@open-everywhere/adapters 0.5.0 → 0.7.0

package/dist/agent/oe-oauth/config.d.ts

@@ -2,6 +2,8 @@
 export declare const OE_OAUTH_MODE_DISCOVERY = "discovery-dcr-pkce";
 /** The static confidential-client dialect (OPE-1086) — no discovery, no registration, HTTP Basic. */
 export declare const OE_OAUTH_MODE_STATIC = "static-confidential";
+/** The Cross App Access dialect (OPE-2453) — an IdP sign-in once, then an ID-JAG mint per app token. */
+export declare const OE_OAUTH_MODE_XAA = "xaa";
 /** How a static provider encodes its token-request body. Declared, never inferred: Notion's REST
  *  token endpoint takes JSON, the RFC 6749 default is form-encoded, and sending the wrong one reads
  *  as an authentication failure rather than as a shape error. */
@@ -50,8 +52,32 @@ export interface OeOauthStaticProviderConfig extends OeOauthProviderConfigBase {
     /** How the token-request body is encoded. */
     readonly bodyEncoding: OeOauthBodyEncoding;
 }
-/** One provider's OAuth target, in one of the two declared modes. */
-export type OeOauthProviderConfig = OeOauthDiscoveryProviderConfig | OeOauthStaticProviderConfig;
+/**
+ * A Cross App Access provider (OPE-2453). The person signs in to the IdP (`idpIssuer`) once; each mint then trades
+ * the person's IdP refresh token for an ID-JAG (RFC 8693, at the IdP) and the ID-JAG for the app's access token
+ * (RFC 7523, at `resourceTokenEndpoint`). Two confidential clients, two secret REFS, no literal secret.
+ */
+export interface OeOauthXaaProviderConfig extends OeOauthProviderConfigBase {
+    readonly mode: typeof OE_OAUTH_MODE_XAA;
+    /** The IdP's OIDC issuer. Its `/.well-known/openid-configuration` names the authorize, token, JWKS and
+     *  revocation endpoints. HTTPS only. */
+    readonly idpIssuer: string;
+    readonly idpClientId: string;
+    readonly idpClientSecretRef: string;
+    readonly idpClientSecretBroker: string;
+    /** The app's authorization server issuer — the ID-JAG `audience`. */
+    readonly audience: string;
+    /** The RFC 8707 resource both legs name, when the app asks for one. */
+    readonly resource?: string;
+    readonly resourceTokenEndpoint: string;
+    readonly resourceClientId: string;
+    readonly resourceClientSecretRef: string;
+    readonly resourceClientSecretBroker: string;
+}
+/** One provider's OAuth target, in one of the three declared modes. */
+export type OeOauthProviderConfig = OeOauthDiscoveryProviderConfig | OeOauthStaticProviderConfig | OeOauthXaaProviderConfig;
+/** Narrow a provider config to the Cross App Access mode. Reads the DECLARED `mode` only. */
+export declare function isXaa(cfg: OeOauthProviderConfig): cfg is OeOauthXaaProviderConfig;
 /** Narrow a provider config to the static confidential-client mode. Reads the DECLARED `mode` and
  *  nothing else — never the presence of a field. */
 export declare function isStaticConfidential(cfg: OeOauthProviderConfig): cfg is OeOauthStaticProviderConfig;

package/dist/agent/oe-oauth/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/config.ts"],"names":[],"mappings":"AAWA,wFAAwF;AACxF,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAE1D;;iEAEiE;AACjE,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,CAAC;AAElD,8DAA8D;AAC9D,UAAU,yBAAyB;IACjC,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;iEACiE;AACjE,MAAM,WAAW,8BAA+B,SAAQ,yBAAyB;IAC/E,QAAQ,CAAC,IAAI,EAAE,OAAO,uBAAuB,CAAC;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+HAA+H;IAC/H,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA4B,SAAQ,yBAAyB;IAC5E,QAAQ,CAAC,IAAI,EAAE,OAAO,oBAAoB,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;qGACiG;IACjG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;0FACsF;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D;qEACiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC5C;AAED,qEAAqE;AACrE,MAAM,MAAM,qBAAqB,GAAG,8BAA8B,GAAG,2BAA2B,CAAC;AAEjG;oDACoD;AACpD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,qBAAqB,GAAG,GAAG,IAAI,2BAA2B,CAEnG;AA6ID;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,GAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAA+B,GAAG,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,SAAS,CAGtJ"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/config.ts"],"names":[],"mappings":"AAWA,wFAAwF;AACxF,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAE1D,wGAAwG;AACxG,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC;;iEAEiE;AACjE,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,CAAC;AAElD,8DAA8D;AAC9D,UAAU,yBAAyB;IACjC,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;iEACiE;AACjE,MAAM,WAAW,8BAA+B,SAAQ,yBAAyB;IAC/E,QAAQ,CAAC,IAAI,EAAE,OAAO,uBAAuB,CAAC;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+HAA+H;IAC/H,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA4B,SAAQ,yBAAyB;IAC5E,QAAQ,CAAC,IAAI,EAAE,OAAO,oBAAoB,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;qGACiG;IACjG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;0FACsF;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D;qEACiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC5C;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB;IACzE,QAAQ,CAAC,IAAI,EAAE,OAAO,iBAAiB,CAAC;IACxC;4CACwC;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;CAC7C;AAED,uEAAuE;AACvE,MAAM,MAAM,qBAAqB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,wBAAwB,CAAC;AAE5H,6FAA6F;AAC7F,wBAAgB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,GAAG,IAAI,wBAAwB,CAEjF;AAED;oDACoD;AACpD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,qBAAqB,GAAG,GAAG,IAAI,2BAA2B,CAEnG;AAkLD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,GAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAA+B,GAAG,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,SAAS,CAGtJ"}

package/dist/agent/oe-oauth/config.js

@@ -11,6 +11,12 @@ import { declaredConnectionSignIns } from "@open-everywhere/core/agent/adapter-a
 export const OE_OAUTH_MODE_DISCOVERY = "discovery-dcr-pkce";
 /** The static confidential-client dialect (OPE-1086) — no discovery, no registration, HTTP Basic. */
 export const OE_OAUTH_MODE_STATIC = "static-confidential";
+/** The Cross App Access dialect (OPE-2453) — an IdP sign-in once, then an ID-JAG mint per app token. */
+export const OE_OAUTH_MODE_XAA = "xaa";
+/** Narrow a provider config to the Cross App Access mode. Reads the DECLARED `mode` only. */
+export function isXaa(cfg) {
+    return cfg.mode === OE_OAUTH_MODE_XAA;
+}
 /** Narrow a provider config to the static confidential-client mode. Reads the DECLARED `mode` and
  *  nothing else — never the presence of a field. */
 export function isStaticConfidential(cfg) {
@@ -100,6 +106,35 @@ function parseStaticProvider(ref, rec) {
         ...(scopes ? { scopes } : {}),
     };
 }
+/** Parse ONE `xaa` entry, with every refusal stated. */
+function parseXaaProvider(ref, rec) {
+    const where = `sign-in "${ref}"`;
+    // 🔴 A LITERAL SECRET IS REFUSED, as in the static dialect: a declaration is committed source.
+    for (const literal of ["clientSecret", "idpClientSecret", "resourceClientSecret"]) {
+        if (literal in rec) {
+            throw new Error(`${where} carries a literal "${literal}". A client secret must NEVER live in a sign-in declaration — store it in the ` +
+                `credential store and name it with "${literal === "clientSecret" ? "idpClientSecretRef" : `${literal}Ref`}".`);
+        }
+    }
+    const resource = rec.resource === undefined ? undefined : requireString(rec.resource, `${where}.resource`);
+    const scopes = parseScopes(rec.scopes);
+    return {
+        mode: OE_OAUTH_MODE_XAA,
+        ref,
+        // The issuer is compared byte-for-byte with the id token's `iss`, so it is kept exactly as declared.
+        idpIssuer: requireHttpsUrl(rec.idpIssuer, `${where}.idpIssuer`),
+        idpClientId: requireString(rec.idpClientId, `${where}.idpClientId`),
+        idpClientSecretRef: requireString(rec.idpClientSecretRef, `${where}.idpClientSecretRef`),
+        idpClientSecretBroker: rec.idpClientSecretBroker === undefined ? "db" : requireString(rec.idpClientSecretBroker, `${where}.idpClientSecretBroker`),
+        audience: requireString(rec.audience, `${where}.audience`),
+        ...(resource ? { resource } : {}),
+        resourceTokenEndpoint: requireHttpsUrl(rec.resourceTokenEndpoint, `${where}.resourceTokenEndpoint`),
+        resourceClientId: requireString(rec.resourceClientId, `${where}.resourceClientId`),
+        resourceClientSecretRef: requireString(rec.resourceClientSecretRef, `${where}.resourceClientSecretRef`),
+        resourceClientSecretBroker: rec.resourceClientSecretBroker === undefined ? "db" : requireString(rec.resourceClientSecretBroker, `${where}.resourceClientSecretBroker`),
+        ...(scopes ? { scopes } : {}),
+    };
+}
 /** Parse ONE `discovery-dcr-pkce` entry. */
 function parseDiscoveryProvider(ref, rec) {
     const where = `sign-in "${ref}"`;
@@ -131,8 +166,12 @@ function parseDeclarations(declared) {
             out.set(ref, parseStaticProvider(ref, rec));
             continue;
         }
+        if (mode === OE_OAUTH_MODE_XAA) {
+            out.set(ref, parseXaaProvider(ref, rec));
+            continue;
+        }
         if (mode !== OE_OAUTH_MODE_DISCOVERY) {
-            throw new Error(`sign-in "${ref}".mode ${JSON.stringify(mode)} is not a known oe-oauth mode — use "${OE_OAUTH_MODE_DISCOVERY}" or "${OE_OAUTH_MODE_STATIC}".`);
+            throw new Error(`sign-in "${ref}".mode ${JSON.stringify(mode)} is not a known oe-oauth mode — use "${OE_OAUTH_MODE_DISCOVERY}", "${OE_OAUTH_MODE_STATIC}" or "${OE_OAUTH_MODE_XAA}".`);
         }
         const parsed = parseDiscoveryProvider(ref, rec);
         // A discovery entry that also carries confidential-client fields is a MIS-DECLARED entry, not a

package/dist/agent/oe-oauth/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../agent/oe-oauth/config.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,6GAA6G;AAC7G,mHAAmH;AACnH,EAAE;AACF,0GAA0G;AAC1G,2GAA2G;AAC3G,uGAAuG;AACvG,yGAAyG;AAEzG,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAEvF,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAC5D,qGAAqG;AACrG,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAyD1D;oDACoD;AACpD,MAAM,UAAU,oBAAoB,CAAC,GAA0B;IAC7D,OAAO,GAAG,CAAC,IAAI,KAAK,oBAAoB,CAAC;AAC3C,CAAC;AAED;;mDAEmD;AACnD,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAEvJ,SAAS,aAAa,CAAC,CAAU,EAAE,KAAa;IAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACtG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC;AAED;;wEAEwE;AACxE,SAAS,eAAe,CAAC,CAAU,EAAE,KAAa;IAChD,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mFAAmF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC5J,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU,EAAE,KAAa;IAClD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAC;IACjI,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;QACpE,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACnF,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,wEAAwE;AACxE,SAAS,mBAAmB,CAAC,GAAW,EAAE,GAA4B;IACpE,MAAM,KAAK,GAAG,YAAY,GAAG,GAAG,CAAC;IACjC,0GAA0G;IAC1G,IAAI,cAAc,IAAI,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,kGAAkG;YACxG,mHAAmH,CACtH,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;IAC3F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QACtD,IAAI,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,IAAI,iDAAiD,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;IAClF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;QACnD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,IAAI,qEAAqE,CAAC,CAAC;QACnI,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;IAC9E,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gFAAgF,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACrJ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,GAAG;QACH,qBAAqB,EAAE,eAAe,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,KAAK,wBAAwB,CAAC;QACnG,aAAa,EAAE,eAAe,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,KAAK,gBAAgB,CAAC;QAC3E,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC;QAC1D,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,KAAK,kBAAkB,CAAC;QAC/E,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,KAAK,qBAAqB,CAAC;QACtI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,YAAY;QACZ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,SAAS,sBAAsB,CAAC,GAAW,EAAE,GAA4B;IACvE,MAAM,KAAK,GAAG,YAAY,GAAG,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,GAAG;QACH,QAAQ;QACR,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9G,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,SAAS,iBAAiB,CAAC,QAAsC;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiC,CAAC;IACrD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,6FAA6F;QAC7F,yFAAyF;QACzF,8FAA8F;QAC9F,yDAAyD;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACzE,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,YAAY,GAAG,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,wCAAwC,uBAAuB,SAAS,oBAAoB,IAAI,CAC9I,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,gGAAgG;QAChG,2FAA2F;QAC3F,wFAAwF;QACxF,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,CAAC,EAAE,CAAC;YAC9G,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,YAAY,GAAG,cAAc,KAAK,2CAA2C,uBAAuB,IAAI;oBACtG,qFAAqF,oBAAoB,8BAA8B,CAC1I,CAAC;YACJ,CAAC;QACH,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAQ,GAAiC,yBAAyB,EAAE;IACpG,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../agent/oe-oauth/config.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,6GAA6G;AAC7G,mHAAmH;AACnH,EAAE;AACF,0GAA0G;AAC1G,2GAA2G;AAC3G,uGAAuG;AACvG,yGAAyG;AAEzG,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAEvF,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAC5D,qGAAqG;AACrG,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAE1D,wGAAwG;AACxG,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAgFvC,6FAA6F;AAC7F,MAAM,UAAU,KAAK,CAAC,GAA0B;IAC9C,OAAO,GAAG,CAAC,IAAI,KAAK,iBAAiB,CAAC;AACxC,CAAC;AAED;oDACoD;AACpD,MAAM,UAAU,oBAAoB,CAAC,GAA0B;IAC7D,OAAO,GAAG,CAAC,IAAI,KAAK,oBAAoB,CAAC;AAC3C,CAAC;AAED;;mDAEmD;AACnD,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAEvJ,SAAS,aAAa,CAAC,CAAU,EAAE,KAAa;IAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACtG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC;AAED;;wEAEwE;AACxE,SAAS,eAAe,CAAC,CAAU,EAAE,KAAa;IAChD,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mFAAmF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC5J,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU,EAAE,KAAa;IAClD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAC;IACjI,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;QACpE,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACnF,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,wEAAwE;AACxE,SAAS,mBAAmB,CAAC,GAAW,EAAE,GAA4B;IACpE,MAAM,KAAK,GAAG,YAAY,GAAG,GAAG,CAAC;IACjC,0GAA0G;IAC1G,IAAI,cAAc,IAAI,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,kGAAkG;YACxG,mHAAmH,CACtH,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;IAC3F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QACtD,IAAI,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,IAAI,iDAAiD,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;IAClF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;QACnD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,IAAI,qEAAqE,CAAC,CAAC;QACnI,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;IAC9E,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gFAAgF,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACrJ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,GAAG;QACH,qBAAqB,EAAE,eAAe,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,KAAK,wBAAwB,CAAC;QACnG,aAAa,EAAE,eAAe,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,KAAK,gBAAgB,CAAC;QAC3E,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC;QAC1D,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,KAAK,kBAAkB,CAAC;QAC/E,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,KAAK,qBAAqB,CAAC;QACtI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,YAAY;QACZ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,SAAS,gBAAgB,CAAC,GAAW,EAAE,GAA4B;IACjE,MAAM,KAAK,GAAG,YAAY,GAAG,GAAG,CAAC;IACjC,+FAA+F;IAC/F,KAAK,MAAM,OAAO,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAClF,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,uBAAuB,OAAO,gFAAgF;gBACpH,sCAAsC,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,IAAI,CAChH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,GAAG;QACH,qGAAqG;QACrG,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,CAAC;QAC/D,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,KAAK,cAAc,CAAC;QACnE,kBAAkB,EAAE,aAAa,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,KAAK,qBAAqB,CAAC;QACxF,qBAAqB,EAAE,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,KAAK,wBAAwB,CAAC;QAClJ,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC;QAC1D,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,qBAAqB,EAAE,eAAe,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,KAAK,wBAAwB,CAAC;QACnG,gBAAgB,EAAE,aAAa,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,KAAK,mBAAmB,CAAC;QAClF,uBAAuB,EAAE,aAAa,CAAC,GAAG,CAAC,uBAAuB,EAAE,GAAG,KAAK,0BAA0B,CAAC;QACvG,0BAA0B,EACxB,GAAG,CAAC,0BAA0B,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,0BAA0B,EAAE,GAAG,KAAK,6BAA6B,CAAC;QAC5I,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,SAAS,sBAAsB,CAAC,GAAW,EAAE,GAA4B;IACvE,MAAM,KAAK,GAAG,YAAY,GAAG,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,GAAG;QACH,QAAQ;QACR,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9G,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,SAAS,iBAAiB,CAAC,QAAsC;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiC,CAAC;IACrD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,6FAA6F;QAC7F,yFAAyF;QACzF,8FAA8F;QAC9F,yDAAyD;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACzE,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,YAAY,GAAG,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,wCAAwC,uBAAuB,OAAO,oBAAoB,SAAS,iBAAiB,IAAI,CACtK,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,gGAAgG;QAChG,2FAA2F;QAC3F,wFAAwF;QACxF,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,CAAC,EAAE,CAAC;YAC9G,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,YAAY,GAAG,cAAc,KAAK,2CAA2C,uBAAuB,IAAI;oBACtG,qFAAqF,oBAAoB,8BAA8B,CAC1I,CAAC;YACJ,CAAC;QACH,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAQ,GAAiC,yBAAyB,EAAE;IACpG,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC"}

package/dist/agent/oe-oauth/errors.d.ts

@@ -42,6 +42,20 @@ export declare class OeOauthRefreshContendedError extends Error {
         readonly type: "app";
     });
 }
+/** Cross App Access (OPE-2453): the IdP or the app REFUSED the mint for a person who is signed in — the IdP admin
+ *  removed the pairing, unassigned the person, or never granted this app. A new sign-in link cannot fix that, so
+ *  this error is DELIBERATELY not classified as user-auth-required: the person gets no "Connect my account" link,
+ *  only the reason. Carries the RFC 6749 error code, never token material. */
+export declare class OeOauthAccessRemovedError extends Error {
+    readonly code = "oe_oauth_access_removed";
+    readonly oauthError?: string;
+    constructor(providerRef: string, subject: {
+        readonly type: "user";
+        readonly id: string;
+    } | {
+        readonly type: "app";
+    }, where: "idp" | "app", oauthError?: string);
+}
 /** A generic upstream OAuth failure (token endpoint / discovery / DCR returned an error). `oauthError`
  *  is the RFC 6749 `error` code when the body carried one (e.g. "invalid_grant", "invalid_client") —
  *  a fixed-vocabulary string, never a secret. */

package/dist/agent/oe-oauth/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/errors.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG,MAAM,CAEvH;AAED;4CAC4C;AAC5C,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,4BAA4B;IACzC,YAAY,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KAAE,EAGlH;CACF;AAED;;sEAEsE;AACtE,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,IAAI,8BAA8B;IAC3C,YAAY,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KAAE,EAAE,GAAG,EAAE,MAAM,EAG/H;CACF;AAED;;;;6CAI6C;AAC7C,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,YAAY,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KAAE,EAGlH;CACF;AAED;;iDAEiD;AACjD,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,EAKrG;CACF;AAED;wGACwG;AACxG,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAIlD;AAED;2EAC2E;AAC3E,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAS3D"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/errors.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG,MAAM,CAEvH;AAED;4CAC4C;AAC5C,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,4BAA4B;IACzC,YAAY,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KAAE,EAGlH;CACF;AAED;;sEAEsE;AACtE,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,IAAI,8BAA8B;IAC3C,YAAY,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KAAE,EAAE,GAAG,EAAE,MAAM,EAG/H;CACF;AAED;;;;6CAI6C;AAC7C,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,YAAY,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KAAE,EAGlH;CACF;AAED;;;8EAG8E;AAC9E,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,6BAA6B;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KAAE,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,UAAU,CAAC,EAAE,MAAM,EAO7J;CACF;AAED;;iDAEiD;AACjD,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,EAKrG;CACF;AAED;wGACwG;AACxG,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAIlD;AAED;2EAC2E;AAC3E,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAS3D"}

package/dist/agent/oe-oauth/errors.js

@@ -35,6 +35,21 @@ export class OeOauthRefreshContendedError extends Error {
         this.name = "OeOauthRefreshContendedError";
     }
 }
+/** Cross App Access (OPE-2453): the IdP or the app REFUSED the mint for a person who is signed in — the IdP admin
+ *  removed the pairing, unassigned the person, or never granted this app. A new sign-in link cannot fix that, so
+ *  this error is DELIBERATELY not classified as user-auth-required: the person gets no "Connect my account" link,
+ *  only the reason. Carries the RFC 6749 error code, never token material. */
+export class OeOauthAccessRemovedError extends Error {
+    code = "oe_oauth_access_removed";
+    oauthError;
+    constructor(providerRef, subject, where, oauthError) {
+        super(`connection "${providerRef}": ${subjectLabel(subject)} — the ${where === "idp" ? "identity provider" : "app"} refused access` +
+            `${oauthError ? ` (${oauthError})` : ""}. Your identity-provider admin manages this access; a new sign-in will not restore it.`);
+        this.name = "OeOauthAccessRemovedError";
+        if (oauthError)
+            this.oauthError = oauthError;
+    }
+}
 /** A generic upstream OAuth failure (token endpoint / discovery / DCR returned an error). `oauthError`
  *  is the RFC 6749 `error` code when the body carried one (e.g. "invalid_grant", "invalid_client") —
  *  a fixed-vocabulary string, never a secret. */

package/dist/agent/oe-oauth/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../agent/oe-oauth/errors.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,oGAAoG;AAEpG,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,OAAkF;IAC7G,OAAO,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED;4CAC4C;AAC5C,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,GAAG,wBAAwB,CAAC;IACzC,YAAY,WAAmB,EAAE,OAAkF;QACjH,KAAK,CAAC,eAAe,WAAW,MAAM,YAAY,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC;QAC9H,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;sEAEsE;AACtE,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,0BAA0B,CAAC;IAC3C,YAAY,WAAmB,EAAE,OAAkF,EAAE,GAAW;QAC9H,KAAK,CAAC,eAAe,WAAW,MAAM,YAAY,CAAC,OAAO,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;;;6CAI6C;AAC7C,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,IAAI,GAAG,4BAA4B,CAAC;IAC7C,YAAY,WAAmB,EAAE,OAAkF;QACjH,KAAK,CAAC,eAAe,WAAW,MAAM,YAAY,CAAC,OAAO,CAAC,yFAAyF,CAAC,CAAC;QACtJ,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED;;iDAEiD;AACjD,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,GAAG,gBAAgB,CAAC;IACxB,UAAU,CAAU;IACpB,UAAU,CAAU;IAC7B,YAAY,OAAe,EAAE,IAAI,GAAmE,EAAE;QACpG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACvD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACvE,CAAC;CACF;AAED;wGACwG;AACxG,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,UAAU,GAAI,CAA8B,CAAC,UAAU,CAAC;IAC9D,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC;AACxF,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,CAAU;IAChD,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,IAAI,GAAI,CAAwB,CAAC,IAAI,CAAC;IAC5C,OAAO,CACL,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,wBAAwB,IAAI,IAAI,KAAK,0BAA0B,CAAC,CAAC;QACxG,CAAC,CAAC,IAAI,KAAK,0BAA0B;QACrC,CAAC,CAAC,IAAI,KAAK,4BAA4B;QACvC,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CACvD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../agent/oe-oauth/errors.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,oGAAoG;AAEpG,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,OAAkF;IAC7G,OAAO,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED;4CAC4C;AAC5C,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,GAAG,wBAAwB,CAAC;IACzC,YAAY,WAAmB,EAAE,OAAkF;QACjH,KAAK,CAAC,eAAe,WAAW,MAAM,YAAY,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC;QAC9H,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;sEAEsE;AACtE,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,0BAA0B,CAAC;IAC3C,YAAY,WAAmB,EAAE,OAAkF,EAAE,GAAW;QAC9H,KAAK,CAAC,eAAe,WAAW,MAAM,YAAY,CAAC,OAAO,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;;;6CAI6C;AAC7C,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,IAAI,GAAG,4BAA4B,CAAC;IAC7C,YAAY,WAAmB,EAAE,OAAkF;QACjH,KAAK,CAAC,eAAe,WAAW,MAAM,YAAY,CAAC,OAAO,CAAC,yFAAyF,CAAC,CAAC;QACtJ,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED;;;8EAG8E;AAC9E,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,yBAAyB,CAAC;IACjC,UAAU,CAAU;IAC7B,YAAY,WAAmB,EAAE,OAAkF,EAAE,KAAoB,EAAE,UAAmB;QAC5J,KAAK,CACH,eAAe,WAAW,MAAM,YAAY,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,iBAAiB;YAC3H,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,wFAAwF,CAClI,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/C,CAAC;CACF;AAED;;iDAEiD;AACjD,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,GAAG,gBAAgB,CAAC;IACxB,UAAU,CAAU;IACpB,UAAU,CAAU;IAC7B,YAAY,OAAe,EAAE,IAAI,GAAmE,EAAE;QACpG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACvD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACvE,CAAC;CACF;AAED;wGACwG;AACxG,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,UAAU,GAAI,CAA8B,CAAC,UAAU,CAAC;IAC9D,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC;AACxF,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,CAAU;IAChD,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,IAAI,GAAI,CAAwB,CAAC,IAAI,CAAC;IAC5C,OAAO,CACL,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,wBAAwB,IAAI,IAAI,KAAK,0BAA0B,CAAC,CAAC;QACxG,CAAC,CAAC,IAAI,KAAK,0BAA0B;QACrC,CAAC,CAAC,IAAI,KAAK,4BAA4B;QACvC,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CACvD,CAAC;AACJ,CAAC"}

package/dist/agent/oe-oauth/oauth-client.d.ts

@@ -14,6 +14,8 @@ export interface DiscoveredEndpoints {
 /** A token endpoint response (authorization-code exchange or refresh). Only the fields we persist. */
 export interface OAuthTokenResponse {
     readonly access_token: string;
+    /** OIDC: present when the request asked for `openid` (the Cross App Access sign-in, OPE-2453). */
+    readonly id_token?: string;
     readonly refresh_token?: string;
     readonly expires_in?: number;
     readonly scope?: string;
@@ -98,6 +100,7 @@ export declare function buildStaticAuthorizationUrl(input: {
 export declare function exchangeCodeConfidential(tokenEndpoint: string, input: {
     readonly code: string;
     readonly redirectUri: string;
+    readonly codeVerifier?: string;
 }, client: ConfidentialClient, fetchImpl: OAuthFetch): Promise<OAuthTokenResponse>;
 /** Refresh an access token as a CONFIDENTIAL client. Same rotation semantics as the public-client
  *  refresh: a rotating server returns a new `refresh_token`, a non-rotating one omits it. */
@@ -121,4 +124,47 @@ export declare function refreshToken(tokenEndpoint: string, input: {
     readonly resource: string;
     readonly scopes?: readonly string[];
 }, fetchImpl: OAuthFetch): Promise<OAuthTokenResponse>;
+/** RFC 8693 / ID-JAG wire constants. The draft is `draft-ietf-oauth-identity-assertion-authz-grant-04`, so these
+ *  names can still move before an RFC; each lives here once. */
+export declare const GRANT_TOKEN_EXCHANGE = "urn:ietf:params:oauth:grant-type:token-exchange";
+export declare const GRANT_JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+export declare const TOKEN_TYPE_ID_JAG = "urn:ietf:params:oauth:token-type:id-jag";
+export declare const TOKEN_TYPE_REFRESH_TOKEN = "urn:ietf:params:oauth:token-type:refresh_token";
+/** The IdP endpoints an OIDC discovery document names. */
+export interface OidcEndpoints {
+    readonly authorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly jwksUri: string;
+    readonly revocationEndpoint?: string;
+}
+/**
+ * OIDC discovery at `issuer` (OpenID Connect Discovery §4). The document's `issuer` MUST equal the configured one
+ * (§4.3): a mismatch means the document is not this IdP's, so it is refused. Every endpoint must be https.
+ */
+export declare function discoverOidc(issuer: string, fetchImpl: OAuthFetch): Promise<OidcEndpoints>;
+/** Fetch the IdP's JWKS document — the keys an id token must verify against. */
+export declare function fetchJwks(jwksUri: string, fetchImpl: OAuthFetch): Promise<{
+    keys: Record<string, unknown>[];
+}>;
+/**
+ * LEG 1 — RFC 8693 token exchange at the IdP: the person's IdP refresh token for an ID-JAG naming `audience`. OE
+ * authenticates as its IdP client (HTTP Basic). The ID-JAG comes back in `access_token`, and the response must
+ * say `issued_token_type` is an ID-JAG: anything else is not the grant leg 2 expects.
+ */
+export declare function requestIdJag(tokenEndpoint: string, input: {
+    readonly subjectToken: string;
+    readonly audience: string;
+    readonly resource?: string;
+    readonly scopes?: readonly string[];
+}, client: ConfidentialClient, fetchImpl: OAuthFetch): Promise<string>;
+/**
+ * LEG 2 — RFC 7523 JWT bearer grant at the APP's authorization server: the ID-JAG for the app's access token. OE
+ * authenticates with the client the APP issued it (HTTP Basic); the app checks the ID-JAG's `client_id` against
+ * it. The draft says the app SHOULD NOT return a refresh token, so the caller re-mints at expiry.
+ */
+export declare function jwtBearerGrant(tokenEndpoint: string, input: {
+    readonly assertion: string;
+    readonly resource?: string;
+    readonly scopes?: readonly string[];
+}, client: ConfidentialClient, fetchImpl: OAuthFetch): Promise<OAuthTokenResponse>;
 //# sourceMappingURL=oauth-client.d.ts.map

package/dist/agent/oe-oauth/oauth-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/oauth-client.ts"],"names":[],"mappings":"AAKA,uFAAuF;AACvF,MAAM,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElF,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC;;;gFAG4E;IAC5E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA0BD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoC7G;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,oBAAoB,EAAE,MAAM,EAC5B,KAAK,EAAE;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACzG,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBxC;AAED,qGAAqG;AACrG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,GAAG,MAAM,CAWT;AA6BD,4GAA4G;AAC5G,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC/I,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAa7B;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,kBAAkB,EAAE,MAAM,EAC1B,KAAK,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,GAAG,cAAc,CAAA;CAAE,EACvH,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED;;4FAE4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,sGAAsG;IACtG,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACvC,oGAAoG;IACpG,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD,GAAG,MAAM,CAST;AAsCD;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAC9D,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAG7B;AAED;6FAC6F;AAC7F,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAC7E,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,kBAAkB,EAAE,MAAM,EAC1B,KAAK,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,GAAG,cAAc,CAAA;CAAE,EAC5F,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;mGACmG;AACnG,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACnI,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAY7B"}
+{"version":3,"file":"oauth-client.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/oauth-client.ts"],"names":[],"mappings":"AAKA,uFAAuF;AACvF,MAAM,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElF,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC;;;gFAG4E;IAC5E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA0BD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoC7G;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,oBAAoB,EAAE,MAAM,EAC5B,KAAK,EAAE;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACzG,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBxC;AAED,qGAAqG;AACrG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,GAAG,MAAM,CAWT;AA6BD,4GAA4G;AAC5G,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC/I,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAa7B;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,kBAAkB,EAAE,MAAM,EAC1B,KAAK,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,GAAG,cAAc,CAAA;CAAE,EACvH,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED;;4FAE4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,sGAAsG;IACtG,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACvC,oGAAoG;IACpG,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD,GAAG,MAAM,CAST;AAsCD;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EAC9F,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;AAED;6FAC6F;AAC7F,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAC7E,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,kBAAkB,EAAE,MAAM,EAC1B,KAAK,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,GAAG,cAAc,CAAA;CAAE,EAC5F,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;mGACmG;AACnG,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACnI,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAY7B;AAID;gEACgE;AAChE,eAAO,MAAM,oBAAoB,oDAAoD,CAAC;AACtF,eAAO,MAAM,gBAAgB,gDAAgD,CAAC;AAC9E,eAAO,MAAM,iBAAiB,4CAA4C,CAAC;AAC3E,eAAO,MAAM,wBAAwB,mDAAmD,CAAC;AAEzF,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAoBhG;AAED,gFAAgF;AAChF,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;CAAE,CAAC,CAMpH;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACpI,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,MAAM,CAAC,CAoBjB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACtG,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAa7B"}

package/dist/agent/oe-oauth/oauth-client.js

@@ -216,7 +216,7 @@ async function postTokenConfidential(tokenEndpoint, client, params, fetchImpl) {
  * RFC 6749 §2.3 forbids authenticating by more than one method in one request.
  */
 export async function exchangeCodeConfidential(tokenEndpoint, input, client, fetchImpl) {
-    const res = await postTokenConfidential(tokenEndpoint, client, { grant_type: "authorization_code", code: input.code, redirect_uri: input.redirectUri }, fetchImpl);
+    const res = await postTokenConfidential(tokenEndpoint, client, { grant_type: "authorization_code", code: input.code, redirect_uri: input.redirectUri, ...(input.codeVerifier ? { code_verifier: input.codeVerifier } : {}) }, fetchImpl);
     return readTokenResponse(tokenEndpoint, res);
 }
 /** Refresh an access token as a CONFIDENTIAL client. Same rotation semantics as the public-client
@@ -259,4 +259,85 @@ export function refreshToken(tokenEndpoint, input, fetchImpl) {
         ...(input.scopes && input.scopes.length ? { scope: input.scopes.join(" ") } : {}),
     }, fetchImpl);
 }
+// ── Cross App Access (OPE-2453): OIDC sign-in at the IdP, then the two ID-JAG legs ─────────────────────────────
+/** RFC 8693 / ID-JAG wire constants. The draft is `draft-ietf-oauth-identity-assertion-authz-grant-04`, so these
+ *  names can still move before an RFC; each lives here once. */
+export const GRANT_TOKEN_EXCHANGE = "urn:ietf:params:oauth:grant-type:token-exchange";
+export const GRANT_JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+export const TOKEN_TYPE_ID_JAG = "urn:ietf:params:oauth:token-type:id-jag";
+export const TOKEN_TYPE_REFRESH_TOKEN = "urn:ietf:params:oauth:token-type:refresh_token";
+/**
+ * OIDC discovery at `issuer` (OpenID Connect Discovery §4). The document's `issuer` MUST equal the configured one
+ * (§4.3): a mismatch means the document is not this IdP's, so it is refused. Every endpoint must be https.
+ */
+export async function discoverOidc(issuer, fetchImpl) {
+    const url = `${trimSlash(issuer)}/.well-known/openid-configuration`;
+    const res = await fetchImpl(url, { headers: { accept: "application/json" }, redirect: "error" });
+    if (!res.ok)
+        throw new OeOauthError(`OIDC discovery failed for ${issuer}`, { httpStatus: res.status, ...(await readError(res)) });
+    const doc = (await res.json().catch(() => ({})));
+    if (doc["issuer"] !== issuer)
+        throw new OeOauthError(`OIDC discovery for ${issuer} names a different issuer — refused`);
+    const https = (k) => {
+        const v = doc[k];
+        if (typeof v !== "string" || v === "")
+            return undefined;
+        if (!v.startsWith("https://"))
+            throw new OeOauthError(`OIDC discovery for ${issuer}: ${k} is not https — refused`);
+        return v;
+    };
+    const authorizationEndpoint = https("authorization_endpoint");
+    const tokenEndpoint = https("token_endpoint");
+    const jwksUri = https("jwks_uri");
+    const revocationEndpoint = https("revocation_endpoint");
+    if (!authorizationEndpoint || !tokenEndpoint || !jwksUri) {
+        throw new OeOauthError(`OIDC discovery for ${issuer} is missing authorization_endpoint, token_endpoint or jwks_uri`);
+    }
+    return { authorizationEndpoint, tokenEndpoint, jwksUri, ...(revocationEndpoint ? { revocationEndpoint } : {}) };
+}
+/** Fetch the IdP's JWKS document — the keys an id token must verify against. */
+export async function fetchJwks(jwksUri, fetchImpl) {
+    const res = await fetchImpl(jwksUri, { headers: { accept: "application/json" }, redirect: "error" });
+    if (!res.ok)
+        throw new OeOauthError(`JWKS fetch failed at ${jwksUri}`, { httpStatus: res.status });
+    const doc = (await res.json().catch(() => ({})));
+    if (!Array.isArray(doc.keys))
+        throw new OeOauthError(`JWKS at ${jwksUri} carries no keys array`);
+    return { keys: doc.keys };
+}
+/**
+ * LEG 1 — RFC 8693 token exchange at the IdP: the person's IdP refresh token for an ID-JAG naming `audience`. OE
+ * authenticates as its IdP client (HTTP Basic). The ID-JAG comes back in `access_token`, and the response must
+ * say `issued_token_type` is an ID-JAG: anything else is not the grant leg 2 expects.
+ */
+export async function requestIdJag(tokenEndpoint, input, client, fetchImpl) {
+    const res = await postTokenConfidential(tokenEndpoint, client, {
+        grant_type: GRANT_TOKEN_EXCHANGE,
+        requested_token_type: TOKEN_TYPE_ID_JAG,
+        subject_token: input.subjectToken,
+        subject_token_type: TOKEN_TYPE_REFRESH_TOKEN,
+        audience: input.audience,
+        ...(input.resource ? { resource: input.resource } : {}),
+        ...(input.scopes && input.scopes.length ? { scope: input.scopes.join(" ") } : {}),
+    }, fetchImpl);
+    const body = (await readTokenResponse(tokenEndpoint, res));
+    if (body.issued_token_type !== TOKEN_TYPE_ID_JAG) {
+        throw new OeOauthError(`token endpoint ${tokenEndpoint} answered the ID-JAG exchange with another token type — refused`);
+    }
+    return body.access_token;
+}
+/**
+ * LEG 2 — RFC 7523 JWT bearer grant at the APP's authorization server: the ID-JAG for the app's access token. OE
+ * authenticates with the client the APP issued it (HTTP Basic); the app checks the ID-JAG's `client_id` against
+ * it. The draft says the app SHOULD NOT return a refresh token, so the caller re-mints at expiry.
+ */
+export async function jwtBearerGrant(tokenEndpoint, input, client, fetchImpl) {
+    const res = await postTokenConfidential(tokenEndpoint, client, {
+        grant_type: GRANT_JWT_BEARER,
+        assertion: input.assertion,
+        ...(input.resource ? { resource: input.resource } : {}),
+        ...(input.scopes && input.scopes.length ? { scope: input.scopes.join(" ") } : {}),
+    }, fetchImpl);
+    return readTokenResponse(tokenEndpoint, res);
+}
 //# sourceMappingURL=oauth-client.js.map

package/dist/agent/oe-oauth/oauth-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../../../agent/oe-oauth/oauth-client.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,6GAA6G;AAE7G,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0B3C,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC,CAAC,MAAM,gBAAgB,MAAM,GAAG,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAa;IACpC,iGAAiG;IACjG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;QACvD,OAAO,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,SAAqB;IAC7E,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,iGAAiG;IACjG,6DAA6D;IAC7D,IAAI,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,0BAA0B,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC1H,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,uCAAuC,CAAC;QAChF,IAAI,YAAY,CAAC,IAAI,EAAE,0BAA0B,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,2CAA2C,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IACvJ,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAwC,CAAC;IAC1F,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACpK,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,YAAY,CAAC,mCAAmC,IAAI,iCAAiC,CAAC,CAAC;IAElH,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,4BAA4B,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChI,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,6CAA6C,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3J,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAKhD,CAAC;IACF,MAAM,qBAAqB,GAAG,OAAO,EAAE,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpH,MAAM,aAAa,GAAG,OAAO,EAAE,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,oBAAoB,GAAG,OAAO,EAAE,CAAC,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;IACjH,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,MAAM,kBAAkB,GAAG,OAAO,EAAE,CAAC,mBAAmB,KAAK,QAAQ,IAAI,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;IACrI,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC,qCAAqC,MAAM,wDAAwD,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,oBAAoB,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/H,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,oBAA4B,EAC5B,KAAyG,EACzG,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,oBAAoB,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,KAAK,CAAC,UAAU;YAC7B,aAAa,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;YAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;YAClC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,yCAAyC,oBAAoB,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5J,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,4CAA4C,CAAC,CAAC;IAChI,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,qBAAqB,CAAC,KAQrC;IACC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1D,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM;QAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;;;8CAI8C;AAC9C,KAAK,UAAU,iBAAiB,CAAC,aAAqB,EAAE,GAAa;IACnE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,kBAAkB,aAAa,aAAa,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YACtH,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;IACxE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,YAAY,CAAC,kBAAkB,aAAa,2BAA2B,CAAC,CAAC;IACpJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,aAAqB,EAAE,IAA4B,EAAE,SAAqB;IACjG,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE;QACzC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,KAA+I,EAC/I,SAAqB;IAErB,OAAO,SAAS,CACd,aAAa,EACb;QACE,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,QAAQ;QAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,EACD,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,kBAA0B,EAC1B,KAAuH,EACvH,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,kBAAkB,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,gFAAgF;YAC3G,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,uBAAuB,kBAAkB,aAAa,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YAChI,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAcD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,YAAoB;IACpE,OAAO,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAO3C;IACC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;QAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM;QAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;;6DAG6D;AAC7D;;;4FAG4F;AAC5F,SAAS,aAAa,CAAC,MAA0B,EAAE,KAAwB;IACzE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,eAAe,CAAU,CAAC;AAEjF,KAAK,UAAU,qBAAqB,CAClC,aAAqB,EACrB,MAA0B,EAC1B,MAA8B,EAC9B,SAAqB;IAErB,MAAM,OAAO,GAA2B,aAAa,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACnF,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC;IACpC,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mCAAmC,CAAC;IACpH,OAAO,CAAC,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,OAAO,SAAS,CAAC,aAAa,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;QACtG,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAqB,EACrB,KAA8D,EAC9D,MAA0B,EAC1B,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC;IACnK,OAAO,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;6FAC6F;AAC7F,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAqB,EACrB,KAA6E,EAC7E,MAA0B,EAC1B,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,qBAAqB,CACrC,aAAa,EACb,MAAM,EACN,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACrJ,SAAS,CACV,CAAC;IACF,OAAO,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,kBAA0B,EAC1B,KAA4F,EAC5F,MAA0B,EAC1B,SAAqB;IAErB,MAAM,OAAO,GAA2B,aAAa,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACnF,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC;IACpC,OAAO,CAAC,cAAc,CAAC,GAAG,mCAAmC,CAAC;IAC9D,OAAO,CAAC,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,kBAAkB,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;QACtI,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,uBAAuB,kBAAkB,aAAa,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YAChI,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,KAAmI,EACnI,SAAqB;IAErB,OAAO,SAAS,CACd,aAAa,EACb;QACE,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,EACD,SAAS,CACV,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../../../agent/oe-oauth/oauth-client.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,6GAA6G;AAE7G,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA4B3C,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC,CAAC,MAAM,gBAAgB,MAAM,GAAG,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAa;IACpC,iGAAiG;IACjG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;QACvD,OAAO,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,SAAqB;IAC7E,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,iGAAiG;IACjG,6DAA6D;IAC7D,IAAI,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,0BAA0B,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC1H,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,uCAAuC,CAAC;QAChF,IAAI,YAAY,CAAC,IAAI,EAAE,0BAA0B,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,2CAA2C,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IACvJ,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAwC,CAAC;IAC1F,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACpK,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,YAAY,CAAC,mCAAmC,IAAI,iCAAiC,CAAC,CAAC;IAElH,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,4BAA4B,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChI,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,6CAA6C,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3J,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAKhD,CAAC;IACF,MAAM,qBAAqB,GAAG,OAAO,EAAE,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpH,MAAM,aAAa,GAAG,OAAO,EAAE,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,oBAAoB,GAAG,OAAO,EAAE,CAAC,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;IACjH,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,MAAM,kBAAkB,GAAG,OAAO,EAAE,CAAC,mBAAmB,KAAK,QAAQ,IAAI,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;IACrI,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC,qCAAqC,MAAM,wDAAwD,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,oBAAoB,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/H,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,oBAA4B,EAC5B,KAAyG,EACzG,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,oBAAoB,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,KAAK,CAAC,UAAU;YAC7B,aAAa,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;YAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;YAClC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,yCAAyC,oBAAoB,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5J,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,4CAA4C,CAAC,CAAC;IAChI,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,qBAAqB,CAAC,KAQrC;IACC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1D,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM;QAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;;;8CAI8C;AAC9C,KAAK,UAAU,iBAAiB,CAAC,aAAqB,EAAE,GAAa;IACnE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,kBAAkB,aAAa,aAAa,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YACtH,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;IACxE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,YAAY,CAAC,kBAAkB,aAAa,2BAA2B,CAAC,CAAC;IACpJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,aAAqB,EAAE,IAA4B,EAAE,SAAqB;IACjG,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE;QACzC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,KAA+I,EAC/I,SAAqB;IAErB,OAAO,SAAS,CACd,aAAa,EACb;QACE,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,QAAQ;QAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,EACD,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,kBAA0B,EAC1B,KAAuH,EACvH,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,kBAAkB,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,gFAAgF;YAC3G,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,uBAAuB,kBAAkB,aAAa,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YAChI,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAcD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,YAAoB;IACpE,OAAO,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAO3C;IACC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;QAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM;QAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;;6DAG6D;AAC7D;;;4FAG4F;AAC5F,SAAS,aAAa,CAAC,MAA0B,EAAE,KAAwB;IACzE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,eAAe,CAAU,CAAC;AAEjF,KAAK,UAAU,qBAAqB,CAClC,aAAqB,EACrB,MAA0B,EAC1B,MAA8B,EAC9B,SAAqB;IAErB,MAAM,OAAO,GAA2B,aAAa,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACnF,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC;IACpC,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mCAAmC,CAAC;IACpH,OAAO,CAAC,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,OAAO,SAAS,CAAC,aAAa,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;QACtG,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAqB,EACrB,KAA8F,EAC9F,MAA0B,EAC1B,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,qBAAqB,CACrC,aAAa,EACb,MAAM,EACN,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC7J,SAAS,CACV,CAAC;IACF,OAAO,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;6FAC6F;AAC7F,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAqB,EACrB,KAA6E,EAC7E,MAA0B,EAC1B,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,qBAAqB,CACrC,aAAa,EACb,MAAM,EACN,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACrJ,SAAS,CACV,CAAC;IACF,OAAO,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,kBAA0B,EAC1B,KAA4F,EAC5F,MAA0B,EAC1B,SAAqB;IAErB,MAAM,OAAO,GAA2B,aAAa,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACnF,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC;IACpC,OAAO,CAAC,cAAc,CAAC,GAAG,mCAAmC,CAAC;IAC9D,OAAO,CAAC,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,kBAAkB,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;QACtI,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,uBAAuB,kBAAkB,aAAa,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YAChI,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,KAAmI,EACnI,SAAqB;IAErB,OAAO,SAAS,CACd,aAAa,EACb;QACE,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,EACD,SAAS,CACV,CAAC;AACJ,CAAC;AAED,kHAAkH;AAElH;gEACgE;AAChE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iDAAiD,CAAC;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,yCAAyC,CAAC;AAC3E,MAAM,CAAC,MAAM,wBAAwB,GAAG,gDAAgD,CAAC;AAUzF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,SAAqB;IACtE,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,mCAAmC,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACjG,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,6BAA6B,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAClI,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC5E,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,MAAM,qCAAqC,CAAC,CAAC;IACxH,MAAM,KAAK,GAAG,CAAC,CAAS,EAAsB,EAAE;QAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QACxD,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACnH,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,qBAAqB,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxD,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa,IAAI,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CAAC,sBAAsB,MAAM,gEAAgE,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAClH,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe,EAAE,SAAqB;IACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACrG,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,wBAAwB,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;IACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,WAAW,OAAO,wBAAwB,CAAC,CAAC;IACjG,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAiC,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,KAAoI,EACpI,MAA0B,EAC1B,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,qBAAqB,CACrC,aAAa,EACb,MAAM,EACN;QACE,UAAU,EAAE,oBAAoB;QAChC,oBAAoB,EAAE,iBAAiB;QACvC,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,kBAAkB,EAAE,wBAAwB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,EACD,SAAS,CACV,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,MAAM,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAyD,CAAC;IACnH,IAAI,IAAI,CAAC,iBAAiB,KAAK,iBAAiB,EAAE,CAAC;QACjD,MAAM,IAAI,YAAY,CAAC,kBAAkB,aAAa,iEAAiE,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,aAAqB,EACrB,KAAsG,EACtG,MAA0B,EAC1B,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,qBAAqB,CACrC,aAAa,EACb,MAAM,EACN;QACE,UAAU,EAAE,gBAAgB;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,EACD,SAAS,CACV,CAAC;IACF,OAAO,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC"}

package/dist/agent/oe-oauth/token-vault.d.ts

@@ -1,4 +1,5 @@
 import type { EncryptedKvVault } from "@open-everywhere/core/agent/adapter-api.js";
+import { recordXaaRefusal, verifyOidcIdToken, type XaaBindingVerdict } from "@open-everywhere/core/agent/adapter-api.js";
 import { type OeOauthProviderConfig } from "./config.js";
 import { type OAuthFetch } from "./oauth-client.js";
 /** A subject a token is minted for — the service identity, or a specific user principal. */
@@ -48,6 +49,20 @@ export interface OeOauthVaultDeps {
      * every other stored secret takes. Read PER TOKEN CALL, so a rotated secret takes effect at once.
      */
     readonly resolveSecret?: (broker: string | undefined, ref: string) => Promise<string>;
+    /** Mints the OIDC nonce of an `xaa` sign-in. Default: the same generator as the opaque state. */
+    readonly newNonce?: () => string;
+    /** Verify an `xaa` sign-in's id token. Default: core's `verifyOidcIdToken` (jose, full signature check). */
+    readonly verifyIdToken?: typeof verifyOidcIdToken;
+    /** Decide whether the IdP account that signed in may complete this requester's `xaa` link. Default: core's
+     *  `checkXaaIdentityBinding` — a confirmed `okta` account on the requester's link-set, refusal by default. */
+    readonly bindIdentity?: (input: {
+        readonly principalSubject: string;
+        readonly signerSubject: string | undefined;
+        readonly connection: string;
+        readonly stage?: "sign-in" | "mint";
+    }) => Promise<XaaBindingVerdict>;
+    /** Audit an `xaa` sign-in refused before the binding ran. Default: core's `recordXaaRefusal`. */
+    readonly recordRefusal?: typeof recordXaaRefusal;
 }
 declare function subjectKey(subject: OeOauthSubject): string;
 /** The provider set a vault reads: a fixed map (a test), or a function read PER CALL (the deployed

package/dist/agent/oe-oauth/token-vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-vault.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/token-vault.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAEnF,OAAO,EAA8C,KAAK,qBAAqB,EAAoC,MAAM,aAAa,CAAC;AACvI,OAAO,EAYL,KAAK,UAAU,EAEhB,MAAM,mBAAmB,CAAC;AAK3B,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAoEvG;;2CAE2C;AAC3C,UAAU,kBAAkB;IAC1B,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAoBD,eAAO,MAAM,kBAAkB,QAAS,CAAC;AASzC,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,iGAAiG;IACjG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,+GAA+G;IAC/G,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;IACnC;gGAC4F;IAC5F,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACvF;AAED,iBAAS,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAEnD;AASD;sFACsF;AACtF,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAEpI;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,GAAE,gBAAqB;;IA6Q5F,wEAAwE;0BA3EvC,MAAM,WAAW,cAAc,KAAG,OAAO,CAAC,OAAO,CAAC;IA8EnF,oFAAoF;+BAtChD,OAAO,CAAC,kBAAkB,CAAC;IAyC/D;;;OAGG;uBACsB,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBzD;;;;;OAKG;0BACyB,MAAM,WAAW,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9E;;;OAGG;oCAEY,MAAM,WACV,cAAc,WACd;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GACrE,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAgD3B;;;;;;;OAOG;iCACgC,MAAM,QAAQ,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAkCxJ;;;OAGG;gCAC+B,MAAM,WAAW,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;EAyEtF;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC"}
+{"version":3,"file":"token-vault.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/token-vault.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAIL,gBAAgB,EAGhB,iBAAiB,EACjB,KAAK,iBAAiB,EACvB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAKL,KAAK,qBAAqB,EAG3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAiBL,KAAK,UAAU,EAEhB,MAAM,mBAAmB,CAAC;AAK3B,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAsEvG;;2CAE2C;AAC3C,UAAU,kBAAkB;IAC1B,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AA6CD,eAAO,MAAM,kBAAkB,QAAS,CAAC;AASzC,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,iGAAiG;IACjG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,+GAA+G;IAC/G,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;IACnC;gGAC4F;IAC5F,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtF,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACjC,4GAA4G;IAC5G,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAClD;kHAC8G;IAC9G,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;KACrC,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjC,iGAAiG;IACjG,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,gBAAgB,CAAC;CAClD;AAED,iBAAS,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAEnD;AASD;sFACsF;AACtF,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAEpI;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,GAAE,gBAAqB;;IAyf5F,wEAAwE;0BA3EvC,MAAM,WAAW,cAAc,KAAG,OAAO,CAAC,OAAO,CAAC;IA8EnF,oFAAoF;+BAtChD,OAAO,CAAC,kBAAkB,CAAC;IAyC/D;;;OAGG;uBACsB,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IAiDzD;;;;;OAKG;0BACyB,MAAM,WAAW,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ9E;;;OAGG;oCAEY,MAAM,WACV,cAAc,WACd;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GACrE,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IA0D3B;;;;;;;OAOG;iCACgC,MAAM,QAAQ,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAsCxJ;;;OAGG;gCAC+B,MAAM,WAAW,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;EA2EtF;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC"}