accounts 0.4.0 → 0.4.2

package/dist/server/CliAuth.js

@@ -0,0 +1,446 @@
+import { Address as core_Address, Base64, Hex, PublicKey } from 'ox';
+import { KeyAuthorization as TempoKeyAuthorization, SignatureEnvelope } from 'ox/tempo';
+import { createClient, http } from 'viem';
+import { verifyHash } from 'viem/actions';
+import { tempo } from 'viem/chains';
+import * as z from 'zod/mini';
+import * as u from '../core/zod/utils.js';
+/** Supported access-key types for CLI bootstrap. */
+export const keyType = z.union([z.literal('secp256k1'), z.literal('p256'), z.literal('webAuthn')]);
+/** Signed key authorization returned by the device-code flow. */
+export const keyAuthorization = z.object({
+    address: u.address(),
+    chainId: u.bigint(),
+    expiry: z.nullish(u.number()),
+    keyId: u.address(),
+    keyType,
+    limits: z.optional(z.readonly(z.array(z.object({ token: u.address(), limit: u.bigint() })))),
+    signature: z.custom(),
+});
+/** Request body for `POST /auth/pkce/code`. */
+export const createRequest = z.object({
+    account: z.optional(u.address()),
+    codeChallenge: z.string(),
+    expiry: z.optional(z.number()),
+    keyType: z.optional(keyType),
+    limits: z.optional(z.readonly(z.array(z.object({ token: u.address(), limit: u.bigint() })))),
+    pubKey: u.hex(),
+});
+/** Response body for `POST /cli-auth/device-code`. */
+export const createResponse = z.object({
+    code: z.string(),
+});
+/** Request body for `POST /auth/pkce/poll/:code`. */
+export const pollRequest = z.object({
+    codeVerifier: z.string(),
+});
+/** Response body for `POST /auth/pkce/poll/:code`. */
+export const pollResponse = u.oneOf([
+    z.object({
+        status: z.literal('pending'),
+    }),
+    z.object({
+        status: z.literal('authorized'),
+        accountAddress: u.address(),
+        keyAuthorization: keyAuthorization,
+    }),
+    z.object({
+        status: z.literal('expired'),
+    }),
+]);
+/** Response body for `GET /auth/pkce/pending/:code`. */
+export const pendingResponse = z.object({
+    accessKeyAddress: u.address(),
+    account: z.optional(u.address()),
+    chainId: u.bigint(),
+    code: z.string(),
+    expiry: z.number(),
+    keyType,
+    limits: z.optional(z.readonly(z.array(z.object({ token: u.address(), limit: u.bigint() })))),
+    pubKey: u.hex(),
+    status: z.literal('pending'),
+});
+/** Request body for `POST /auth/pkce`. */
+export const authorizeRequest = z.object({
+    accountAddress: u.address(),
+    code: z.string(),
+    keyAuthorization: keyAuthorization,
+});
+/** Response body for `POST /cli-auth/authorize`. */
+export const authorizeResponse = z.object({
+    status: z.literal('authorized'),
+});
+/** Stored device-code entry schema. */
+export const entry = u.oneOf([
+    z.object({
+        account: z.optional(u.address()),
+        chainId: u.bigint(),
+        code: z.string(),
+        codeChallenge: z.string(),
+        createdAt: z.number(),
+        expiresAt: z.number(),
+        expiry: z.number(),
+        keyType,
+        limits: z.optional(z.readonly(z.array(z.object({ token: u.address(), limit: u.bigint() })))),
+        pubKey: u.hex(),
+        status: z.literal('pending'),
+    }),
+    z.object({
+        account: z.optional(u.address()),
+        accountAddress: u.address(),
+        authorizedAt: z.number(),
+        chainId: u.bigint(),
+        code: z.string(),
+        codeChallenge: z.string(),
+        createdAt: z.number(),
+        expiresAt: z.number(),
+        expiry: z.number(),
+        keyAuthorization,
+        keyType,
+        limits: z.optional(z.readonly(z.array(z.object({ token: u.address(), limit: u.bigint() })))),
+        pubKey: u.hex(),
+        status: z.literal('authorized'),
+    }),
+    z.object({
+        account: z.optional(u.address()),
+        accountAddress: u.address(),
+        authorizedAt: z.number(),
+        chainId: u.bigint(),
+        code: z.string(),
+        codeChallenge: z.string(),
+        consumedAt: z.number(),
+        createdAt: z.number(),
+        expiresAt: z.number(),
+        expiry: z.number(),
+        keyAuthorization,
+        keyType,
+        limits: z.optional(z.readonly(z.array(z.object({ token: u.address(), limit: u.bigint() })))),
+        pubKey: u.hex(),
+        status: z.literal('consumed'),
+    }),
+]);
+/** Error thrown when pending device-code lookup cannot return a pending request. */
+export class PendingError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.name = 'PendingError';
+        this.status = status;
+    }
+}
+/** Built-in device-code store helpers. */
+export const Store = {
+    /**
+     * Creates an in-memory device-code store.
+     *
+     * Useful for tests and single-process servers.
+     */
+    memory() {
+        const entries = new Map();
+        return {
+            async authorize(options) {
+                const current = entries.get(options.code);
+                if (!current || current.status !== 'pending')
+                    return undefined;
+                const next = {
+                    ...current,
+                    accountAddress: options.accountAddress,
+                    authorizedAt: Date.now(),
+                    keyAuthorization: options.keyAuthorization,
+                    status: 'authorized',
+                };
+                entries.set(options.code, next);
+                return next;
+            },
+            async consume(code) {
+                const current = entries.get(code);
+                if (!current || current.status !== 'authorized')
+                    return undefined;
+                entries.set(code, {
+                    ...current,
+                    consumedAt: Date.now(),
+                    status: 'consumed',
+                });
+                return current;
+            },
+            async create(entry_) {
+                entries.set(entry_.code, entry_);
+            },
+            async delete(code) {
+                entries.delete(code);
+            },
+            async get(code) {
+                return entries.get(code);
+            },
+        };
+    },
+    /**
+     * Creates a key-value backed device-code store.
+     *
+     * Stored values are encoded through the shared entry schema so they remain
+     * JSON-safe across KV implementations.
+     */
+    kv(kv, options = {}) {
+        const key = options.key ?? 'cli-auth';
+        function toKey(code) {
+            return `${key}:${code}`;
+        }
+        return {
+            async authorize(options) {
+                const current = await this.get(options.code);
+                if (!current || current.status !== 'pending')
+                    return undefined;
+                const next = {
+                    ...current,
+                    accountAddress: options.accountAddress,
+                    authorizedAt: Date.now(),
+                    keyAuthorization: options.keyAuthorization,
+                    status: 'authorized',
+                };
+                await kv.set(toKey(options.code), z.encode(entry, next));
+                return next;
+            },
+            async consume(code) {
+                const current = await this.get(code);
+                if (!current || current.status !== 'authorized')
+                    return undefined;
+                await kv.set(toKey(code), z.encode(entry, {
+                    ...current,
+                    consumedAt: Date.now(),
+                    status: 'consumed',
+                }));
+                return current;
+            },
+            async create(entry_) {
+                await kv.set(toKey(entry_.code), z.encode(entry, entry_));
+            },
+            async delete(code) {
+                await kv.delete(toKey(code));
+            },
+            async get(code) {
+                const value = await kv.get(toKey(code));
+                if (!value)
+                    return undefined;
+                return z.decode(entry, value);
+            },
+        };
+    },
+};
+/** Built-in policy helpers. */
+export const Policy = {
+    /** Creates an allow-all policy with a default 24-hour expiry when omitted. */
+    allow() {
+        return {
+            validate({ expiry, limits }) {
+                return {
+                    expiry: expiry ?? Math.floor(Date.now() / 1000) + 60 * 60 * 24,
+                    ...(limits ? { limits } : {}),
+                };
+            },
+        };
+    },
+    /** Returns the provided policy unchanged. */
+    from(policy) {
+        return policy;
+    },
+};
+/** Creates and stores a new device code. */
+export async function createDeviceCode(options) {
+    const { chainId = BigInt(tempo.id), now = Date.now, policy = Policy.allow(), random = randomBytes, request, store = Store.memory(), ttlMs = 10 * 60 * 1_000, } = options;
+    const { account, codeChallenge, pubKey } = request;
+    const keyType = request.keyType ?? 'secp256k1';
+    const approved = await policy.validate({
+        ...(account ? { account } : {}),
+        expiry: request.expiry,
+        keyType,
+        ...(request.limits ? { limits: request.limits } : {}),
+        pubKey,
+    });
+    let code;
+    for (let i = 0; i < 10; i++) {
+        const candidate = createCode(random);
+        if (await store.get(candidate))
+            continue;
+        code = candidate;
+        break;
+    }
+    if (!code)
+        throw new Error('Unable to allocate device code.');
+    const createdAt = now();
+    await store.create({
+        ...(account ? { account } : {}),
+        chainId: typeof chainId === 'bigint' ? chainId : BigInt(chainId),
+        code,
+        codeChallenge,
+        createdAt,
+        expiresAt: createdAt + ttlMs,
+        expiry: approved.expiry,
+        keyType,
+        ...(approved.limits ? { limits: approved.limits } : {}),
+        pubKey,
+        status: 'pending',
+    });
+    return { code };
+}
+/** Looks up a pending device code for browser approval UIs. */
+export async function pending(options) {
+    const { code, now = Date.now, store = Store.memory() } = options;
+    const normalized = normalizeCode(code);
+    const current = await store.get(normalized);
+    if (!current)
+        throw new PendingError('Unknown device code.', 404);
+    if (isExpired(current, now)) {
+        await store.delete(normalized);
+        throw new PendingError('Expired device code.', 404);
+    }
+    if (current.status !== 'pending')
+        throw new PendingError('Device code already completed.', 400);
+    return {
+        accessKeyAddress: core_Address.fromPublicKey(PublicKey.from(current.pubKey)),
+        ...(current.account ? { account: current.account } : {}),
+        chainId: current.chainId,
+        code: current.code,
+        expiry: current.expiry,
+        keyType: current.keyType,
+        ...(current.limits ? { limits: current.limits } : {}),
+        pubKey: current.pubKey,
+        status: 'pending',
+    };
+}
+/** Polls a device code with PKCE verification. */
+export async function poll(options) {
+    const { code, now = Date.now, request, store = Store.memory() } = options;
+    const normalized = normalizeCode(code);
+    const current = await store.get(normalized);
+    if (!current)
+        return { status: 'expired' };
+    if (isExpired(current, now)) {
+        await store.delete(normalized);
+        return { status: 'expired' };
+    }
+    if (!(await verifyCodeChallenge(request.codeVerifier, current.codeChallenge)))
+        throw new Error('Invalid code verifier.');
+    if (current.status === 'pending')
+        return { status: 'pending' };
+    if (current.status === 'consumed') {
+        await store.delete(normalized);
+        return { status: 'expired' };
+    }
+    const authorized = await store.consume(normalized);
+    if (!authorized)
+        return { status: 'expired' };
+    return {
+        accountAddress: authorized.accountAddress,
+        keyAuthorization: authorized.keyAuthorization,
+        status: 'authorized',
+    };
+}
+/** Authorizes a pending device code after validating the signed key authorization. */
+export async function authorize(options) {
+    const { chainId, client = getClient({ chainId }), now = Date.now, request, store = Store.memory(), } = options;
+    const code = normalizeCode(request.code);
+    const current = await store.get(code);
+    if (!current)
+        throw new Error('Unknown device code.');
+    if (isExpired(current, now)) {
+        await store.delete(code);
+        throw new Error('Expired device code.');
+    }
+    if (current.status !== 'pending')
+        throw new Error('Device code already completed.');
+    if (current.account && current.account.toLowerCase() !== request.accountAddress.toLowerCase())
+        throw new Error('Account does not match requested account.');
+    const expected = expectedKeyAuthorization(current);
+    const actual = normalizeKeyAuthorization(request.keyAuthorization);
+    if (actual.keyId.toLowerCase() !== expected.address.toLowerCase())
+        throw new Error('Key authorization key does not match the device-code request.');
+    if (actual.address.toLowerCase() !== expected.address.toLowerCase())
+        throw new Error('Key authorization address does not match the device-code request.');
+    if (actual.keyType !== expected.type)
+        throw new Error('Key authorization key type does not match the device-code request.');
+    if (actual.chainId !== expected.chainId)
+        throw new Error('Key authorization chain does not match the device-code request.');
+    if ((actual.expiry ?? undefined) !== (expected.expiry ?? undefined))
+        throw new Error('Key authorization expiry does not match the device-code request.');
+    if (!sameLimits(actual.limits, expected.limits))
+        throw new Error('Key authorization limits do not match the device-code request.');
+    const valid = await verifyHash(client, {
+        address: request.accountAddress,
+        hash: TempoKeyAuthorization.getSignPayload(expected),
+        signature: SignatureEnvelope.serialize(SignatureEnvelope.fromRpc(actual.signature), {
+            magic: actual.signature.type === 'webAuthn',
+        }),
+    });
+    if (!valid)
+        throw new Error('Key authorization signature is invalid.');
+    const authorized = await store.authorize({
+        accountAddress: request.accountAddress,
+        code,
+        keyAuthorization: request.keyAuthorization,
+    });
+    if (!authorized)
+        throw new Error('Unable to authorize device code.');
+    return { status: 'authorized' };
+}
+const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+function createCode(random) {
+    const bytes = random(8);
+    let code = '';
+    for (const byte of bytes)
+        code += alphabet[byte % alphabet.length];
+    return code;
+}
+function normalizeCode(code) {
+    return code.replaceAll('-', '').toUpperCase();
+}
+function expectedKeyAuthorization(entry) {
+    return TempoKeyAuthorization.from({
+        address: core_Address.fromPublicKey(PublicKey.from(entry.pubKey)),
+        chainId: entry.chainId,
+        expiry: entry.expiry,
+        ...(entry.limits ? { limits: entry.limits } : {}),
+        type: entry.keyType,
+    });
+}
+function getClient(options = {}) {
+    const chainId = options.chainId;
+    return createClient({
+        chain: chainId
+            ? {
+                ...tempo,
+                id: typeof chainId === 'bigint' ? Number(chainId) : chainId,
+            }
+            : tempo,
+        transport: http(),
+    });
+}
+function isExpired(entry, now) {
+    return now() > entry.expiresAt;
+}
+function normalizeKeyAuthorization(value) {
+    return {
+        ...value,
+        expiry: value.expiry ?? undefined,
+        limits: value.limits ?? undefined,
+    };
+}
+function randomBytes(size) {
+    return crypto.getRandomValues(new Uint8Array(size));
+}
+function sameLimits(a, b) {
+    if (!a && !b)
+        return true;
+    if (!a || !b || a.length !== b.length)
+        return false;
+    return a.every((limit, i) => {
+        const other = b[i];
+        if (!other)
+            return false;
+        return limit.token.toLowerCase() === other.token.toLowerCase() && limit.limit === other.limit;
+    });
+}
+async function verifyCodeChallenge(codeVerifier, codeChallenge) {
+    const hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(codeVerifier));
+    return Base64.fromBytes(new Uint8Array(hash), { pad: false, url: true }) === codeChallenge;
+}
+//# sourceMappingURL=CliAuth.js.map

package/dist/server/CliAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CliAuth.js","sourceRoot":"","sources":["../../src/server/CliAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,IAAI,CAAA;AACpE,OAAO,EAAE,gBAAgB,IAAI,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,IAAI,EAA2C,MAAM,MAAM,CAAA;AAElF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACnC,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B,OAAO,KAAK,CAAC,MAAM,sBAAsB,CAAA;AAIzC,oDAAoD;AACpD,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;AAElG,iEAAiE;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,OAAO;IACP,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,SAAS,EAAE,CAAC,CAAC,MAAM,EAA0C;CAC9D,CAAC,CAAA;AAEF,+CAA+C;AAC/C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;CAChB,CAAC,CAAA;AAEF,sDAAsD;AACtD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAA;AAEF,qDAAqD;AACrD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAA;AAEF,sDAAsD;AACtD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;KAC7B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QAC/B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC3B,gBAAgB,EAAE,gBAAgB;KACnC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;KAC7B,CAAC;CACH,CAAC,CAAA;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,OAAO;IACP,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;CAC7B,CAAC,CAAA;AAEF,0CAA0C;AAC1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,gBAAgB,EAAE,gBAAgB;CACnC,CAAC,CAAA;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;CAChC,CAAC,CAAA;AAEF,uCAAuC;AACvC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAC3B,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,OAAO;QACP,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;KAC7B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAChC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,gBAAgB;QAChB,OAAO;QACP,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAChC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAChC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,gBAAgB;QAChB,OAAO;QACP,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;KAC9B,CAAC;CACH,CAAC,CAAA;AAgDF,oFAAoF;AACpF,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,MAAM,CAAW;IAEjB,YAAY,OAAe,EAAE,MAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAgCD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB;;;;OAIG;IACH,MAAM;QACJ,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAA;QAExC,OAAO;YACL,KAAK,CAAC,SAAS,CAAC,OAAO;gBACrB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBACzC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;gBAC9D,MAAM,IAAI,GAAG;oBACX,GAAG,OAAO;oBACV,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;oBACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;oBAC1C,MAAM,EAAE,YAAY;iBACM,CAAA;gBAC5B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBAC/B,OAAO,IAAI,CAAA;YACb,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACjC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;oBAAE,OAAO,SAAS,CAAA;gBACjE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;oBAChB,GAAG,OAAO;oBACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;oBACtB,MAAM,EAAE,UAAU;iBACM,CAAC,CAAA;gBAC3B,OAAO,OAAO,CAAA;YAChB,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,MAAM;gBACjB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAClC,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,IAAI;gBACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACtB,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI;gBACZ,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC1B,CAAC;SACF,CAAA;IACH,CAAC;IACD;;;;;OAKG;IACH,EAAE,CAAC,EAAM,EAAE,UAA4B,EAAE;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAAA;QAErC,SAAS,KAAK,CAAC,IAAY;YACzB,OAAO,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACzB,CAAC;QAED,OAAO;YACL,KAAK,CAAC,SAAS,CAAC,OAAO;gBACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;gBAC9D,MAAM,IAAI,GAAG;oBACX,GAAG,OAAO;oBACV,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;oBACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;oBAC1C,MAAM,EAAE,YAAY;iBACM,CAAA;gBAC5B,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;gBACxD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACpC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;oBAAE,OAAO,SAAS,CAAA;gBACjE,MAAM,EAAE,CAAC,GAAG,CACV,KAAK,CAAC,IAAI,CAAC,EACX,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE;oBACd,GAAG,OAAO;oBACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;oBACtB,MAAM,EAAE,UAAU;iBACM,CAAC,CAC5B,CAAA;gBACD,OAAO,OAAO,CAAA;YAChB,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,MAAM;gBACjB,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;YAC3D,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,IAAI;gBACf,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9B,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI;gBACZ,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAwB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;gBAC9D,IAAI,CAAC,KAAK;oBAAE,OAAO,SAAS,CAAA;gBAC5B,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YAC/B,CAAC;SACF,CAAA;IACH,CAAC;CACF,CAAA;AAED,+BAA+B;AAC/B,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,8EAA8E;IAC9E,KAAK;QACH,OAAO;YACL,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE;gBACzB,OAAO;oBACL,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;oBAC9D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9B,CAAA;YACH,CAAC;SACF,CAAA;IACH,CAAC;IACD,6CAA6C;IAC7C,IAAI,CAAC,MAAc;QACjB,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,4CAA4C;AAC5C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAiC;IAEjC,MAAM,EACJ,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAC1B,GAAG,GAAG,IAAI,CAAC,GAAG,EACd,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,EACvB,MAAM,GAAG,WAAW,EACpB,OAAO,EACP,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,EACtB,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,GACxB,GAAG,OAAO,CAAA;IACX,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,WAAW,CAAA;IAC9C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;QACrC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM;KACP,CAAC,CAAA;IAEF,IAAI,IAAwB,CAAA;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAQ;QACxC,IAAI,GAAG,SAAS,CAAA;QAChB,MAAK;IACP,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IAE7D,MAAM,SAAS,GAAG,GAAG,EAAE,CAAA;IAEvB,MAAM,KAAK,CAAC,MAAM,CAAC;QACjB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAChE,IAAI;QACJ,aAAa;QACb,SAAS;QACT,SAAS,EAAE,SAAS,GAAG,KAAK;QAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO;QACP,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM;QACN,MAAM,EAAE,SAAS;KAClB,CAAC,CAAA;IAEF,OAAO,EAAE,IAAI,EAAE,CAAA;AACjB,CAAC;AAuBD,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAwB;IACpD,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAA;IAChE,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC3C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAA;IACjE,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC9B,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAA;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAA;IAE/F,OAAO;QACL,gBAAgB,EAAE,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5E,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,SAAS;KAClB,CAAA;AACH,CAAC;AAeD,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC9C,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAA;IACzE,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC1C,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC9B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC9B,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC9B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC9B,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAClD,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC7C,OAAO;QACL,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,MAAM,EAAE,YAAY;KACrB,CAAA;AACH,CAAC;AAiBD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA0B;IACxD,MAAM,EACJ,OAAO,EACP,MAAM,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAC/B,GAAG,GAAG,IAAI,CAAC,GAAG,EACd,OAAO,EACP,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,GACvB,GAAG,OAAO,CAAA;IACX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACrD,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE;QAC3F,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAE9D,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAElE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE;QAC/D,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAClF,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE;QACjE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;IACtF,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,IAAI;QAClC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;IACvF,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;QACrC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACrF,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IAEnF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAe,EAAE;QAC9C,OAAO,EAAE,OAAO,CAAC,cAAc;QAC/B,IAAI,EAAE,qBAAqB,CAAC,cAAc,CAAC,QAAQ,CAAC;QACpD,SAAS,EAAE,iBAAiB,CAAC,SAAS,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;YAClF,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,UAAU;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAEtE,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;QACvC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI;QACJ,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC,CAAA;IACF,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAEpE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;AACjC,CAAC;AAmBD,MAAM,QAAQ,GAAG,kCAAkC,CAAA;AAEnD,SAAS,UAAU,CAAC,MAAoC;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,IAAI,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AAC/C,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAoB;IACpD,OAAO,qBAAqB,CAAC,IAAI,CAAC;QAChC,OAAO,EAAE,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,EAAE,KAAK,CAAC,OAAO;KACpB,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,UAAqD,EAAE;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAC/B,OAAO,YAAY,CAAC;QAClB,KAAK,EAAE,OAAO;YACZ,CAAC,CAAC;gBACE,GAAG,KAAK;gBACR,EAAE,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO;aAC5D;YACH,CAAC,CAAC,KAAK;QACT,SAAS,EAAE,IAAI,EAAE;KAClB,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAY,EAAE,GAAiB;IAChD,OAAO,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,CAAA;AAChC,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAwC;IACzE,OAAO;QACL,GAAG,KAAK;QACR,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;KAClC,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,UAAU,CACjB,CAA2D,EAC3D,CAA2D;IAE3D,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACzB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACnD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAClB,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAA;QACxB,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAA;IAC/F,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,YAAoB,EAAE,aAAqB;IAC5E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;IAC1F,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,aAAa,CAAA;AAC5F,CAAC"}

package/dist/server/Handler.d.ts

@@ -1,13 +1,14 @@
 import { type Router, type RouterOptions } from '@remix-run/fetch-router';
 import { RpcRequest } from 'ox';
-import { type Chain, type Transport } from 'viem';
+import { type Chain, type Client, type Transport } from 'viem';
 import type { LocalAccount } from 'viem/accounts';
+import * as CliAuth from './CliAuth.js';
 import type { Kv } from './Kv.js';
 export type Handler = Omit<Router, 'fetch'> & {
     fetch: (input: string | URL | Request, ...args: any[]) => Promise<Response>;
     listener: (req: any, res: any) => void;
 };
-export declare function compose(handlers: Handler[], options?: compose.Options): Handler;
+export declare function compose(handlers: Array<Handler>, options?: compose.Options): Handler;
 export declare namespace compose {
     type Options = from.Options & {
         /** The path to use for the handler. */
@@ -200,6 +201,39 @@ export declare namespace feePayer {
         transports?: Record<number, Transport> | undefined;
     };
 }
+/**
+ * Instantiates a generic device-code handler for access-key bootstrap.
+ *
+ * Exposes 4 endpoints:
+ * - `GET /auth/pkce/pending/:code`
+ * - `POST /auth/pkce/code`
+ * - `POST /auth/pkce/poll/:code`
+ * - `POST /auth/pkce`
+ *
+ * @param options - Options.
+ * @returns Request handler.
+ */
+export declare function codeAuth(options?: codeAuth.Options): Handler;
+export declare namespace codeAuth {
+    type Options = from.Options & {
+        /** Chain ID embedded into authorized access keys. Defaults to the client chain or tempo.id. */
+        chainId?: bigint | number | undefined;
+        /** Client used to verify signed key authorizations. */
+        client?: Client<Transport, Chain | undefined> | undefined;
+        /** Time source used for TTL evaluation. */
+        now?: (() => number) | undefined;
+        /** Path prefix for the code auth endpoints. @default "/auth/pkce" */
+        path?: string | undefined;
+        /** Policy used to validate and default requested CLI auth fields. */
+        policy?: CliAuth.Policy | undefined;
+        /** Random byte generator used for device-code allocation. */
+        random?: ((size: number) => Uint8Array) | undefined;
+        /** Device-code store. */
+        store?: CliAuth.Store | undefined;
+        /** Pending entry TTL in milliseconds. @default 600000 */
+        ttlMs?: number | undefined;
+    };
+}
 /**
  * Instantiates a WebAuthn ceremony handler that manages registration and
  * authentication flows server-side.

package/dist/server/Handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Handler.d.ts","sourceRoot":"","sources":["../../src/server/Handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAsB,UAAU,EAAe,MAAM,IAAI,CAAA;AAEhE,OAAO,EAAE,KAAK,KAAK,EAAmC,KAAK,SAAS,EAAE,MAAM,MAAM,CAAA;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAWjD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAA;AAEjC,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAC5C,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3E,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,CAAA;CACvC,CAAA;AAED,wBAAgB,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,GAAE,OAAO,CAAC,OAAY,GAAG,OAAO,CAkBnF;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,KAAY,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG;QACnC,uCAAuC;QACvC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC1B,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE,IAAI,CAAC,OAAY,GAAG,OAAO,CAiBxD;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAY,OAAO,GAAG,aAAa,GAAG;QACpC;;;;;WAKG;QACH,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;QACjC,sCAAsC;QACtC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;KACvD,CAAA;IAED,KAAY,IAAI,GAAG;QACjB,0CAA0C;QAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;QACtC,wEAAwE;QACxE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,qDAAqD;QACrD,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,oCAAoC;QACpC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QACjC,wCAAwC;QACxC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAClC,8CAA8C;QAC9C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC5B,CAAA;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoIG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,WA8FjD;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAY,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG;QACnC,uCAAuC;QACvC,OAAO,EAAE,YAAY,CAAA;QACrB;;;;WAIG;QACH,MAAM,CAAC,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,GAAG,SAAS,CAAA;QACjD,oDAAoD;QACpD,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAC7D,mCAAmC;QACnC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,yEAAyE;QACzE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,SAAS,CAAA;KACnD,CAAA;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,CAqI3D;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG;QAC5B,4EAA4E;QAC5E,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACjC,sDAAsD;QACtD,EAAE,EAAE,EAAE,CAAA;QACN,8GAA8G;QAC9G,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE;YACxB,YAAY,EAAE,MAAM,CAAA;YACpB,SAAS,EAAE,MAAM,CAAA;YACjB,OAAO,EAAE,OAAO,CAAA;SACjB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QACzD,gHAAgH;QAChH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE;YAC5B,YAAY,EAAE,MAAM,CAAA;YACpB,SAAS,EAAE,MAAM,CAAA;YACjB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;YAC3B,OAAO,EAAE,OAAO,CAAA;SACjB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QACzD,iGAAiG;QACjG,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;QAClC,+EAA+E;QAC/E,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,+CAA+C;QAC/C,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF"}
+{"version":3,"file":"Handler.d.ts","sourceRoot":"","sources":["../../src/server/Handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAsB,UAAU,EAAe,MAAM,IAAI,CAAA;AAEhE,OAAO,EAAE,KAAK,KAAK,EAAE,KAAK,MAAM,EAAsB,KAAK,SAAS,EAAE,MAAM,MAAM,CAAA;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAWjD,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AAEvC,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAA;AAEjC,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAC5C,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3E,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,CAAA;CACvC,CAAA;AAED,wBAAgB,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,GAAE,OAAO,CAAC,OAAY,GAAG,OAAO,CAkBxF;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,KAAY,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG;QACnC,uCAAuC;QACvC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC1B,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE,IAAI,CAAC,OAAY,GAAG,OAAO,CAiBxD;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAY,OAAO,GAAG,aAAa,GAAG;QACpC;;;;;WAKG;QACH,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;QACjC,sCAAsC;QACtC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;KACvD,CAAA;IAED,KAAY,IAAI,GAAG;QACjB,0CAA0C;QAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;QACtC,wEAAwE;QACxE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,qDAAqD;QACrD,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,oCAAoC;QACpC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QACjC,wCAAwC;QACxC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAClC,8CAA8C;QAC9C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC5B,CAAA;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoIG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,WA8FjD;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAY,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG;QACnC,uCAAuC;QACvC,OAAO,EAAE,YAAY,CAAA;QACrB;;;;WAIG;QACH,MAAM,CAAC,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,GAAG,SAAS,CAAA;QACjD,oDAAoD;QACpD,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAC7D,mCAAmC;QACnC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,yEAAyE;QACzE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,SAAS,CAAA;KACnD,CAAA;CACF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,OAAO,GAAE,QAAQ,CAAC,OAAY,GAAG,OAAO,CAqFhE;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAY,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG;QACnC,+FAA+F;QAC/F,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;QACrC,uDAAuD;QACvD,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;QACzD,2CAA2C;QAC3C,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAA;QAChC,qEAAqE;QACrE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,qEAAqE;QACrE,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAA;QACnC,6DAA6D;QAC7D,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,CAAC,GAAG,SAAS,CAAA;QACnD,yBAAyB;QACzB,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,GAAG,SAAS,CAAA;QACjC,yDAAyD;QACzD,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,CAAA;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,CAqI3D;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG;QAC5B,4EAA4E;QAC5E,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACjC,sDAAsD;QACtD,EAAE,EAAE,EAAE,CAAA;QACN,8GAA8G;QAC9G,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE;YACxB,YAAY,EAAE,MAAM,CAAA;YACpB,SAAS,EAAE,MAAM,CAAA;YACjB,OAAO,EAAE,OAAO,CAAA;SACjB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QACzD,gHAAgH;QAChH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE;YAC5B,YAAY,EAAE,MAAM,CAAA;YACpB,SAAS,EAAE,MAAM,CAAA;YACjB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;YAC3B,OAAO,EAAE,OAAO,CAAA;SACjB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QACzD,iGAAiG;QACjG,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;QAClC,+EAA+E;QAC/E,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,+CAA+C;QAC/C,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF"}

package/dist/server/Handler.js

@@ -6,6 +6,8 @@ import { signTransaction } from 'viem/actions';
 import { tempo, tempoModerato } from 'viem/chains';
 import { Transaction } from 'viem/tempo';
 import { Authentication, Registration, } from 'webauthx/server';
+import * as z from 'zod/mini';
+import * as CliAuth from './CliAuth.js';
 import * as RequestListener from './internal/requestListener.js';
 export function compose(handlers, options = {}) {
     const path = options.path ?? '/';
@@ -245,6 +247,88 @@ export function feePayer(options) {
     });
     return router;
 }
+/**
+ * Instantiates a generic device-code handler for access-key bootstrap.
+ *
+ * Exposes 4 endpoints:
+ * - `GET /auth/pkce/pending/:code`
+ * - `POST /auth/pkce/code`
+ * - `POST /auth/pkce/poll/:code`
+ * - `POST /auth/pkce`
+ *
+ * @param options - Options.
+ * @returns Request handler.
+ */
+export function codeAuth(options = {}) {
+    const { chainId, client, now, path = '/auth/pkce', policy, random, store = CliAuth.Store.memory(), ttlMs, ...rest } = options;
+    const router = from(rest);
+    router.get(`${path}/pending/:code`, async ({ params }) => {
+        try {
+            const { code } = params;
+            const result = await CliAuth.pending({
+                code,
+                ...(now ? { now } : {}),
+                store,
+            });
+            return Response.json(z.encode(CliAuth.pendingResponse, result));
+        }
+        catch (error) {
+            const status = error instanceof CliAuth.PendingError ? error.status : 400;
+            return Response.json({ error: error.message }, { status });
+        }
+    });
+    router.post(`${path}/code`, async ({ request: req }) => {
+        try {
+            const request = z.decode(CliAuth.createRequest, await req.json());
+            const result = await CliAuth.createDeviceCode({
+                ...(typeof chainId !== 'undefined' ? { chainId } : {}),
+                ...(now ? { now } : {}),
+                ...(policy ? { policy } : {}),
+                ...(random ? { random } : {}),
+                request,
+                store,
+                ...(typeof ttlMs !== 'undefined' ? { ttlMs } : {}),
+            });
+            return Response.json(z.encode(CliAuth.createResponse, result));
+        }
+        catch (error) {
+            return Response.json({ error: error.message }, { status: 400 });
+        }
+    });
+    router.post(`${path}/poll/:code`, async ({ params, request: req }) => {
+        try {
+            const request = z.decode(CliAuth.pollRequest, await req.json());
+            const { code } = params;
+            const result = await CliAuth.poll({
+                code,
+                ...(now ? { now } : {}),
+                request,
+                store,
+            });
+            return Response.json(z.encode(CliAuth.pollResponse, result));
+        }
+        catch (error) {
+            return Response.json({ error: error.message }, { status: 400 });
+        }
+    });
+    router.post(path, async ({ request: req }) => {
+        try {
+            const request = z.decode(CliAuth.authorizeRequest, await req.json());
+            const result = await CliAuth.authorize({
+                ...(typeof chainId !== 'undefined' ? { chainId } : {}),
+                ...(client ? { client } : {}),
+                ...(now ? { now } : {}),
+                request,
+                store,
+            });
+            return Response.json(z.encode(CliAuth.authorizeResponse, result));
+        }
+        catch (error) {
+            return Response.json({ error: error.message }, { status: 400 });
+        }
+    });
+    return router;
+}
 /**
  * Instantiates a WebAuthn ceremony handler that manages registration and
  * authentication flows server-side.