@sentropic/llm-mesh 0.24.0 → 0.25.0

package/README.md

@@ -89,6 +89,198 @@ const facade = createLlmMeshFacade({
 That migration option is only for pre-ownerScope local records. New enrollment
 always takes ownership from `StartEnrollmentInput.ownerScope`.
 
+## Claude subscription enrollment (LOT 1)
+
+The facade supports browser PKCE enrollment and renewable Claude CLI credential
+import, durable ordinary seats, and refresh on acquire. Hosts without a qualified
+official CLI runner remain **enrollment only**, execution **`not-covered`**.
+The LOT 2 bridge below provides the host injection seam.
+
+```ts
+import { createLlmMeshFacade } from '@sentropic/llm-mesh/facade';
+import type { EnrollmentCompletion } from '@sentropic/llm-mesh/enrollment';
+
+const facade = createLlmMeshFacade({
+  mode: 'cli',
+  configResolver: { async resolveConfig() { return {}; } },
+});
+const session = await facade.enroll('claude-code', {
+  configRef: 'claude-code', mode: 'cli', redirectUri: '', ownerScope: verifiedOwner,
+});
+// A trusted local component opens session.url and captures <code>#<state>.
+// Capability-check optional methods when supporting older mesh versions.
+if (!facade.completeClaudeEnrollment) throw new Error('Claude enrollment unavailable');
+const completion: EnrollmentCompletion = await facade.completeClaudeEnrollment(
+  session.enrollmentId, maskedCodeInput, verifiedOwner,
+);
+```
+
+The authenticated host supplies the owner. Code/credential inputs and the
+authorization URL stay inside trusted local UI/provider/storage components:
+never put them in agent or MCP arguments, shell text, argv, environment variables,
+logs, traces, snapshots, history, clipboard diagnostics or exception receipts.
+Completion/list results contain only public account references and labels. A
+browser session expires after 15 minutes; each completion is one-use, with strict
+state, cancellation and a 30-second token-request deadline. Failed/ambiguous
+exchanges require a fresh enrollment; codes are never retried automatically.
+
+`{}` selects the provisional A2 profile `claude-code-oauth-2.1.296-v1`, sourced from
+the [official 2.1.296 package](https://registry.npmjs.org/@anthropic-ai/claude-code/2.1.296) and
+live-validated on 2026-10-10 (authorize endpoint `claude.com/cai`, `user:plugins` scope, 32-byte
+nonce states).
+Current provider acceptance remains unverified. Nonempty resolver results must be
+complete profiles: `id`, `authorizationUrl`, `tokenUrl`, `clientId`, `redirectUri`,
+`authorizationScopes`, `refreshScopes`, `requiredScopes`, `source`. URLs use HTTPS;
+required scopes include `user:inference` and must occur in authorization/refresh
+scopes. IDs are immutable; the bundled ID cannot be redefined. Redirect input must
+be empty or exactly the configured manual callback. No client secret is required.
+Custom refresh resolves the stored ID and requires an exact version match; keep
+old profiles available while grants exist. Bundled refresh bypasses the host
+resolver. Unknown IDs and legacy `v1.0.0` require reauthentication before HTTP.
+
+For sessionless paste, the trusted component calls the optional
+`facade.completeClaudeCredentialImport(maskedCredentialJson, verifiedOwner)`.
+Accept either the full JSON document containing `claudeAiOauth` or that inner
+object: `accessToken`, `refreshToken`, `expiresAt` (epoch milliseconds), `scopes`.
+The limit is 64 KiB in UTF-8. Access-only strings/setup tokens are refused; missing
+refresh material, blank/CR/LF tokens, invalid expiry or incompatible scopes fail.
+Unknown fields and descriptive identity data are discarded; labels use opaque
+random account IDs. Valid past expiry is accepted offline and refreshed on first
+acquire. Import uses the host's `claude-code` profile, never a profile in the paste.
+
+CLI mode defaults to an encrypted file keyring. Portal mode defaults to memory;
+provide a durable keyring with atomic owner claims for restart persistence.
+Both paths save the envelope, public record and index before local eligibility.
+Refresh stays single-flight through validation, save and publication. Local storage
+or preparation outages before a provider request are retryable; terminal errors or
+failures after a request may have been sent require reauthentication. Scope metadata
+records the actual validated grant scopes.
+One grant means one mesh account and one refresh holder. Imports with a refresh
+token already stored for a Claude account of the same owner are refused with
+"This Claude credential is already enrolled"; comparisons stay in process.
+Use one credential-owning service per grant. Before importing, disable/logout the
+source CLI and record transfer evidence; copying a file does not transfer refresh
+ownership or create a new provider device. Local removal does not prove provider
+revocation. Custody-managed access projections belong to the separate custody host,
+not this ordinary local enrollment/refresh path.
+
+### Terms of use
+
+This tool demonstrates feasibility. **Owner decision:** “each user assumes”
+responsibility for compliance and the risks of account suspension or refused calls.
+This is the owner's allocation of responsibility, not Anthropic permission.
+
+Established distinctions, **verified (source, 2026-09-26)** in
+[Claude Code legal and compliance](https://code.claude.com/docs/en/legal-and-compliance.md):
+
+| Account | Publicly established | Unverified for this mesh deployment |
+| --- | --- | --- |
+| Individual Pro/Max | [Consumer Terms](https://www.anthropic.com/legal/consumer-terms); ordinary native-app OAuth use; advertised limits assume ordinary individual Claude Code/Agent SDK use. Developers may not route requests through Free/Pro/Max credentials on users' behalf. General third-party Claude.ai login restrictions are stated generally; developers “may not collect, store, or intermediate Claude.ai credentials or session tokens — sign-in to a Claude account must complete through Anthropic's own flow”. | Applicability of these restrictions to this user-enrolled arrangement is unverified. |
+| Organization Team/Enterprise | [Commercial Terms](https://www.anthropic.com/legal/commercial-terms); ordinary native-app OAuth use. General third-party Claude.ai login and credential/session-token collection, storage and intermediation restrictions are stated generally; sign-in to a Claude account must complete through Anthropic's own flow. | Applicability of these restrictions to this user-enrolled arrangement is unverified, as are organization-specific agreements/exceptions; the individual-plan routing sentence establishes no organizational exemption. |
+| API key / [Console](https://platform.claude.com/) | [Commercial Terms](https://www.anthropic.com/legal/commercial-terms); recommended developer authentication. Customer-managed keys for authorized users are permitted subject to billing to the key owner and the stated no-resale/intermediation conditions. | Compliance of the actual deployment; API-key guidance does not authorize subscription-token substitution. |
+
+The credential and sign-in restrictions are stated generally for all subscription
+plans. They are relevant to credential-paste enrollment (M4) and mesh storage of
+grants; user enrollment and the owner's decision do not establish an exception.
+
+**Verified (source):** the same page permits hosting the unmodified official binary
+under stated conditions: Commercial Terms, no built-in auth method restricted,
+end-user authentication/direct billing, and no paying/reselling/intermediating their
+usage. It preserves end users' own subscription sign-in to that binary.
+**Unverified:** whether mesh credential projection and runner restrictions meet
+those conditions; executing the official binary alone does not establish permission
+to enroll, store or intermediate subscription credentials.
+
+## Claude official CLI execution (LOT 2 mesh bridge)
+
+`ClaudeCodeRuntimeClient` implements the Anthropic client slot and accepts a
+host-provided `ClaudeCodeCliRunner`. The host executes the unmodified official
+`claude` subprocess; llm-mesh imports no process API and provides no runner,
+Messages transport, client headers, runtime refresh or automatic retry.
+
+```ts
+import { ClaudeCodeRuntimeClient, createDefaultProviderAdapters } from '@sentropic/llm-mesh';
+import type { AnthropicAdapterClient, ClaudeCodeCliRunner, ClaudeCodeCliCapabilities } from '@sentropic/llm-mesh';
+
+// Trusted host supplies these after qualifying the exact CLI and isolated runner.
+declare const runner: ClaudeCodeCliRunner;
+declare const capabilities: ClaudeCodeCliCapabilities;
+declare const directAnthropicClient: AnthropicAdapterClient;
+const adapters = createDefaultProviderAdapters({
+  anthropic: new ClaudeCodeRuntimeClient({ runner, capabilities, fallback: directAnthropicClient }),
+});
+```
+
+Only `account-transport` with provider `claude-code`, and `claude-code-account`,
+reach the runner. Other auth delegates to the supplied direct client, or is
+refused when no fallback exists. Conflicting request auth is removed; the selected
+auth remains in the context. Unresolved auth callbacks without a trusted context
+are refused. A seat failure never falls
+back to metered API authentication. The in-process input contains only access
+token, finite unexpired epoch-millisecond expiry and the actual grant scopes,
+the projected request, and an abort signal. Ordinary scopes come from
+`material.metadata.scopes`; access-only custody uses trusted
+`material.descriptor.metadata.scopes`, filling absent scopes from trusted resolution
+`descriptor.metadata.scopes`; explicit invalid scopes are never replaced.
+No refresh token, headers, account metadata or request auth reaches the runner.
+
+The versioned capability profile requires `cliVersion`, `source` and
+`qualificationRef` for protocol `claude-code-stream-json-v1`. These references are
+trusted host attestations, not verification by mesh. Default request support is
+an explicit `modelId` and one user text message. Only this baseline is expected to
+qualify with the official CLI; `history` and `tools` are expected **`not-covered`**
+unless M3 proves otherwise, with separate source/qualification references.
+**Verified (source):** the [SDK input contract](https://platform.claude.com/docs/en/agent-sdk/typescript)
+uses `SDKUserMessage` streams. “All CLI stream-json input is user-only” remains
+**unverified**: the inspected official 2.1.80 parser also accepts assistant/system
+records (spec A7). Neither fact proves history or mesh-owned tool continuation.
+The tool subset accepts JSON function
+schemas, complete call IDs/arguments and matching string results; it rejects
+incomplete histories and unsupported extras. System/developer prompts, media,
+reasoning, sampling/token limits, structured output, forced/parallel tools and
+provider overrides are refused before running. Callers using `createLlmMesh` may
+use its model-selection contract; mesh resolves it to `modelId` and removes `model`
+before delegation. Direct runtime-client calls must supply `modelId` and omit
+`model`; this client does not resolve aliases or choose a default model.
+
+The host must prove isolated credential/config files, environment allowlisting,
+tool/hook/MCP confinement, bounded parsing, cross-process serialization,
+descendant reaping/cleanup and zero child refresh. Abort and consumer early-close
+signal cancellation; the trusted host owns process termination. A final runner
+result must certify successful cleanup, followed by EOF.
+
+Production must enforce default-deny egress for the runner's **whole process tree**
+using a network namespace or equivalent: allow only qualified inference origins,
+block the OAuth token endpoint and all alternate destinations, and prevent bypass
+by descendants, proxies, direct IPs or inherited host access. Shared inference/token
+origins require enforceable endpoint separation or refusal. The M5 probe is a
+regression check, not this enforcement. Its fixture CA/DNS overrides and fake token
+endpoint are test-only; production denies those overrides and token egress.
+
+The host prefers verified tmpfs (e.g. `$XDG_RUNTIME_DIR`); otherwise it uses a
+dedicated 0700 directory, with exclusive 0600 files, `O_EXCL | O_NOFOLLOW` and
+`lstat` checks. SIGKILL/crash can bypass cleanup and leave an access-only file.
+A supervisor reaps descendants; orphan sweeps run at the next runner start **and
+host boot**, using lock/PID/start/boot identity and a configured staleness threshold
+(default five minutes, with retry for younger orphans). Live or ambiguous owners
+prevent deletion. Sweeps delete within the dedicated root without following
+symlinks or reading credential contents; tmpfs/deletion do not guarantee erasure
+from swap, dumps or storage.
+
+The projection contains the **real expiry**, never a refresh token. Writing an
+earlier timestamp cannot shorten provider validity. The host can refuse remaining
+TTL above `maxRemainingTtlMs` or below its run deadline. Running immediately after
+refresh improves freshness but usually maximizes remaining TTL and does not reduce
+exposure; it may conflict with that maximum. Cleanup cannot revoke a stolen token.
+These host requirements are **unverified implementations** until qualified in h2a.
+The precise contract,
+proposed h2a tests and fake-credential M5 counting probe are in
+[`spec/SPEC_EVOL_LLM_MESH_CLAUDE_SEAT.md`](../../spec/SPEC_EVOL_LLM_MESH_CLAUDE_SEAT.md).
+No real CLI qualification is claimed by the mesh fake-runner tests. Until the
+host supplies a qualified runner, seats remain **enrollment only** and execution
+is **`not-covered`**. The Terms of use and suspension/refused-call risks above
+apply equally when the official CLI executes requests.
+
 ## Route quote
 
 `quoteRoute(input, { council, profiles })` (or `routePlanner.quote(input)`)

package/dist/enrollment/claude-code.d.ts

@@ -1,9 +1,31 @@
+import type { ConfigResolver } from '../service/facade.js';
 import type { CompleteEnrollmentInput, EnrollmentProvider, EnrollmentSession, PreparedCredential, RefreshInput, ResolvedProviderMetadata, StartEnrollmentInput } from './contracts.js';
+export declare class ClaudeRefreshPreparationError extends Error {
+    constructor();
+}
+export interface ClaudeCodeEnrollmentOptions {
+    configResolver?: ConfigResolver;
+    fetchFn?: typeof fetch;
+    nowFn?: () => number;
+}
 export declare class ClaudeCodeEnrollmentProvider implements EnrollmentProvider {
-    start(_input: StartEnrollmentInput): Promise<EnrollmentSession>;
-    complete(_input: CompleteEnrollmentInput): Promise<PreparedCredential>;
-    resolve(_credential: PreparedCredential): Promise<ResolvedProviderMetadata>;
-    refresh(_input: RefreshInput): Promise<PreparedCredential>;
-    cancel(_enrollmentId: string): Promise<void>;
+    private readonly options;
+    private readonly fetchFn;
+    private readonly now;
+    private readonly metadata;
+    private readonly sessions;
+    constructor(options?: ClaudeCodeEnrollmentOptions);
+    private profile;
+    start(input: StartEnrollmentInput): Promise<EnrollmentSession>;
+    complete(input: CompleteEnrollmentInput): Promise<PreparedCredential>;
+    importCredential(credentialJson: string): Promise<PreparedCredential>;
+    resolve(credential: PreparedCredential): Promise<ResolvedProviderMetadata>;
+    private prepare;
+    private grant;
+    private exchange;
+    refresh(input: RefreshInput & {
+        grantedScopes?: unknown;
+    }): Promise<PreparedCredential>;
+    cancel(enrollmentId: string): Promise<void>;
 }
 //# sourceMappingURL=claude-code.d.ts.map

package/dist/enrollment/claude-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../src/enrollment/claude-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,gBAAgB,CAAC;AAExB,qBAAa,4BAA6B,YAAW,kBAAkB;IAC/D,KAAK,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAM/D,QAAQ,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAMtE,OAAO,CAAC,WAAW,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAM3E,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAM1D,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGnD"}
+{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../src/enrollment/claude-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EACV,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,gBAAgB,CAAC;AA+BxB,qBAAa,6BAA8B,SAAQ,KAAK;;CAEvD;AAgCD,MAAM,WAAW,2BAA2B;IAC1C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAYD,qBAAa,4BAA6B,YAAW,kBAAkB;IAKzD,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IACxF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;gBAChC,OAAO,GAAE,2BAAgC;YAKxD,OAAO;IAkBf,KAAK,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmB9D,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiBrE,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAerE,OAAO,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAKhF,OAAO,CAAC,OAAO;IAef,OAAO,CAAC,KAAK;YAcC,QAAQ;IA2BhB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQvF,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CASlD"}

package/dist/enrollment/claude-code.js

@@ -1,18 +1,232 @@
+import { generateNonce, generatePkcePair } from './pkce.js';
+// Public constants verified in official Claude Code 2.1.296 (spec ledger A2; live
+// validation 2026-10-10: the legacy claude.ai authorize endpoint leaves the consent
+// button permanently disabled and current grants carry the user:plugins scope).
+const USER_SCOPES = ['user:profile', 'user:inference', 'user:sessions:claude_code',
+    'user:mcp_servers', 'user:plugins', 'user:file_upload'];
+const BUNDLED_PROFILE = {
+    id: 'claude-code-oauth-2.1.296-v1',
+    authorizationUrl: 'https://claude.com/cai/oauth/authorize',
+    tokenUrl: 'https://platform.claude.com/v1/oauth/token',
+    clientId: '9d1c250a-e61b-44d9-88ed-5944d1962f5e',
+    redirectUri: 'https://platform.claude.com/oauth/code/callback',
+    authorizationScopes: ['org:create_api_key', ...USER_SCOPES],
+    refreshScopes: [...USER_SCOPES], requiredScopes: ['user:inference'],
+    source: 'https://registry.npmjs.org/@anthropic-ai/claude-code/2.1.296',
+};
+const failure = (reason) => new Error(`Claude enrollment: ${reason}; reauthenticate`);
+// Only local preparation failures may permit replaying the same refresh grant.
+export class ClaudeRefreshPreparationError extends Error {
+    constructor() { super('Claude refresh preparation failed; retry later'); }
+}
+const object = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const token = (value) => typeof value === 'string' && value.trim().length > 0 && !/[\r\n]/.test(value);
+const scopes = (value) => Array.isArray(value)
+    && value.length > 0 && value.every((item) => typeof item === 'string' && /^[a-z0-9:_-]+$/.test(item));
+const httpsUrl = (value) => {
+    if (typeof value !== 'string')
+        return false;
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:' && !url.username && !url.password && !url.search && !url.hash;
+    }
+    catch {
+        return false;
+    }
+};
+function validateProfile(value) {
+    if (!object(value) || typeof value.id !== 'string' || !/^[a-z0-9][a-z0-9._-]{2,99}$/.test(value.id)
+        || value.id === 'v1.0.0' || !httpsUrl(value.authorizationUrl) || !httpsUrl(value.tokenUrl)
+        || !httpsUrl(value.redirectUri) || !httpsUrl(value.source) || !token(value.clientId)
+        || !scopes(value.authorizationScopes) || !scopes(value.refreshScopes) || !scopes(value.requiredScopes)
+        || !value.requiredScopes.includes('user:inference')
+        || !value.requiredScopes.every((scope) => value.authorizationScopes.includes(scope)
+            && value.refreshScopes.includes(scope)))
+        throw failure('invalid OAuth profile');
+    const profile = { id: value.id, authorizationUrl: value.authorizationUrl,
+        tokenUrl: value.tokenUrl, redirectUri: value.redirectUri, clientId: value.clientId,
+        source: value.source, authorizationScopes: [...value.authorizationScopes],
+        refreshScopes: [...value.refreshScopes], requiredScopes: [...value.requiredScopes] };
+    if (profile.id === BUNDLED_PROFILE.id && JSON.stringify(profile) !== JSON.stringify({
+        ...profile, ...BUNDLED_PROFILE,
+    }))
+        throw failure('reserved OAuth profile');
+    return profile;
+}
 export class ClaudeCodeEnrollmentProvider {
-    async start(_input) {
-        throw new Error('UNSUPPORTED: claude-code account transport enrollment is portal-only and unsupported locally in h2a-runtime.');
+    options;
+    fetchFn;
+    now;
+    metadata = new WeakMap();
+    sessions = new Map();
+    constructor(options = {}) {
+        this.options = options;
+        this.fetchFn = options.fetchFn ?? fetch;
+        this.now = options.nowFn ?? Date.now;
+    }
+    async profile(configRef, refresh = false) {
+        if (refresh && configRef === BUNDLED_PROFILE.id)
+            return BUNDLED_PROFILE;
+        if (refresh && (!configRef || configRef === 'v1.0.0'))
+            throw failure('unknown OAuth profile');
+        let value;
+        try {
+            value = await this.options.configResolver?.resolveConfig(configRef);
+        }
+        catch {
+            if (refresh)
+                throw new ClaudeRefreshPreparationError();
+            throw failure('OAuth profile resolution failed');
+        }
+        if (!this.options.configResolver || (object(value) && Object.keys(value).length === 0)) {
+            if (refresh)
+                throw failure('unknown OAuth profile');
+            return BUNDLED_PROFILE;
+        }
+        const profile = validateProfile(value);
+        if (refresh && profile.id !== configRef)
+            throw failure('OAuth profile version mismatch');
+        return profile;
+    }
+    async start(input) {
+        if (!input.ownerScope?.trim())
+            throw failure('ownerScope is required');
+        const profile = await this.profile(input.configRef);
+        if (input.redirectUri && input.redirectUri !== profile.redirectUri)
+            throw failure('redirect mismatch');
+        const { codeVerifier, codeChallenge } = generatePkcePair();
+        const state = generateNonce();
+        const enrollmentId = `enr_claude_${generateNonce()}`;
+        const expiresAt = this.now() + 15 * 60_000;
+        const url = new URL(profile.authorizationUrl);
+        url.search = new URLSearchParams({ code: 'true', response_type: 'code', client_id: profile.clientId,
+            redirect_uri: profile.redirectUri, scope: profile.authorizationScopes.join(' '),
+            code_challenge: codeChallenge, code_challenge_method: 'S256', state }).toString();
+        const timer = setTimeout(() => { void this.cancel(enrollmentId); }, 15 * 60_000);
+        timer.unref?.();
+        this.sessions.set(enrollmentId, { profile, verifier: codeVerifier, state, expiresAt,
+            consumed: false, controller: new AbortController(), timer });
+        return { kind: 'authorization-url', enrollmentId, url: url.toString(), expiresAt: new Date(expiresAt).toISOString() };
+    }
+    async complete(input) {
+        const session = this.sessions.get(input.enrollmentId);
+        if (!session || session.consumed)
+            throw failure('session unavailable');
+        session.consumed = true;
+        try {
+            const parts = typeof input.code === 'string' ? input.code.split('#') : [];
+            if (this.now() >= session.expiresAt || parts.length !== 2 || !token(parts[0])
+                || parts[1] !== session.state)
+                throw failure('invalid code, state or expired session');
+            const value = await this.exchange(session.profile, { grant_type: 'authorization_code',
+                code: parts[0], state: session.state, code_verifier: session.verifier,
+                client_id: session.profile.clientId, redirect_uri: session.profile.redirectUri }, session.controller);
+            if (this.sessions.get(input.enrollmentId) !== session || session.controller.signal.aborted
+                || this.now() >= session.expiresAt)
+                throw failure('session cancelled or expired');
+            return this.grant(value, session.profile, `acct_claude_${generateNonce()}`, 'browser');
+        }
+        finally {
+            await this.cancel(input.enrollmentId);
+        }
+    }
+    async importCredential(credentialJson) {
+        if (typeof credentialJson !== 'string' || new TextEncoder().encode(credentialJson).length > 65_536) {
+            throw failure('invalid credential document');
+        }
+        let value;
+        try {
+            value = JSON.parse(credentialJson);
+        }
+        catch {
+            throw failure('Paste the renewable Claude CLI credential or use browser enrollment');
+        }
+        if (object(value) && Object.hasOwn(value, 'claudeAiOauth'))
+            value = value.claudeAiOauth;
+        if (!object(value))
+            throw failure('invalid credential document');
+        const profile = await this.profile('claude-code');
+        return this.prepare(value.accessToken, value.refreshToken, value.expiresAt, value.scopes, profile, `acct_claude_${generateNonce()}`, 'credential-import');
+    }
+    async resolve(credential) {
+        const metadata = this.metadata.get(credential);
+        return metadata ? { ...metadata, scopes: [...metadata.scopes] } : {};
+    }
+    prepare(access, refresh, expiry, grantedScopes, profile, accountId, method) {
+        if (!token(access) || !token(refresh) || typeof expiry !== 'number' || expiry <= 0
+            || !Number.isFinite(expiry) || !Number.isFinite(new Date(expiry).getTime())
+            || !scopes(grantedScopes) || !profile.requiredScopes.every((scope) => grantedScopes.includes(scope))
+            || !grantedScopes.every((scope) => profile.authorizationScopes.includes(scope))) {
+            throw failure('invalid renewable grant');
+        }
+        const credential = { accountId, accessToken: access, refreshToken: refresh,
+            expiresAt: new Date(expiry).toISOString(), authClientConfigVersion: profile.id };
+        this.metadata.set(credential, { billing_type: 'seat', enrollmentMethod: method,
+            authClientConfigVersion: profile.id, refreshManagement: 'mesh', scopes: [...grantedScopes] });
+        return credential;
     }
-    async complete(_input) {
-        throw new Error('UNSUPPORTED: claude-code account transport enrollment is portal-only and unsupported locally in h2a-runtime.');
+    grant(value, profile, accountId, method, previousRefresh, previousScopes) {
+        if (!object(value) || typeof value.expires_in !== 'number' || !Number.isFinite(value.expires_in)
+            || value.expires_in <= 0 || (Object.hasOwn(value, 'scope') && typeof value.scope !== 'string')) {
+            throw failure('invalid token response');
+        }
+        const expiry = this.now() + value.expires_in * 1000;
+        if (expiry <= this.now())
+            throw failure('invalid token expiry');
+        return this.prepare(value.access_token, Object.hasOwn(value, 'refresh_token') ? value.refresh_token : previousRefresh, expiry, typeof value.scope === 'string' ? value.scope.split(' ') : previousScopes, profile, accountId, method);
     }
-    async resolve(_credential) {
-        throw new Error('UNSUPPORTED: claude-code account transport enrollment is portal-only and unsupported locally in h2a-runtime.');
+    async exchange(profile, body, controller = new AbortController()) {
+        let timer;
+        const deadline = new Promise((_, reject) => {
+            timer = setTimeout(() => { controller.abort(); reject(failure('token request timed out')); }, 30_000);
+        });
+        try {
+            return await Promise.race([deadline, (async () => {
+                    let response;
+                    let value;
+                    try {
+                        response = await this.fetchFn(profile.tokenUrl, { method: 'POST', redirect: 'error',
+                            headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body), signal: controller.signal });
+                    }
+                    catch {
+                        throw failure('token request failed');
+                    }
+                    try {
+                        value = await response.json();
+                    }
+                    catch {
+                        throw failure(`HTTP ${response.status} invalid_response`);
+                    }
+                    if (!response.ok) {
+                        const code = object(value) && typeof value.error === 'string'
+                            && ['invalid_grant', 'invalid_request', 'invalid_client', 'unauthorized_client',
+                                'unsupported_grant_type', 'invalid_scope', 'access_denied'].includes(value.error) ? value.error : 'oauth_error';
+                        throw failure(`HTTP ${response.status} ${code}`);
+                    }
+                    return value;
+                })()]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
     }
-    async refresh(_input) {
-        throw new Error('UNSUPPORTED: claude-code account transport refresh is portal-only and unsupported locally in h2a-runtime.');
+    async refresh(input) {
+        const profile = await this.profile(input.credentialVersion, true);
+        if (!token(input.refreshToken))
+            throw failure('missing or invalid refresh token');
+        const value = await this.exchange(profile, { grant_type: 'refresh_token',
+            refresh_token: input.refreshToken, client_id: profile.clientId, scope: profile.refreshScopes.join(' ') });
+        return this.grant(value, profile, input.accountId, 'refresh', input.refreshToken, input.grantedScopes);
     }
-    async cancel(_enrollmentId) {
-        // no-op stub
+    async cancel(enrollmentId) {
+        const session = this.sessions.get(enrollmentId);
+        if (!session)
+            return;
+        this.sessions.delete(enrollmentId);
+        clearTimeout(session.timer);
+        session.controller.abort();
+        session.verifier = '';
+        session.state = '';
     }
 }
 //# sourceMappingURL=claude-code.js.map

package/dist/enrollment/claude-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/enrollment/claude-code.ts"],"names":[],"mappings":"AAUA,MAAM,OAAO,4BAA4B;IACvC,KAAK,CAAC,KAAK,CAAC,MAA4B;QACtC,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAA+B;QAC5C,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,WAA+B;QAC3C,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,aAAa;IACf,CAAC;CACF"}
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/enrollment/claude-code.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAuB5D,kFAAkF;AAClF,oFAAoF;AACpF,gFAAgF;AAChF,MAAM,WAAW,GAAG,CAAC,cAAc,EAAE,gBAAgB,EAAE,2BAA2B;IAChF,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;AAC1D,MAAM,eAAe,GAAuB;IAC1C,EAAE,EAAE,8BAA8B;IAClC,gBAAgB,EAAE,wCAAwC;IAC1D,QAAQ,EAAE,4CAA4C;IACtD,QAAQ,EAAE,sCAAsC;IAChD,WAAW,EAAE,iDAAiD;IAC9D,mBAAmB,EAAE,CAAC,oBAAoB,EAAE,GAAG,WAAW,CAAC;IAC3D,aAAa,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC,gBAAgB,CAAC;IACnE,MAAM,EAAE,8DAA8D;CACvE,CAAC;AACF,MAAM,OAAO,GAAG,CAAC,MAAc,EAAS,EAAE,CAAC,IAAI,KAAK,CAAC,sBAAsB,MAAM,kBAAkB,CAAC,CAAC;AACrG,+EAA+E;AAC/E,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,gBAAgB,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC,CAAC;CAC3E;AACD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAoC,EAAE,CAClE,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChE,MAAM,KAAK,GAAG,CAAC,KAAc,EAAmB,EAAE,CAChD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChF,MAAM,MAAM,GAAG,CAAC,KAAc,EAAqB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;OACrE,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACxG,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC,CAAC;AACF,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;WAC9F,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;WACvF,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;WACjF,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;WACnG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC;WAChD,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAE,KAAK,CAAC,mBAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC;eAC3F,KAAK,CAAC,aAA0B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAClG,MAAM,OAAO,GAAuB,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QAC1F,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ;QAClF,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACzE,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;IACvF,IAAI,OAAO,CAAC,EAAE,KAAK,eAAe,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC;QAClF,GAAG,OAAO,EAAE,GAAG,eAAe;KAC/B,CAAC;QAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC;AACjB,CAAC;AAkBD,MAAM,OAAO,4BAA4B;IAKV;IAJZ,OAAO,CAAe;IACtB,GAAG,CAAe;IAClB,QAAQ,GAAG,IAAI,OAAO,EAAgD,CAAC;IACvE,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7D,YAA6B,UAAuC,EAAE;QAAzC,YAAO,GAAP,OAAO,CAAkC;QACpE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAO,GAAG,KAAK;QACtD,IAAI,OAAO,IAAI,SAAS,KAAK,eAAe,CAAC,EAAE;YAAE,OAAO,eAAe,CAAC;QACxE,IAAI,OAAO,IAAI,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,QAAQ,CAAC;YAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC9F,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YAAC,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAC5E,MAAM,CAAC;YACL,IAAI,OAAO;gBAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;YACvD,MAAM,OAAO,CAAC,iCAAiC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACvF,IAAI,OAAO;gBAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;YACpD,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS;YAAE,MAAM,OAAO,CAAC,gCAAgC,CAAC,CAAC;QACzF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA2B;QACrC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;YAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACvG,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,gBAAgB,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,cAAc,aAAa,EAAE,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC9C,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ;YACjG,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/E,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;QAChF,KAA2C,CAAC,KAAK,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS;YACjF,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IACxH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAA8B;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACvE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;mBACxE,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK;gBAAE,MAAM,OAAO,CAAC,wCAAwC,CAAC,CAAC;YACzF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,oBAAoB;gBACnF,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,QAAQ;gBACrE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YACxG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;mBACrF,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,SAAS;gBAAE,MAAM,OAAO,CAAC,8BAA8B,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,eAAe,aAAa,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QACzF,CAAC;gBAAS,CAAC;YAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,cAAsB;QAC3C,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YACnG,MAAM,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YACjD,MAAM,OAAO,CAAC,qEAAqE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC;QACxF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EACtF,OAAO,EAAE,eAAe,aAAa,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAA8B;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,CAAC;IAEO,OAAO,CAAC,MAAe,EAAE,OAAgB,EAAE,MAAe,EAAE,aAAsB,EACxF,OAA2B,EAAE,SAAiB,EAAE,MAAc;QAC9D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC;eAC7E,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;eACxE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;eACjG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,UAAU,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO;YACxE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM;YAC5E,uBAAuB,EAAE,OAAO,CAAC,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,KAAc,EAAE,OAA2B,EAAE,SAAiB,EAC1E,MAAc,EAAE,eAAwB,EAAE,cAAwB;QAClE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;eAC3F,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;YACjG,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACpD,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EACpC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,EAC7E,MAAM,EAAE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EACjF,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,OAA2B,EAAE,IAA4B,EAC9E,UAAU,GAAG,IAAI,eAAe,EAAE;QAClC,IAAI,KAAgD,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACxG,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,IAAI,EAAE;oBAC/C,IAAI,QAAkB,CAAC;oBACvB,IAAI,KAAc,CAAC;oBACnB,IAAI,CAAC;wBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;4BACjF,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC9G,CAAC;oBAAC,MAAM,CAAC;wBAAC,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;oBAAC,CAAC;oBAClD,IAAI,CAAC;wBAAC,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBAAC,CAAC;oBACtC,MAAM,CAAC;wBAAC,MAAM,OAAO,CAAC,QAAQ,QAAQ,CAAC,MAAM,mBAAmB,CAAC,CAAC;oBAAC,CAAC;oBACpE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;+BACxD,CAAC,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB;gCAC7E,wBAAwB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;wBACpH,MAAM,OAAO,CAAC,QAAQ,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;oBACnD,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACT,CAAC;gBAAS,CAAC;YAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAiD;QAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC;YAAE,MAAM,OAAO,CAAC,kCAAkC,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,eAAe;YACtE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACnC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3B,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/enrollment/index.d.ts

@@ -1,2 +1,2 @@
-export type { AccountPublic, CredentialEnvelope, EnrollmentProvider, EnrollmentSession, PreparedCredential, ResolvedProviderMetadata, StartEnrollmentInput, } from './contracts.js';
+export type { AccountPublic, CredentialEnvelope, EnrollmentCompletion, EnrollmentProvider, EnrollmentSession, PreparedCredential, ResolvedProviderMetadata, StartEnrollmentInput, } from './contracts.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/enrollment/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/enrollment/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/enrollment/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC"}

package/dist/enrollment/pkce.js

@@ -11,7 +11,7 @@ export function generatePkcePair() {
     return { codeVerifier, codeChallenge };
 }
 export function generateNonce() {
-    return base64Url(randomBytes(16));
+    return base64Url(randomBytes(32));
 }
 export async function createLoopbackServer(expectedState, preferredPort = 0) {
     let server = null;

package/dist/index.d.ts

@@ -21,6 +21,7 @@ export * from './codex.js';
 export * from './transport/codex-runtime-client.js';
 export * from './transport/codex-runtime-wire.js';
 export * from './transport/cloud-code-runtime-client.js';
+export * from './transport/claude-code-runtime-client.js';
 export * from './transport/muse-runtime-client.js';
 export * from './transport/mistral-runtime-client.js';
 export * from './streaming.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,iBAAiB,GAChF,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,cAAc,YAAY,CAAC;AAC3B,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,iBAAiB,GAChF,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,cAAc,YAAY,CAAC;AAC3B,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,0CAA0C,CAAC;AACzD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -21,6 +21,7 @@ export * from './codex.js';
 export * from './transport/codex-runtime-client.js';
 export * from './transport/codex-runtime-wire.js';
 export * from './transport/cloud-code-runtime-client.js';
+export * from './transport/claude-code-runtime-client.js';
 export * from './transport/muse-runtime-client.js';
 export * from './transport/mistral-runtime-client.js';
 export * from './streaming.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,0BAA0B,EAAE,eAAe,EAAE,UAAU,GACxD,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,cAAc,YAAY,CAAC;AAC3B,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,0BAA0B,EAAE,eAAe,EAAE,UAAU,GACxD,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,cAAc,YAAY,CAAC;AAC3B,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,0CAA0C,CAAC;AACzD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/dist/route-planner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-planner.d.ts","sourceRoot":"","sources":["../src/route-planner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,KAAK,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAS3G,OAAO,KAAK,EACV,oBAAoB,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,EACjF,qBAAqB,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,sBAAsB,EACtF,wBAAwB,EAAE,UAAU,EAAE,eAAe,EACtD,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,2BAA2B,EAAwB,MAAM,qBAAqB,CAAC;AAoBxF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;CACjE;AACD,qBAAa,oBAAqB,YAAW,YAAY;IAiB3C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAhBpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqC;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAGtB;IACL,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;IACvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAS;gBAErB,OAAO,EAAE,2BAA2B;IAc3D,UAAU,CACd,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,SAAS,wBAAwB,EAAE,CAAC;IAgBzC,IAAI,CAAC,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;IAoKtF,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU;IAGzC,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,UAAU;IAQZ,cAAc,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EACzF,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAsCzE,gBAAgB,CAAC,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAIhH,eAAe,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EACpF,gBAAgB,CAAC,EAAE,MAAM,GAAG,mBAAmB;IAIjD,cAAc,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EACnF,gBAAgB,CAAC,EAAE,MAAM,GAAG,mBAAmB;IAIjD,aAAa,CAAC,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EACnF,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO;IAchC,OAAO,CAAC,cAAc;IA6BtB,OAAO,CAAC,IAAI;IAqCZ,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,IAAI;CAOb"}
+{"version":3,"file":"route-planner.d.ts","sourceRoot":"","sources":["../src/route-planner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,KAAK,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAQ3G,OAAO,KAAK,EACV,oBAAoB,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,EACjF,qBAAqB,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,sBAAsB,EACtF,wBAAwB,EAAE,UAAU,EAAE,eAAe,EACtD,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,2BAA2B,EAAwB,MAAM,qBAAqB,CAAC;AAExF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;CACjE;AACD,qBAAa,oBAAqB,YAAW,YAAY;IAiB3C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAhBpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqC;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAGtB;IACL,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;IACvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAS;gBAErB,OAAO,EAAE,2BAA2B;IAc3D,UAAU,CACd,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,SAAS,wBAAwB,EAAE,CAAC;IAczC,IAAI,CAAC,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;IAyItF,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU;IAGzC,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,UAAU;IAQZ,cAAc,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EACzF,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAsCzE,gBAAgB,CAAC,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAIhH,eAAe,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EACpF,gBAAgB,CAAC,EAAE,MAAM,GAAG,mBAAmB;IAIjD,cAAc,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EACnF,gBAAgB,CAAC,EAAE,MAAM,GAAG,mBAAmB;IAIjD,aAAa,CAAC,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EACnF,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO;IAchC,OAAO,CAAC,cAAc;IA6BtB,OAAO,CAAC,IAAI;IAwBZ,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,IAAI;CAOb"}