoffRandom?: () => number;
+    heartbeatIntervalMs?: number;
+    idleTimeoutMs?: number;
+}
+//# sourceMappingURL=agent.d.ts.map

package/dist/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAIjE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC;AAE7C,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAID,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,QAAQ,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvC;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,WAAW,CACT,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,aAAa,GACjB,aAAa,CAAC,UAAU,CAAC,CAAC;CAC9B;AAID,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACjD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IAChD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IAChD,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CAClD;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,YAAY,CAAC;IACpB,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC;IAChD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,mBAAmB,CAAC,EAAE,OAAO,KAAK,CAAC;IACnC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,MAAM,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}

package/dist/agent.js

@@ -0,0 +1,6 @@
+/**
+ * Public SDK types for the Nority bridge protocol.
+ * Provider-agnostic — no assumptions about the agent runtime transport.
+ */
+export {};
+//# sourceMappingURL=agent.js.map

package/dist/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/auth/jwt.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Bridge JWT utilities.
+ *
+ * Bridge JWTs are:
+ * - Short-lived (cached ephemerally, never persisted as durable credential)
+ * - Bridge-scoped (audience: "nority-bridge")
+ * - Least-privilege (scope: "bridge:connect bridge:replay bridge:events")
+ */
+export declare const BRIDGE_JWT_AUDIENCE = "nority-bridge";
+export declare const BRIDGE_JWT_SCOPES: readonly ["bridge:connect", "bridge:replay", "bridge:events"];
+export interface AccessTokenRecord {
+    accessJwt: string;
+    expiresAt: string;
+    agentId?: string;
+}
+export interface JwtCacheOptions {
+    clock?: () => Date;
+    expirySkewMs?: number;
+}
+/**
+ * Check if a JWT is likely expired (without full validation).
+ * Returns true if the token appears to be expired based on the exp claim.
+ */
+export declare function isJwtExpired(jwt: string, nowEpochSeconds?: number): boolean;
+/**
+ * Ephemeral in-memory JWT cache.
+ */
+export declare class JwtCache {
+    private readonly clock;
+    private readonly expirySkewMs;
+    private current;
+    constructor(options?: JwtCacheOptions);
+    seed(record: AccessTokenRecord): void;
+    clear(): void;
+    getValid(): AccessTokenRecord | null;
+    private assertRecord;
+}
+//# sourceMappingURL=jwt.d.ts.map

package/dist/auth/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AACnD,eAAO,MAAM,iBAAiB,+DAIpB,CAAC;AAEX,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,eAAe,SAAoB,GAClC,OAAO,CAqBT;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,OAAO,CAAkC;gBAErC,OAAO,GAAE,eAAoB;IAKzC,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;IAKrC,KAAK,IAAI,IAAI;IAIb,QAAQ,IAAI,iBAAiB,GAAG,IAAI;IAqBpC,OAAO,CAAC,YAAY;CAarB"}

package/dist/auth/jwt.js

@@ -0,0 +1,83 @@
+/**
+ * Bridge JWT utilities.
+ *
+ * Bridge JWTs are:
+ * - Short-lived (cached ephemerally, never persisted as durable credential)
+ * - Bridge-scoped (audience: "nority-bridge")
+ * - Least-privilege (scope: "bridge:connect bridge:replay bridge:events")
+ */
+export const BRIDGE_JWT_AUDIENCE = "nority-bridge";
+export const BRIDGE_JWT_SCOPES = [
+    "bridge:connect",
+    "bridge:replay",
+    "bridge:events",
+];
+/**
+ * Check if a JWT is likely expired (without full validation).
+ * Returns true if the token appears to be expired based on the exp claim.
+ */
+export function isJwtExpired(jwt, nowEpochSeconds = Date.now() / 1000) {
+    if (!jwt) {
+        throw new Error("isJwtExpired: jwt is required");
+    }
+    const parts = jwt.split(".");
+    if (parts.length !== 3) {
+        throw new Error("isJwtExpired: invalid JWT format");
+    }
+    try {
+        const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+        if (typeof payload.exp !== "number") {
+            return true;
+        }
+        return nowEpochSeconds >= payload.exp;
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * Ephemeral in-memory JWT cache.
+ */
+export class JwtCache {
+    clock;
+    expirySkewMs;
+    current = null;
+    constructor(options = {}) {
+        this.clock = options.clock ?? (() => new Date());
+        this.expirySkewMs = options.expirySkewMs ?? 5_000;
+    }
+    seed(record) {
+        this.assertRecord(record);
+        this.current = { ...record };
+    }
+    clear() {
+        this.current = null;
+    }
+    getValid() {
+        if (this.current === null) {
+            return null;
+        }
+        const expiryMs = Date.parse(this.current.expiresAt);
+        if (Number.isNaN(expiryMs)) {
+            throw new Error(`JwtCache.getValid: invalid expiresAt timestamp: ${this.current.expiresAt}`);
+        }
+        const nowMs = this.clock().getTime();
+        if (nowMs >= expiryMs - this.expirySkewMs) {
+            this.current = null;
+            return null;
+        }
+        return { ...this.current };
+    }
+    assertRecord(record) {
+        if (!record.accessJwt) {
+            throw new Error("JwtCache.seed: accessJwt is required");
+        }
+        if (!record.expiresAt) {
+            throw new Error("JwtCache.seed: expiresAt is required");
+        }
+        if (Number.isNaN(Date.parse(record.expiresAt))) {
+            throw new Error(`JwtCache.seed: expiresAt must be RFC3339, got ${record.expiresAt}`);
+        }
+    }
+}
+//# sourceMappingURL=jwt.js.map

package/dist/auth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,gBAAgB;IAChB,eAAe;IACf,eAAe;CACP,CAAC;AAaX;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;IAEnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CACjC,CAAC;QACtB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,QAAQ;IACF,KAAK,CAAa;IAClB,YAAY,CAAS;IAC9B,OAAO,GAA6B,IAAI,CAAC;IAEjD,YAAY,UAA2B,EAAE;QACvC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,MAAyB;QAC5B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,QAAQ;QACN,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,mDAAmD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,KAAK,IAAI,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAEO,YAAY,CAAC,MAAyB;QAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,iDAAiD,MAAM,CAAC,SAAS,EAAE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/auth/pairing.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Pairing flow helpers.
+ */
+export declare const PAIRING_TOKEN_TTL_SECONDS = 120;
+export declare const DEEPLINK_PREFIX = "nority://pair-bridge?token=";
+export interface PairingClockOptions {
+    clock?: () => Date;
+    tokenTtlSeconds?: number;
+}
+export declare function createDeeplinkUrl(token: string): string;
+export declare function createPairingToken(): string;
+export declare function createPairingExpiry(options?: PairingClockOptions): string;
+export declare function isPairingExpired(expiresAt: string, clock?: () => Date): boolean;
+//# sourceMappingURL=pairing.d.ts.map

package/dist/auth/pairing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/auth/pairing.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,eAAO,MAAM,eAAe,gCAAgC,CAAC;AAE7D,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,mBAAwB,GAChC,MAAM,CAUR;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,MAAM,IAAuB,GACnC,OAAO,CAaT"}

package/dist/auth/pairing.js

@@ -0,0 +1,34 @@
+import { randomBytes } from "node:crypto";
+/**
+ * Pairing flow helpers.
+ */
+export const PAIRING_TOKEN_TTL_SECONDS = 120;
+export const DEEPLINK_PREFIX = "nority://pair-bridge?token=";
+export function createDeeplinkUrl(token) {
+    if (!token) {
+        throw new Error("createDeeplinkUrl: token is required");
+    }
+    return `${DEEPLINK_PREFIX}${token}`;
+}
+export function createPairingToken() {
+    return `pair_${randomBytes(15).toString("base64url")}`;
+}
+export function createPairingExpiry(options = {}) {
+    const clock = options.clock ?? (() => new Date());
+    const tokenTtlSeconds = options.tokenTtlSeconds ?? PAIRING_TOKEN_TTL_SECONDS;
+    if (tokenTtlSeconds <= 0) {
+        throw new Error(`createPairingExpiry: tokenTtlSeconds must be positive, got ${tokenTtlSeconds}`);
+    }
+    return new Date(clock().getTime() + tokenTtlSeconds * 1000).toISOString();
+}
+export function isPairingExpired(expiresAt, clock = () => new Date()) {
+    if (!expiresAt) {
+        throw new Error("isPairingExpired: expiresAt is required");
+    }
+    const expiryMs = Date.parse(expiresAt);
+    if (Number.isNaN(expiryMs)) {
+        throw new Error(`isPairingExpired: expiresAt must be RFC3339, got ${expiresAt}`);
+    }
+    return clock().getTime() >= expiryMs;
+}
+//# sourceMappingURL=pairing.js.map

package/dist/auth/pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../../src/auth/pairing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;GAEG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAC7C,MAAM,CAAC,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAO7D,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,eAAe,GAAG,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,UAA+B,EAAE;IAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAC7E,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,8DAA8D,eAAe,EAAE,CAChF,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,QAAoB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAEpC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,oDAAoD,SAAS,EAAE,CAChE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,QAAQ,CAAC;AACvC,CAAC"}

package/dist/auth/reconnect.d.ts

@@ -0,0 +1,28 @@
+import { AccessTokenRecord, type JwtCacheOptions } from "./jwt.js";
+export declare const CHALLENGE_ENDPOINT = "/v1/bridge/auth/challenge";
+export declare const VERIFY_ENDPOINT = "/v1/bridge/auth/verify";
+export interface BridgeAccessTokenManagerOptions extends JwtCacheOptions {
+    backendUrl: string;
+    fetchImplementation?: typeof fetch;
+}
+export interface GetAccessTokenOptions {
+    credential: string;
+    privateKeyPem: string;
+    forceRefresh?: boolean;
+}
+/**
+ * Mints and caches short-lived bridge access JWTs.
+ */
+export declare class BridgeAccessTokenManager {
+    private readonly backendUrl;
+    private readonly fetchImplementation;
+    private readonly jwtCache;
+    constructor(options: BridgeAccessTokenManagerOptions);
+    seed(record: AccessTokenRecord): void;
+    clear(): void;
+    getAccessToken(options: GetAccessTokenOptions): Promise<AccessTokenRecord>;
+    private fetchChallenge;
+    private fetchVerify;
+}
+export type { AccessTokenRecord } from "./jwt.js";
+//# sourceMappingURL=reconnect.d.ts.map

package/dist/auth/reconnect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconnect.d.ts","sourceRoot":"","sources":["../../src/auth/reconnect.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EAEjB,KAAK,eAAe,EACrB,MAAM,UAAU,CAAC;AAGlB,eAAO,MAAM,kBAAkB,8BAA8B,CAAC;AAC9D,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAaxD,MAAM,WAAW,+BAAgC,SAAQ,eAAe;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,OAAO,KAAK,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAe;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;gBAExB,OAAO,EAAE,+BAA+B;IAapD,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;IAIrC,KAAK,IAAI,IAAI;IAIP,cAAc,CAClB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,iBAAiB,CAAC;YA0Cf,cAAc;YA+Bd,WAAW;CAmC1B;AAWD,YAAY,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}

package/dist/auth/reconnect.js

@@ -0,0 +1,110 @@
+import { JwtCache, } from "./jwt.js";
+import { signEd25519 } from "../crypto/identity.js";
+export const CHALLENGE_ENDPOINT = "/v1/bridge/auth/challenge";
+export const VERIFY_ENDPOINT = "/v1/bridge/auth/verify";
+/**
+ * Mints and caches short-lived bridge access JWTs.
+ */
+export class BridgeAccessTokenManager {
+    backendUrl;
+    fetchImplementation;
+    jwtCache;
+    constructor(options) {
+        if (!options) {
+            throw new Error("BridgeAccessTokenManager: options are required");
+        }
+        if (!options.backendUrl) {
+            throw new Error("BridgeAccessTokenManager: backendUrl is required");
+        }
+        this.backendUrl = options.backendUrl;
+        this.fetchImplementation = options.fetchImplementation ?? fetch;
+        this.jwtCache = new JwtCache(options);
+    }
+    seed(record) {
+        this.jwtCache.seed(record);
+    }
+    clear() {
+        this.jwtCache.clear();
+    }
+    async getAccessToken(options) {
+        if (!options) {
+            throw new Error("BridgeAccessTokenManager.getAccessToken: options are required");
+        }
+        if (!options.credential) {
+            throw new Error("BridgeAccessTokenManager.getAccessToken: credential is required");
+        }
+        if (!options.forceRefresh) {
+            const cached = this.jwtCache.getValid();
+            if (cached !== null) {
+                return cached;
+            }
+        }
+        if (!options.privateKeyPem) {
+            throw new Error("BridgeAccessTokenManager.getAccessToken: privateKeyPem is required");
+        }
+        const challenge = await this.fetchChallenge(options.credential);
+        const signature = await signEd25519(options.privateKeyPem, Buffer.from(challenge.challenge, "hex"));
+        const verified = await this.fetchVerify({
+            credential: options.credential,
+            challenge: challenge.challenge,
+            signature: signature.toString("base64"),
+        });
+        const record = {
+            accessJwt: verified.access_jwt,
+            agentId: verified.agent_id,
+            expiresAt: verified.expires_at,
+        };
+        this.jwtCache.seed(record);
+        return record;
+    }
+    async fetchChallenge(credential) {
+        const response = await this.fetchImplementation(resolveHttpEndpoint(this.backendUrl, CHALLENGE_ENDPOINT), {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({ credential }),
+        });
+        if (!response.ok) {
+            throw new Error(`BridgeAccessTokenManager.fetchChallenge: backend returned ${response.status}`);
+        }
+        const body = (await response.json());
+        if (!body.challenge || !body.expires_at) {
+            throw new Error("BridgeAccessTokenManager.fetchChallenge: challenge and expires_at are required");
+        }
+        return {
+            challenge: body.challenge,
+            expires_at: body.expires_at,
+        };
+    }
+    async fetchVerify(input) {
+        const response = await this.fetchImplementation(resolveHttpEndpoint(this.backendUrl, VERIFY_ENDPOINT), {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+            },
+            body: JSON.stringify(input),
+        });
+        if (!response.ok) {
+            throw new Error(`BridgeAccessTokenManager.fetchVerify: backend returned ${response.status}`);
+        }
+        const body = (await response.json());
+        if (!body.access_jwt || !body.expires_at || !body.agent_id) {
+            throw new Error("BridgeAccessTokenManager.fetchVerify: access_jwt, agent_id, and expires_at are required");
+        }
+        return {
+            access_jwt: body.access_jwt,
+            agent_id: body.agent_id,
+            expires_at: body.expires_at,
+        };
+    }
+}
+function resolveHttpEndpoint(backendUrl, path) {
+    const url = new URL(backendUrl);
+    url.protocol = url.protocol === "wss:" ? "https:" : "http:";
+    url.pathname = path;
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+}
+//# sourceMappingURL=reconnect.js.map

package/dist/auth/reconnect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconnect.js","sourceRoot":"","sources":["../../src/auth/reconnect.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,QAAQ,GAET,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAwBxD;;GAEG;AACH,MAAM,OAAO,wBAAwB;IAClB,UAAU,CAAS;IACnB,mBAAmB,CAAe;IAClC,QAAQ,CAAW;IAEpC,YAAY,OAAwC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,KAAK,CAAC;QAChE,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,MAAyB;QAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,OAA8B;QAE9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,WAAW,CACjC,OAAO,CAAC,aAAa,EACrB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CACxC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;YACtC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAsB;YAChC,SAAS,EAAE,QAAQ,CAAC,UAAU;YAC9B,OAAO,EAAE,QAAQ,CAAC,QAAQ;YAC1B,SAAS,EAAE,QAAQ,CAAC,UAAU;SAC/B,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,UAAkB;QAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC7C,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,EACxD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC;SACrC,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,6DAA6D,QAAQ,CAAC,MAAM,EAAE,CAC/E,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,KAIzB;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC7C,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,EACrD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,0DAA0D,QAAQ,CAAC,MAAM,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QAED,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,UAAkB,EAAE,IAAY;IAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5D,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}