@palantir/pack.auth.foundry 0.0.1-beta.1

package/.turbo/turbo-lint.log

@@ -0,0 +1,20 @@
+
+> @palantir/pack.auth.foundry@0.0.1-beta.1 lint /home/runner/work/pack/pack/packages/auth/foundry
+> eslint ./src ; dprint check --config $(find-up dprint.json) --allow-no-files
+
+
+/home/runner/work/pack/pack/packages/auth/foundry/src/__tests__/AuthServiceConfidential.test.ts
+  181:14  warning  A method that is not declared with `this: void` may cause unintentional scoping of `this` when separated from its object.
+Consider using an arrow function or explicitly `.bind()`ing the method to avoid calling the method with an unintended `this` value. 
+If a function does not access `this`, it can be annotated with `this: void`  @typescript-eslint/unbound-method
+  388:14  warning  A method that is not declared with `this: void` may cause unintentional scoping of `this` when separated from its object.
+Consider using an arrow function or explicitly `.bind()`ing the method to avoid calling the method with an unintended `this` value. 
+If a function does not access `this`, it can be annotated with `this: void`  @typescript-eslint/unbound-method
+
+/home/runner/work/pack/pack/packages/auth/foundry/src/__tests__/AuthServiceStatic.test.ts
+  146:14  warning  A method that is not declared with `this: void` may cause unintentional scoping of `this` when separated from its object.
+Consider using an arrow function or explicitly `.bind()`ing the method to avoid calling the method with an unintended `this` value. 
+If a function does not access `this`, it can be annotated with `this: void`  @typescript-eslint/unbound-method
+
+✖ 3 problems (0 errors, 3 warnings)
+

package/.turbo/turbo-transpileBrowser.log

@@ -0,0 +1,5 @@
+
+> @palantir/pack.auth.foundry@0.0.1-beta.1 transpileBrowser /home/runner/work/pack/pack/packages/auth/foundry
+> monorepo-transpile -f esm -m bundle -t browser
+
+👍

package/.turbo/turbo-transpileCjs.log

@@ -0,0 +1,5 @@
+
+> @palantir/pack.auth.foundry@0.0.1-beta.1 transpileCjs /home/runner/work/pack/pack/packages/auth/foundry
+> monorepo-transpile -f cjs -m bundle -t node
+
+👍

package/.turbo/turbo-transpileEsm.log

@@ -0,0 +1,5 @@
+
+> @palantir/pack.auth.foundry@0.0.1-beta.1 transpileEsm /home/runner/work/pack/pack/packages/auth/foundry
+> monorepo-transpile -f esm -m bundle -t node
+
+👍

package/.turbo/turbo-transpileTypes.log

@@ -0,0 +1,5 @@
+
+> @palantir/pack.auth.foundry@0.0.1-beta.1 transpileTypes /home/runner/work/pack/pack/packages/auth/foundry
+> monorepo-transpile -f esm -m types -t node
+
+👍

package/.turbo/turbo-typecheck.log

@@ -0,0 +1,4 @@
+
+> @palantir/pack.auth.foundry@0.0.1-beta.1 typecheck /home/runner/work/pack/pack/packages/auth/foundry
+> tsc --noEmit --emitDeclarationOnly false
+

package/LICENSE.txt

@@ -0,0 +1,13 @@
+Copyright 2025 Palantir Technologies, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -0,0 +1,159 @@
+# @palantir/pack.auth-foundry
+
+Foundry-specific authentication implementations for PACK applications.
+
+## Overview
+
+This package provides concrete authentication services that implement the `@palantir/pack.auth` interfaces for Palantir Foundry platforms. It includes support for various authentication methods including OAuth flows and static token providers.
+
+## Authentication Services
+
+### StaticTokenService
+
+For applications with pre-existing tokens (CLI tools, service accounts, etc.):
+
+```typescript
+import { createStaticTokenService } from "@palantir/pack.auth-foundry";
+
+const tokenProvider = () => Promise.resolve("your-existing-token");
+const service = createStaticTokenService(tokenProvider, baseUrl);
+
+// Starts authenticated immediately
+console.log(service.isAuthenticated()); // true
+console.log(service.isValidated()); // false (until explicitly validated)
+
+// Validate when needed
+await service.validateToken(); // Calls platform API to verify token
+console.log(service.getCurrentUser()); // UserRef with platform data
+```
+
+### PublicOauthService
+
+For browser applications requiring user login:
+
+```typescript
+import { createPublicOauthClient } from "@osdk/oauth";
+import { createPublicOauthService } from "@palantir/pack.auth-foundry";
+
+const oauthClient = createPublicOauthClient(clientId, baseUrl, redirectUrl);
+const service = createPublicOauthService(oauthClient, baseUrl);
+
+// Starts unauthenticated
+console.log(service.isAuthenticated()); // false
+
+// User must sign in
+await service.signIn(); // Redirects to OAuth flow
+console.log(service.isAuthenticated()); // true (after successful OAuth)
+
+// Validate to get user data
+await service.validateToken();
+console.log(service.getCurrentUser()); // UserRef with platform data
+```
+
+### ConfidentialOauthService
+
+For server-side applications with client credentials:
+
+```typescript
+import { createConfidentialOauthClient } from "@osdk/oauth";
+import { createConfidentialOauthService } from "@palantir/pack.auth-foundry";
+
+const oauthClient = createConfidentialOauthClient(
+  clientId,
+  clientSecret,
+  baseUrl,
+);
+const service = createConfidentialOauthService(oauthClient, baseUrl);
+
+// Starts authenticated after initial token fetch
+await service.signIn(); // Performs client credentials flow
+console.log(service.isAuthenticated()); // true
+
+// Validate to get user data (may not be available for service accounts)
+await service.validateToken();
+```
+
+## Authentication vs Validation
+
+All services follow the same pattern:
+
+- **Authenticated**: Has a token available locally
+- **Validated**: Token has been verified with the Foundry platform
+
+This separation allows for:
+
+- **Fast startup**: No blocking API calls during initialization
+- **Explicit validation**: Apps control when validation occurs
+- **Token reuse**: Works with existing/cached tokens
+- **User data access**: Only available after validation
+
+```typescript
+// Immediately after creation
+service.isAuthenticated(); // May be true (static/confidential) or false (public)
+service.isValidated(); // Always false initially
+service.getCurrentUser(); // Always undefined initially
+
+// After validation
+await service.validateToken();
+service.isValidated(); // true if token is valid
+service.getCurrentUser(); // UserRef if validation succeeded
+```
+
+## Integration
+
+This package is typically used through `@palantir/pack.app`'s `initPackApp()` function, which automatically creates the appropriate service based on the OSDK client's authentication:
+
+```typescript
+import { createClient } from "@osdk/client";
+import {
+  createConfidentialOauthClient,
+  createPublicOauthClient,
+} from "@osdk/oauth";
+import { initPackApp } from "@palantir/pack.app";
+
+// Public OAuth (browser apps)
+const publicAuth = createPublicOauthClient(
+  "your-client-id",
+  "https://your-foundry-instance.com",
+  "http://localhost:3000/callback",
+);
+const publicClient = createClient(baseUrl, ontologyRid, publicAuth);
+const app = initPackApp(publicClient, { app: { appId: "your-app" } });
+
+// Static token (CLI/service)
+const tokenProvider = () => Promise.resolve("your-token");
+const tokenClient = createClient(baseUrl, ontologyRid, tokenProvider);
+const app = initPackApp(tokenClient, { app: { appId: "your-app" } });
+
+// Confidential OAuth (server apps)
+const confidentialAuth = createConfidentialOauthClient(
+  "your-client-id",
+  "your-client-secret",
+  "https://your-foundry-instance.com",
+);
+const confidentialClient = createClient(baseUrl, ontologyRid, confidentialAuth);
+const app = initPackApp(confidentialClient, { app: { appId: "your-app" } });
+
+// Override auth with custom token provider
+const app = initPackApp(client, {
+  app: { appId: "your-app" },
+  auth: customTokenProvider, // Override client's auth
+});
+```
+
+The services handle platform-specific details like:
+
+- OAuth flow management
+- Token refresh and expiration
+- Platform API integration for validation
+- User data fetching and caching
+- State change notifications
+
+## Platform APIs
+
+Token validation uses the Foundry platform API:
+
+- **Endpoint**: `${baseUrl}/multipass/api/users/me`
+- **Purpose**: Verify token validity and fetch user information
+- **Caching**: User data cached for 5 minutes via UserRef
+- **Error handling**: Network errors and invalid tokens handled gracefully

package/build/browser/index.js

@@ -0,0 +1,374 @@
+import { AuthState } from '@palantir/pack.auth';
+export { createAuthModuleConfig } from '@palantir/pack.auth';
+import { Users } from '@osdk/foundry.admin';
+
+// src/auth/AuthServiceConfidential.ts
+
+// src/utils/jwtUtils.ts
+function maybeDecodeUuidClaim(value) {
+  if (!Array.isArray(value)) {
+    return void 0;
+  }
+  if (value.length === 16 && value.every((v) => typeof v === "number")) {
+    return decodeUuidBytes(value);
+  }
+  return void 0;
+}
+function decodeUuidBytes(bytes) {
+  if (bytes.length !== 16) {
+    return "";
+  }
+  const hex = bytes.map((b) => b.toString(16).padStart(2, "0")).join("");
+  return [hex.slice(0, 8), hex.slice(8, 12), hex.slice(12, 16), hex.slice(16, 20), hex.slice(20, 32)].join("-");
+}
+function parseJwtToken(token) {
+  if (!token) {
+    return void 0;
+  }
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+      return void 0;
+    }
+    const payload = parts[1];
+    if (!payload) {
+      return void 0;
+    }
+    const paddedPayload = payload.padEnd(payload.length + (4 - payload.length % 4) % 4, "=");
+    const decoded = JSON.parse(atob(paddedPayload));
+    return {
+      // JWT exp is seconds since epoch, convert to ms
+      expiryInstantUtc: typeof decoded.exp === "number" ? decoded.exp * 1e3 : void 0,
+      orgId: maybeDecodeUuidClaim(decoded.org),
+      sessionId: maybeDecodeUuidClaim(decoded.sid),
+      tokenId: maybeDecodeUuidClaim(decoded.jti),
+      userId: maybeDecodeUuidClaim(decoded.sub)
+    };
+  } catch {
+    return void 0;
+  }
+}
+
+// src/auth/AuthServiceBase.ts
+var AuthServiceBase = class {
+  currentState;
+  isTokenValidated = false;
+  currentUserId;
+  cachedUserData;
+  stateCallbacks = /* @__PURE__ */ new Set();
+  tokenChangeCallbacks = /* @__PURE__ */ new Set();
+  currentToken;
+  app;
+  logger;
+  constructor(app, logger, initialState = AuthState.Unauthenticated) {
+    this.app = app;
+    this.logger = logger;
+    this.currentState = initialState;
+  }
+  clearUserState() {
+    this.isTokenValidated = false;
+    this.currentUserId = void 0;
+    this.cachedUserData = void 0;
+  }
+  isAuthenticated() {
+    return this.getTokenOrUndefined() != null;
+  }
+  getCurrentUserId() {
+    return this.isTokenValidated ? this.currentUserId : void 0;
+  }
+  isValidated() {
+    return this.isTokenValidated;
+  }
+  async validateToken() {
+    if (!this.isAuthenticated()) {
+      this.clearUserState();
+      return false;
+    }
+    if (this.app.config.isTestMode) {
+      this.isTokenValidated = true;
+      return true;
+    }
+    try {
+      const user = await Users.getCurrent(this.app.config.osdkClient);
+      this.isTokenValidated = true;
+      this.cachedUserData = user;
+      this.currentUserId = user.id;
+      return true;
+    } catch (error) {
+      this.logger.error("Token validation failed", error);
+      this.clearUserState();
+      return false;
+    }
+  }
+  onAuthStateChange(callback) {
+    this.stateCallbacks.add(callback);
+    try {
+      callback({
+        state: this.currentState
+      });
+    } catch (err) {
+      this.logger.error("Error in auth state callback:", err);
+    }
+    return () => {
+      this.stateCallbacks.delete(callback);
+    };
+  }
+  onTokenChange(callback) {
+    this.tokenChangeCallbacks.add(callback);
+    const token = this.getTokenOrUndefined();
+    if (token != null) {
+      const info = parseJwtToken(token) ?? {};
+      try {
+        callback(token, info);
+      } catch (err) {
+        this.logger.error("Error in token change callback:", err);
+      }
+    }
+    return () => {
+      this.tokenChangeCallbacks.delete(callback);
+    };
+  }
+  getCurrentState() {
+    return this.currentState;
+  }
+  async getUserData(userId, force) {
+    if (!this.isTokenValidated || !this.currentUserId || this.currentUserId !== userId) {
+      throw new Error(`User data not available for userId: ${userId}`);
+    }
+    if (!force && this.cachedUserData) {
+      return this.cachedUserData;
+    }
+    if (this.app.config.isTestMode) {
+      throw new Error("Cannot refresh user data in test mode");
+    }
+    try {
+      const user = await Users.get(this.app.config.osdkClient, userId);
+      this.cachedUserData = user;
+      return user;
+    } catch (error) {
+      this.logger.error("Failed to refresh user data", error);
+      throw new Error("Failed to refresh user data");
+    }
+  }
+  dispose() {
+    this.stateCallbacks.clear();
+    this.tokenChangeCallbacks.clear();
+    this.clearUserState();
+  }
+  notifyTokenChange(token) {
+    const info = (token != null ? parseJwtToken(token) : void 0) ?? {};
+    this.tokenChangeCallbacks.forEach((callback) => {
+      try {
+        callback(token, info);
+      } catch (err) {
+        this.logger.error("Error in token change callback:", err);
+      }
+    });
+  }
+  updateState(newState, error) {
+    const previousState = this.currentState;
+    this.currentState = newState;
+    const event = {
+      previousState,
+      state: newState,
+      error
+    };
+    this.stateCallbacks.forEach((callback) => {
+      try {
+        callback(event);
+      } catch (err) {
+        this.logger.error("Error in auth state callback:", err);
+      }
+    });
+  }
+};
+
+// src/auth/AuthServiceConfidential.ts
+var AuthServiceConfidential = class extends AuthServiceBase {
+  oauthClient;
+  constructor(app, oauthClient) {
+    const initialState = oauthClient.getTokenOrUndefined() ? AuthState.Authenticated : AuthState.Unauthenticated;
+    super(app, app.config.logger.child({}, {
+      msgPrefix: "AuthServiceConfidential"
+    }), initialState);
+    this.oauthClient = oauthClient;
+    this.oauthClient.addEventListener("signIn", this.signInHandler);
+    this.oauthClient.addEventListener("signOut", this.signOutHandler);
+  }
+  async getToken() {
+    return this.oauthClient();
+  }
+  signInHandler = () => {
+    this.updateState(AuthState.Authenticated);
+    const token = this.getTokenOrUndefined();
+    this.notifyTokenChange(token);
+  };
+  signOutHandler = () => {
+    this.updateState(AuthState.Unauthenticated);
+    this.notifyTokenChange(void 0);
+  };
+  getTokenOrUndefined() {
+    return this.oauthClient.getTokenOrUndefined();
+  }
+  async signIn() {
+    try {
+      this.updateState(AuthState.Authenticating);
+      await this.oauthClient.signIn();
+    } catch (error) {
+      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+  async signOut() {
+    try {
+      this.clearUserState();
+      await this.oauthClient.signOut();
+    } catch (error) {
+      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+  dispose() {
+    this.oauthClient.removeEventListener("signIn", this.signInHandler);
+    this.oauthClient.removeEventListener("signOut", this.signOutHandler);
+    super.dispose();
+  }
+};
+function createConfidentialOauthService(app, oauthClient) {
+  return new AuthServiceConfidential(app, oauthClient);
+}
+var AuthServicePublic = class extends AuthServiceBase {
+  hasInitialized = false;
+  oauthClient;
+  constructor(app, oauthClient) {
+    super(app, app.config.logger.child({}, {
+      msgPrefix: "AuthServicePublic"
+    }), AuthState.Initializing);
+    this.oauthClient = oauthClient;
+    this.oauthClient.addEventListener("signIn", this.signInHandler);
+    this.oauthClient.addEventListener("signOut", this.signOutHandler);
+    this.oauthClient.addEventListener("refresh", this.refreshHandler);
+  }
+  async getToken() {
+    return this.oauthClient();
+  }
+  signInHandler = () => {
+    const token = this.getTokenOrUndefined();
+    this.notifyTokenChange(token);
+    this.updateState(AuthState.Authenticated);
+  };
+  signOutHandler = () => {
+    this.notifyTokenChange(void 0);
+    this.updateState(AuthState.Unauthenticated);
+  };
+  refreshHandler = () => {
+    const token = this.getTokenOrUndefined();
+    this.notifyTokenChange(token);
+    this.updateState(AuthState.Authenticated);
+  };
+  getTokenOrUndefined() {
+    return this.oauthClient.getTokenOrUndefined();
+  }
+  onAuthStateChange(callback) {
+    const unsubscribe = super.onAuthStateChange(callback);
+    if (!this.hasInitialized && this.currentState === AuthState.Initializing) {
+      this.hasInitialized = true;
+      void this.signIn().catch(() => {
+      });
+    }
+    return unsubscribe;
+  }
+  async signIn() {
+    try {
+      this.updateState(AuthState.Authenticating);
+      await this.oauthClient.signIn();
+    } catch (error) {
+      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+  async signOut() {
+    try {
+      this.clearUserState();
+      await this.oauthClient.signOut();
+    } catch (error) {
+      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+  async refresh() {
+    try {
+      await this.oauthClient.refresh();
+    } catch (error) {
+      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+  dispose() {
+    this.oauthClient.removeEventListener("signIn", this.signInHandler);
+    this.oauthClient.removeEventListener("signOut", this.signOutHandler);
+    this.oauthClient.removeEventListener("refresh", this.refreshHandler);
+    super.dispose();
+  }
+};
+function createPublicOauthService(app, oauthClient) {
+  return new AuthServicePublic(app, oauthClient);
+}
+var AuthServiceStatic = class extends AuthServiceBase {
+  tokenProvider;
+  latestToken;
+  constructor(app, tokenProvider) {
+    super(app, app.config.logger.child({}, {
+      msgPrefix: "AuthServiceStatic"
+    }), AuthState.Unauthenticated);
+    this.tokenProvider = tokenProvider;
+    void this.getToken().catch(() => {
+    });
+  }
+  async getToken() {
+    try {
+      const token = await this.tokenProvider();
+      if (this.latestToken !== token) {
+        this.latestToken = token;
+        this.notifyTokenChange(token);
+        if (this.currentState !== AuthState.Authenticated) {
+          this.updateState(AuthState.Authenticated);
+        }
+      }
+      return token;
+    } catch (error) {
+      if (this.latestToken !== void 0) {
+        this.latestToken = void 0;
+        this.notifyTokenChange(void 0);
+      }
+      this.updateState(AuthState.Error, error);
+      throw error;
+    }
+  }
+  getTokenOrUndefined() {
+    return this.latestToken;
+  }
+  isAuthenticated() {
+    return this.latestToken != null;
+  }
+  signIn() {
+    return Promise.resolve();
+  }
+  signOut() {
+    this.clearUserState();
+    this.latestToken = void 0;
+    this.updateState(AuthState.Unauthenticated);
+    return Promise.reject(new Error("Sign out not supported for static token providers"));
+  }
+  dispose() {
+    super.dispose();
+    this.latestToken = void 0;
+  }
+};
+function createStaticTokenService(app, tokenProvider) {
+  return new AuthServiceStatic(app, tokenProvider);
+}
+
+export { createConfidentialOauthService, createPublicOauthService, createStaticTokenService };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/build/browser/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/jwtUtils.ts","../../src/auth/AuthServiceBase.ts","../../src/auth/AuthServiceConfidential.ts","../../src/auth/AuthServicePublic.ts","../../src/auth/AuthServiceStatic.ts"],"names":["AuthState"],"mappings":";;;;;;;AAoBA,SAAS,qBAAqB,KAAA,EAAO;AACnC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,CAAM,WAAW,EAAA,IAAM,KAAA,CAAM,MAAM,CAAA,CAAA,KAAK,OAAO,CAAA,KAAM,QAAQ,CAAA,EAAG;AAElE,IAAA,OAAO,gBAAgB,KAAK,CAAA;AAAA,EAC9B;AACA,EAAA,OAAO,MAAA;AACT;AAMA,SAAS,gBAAgB,KAAA,EAAO;AAC9B,EAAA,IAAI,KAAA,CAAM,WAAW,EAAA,EAAI;AACvB,IAAA,OAAO,EAAA;AAAA,EACT;AAGA,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAGnE,EAAA,OAAO,CAAC,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,EAAG,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,EAAG,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA,EAAG,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA,EAAG,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC9G;AAeO,SAAS,cAAc,KAAA,EAAO;AACnC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI;AAEF,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,OAAO,KAAA,CAAA;AAAA,IACT;AAGA,IAAA,MAAM,OAAA,GAAU,MAAM,CAAC,CAAA;AACvB,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO,KAAA,CAAA;AAAA,IACT;AAGA,IAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAA,CAAU,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,IAAK,CAAA,EAAG,GAAG,CAAA;AACvF,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,aAAa,CAAC,CAAA;AAC9C,IAAA,OAAO;AAAA;AAAA,MAEL,kBAAkB,OAAO,OAAA,CAAQ,QAAQ,QAAA,GAAW,OAAA,CAAQ,MAAM,GAAA,GAAO,KAAA,CAAA;AAAA,MACzE,KAAA,EAAO,oBAAA,CAAqB,OAAA,CAAQ,GAAG,CAAA;AAAA,MACvC,SAAA,EAAW,oBAAA,CAAqB,OAAA,CAAQ,GAAG,CAAA;AAAA,MAC3C,OAAA,EAAS,oBAAA,CAAqB,OAAA,CAAQ,GAAG,CAAA;AAAA,MACzC,MAAA,EAAQ,oBAAA,CAAqB,OAAA,CAAQ,GAAG;AAAA,KAC1C;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;;;ACxEO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAAA;AAAA,EACA,gBAAA,GAAmB,KAAA;AAAA,EACnB,aAAA;AAAA,EACA,cAAA;AAAA,EACA,cAAA,uBAAqB,GAAA,EAAI;AAAA,EACzB,oBAAA,uBAA2B,GAAA,EAAI;AAAA,EAC/B,YAAA;AAAA,EACA,GAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA,CAAY,GAAA,EAAK,MAAA,EAAQ,YAAA,GAAe,UAAU,eAAA,EAAiB;AACjE,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AAAA,EACtB;AAAA,EACA,cAAA,GAAiB;AACf,IAAA,IAAA,CAAK,gBAAA,GAAmB,KAAA;AACxB,IAAA,IAAA,CAAK,aAAA,GAAgB,MAAA;AACrB,IAAA,IAAA,CAAK,cAAA,GAAiB,MAAA;AAAA,EACxB;AAAA,EACA,eAAA,GAAkB;AAChB,IAAA,OAAO,IAAA,CAAK,qBAAoB,IAAK,IAAA;AAAA,EACvC;AAAA,EACA,gBAAA,GAAmB;AACjB,IAAA,OAAO,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,aAAA,GAAgB,MAAA;AAAA,EACtD;AAAA,EACA,WAAA,GAAc;AACZ,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACd;AAAA,EACA,MAAM,aAAA,GAAgB;AACpB,IAAA,IAAI,CAAC,IAAA,CAAK,eAAA,EAAgB,EAAG;AAC3B,MAAA,IAAA,CAAK,cAAA,EAAe;AACpB,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,UAAA,EAAY;AAC9B,MAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AACxB,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,IAAI;AACF,MAAA,MAAM,OAAO,MAAM,KAAA,CAAM,WAAW,IAAA,CAAK,GAAA,CAAI,OAAO,UAAU,CAAA;AAC9D,MAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AACxB,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,IAAA,CAAK,gBAAgB,IAAA,CAAK,EAAA;AAC1B,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,yBAAA,EAA2B,KAAK,CAAA;AAClD,MAAA,IAAA,CAAK,cAAA,EAAe;AACpB,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA,EACA,kBAAkB,QAAA,EAAU;AAC1B,IAAA,IAAA,CAAK,cAAA,CAAe,IAAI,QAAQ,CAAA;AAChC,IAAA,IAAI;AACF,MAAA,QAAA,CAAS;AAAA,QACP,OAAO,IAAA,CAAK;AAAA,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,+BAAA,EAAiC,GAAG,CAAA;AAAA,IACxD;AACA,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,cAAA,CAAe,OAAO,QAAQ,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EACA,cAAc,QAAA,EAAU;AACtB,IAAA,IAAA,CAAK,oBAAA,CAAqB,IAAI,QAAQ,CAAA;AAGtC,IAAA,MAAM,KAAA,GAAQ,KAAK,mBAAA,EAAoB;AACvC,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,MAAM,IAAA,GAAO,aAAA,CAAc,KAAK,CAAA,IAAK,EAAC;AACtC,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,OAAO,IAAI,CAAA;AAAA,MACtB,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,iCAAA,EAAmC,GAAG,CAAA;AAAA,MAC1D;AAAA,IACF;AACA,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,oBAAA,CAAqB,OAAO,QAAQ,CAAA;AAAA,IAC3C,CAAA;AAAA,EACF;AAAA,EACA,eAAA,GAAkB;AAChB,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA,EACA,MAAM,WAAA,CAAY,MAAA,EAAQ,KAAA,EAAO;AAC/B,IAAA,IAAI,CAAC,KAAK,gBAAA,IAAoB,CAAC,KAAK,aAAA,IAAiB,IAAA,CAAK,kBAAkB,MAAA,EAAQ;AAClF,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oCAAA,EAAuC,MAAM,CAAA,CAAE,CAAA;AAAA,IACjE;AACA,IAAA,IAAI,CAAC,KAAA,IAAS,IAAA,CAAK,cAAA,EAAgB;AACjC,MAAA,OAAO,IAAA,CAAK,cAAA;AAAA,IACd;AACA,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,UAAA,EAAY;AAC9B,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD;AACA,IAAA,IAAI;AAEF,MAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,GAAA,CAAI,KAAK,GAAA,CAAI,MAAA,CAAO,YAAY,MAAM,CAAA;AAC/D,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,6BAAA,EAA+B,KAAK,CAAA;AACtD,MAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,OAAA,GAAU;AACR,IAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAC1B,IAAA,IAAA,CAAK,qBAAqB,KAAA,EAAM;AAChC,IAAA,IAAA,CAAK,cAAA,EAAe;AAAA,EACtB;AAAA,EACA,kBAAkB,KAAA,EAAO;AACvB,IAAA,MAAM,QAAQ,KAAA,IAAS,IAAA,GAAO,cAAc,KAAK,CAAA,GAAI,WAAc,EAAC;AACpE,IAAA,IAAA,CAAK,oBAAA,CAAqB,QAAQ,CAAA,QAAA,KAAY;AAC5C,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,OAAO,IAAI,CAAA;AAAA,MACtB,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,iCAAA,EAAmC,GAAG,CAAA;AAAA,MAC1D;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA,EACA,WAAA,CAAY,UAAU,KAAA,EAAO;AAC3B,IAAA,MAAM,gBAAgB,IAAA,CAAK,YAAA;AAC3B,IAAA,IAAA,CAAK,YAAA,GAAe,QAAA;AACpB,IAAA,MAAM,KAAA,GAAQ;AAAA,MACZ,aAAA;AAAA,MACA,KAAA,EAAO,QAAA;AAAA,MACP;AAAA,KACF;AACA,IAAA,IAAA,CAAK,cAAA,CAAe,QAAQ,CAAA,QAAA,KAAY;AACtC,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,KAAK,CAAA;AAAA,MAChB,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,+BAAA,EAAiC,GAAG,CAAA;AAAA,MACxD;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AACF,CAAA;;;ACvIO,IAAM,uBAAA,GAAN,cAAsC,eAAA,CAAgB;AAAA,EAC3D,WAAA;AAAA,EACA,WAAA,CAAY,KAAK,WAAA,EAAa;AAC5B,IAAA,MAAM,eAAe,WAAA,CAAY,mBAAA,EAAoB,GAAIA,SAAAA,CAAU,gBAAgBA,SAAAA,CAAU,eAAA;AAC7F,IAAA,KAAA,CAAM,KAAK,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,EAAC,EAAG;AAAA,MACrC,SAAA,EAAW;AAAA,KACZ,GAAG,YAAY,CAAA;AAChB,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,WAAA,CAAY,gBAAA,CAAiB,QAAA,EAAU,IAAA,CAAK,aAAa,CAAA;AAC9D,IAAA,IAAA,CAAK,WAAA,CAAY,gBAAA,CAAiB,SAAA,EAAW,IAAA,CAAK,cAAc,CAAA;AAAA,EAClE;AAAA,EACA,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,KAAK,WAAA,EAAY;AAAA,EAC1B;AAAA,EACA,gBAAgB,MAAM;AACpB,IAAA,IAAA,CAAK,WAAA,CAAYA,UAAU,aAAa,CAAA;AACxC,IAAA,MAAM,KAAA,GAAQ,KAAK,mBAAA,EAAoB;AACvC,IAAA,IAAA,CAAK,kBAAkB,KAAK,CAAA;AAAA,EAC9B,CAAA;AAAA,EACA,iBAAiB,MAAM;AACrB,IAAA,IAAA,CAAK,WAAA,CAAYA,UAAU,eAAe,CAAA;AAC1C,IAAA,IAAA,CAAK,kBAAkB,MAAS,CAAA;AAAA,EAClC,CAAA;AAAA,EACA,mBAAA,GAAsB;AACpB,IAAA,OAAO,IAAA,CAAK,YAAY,mBAAA,EAAoB;AAAA,EAC9C;AAAA,EACA,MAAM,MAAA,GAAS;AACb,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,WAAA,CAAYA,UAAU,cAAc,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,YAAY,MAAA,EAAO;AAAA,IAChC,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,WAAA,CAAYA,SAAAA,CAAU,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAC3F,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,OAAA,GAAU;AACd,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,cAAA,EAAe;AACpB,MAAA,MAAM,IAAA,CAAK,YAAY,OAAA,EAAQ;AAAA,IACjC,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,WAAA,CAAYA,SAAAA,CAAU,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAC3F,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EACA,OAAA,GAAU;AACR,IAAA,IAAA,CAAK,WAAA,CAAY,mBAAA,CAAoB,QAAA,EAAU,IAAA,CAAK,aAAa,CAAA;AACjE,IAAA,IAAA,CAAK,WAAA,CAAY,mBAAA,CAAoB,SAAA,EAAW,IAAA,CAAK,cAAc,CAAA;AACnE,IAAA,KAAA,CAAM,OAAA,EAAQ;AAAA,EAChB;AACF,CAAA;AAKO,SAAS,8BAAA,CAA+B,KAAK,WAAA,EAAa;AAC/D,EAAA,OAAO,IAAI,uBAAA,CAAwB,GAAA,EAAK,WAAW,CAAA;AACrD;ACxDO,IAAM,iBAAA,GAAN,cAAgC,eAAA,CAAgB;AAAA,EACrD,cAAA,GAAiB,KAAA;AAAA,EACjB,WAAA;AAAA,EACA,WAAA,CAAY,KAAK,WAAA,EAAa;AAC5B,IAAA,KAAA,CAAM,KAAK,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,EAAC,EAAG;AAAA,MACrC,SAAA,EAAW;AAAA,KACZ,CAAA,EAAGA,SAAAA,CAAU,YAAY,CAAA;AAC1B,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,WAAA,CAAY,gBAAA,CAAiB,QAAA,EAAU,IAAA,CAAK,aAAa,CAAA;AAC9D,IAAA,IAAA,CAAK,WAAA,CAAY,gBAAA,CAAiB,SAAA,EAAW,IAAA,CAAK,cAAc,CAAA;AAChE,IAAA,IAAA,CAAK,WAAA,CAAY,gBAAA,CAAiB,SAAA,EAAW,IAAA,CAAK,cAAc,CAAA;AAAA,EAClE;AAAA,EACA,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,KAAK,WAAA,EAAY;AAAA,EAC1B;AAAA,EACA,gBAAgB,MAAM;AACpB,IAAA,MAAM,KAAA,GAAQ,KAAK,mBAAA,EAAoB;AACvC,IAAA,IAAA,CAAK,kBAAkB,KAAK,CAAA;AAC5B,IAAA,IAAA,CAAK,WAAA,CAAYA,UAAU,aAAa,CAAA;AAAA,EAC1C,CAAA;AAAA,EACA,iBAAiB,MAAM;AACrB,IAAA,IAAA,CAAK,kBAAkB,MAAS,CAAA;AAChC,IAAA,IAAA,CAAK,WAAA,CAAYA,UAAU,eAAe,CAAA;AAAA,EAC5C,CAAA;AAAA,EACA,iBAAiB,MAAM;AACrB,IAAA,MAAM,KAAA,GAAQ,KAAK,mBAAA,EAAoB;AACvC,IAAA,IAAA,CAAK,kBAAkB,KAAK,CAAA;AAC5B,IAAA,IAAA,CAAK,WAAA,CAAYA,UAAU,aAAa,CAAA;AAAA,EAC1C,CAAA;AAAA,EACA,mBAAA,GAAsB;AACpB,IAAA,OAAO,IAAA,CAAK,YAAY,mBAAA,EAAoB;AAAA,EAC9C;AAAA,EACA,kBAAkB,QAAA,EAAU;AAC1B,IAAA,MAAM,WAAA,GAAc,KAAA,CAAM,iBAAA,CAAkB,QAAQ,CAAA;AACpD,IAAA,IAAI,CAAC,IAAA,CAAK,cAAA,IAAkB,IAAA,CAAK,YAAA,KAAiBA,UAAU,YAAA,EAAc;AACxE,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,KAAK,IAAA,CAAK,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM;AAAA,MAI/B,CAAC,CAAA;AAAA,IACH;AACA,IAAA,OAAO,WAAA;AAAA,EACT;AAAA,EACA,MAAM,MAAA,GAAS;AACb,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,WAAA,CAAYA,UAAU,cAAc,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,YAAY,MAAA,EAAO;AAAA,IAChC,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,WAAA,CAAYA,SAAAA,CAAU,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAC3F,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,OAAA,GAAU;AACd,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,cAAA,EAAe;AACpB,MAAA,MAAM,IAAA,CAAK,YAAY,OAAA,EAAQ;AAAA,IACjC,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,WAAA,CAAYA,SAAAA,CAAU,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAC3F,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,OAAA,GAAU;AACd,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,YAAY,OAAA,EAAQ;AAAA,IACjC,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,WAAA,CAAYA,SAAAA,CAAU,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAC3F,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EACA,OAAA,GAAU;AACR,IAAA,IAAA,CAAK,WAAA,CAAY,mBAAA,CAAoB,QAAA,EAAU,IAAA,CAAK,aAAa,CAAA;AACjE,IAAA,IAAA,CAAK,WAAA,CAAY,mBAAA,CAAoB,SAAA,EAAW,IAAA,CAAK,cAAc,CAAA;AACnE,IAAA,IAAA,CAAK,WAAA,CAAY,mBAAA,CAAoB,SAAA,EAAW,IAAA,CAAK,cAAc,CAAA;AACnE,IAAA,KAAA,CAAM,OAAA,EAAQ;AAAA,EAChB;AACF,CAAA;AAKO,SAAS,wBAAA,CAAyB,KAAK,WAAA,EAAa;AACzD,EAAA,OAAO,IAAI,iBAAA,CAAkB,GAAA,EAAK,WAAW,CAAA;AAC/C;ACnFO,IAAM,iBAAA,GAAN,cAAgC,eAAA,CAAgB;AAAA,EACrD,aAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA,CAAY,KAAK,aAAA,EAAe;AAC9B,IAAA,KAAA,CAAM,KAAK,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,EAAC,EAAG;AAAA,MACrC,SAAA,EAAW;AAAA,KACZ,CAAA,EAAGA,SAAAA,CAAU,eAAe,CAAA;AAC7B,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AACrB,IAAA,KAAK,IAAA,CAAK,QAAA,EAAS,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAAA,EACrC;AAAA,EACA,MAAM,QAAA,GAAW;AACf,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,aAAA,EAAc;AACvC,MAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,EAAO;AAC9B,QAAA,IAAA,CAAK,WAAA,GAAc,KAAA;AACnB,QAAA,IAAA,CAAK,kBAAkB,KAAK,CAAA;AAC5B,QAAA,IAAI,IAAA,CAAK,YAAA,KAAiBA,SAAAA,CAAU,aAAA,EAAe;AACjD,UAAA,IAAA,CAAK,WAAA,CAAYA,UAAU,aAAa,CAAA;AAAA,QAC1C;AAAA,MACF;AACA,MAAA,OAAO,KAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,IAAA,CAAK,gBAAgB,MAAA,EAAW;AAClC,QAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AACnB,QAAA,IAAA,CAAK,kBAAkB,MAAS,CAAA;AAAA,MAClC;AACA,MAAA,IAAA,CAAK,WAAA,CAAYA,SAAAA,CAAU,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EACA,mBAAA,GAAsB;AACpB,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EACd;AAAA,EACA,eAAA,GAAkB;AAChB,IAAA,OAAO,KAAK,WAAA,IAAe,IAAA;AAAA,EAC7B;AAAA,EACA,MAAA,GAAS;AACP,IAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,EACzB;AAAA,EACA,OAAA,GAAU;AACR,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AACnB,IAAA,IAAA,CAAK,WAAA,CAAYA,UAAU,eAAe,CAAA;AAC1C,IAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,mDAAmD,CAAC,CAAA;AAAA,EACtF;AAAA,EACA,OAAA,GAAU;AACR,IAAA,KAAA,CAAM,OAAA,EAAQ;AACd,IAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AAAA,EACrB;AACF,CAAA;AAKO,SAAS,wBAAA,CAAyB,KAAK,aAAA,EAAe;AAC3D,EAAA,OAAO,IAAI,iBAAA,CAAkB,GAAA,EAAK,aAAa,CAAA;AACjD","file":"index.js","sourcesContent":["/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Decode a Palantir-specific JWT claim that stores UUIDs as 16-byte arrays.\n * These are the sub, sid, jti, and org claims.\n */\nfunction maybeDecodeUuidClaim(value) {\n  if (!Array.isArray(value)) {\n    return undefined;\n  }\n  if (value.length === 16 && value.every(v => typeof v === \"number\")) {\n    // Convert 16-byte array to UUID string\n    return decodeUuidBytes(value);\n  }\n  return undefined;\n}\n\n/**\n * Convert a 16-byte array to UUID string format.\n * Based on Palantir's UUID encoding format.\n */\nfunction decodeUuidBytes(bytes) {\n  if (bytes.length !== 16) {\n    return \"\";\n  }\n\n  // Convert bytes to hex string\n  const hex = bytes.map(b => b.toString(16).padStart(2, \"0\")).join(\"\");\n\n  // Format as UUID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\n  return [hex.slice(0, 8), hex.slice(8, 12), hex.slice(12, 16), hex.slice(16, 20), hex.slice(20, 32)].join(\"-\");\n}\n\n/**\n * Represents the parsed payload from a JWT token (unverified).\n * The information provided should not be used for security-sensitive\n * applications unless verified through some other process.\n */\n\n/**\n * Parse JWT token to extract unverified claims including userId, sessionId, tokenId, organizationId, and expiry.\n * This does NOT verify the token signature - it only extracts payload data.\n *\n * @param token - JWT token string\n * @returns Unverified token info or undefined if parsing fails\n */\nexport function parseJwtToken(token) {\n  if (!token) {\n    return undefined;\n  }\n  try {\n    // JWT tokens have 3 parts separated by dots: header.payload.signature\n    const parts = token.split(\".\");\n    if (parts.length !== 3) {\n      return undefined;\n    }\n\n    // Decode the payload (second part)\n    const payload = parts[1];\n    if (!payload) {\n      return undefined;\n    }\n\n    // Add padding if needed for base64 decoding\n    const paddedPayload = payload.padEnd(payload.length + (4 - payload.length % 4) % 4, \"=\");\n    const decoded = JSON.parse(atob(paddedPayload));\n    return {\n      // JWT exp is seconds since epoch, convert to ms\n      expiryInstantUtc: typeof decoded.exp === \"number\" ? decoded.exp * 1000 : undefined,\n      orgId: maybeDecodeUuidClaim(decoded.org),\n      sessionId: maybeDecodeUuidClaim(decoded.sid),\n      tokenId: maybeDecodeUuidClaim(decoded.jti),\n      userId: maybeDecodeUuidClaim(decoded.sub)\n    };\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Check if a JWT token is expired based on its exp claim (unverified).\n *\n * @param tokenInfo - Unverified token info\n * @returns true if token is expired, false if valid or no expiry info\n */\nexport function isTokenExpired(tokenInfo) {\n  if (!tokenInfo.expiryInstantUtc) {\n    return false; // No expiry info, assume valid\n  }\n  const now = Date.now();\n  return tokenInfo.expiryInstantUtc < now;\n}","/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Users } from \"@osdk/foundry.admin\";\nimport { AuthState } from \"@palantir/pack.auth\";\nimport { parseJwtToken } from \"../utils/jwtUtils.js\";\nexport class AuthServiceBase {\n  currentState;\n  isTokenValidated = false;\n  currentUserId;\n  cachedUserData;\n  stateCallbacks = new Set();\n  tokenChangeCallbacks = new Set();\n  currentToken;\n  app;\n  logger;\n  constructor(app, logger, initialState = AuthState.Unauthenticated) {\n    this.app = app;\n    this.logger = logger;\n    this.currentState = initialState;\n  }\n  clearUserState() {\n    this.isTokenValidated = false;\n    this.currentUserId = undefined;\n    this.cachedUserData = undefined;\n  }\n  isAuthenticated() {\n    return this.getTokenOrUndefined() != null;\n  }\n  getCurrentUserId() {\n    return this.isTokenValidated ? this.currentUserId : undefined;\n  }\n  isValidated() {\n    return this.isTokenValidated;\n  }\n  async validateToken() {\n    if (!this.isAuthenticated()) {\n      this.clearUserState();\n      return false;\n    }\n    if (this.app.config.isTestMode) {\n      this.isTokenValidated = true;\n      return true;\n    }\n    try {\n      const user = await Users.getCurrent(this.app.config.osdkClient);\n      this.isTokenValidated = true;\n      this.cachedUserData = user;\n      this.currentUserId = user.id;\n      return true;\n    } catch (error) {\n      this.logger.error(\"Token validation failed\", error);\n      this.clearUserState();\n      return false;\n    }\n  }\n  onAuthStateChange(callback) {\n    this.stateCallbacks.add(callback);\n    try {\n      callback({\n        state: this.currentState\n      });\n    } catch (err) {\n      this.logger.error(\"Error in auth state callback:\", err);\n    }\n    return () => {\n      this.stateCallbacks.delete(callback);\n    };\n  }\n  onTokenChange(callback) {\n    this.tokenChangeCallbacks.add(callback);\n\n    // Immediately notify with current token if available\n    const token = this.getTokenOrUndefined();\n    if (token != null) {\n      const info = parseJwtToken(token) ?? {};\n      try {\n        callback(token, info);\n      } catch (err) {\n        this.logger.error(\"Error in token change callback:\", err);\n      }\n    }\n    return () => {\n      this.tokenChangeCallbacks.delete(callback);\n    };\n  }\n  getCurrentState() {\n    return this.currentState;\n  }\n  async getUserData(userId, force) {\n    if (!this.isTokenValidated || !this.currentUserId || this.currentUserId !== userId) {\n      throw new Error(`User data not available for userId: ${userId}`);\n    }\n    if (!force && this.cachedUserData) {\n      return this.cachedUserData;\n    }\n    if (this.app.config.isTestMode) {\n      throw new Error(\"Cannot refresh user data in test mode\");\n    }\n    try {\n      // TODO: debounce and use Users.getBatch for efficiency when looking up multiple users\n      const user = await Users.get(this.app.config.osdkClient, userId);\n      this.cachedUserData = user;\n      return user;\n    } catch (error) {\n      this.logger.error(\"Failed to refresh user data\", error);\n      throw new Error(\"Failed to refresh user data\");\n    }\n  }\n  dispose() {\n    this.stateCallbacks.clear();\n    this.tokenChangeCallbacks.clear();\n    this.clearUserState();\n  }\n  notifyTokenChange(token) {\n    const info = (token != null ? parseJwtToken(token) : undefined) ?? {};\n    this.tokenChangeCallbacks.forEach(callback => {\n      try {\n        callback(token, info);\n      } catch (err) {\n        this.logger.error(\"Error in token change callback:\", err);\n      }\n    });\n  }\n  updateState(newState, error) {\n    const previousState = this.currentState;\n    this.currentState = newState;\n    const event = {\n      previousState,\n      state: newState,\n      error\n    };\n    this.stateCallbacks.forEach(callback => {\n      try {\n        callback(event);\n      } catch (err) {\n        this.logger.error(\"Error in auth state callback:\", err);\n      }\n    });\n  }\n}","/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthState } from \"@palantir/pack.auth\";\nimport { AuthServiceBase } from \"./AuthServiceBase.js\";\nexport class AuthServiceConfidential extends AuthServiceBase {\n  oauthClient;\n  constructor(app, oauthClient) {\n    const initialState = oauthClient.getTokenOrUndefined() ? AuthState.Authenticated : AuthState.Unauthenticated;\n    super(app, app.config.logger.child({}, {\n      msgPrefix: \"AuthServiceConfidential\"\n    }), initialState);\n    this.oauthClient = oauthClient;\n    this.oauthClient.addEventListener(\"signIn\", this.signInHandler);\n    this.oauthClient.addEventListener(\"signOut\", this.signOutHandler);\n  }\n  async getToken() {\n    return this.oauthClient();\n  }\n  signInHandler = () => {\n    this.updateState(AuthState.Authenticated);\n    const token = this.getTokenOrUndefined();\n    this.notifyTokenChange(token);\n  };\n  signOutHandler = () => {\n    this.updateState(AuthState.Unauthenticated);\n    this.notifyTokenChange(undefined);\n  };\n  getTokenOrUndefined() {\n    return this.oauthClient.getTokenOrUndefined();\n  }\n  async signIn() {\n    try {\n      this.updateState(AuthState.Authenticating);\n      await this.oauthClient.signIn();\n    } catch (error) {\n      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));\n      throw error;\n    }\n  }\n  async signOut() {\n    try {\n      this.clearUserState();\n      await this.oauthClient.signOut();\n    } catch (error) {\n      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));\n      throw error;\n    }\n  }\n  dispose() {\n    this.oauthClient.removeEventListener(\"signIn\", this.signInHandler);\n    this.oauthClient.removeEventListener(\"signOut\", this.signOutHandler);\n    super.dispose();\n  }\n}\n\n/**\n * Creates a confidential OAuth auth service that wraps a ConfidentialOauthClient\n */\nexport function createConfidentialOauthService(app, oauthClient) {\n  return new AuthServiceConfidential(app, oauthClient);\n}","/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthState } from \"@palantir/pack.auth\";\nimport { AuthServiceBase } from \"./AuthServiceBase.js\";\nexport class AuthServicePublic extends AuthServiceBase {\n  hasInitialized = false;\n  oauthClient;\n  constructor(app, oauthClient) {\n    super(app, app.config.logger.child({}, {\n      msgPrefix: \"AuthServicePublic\"\n    }), AuthState.Initializing);\n    this.oauthClient = oauthClient;\n    this.oauthClient.addEventListener(\"signIn\", this.signInHandler);\n    this.oauthClient.addEventListener(\"signOut\", this.signOutHandler);\n    this.oauthClient.addEventListener(\"refresh\", this.refreshHandler);\n  }\n  async getToken() {\n    return this.oauthClient();\n  }\n  signInHandler = () => {\n    const token = this.getTokenOrUndefined();\n    this.notifyTokenChange(token);\n    this.updateState(AuthState.Authenticated);\n  };\n  signOutHandler = () => {\n    this.notifyTokenChange(undefined);\n    this.updateState(AuthState.Unauthenticated);\n  };\n  refreshHandler = () => {\n    const token = this.getTokenOrUndefined();\n    this.notifyTokenChange(token);\n    this.updateState(AuthState.Authenticated);\n  };\n  getTokenOrUndefined() {\n    return this.oauthClient.getTokenOrUndefined();\n  }\n  onAuthStateChange(callback) {\n    const unsubscribe = super.onAuthStateChange(callback);\n    if (!this.hasInitialized && this.currentState === AuthState.Initializing) {\n      this.hasInitialized = true;\n      void this.signIn().catch(() => {\n        // Don't allow unhandled rejection to bubble up, mostly for testing.\n        // Note the signIn method will log errors and throw for promise consumers,\n        // but we don't need to handle anything here.\n      });\n    }\n    return unsubscribe;\n  }\n  async signIn() {\n    try {\n      this.updateState(AuthState.Authenticating);\n      await this.oauthClient.signIn();\n    } catch (error) {\n      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));\n      throw error;\n    }\n  }\n  async signOut() {\n    try {\n      this.clearUserState();\n      await this.oauthClient.signOut();\n    } catch (error) {\n      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));\n      throw error;\n    }\n  }\n  async refresh() {\n    try {\n      await this.oauthClient.refresh();\n    } catch (error) {\n      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));\n      throw error;\n    }\n  }\n  dispose() {\n    this.oauthClient.removeEventListener(\"signIn\", this.signInHandler);\n    this.oauthClient.removeEventListener(\"signOut\", this.signOutHandler);\n    this.oauthClient.removeEventListener(\"refresh\", this.refreshHandler);\n    super.dispose();\n  }\n}\n\n/**\n * Creates a public OAuth auth service that wraps a PublicOauthClient\n */\nexport function createPublicOauthService(app, oauthClient) {\n  return new AuthServicePublic(app, oauthClient);\n}","/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthState } from \"@palantir/pack.auth\";\nimport { AuthServiceBase } from \"./AuthServiceBase.js\";\nexport class AuthServiceStatic extends AuthServiceBase {\n  tokenProvider;\n  latestToken;\n  constructor(app, tokenProvider) {\n    super(app, app.config.logger.child({}, {\n      msgPrefix: \"AuthServiceStatic\"\n    }), AuthState.Unauthenticated);\n    this.tokenProvider = tokenProvider;\n    void this.getToken().catch(() => {});\n  }\n  async getToken() {\n    try {\n      const token = await this.tokenProvider();\n      if (this.latestToken !== token) {\n        this.latestToken = token;\n        this.notifyTokenChange(token);\n        if (this.currentState !== AuthState.Authenticated) {\n          this.updateState(AuthState.Authenticated);\n        }\n      }\n      return token;\n    } catch (error) {\n      if (this.latestToken !== undefined) {\n        this.latestToken = undefined;\n        this.notifyTokenChange(undefined);\n      }\n      this.updateState(AuthState.Error, error);\n      throw error;\n    }\n  }\n  getTokenOrUndefined() {\n    return this.latestToken;\n  }\n  isAuthenticated() {\n    return this.latestToken != null;\n  }\n  signIn() {\n    return Promise.resolve();\n  }\n  signOut() {\n    this.clearUserState();\n    this.latestToken = undefined;\n    this.updateState(AuthState.Unauthenticated);\n    return Promise.reject(new Error(\"Sign out not supported for static token providers\"));\n  }\n  dispose() {\n    super.dispose();\n    this.latestToken = undefined;\n  }\n}\n\n/**\n * Creates a static token auth service for CLI/service scenarios where a token is provided externally.\n */\nexport function createStaticTokenService(app, tokenProvider) {\n  return new AuthServiceStatic(app, tokenProvider);\n}"]}