ftown 0.20.9 → 0.21.0

package/dist/pairing-client.js

@@ -1,469 +0,0 @@
-/**
- * Device-pairing onboarding client (contract docs/plans/device-pairing-contract.md).
- *
- * OAuth-device-authorization-style flow: the bridge asks the server to start a
- * pairing request, prints a short user code + verification URL, and polls until
- * the logged-in user approves the named machine in the browser. On approval the
- * server returns the SAME token bundle shape as `/api/auth/bridge`.
- *
- * P8: no secret is ever logged. `deviceCode` (the poll credential) and every
- * returned token/refreshToken stay out of the `log` sink; only the low-value,
- * single-use `userCode` and the verification URL are printed.
- */
-import { encodeAccountEnrollmentLink, parseAccountEnrollmentLink } from './security/account-crypto.js';
-import { accountReadUrl } from './security/bridge/account-client.js';
-import { readAccountHistory } from './security/bridge/account-client.js';
-import { AccountTrustError } from './security/account-crypto.js';
-import { createPendingConfirmation, createPendingHello, normalizePendingAccountHint, openPendingResult, parsePendingOffer, parsePendingState, pendingComparisonCode, pendingHelloHash, pendingOfferHash, PENDING_APPROVAL_LIMITS } from './security/pending-approval-crypto.js';
-import { isDeepStrictEqual } from 'node:util';
-import { matchesPendingBridgeDecision } from './security/bridge/pending-approval.js';
-/** Servers deny a revoked bridgeId, and trusted browsers refuse to approve it; only a new identity pairs again. */
-export const REMOVED_COMPUTER_HINT = 'If this computer was removed from your account before, run `ftown start --new-identity`.';
-const realSleep = (ms) => new Promise((r) => setTimeout(r, ms));
-export async function runPairing(opts) {
-    if (opts.pending)
-        return runPendingPairing(opts, opts.pending);
-    const { apiUrl, bridgeId, hostname, platform, localPort, localNonce, fetchImpl = fetch, sleepImpl = realSleep, log = (msg) => console.log(msg), } = opts;
-    const enrollment = opts.enrollment ? await parseAccountEnrollmentLink(opts.enrollment) : undefined;
-    if (enrollment && (enrollment.request.kind !== 'bridge' || enrollment.request.bridgeId !== bridgeId))
-        throw new Error('Invalid encrypted bridge enrollment');
-    const start = await postJson(fetchImpl, `${apiUrl}/api/auth/bridge/pair/start`, {
-        bridgeId,
-        hostname,
-        platform,
-        ...(enrollment ? { enrollment: enrollment.request } : {}),
-    });
-    // P8: userCode + URL are printed; deviceCode is NEVER logged.
-    if (enrollment) {
-        accountReadUrl(apiUrl);
-        if (typeof start.userCode !== 'string' || !/^[A-Za-z0-9-]{1,100}$/.test(start.userCode)
-            || typeof start.deviceCode !== 'string' || start.deviceCode.length < 1 || start.deviceCode.length > 200
-            || !Number.isInteger(start.intervalMs) || start.intervalMs < 100 || start.intervalMs > 60000
-            || !Number.isInteger(start.expiresInMs) || start.expiresInMs < 1 || start.expiresInMs > 300000)
-            throw new Error('Invalid encrypted bridge approval response');
-        await opts.onPairingCode?.(start.userCode);
-        const url = new URL('/pair', apiUrl);
-        url.searchParams.set('code', start.userCode);
-        url.hash = `account=${encodeAccountEnrollmentLink(enrollment)}`;
-        // An interactive CLI may display this directly; redirected logs only receive instructions.
-        if (opts.displayEnrollmentUrl)
-            opts.displayEnrollmentUrl(url.href);
-        else if (process.stderr.isTTY)
-            process.stderr.write(`Approve this computer: ${url.href}\n`);
-        log('Waiting for encrypted computer approval. Run ftown security pair-link to display the current private approval link.');
-    }
-    else
-        log('Approve this machine to connect it to ftown:\n' +
-            `    ${start.verificationUri}\n` +
-            `    code: ${start.userCode}\n` +
-            'Waiting for approval…');
-    const deviceCode = start.deviceCode;
-    const intervalMs = start.intervalMs;
-    const deadline = Math.min(Date.now() + start.expiresInMs, enrollment ? Date.parse(enrollment.request.expiresAt) : Infinity);
-    // Wait one interval before the first poll (the user needs time to approve).
-    await sleepImpl(intervalMs);
-    for (;;) {
-        if (Date.now() >= deadline) {
-            log(REMOVED_COMPUTER_HINT);
-            throw new Error('Pairing timed out');
-        }
-        const poll = await postJson(fetchImpl, `${apiUrl}/api/auth/bridge/pair/poll`, {
-            deviceCode,
-            localPort,
-        });
-        switch (poll.status) {
-            case 'approved': {
-                if (!poll.ownerId || !poll.token || !poll.refreshToken || !poll.centrifugoUrl || !poll.userId) {
-                    throw new Error('Pairing approved but token bundle was incomplete');
-                }
-                if (enrollment && (!poll.accountApproval || !poll.accountHistory))
-                    throw new Error('Encrypted bridge approval is required; no legacy fallback');
-                return {
-                    ownerId: poll.ownerId,
-                    token: poll.token,
-                    refreshToken: poll.refreshToken,
-                    centrifugoUrl: poll.centrifugoUrl,
-                    userId: poll.userId,
-                    ...(enrollment ? { accountApproval: poll.accountApproval, accountHistory: poll.accountHistory } : {}),
-                };
-            }
-            case 'pending':
-                await sleepImpl(intervalMs);
-                break;
-            case 'slow_down':
-                // Advisory back-off: wait an extra interval on top of the normal one.
-                await sleepImpl(intervalMs * 2);
-                break;
-            case 'denied':
-                log(REMOVED_COMPUTER_HINT);
-                throw new Error('Pairing denied');
-            case 'expired':
-                log(REMOVED_COMPUTER_HINT);
-                throw new Error('Pairing request expired before approval');
-            case 'consumed':
-                throw new Error('Pairing code was already consumed');
-            case 'unknown':
-                throw new Error('Pairing request not found (unknown device code)');
-            default:
-                throw new Error(`Unexpected pairing status: ${String(poll.status)}`);
-        }
-    }
-}
-class PendingNetworkError extends Error {
-    constructor() { super('Computer approval service is temporarily unavailable.'); }
-}
-function record(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        throw new AccountTrustError('account_enrollment_invalid');
-    return value;
-}
-function text(value, limit = 16384) {
-    if (typeof value !== 'string' || value.length < 1 || value.length > limit)
-        throw new AccountTrustError('account_enrollment_invalid');
-    return value;
-}
-async function abortable(promise, signal) {
-    signal.throwIfAborted();
-    let listener;
-    try {
-        return await Promise.race([promise, new Promise((_resolve, reject) => {
-                listener = () => reject(signal.reason);
-                signal.addEventListener('abort', listener, { once: true });
-                if (signal.aborted)
-                    listener();
-            })]);
-    }
-    finally {
-        if (listener)
-            signal.removeEventListener('abort', listener);
-    }
-}
-/** Bound the entire fetch AND body read, and never send a credential through a redirect. */
-async function pendingJson(opts, path, body, lifetime) {
-    const base = accountReadUrl(opts.apiUrl);
-    const url = new URL(path, base.origin);
-    if (url.origin !== base.origin || !path.startsWith('/api/'))
-        throw new AccountTrustError('account_enrollment_invalid');
-    const encoded = JSON.stringify(body);
-    if (Buffer.byteLength(encoded) > PENDING_APPROVAL_LIMITS.maxWireBytes)
-        throw new AccountTrustError('account_capacity_exceeded');
-    const timeout = new AbortController();
-    const timer = setTimeout(() => timeout.abort(new PendingNetworkError()), PENDING_APPROVAL_LIMITS.requestTimeoutMs);
-    const signal = AbortSignal.any([lifetime, timeout.signal]);
-    try {
-        const result = await abortable((async () => {
-            let response;
-            try {
-                response = await (opts.fetchImpl ?? fetch)(url, { method: 'POST', headers: { 'Content-Type': 'application/json' },
-                    body: encoded, redirect: 'manual', cache: 'no-store', signal });
-            }
-            catch {
-                if (lifetime.aborted)
-                    lifetime.throwIfAborted();
-                throw new PendingNetworkError();
-            }
-            if (response.status >= 300 && response.status < 400)
-                throw new AccountTrustError('account_enrollment_invalid');
-            if (response.status === 429 || response.status >= 500)
-                throw new PendingNetworkError();
-            if (!response.ok)
-                throw new AccountTrustError(response.status === 409 ? 'account_trust_conflict'
-                    : response.status === 410 ? 'account_enrollment_expired' : 'account_enrollment_invalid');
-            const declared = response.headers.get('content-length');
-            if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > PENDING_APPROVAL_LIMITS.maxWireBytes))
-                throw new AccountTrustError('account_capacity_exceeded');
-            const reader = response.body?.getReader();
-            if (!reader)
-                throw new AccountTrustError('account_enrollment_invalid');
-            const cancel = () => { void reader.cancel().catch(() => undefined); };
-            signal.addEventListener('abort', cancel, { once: true });
-            if (signal.aborted)
-                cancel();
-            const chunks = [];
-            let size = 0;
-            try {
-                for (;;) {
-                    let next;
-                    try {
-                        next = await reader.read();
-                    }
-                    catch {
-                        signal.throwIfAborted();
-                        throw new PendingNetworkError();
-                    }
-                    const { done, value } = next;
-                    if (done)
-                        break;
-                    size += value.byteLength;
-                    if (size > PENDING_APPROVAL_LIMITS.maxWireBytes)
-                        throw new AccountTrustError('account_capacity_exceeded');
-                    chunks.push(value);
-                }
-                const bytes = Buffer.concat(chunks);
-                try {
-                    return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
-                }
-                catch {
-                    throw new AccountTrustError('account_enrollment_invalid');
-                }
-            }
-            finally {
-                signal.removeEventListener('abort', cancel);
-                if (signal.aborted || size > PENDING_APPROVAL_LIMITS.maxWireBytes)
-                    cancel();
-                reader.releaseLock();
-            }
-        })(), signal);
-        lifetime.throwIfAborted();
-        return result;
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-async function runPendingPairing(opts, ctx) {
-    if (opts.enrollment || ctx.request.kind !== 'bridge' || ctx.request.bridgeId !== opts.bridgeId
-        || !isDeepStrictEqual(ctx.request.candidate, ctx.identity.endpoint) || !/^[A-Za-z0-9_-]{43}$/.test(ctx.candidateToken))
-        throw new AccountTrustError('account_enrollment_invalid');
-    const hint = normalizePendingAccountHint(opts.accountHint);
-    const expires = Date.parse(ctx.request.expiresAt);
-    const expiry = new AbortController();
-    const timer = setTimeout(() => expiry.abort(new AccountTrustError('account_enrollment_expired')), Math.max(0, expires - Date.now()));
-    const signal = AbortSignal.any([ctx.signal, expiry.signal]);
-    const processNonce = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString('base64url');
-    let offer;
-    let packet;
-    let confirmedOfferHash;
-    let credentials;
-    let localStatus = { version: 1, requestId: ctx.request.requestId, processNonce,
-        expiresAt: ctx.request.expiresAt, phase: 'waiting', offerHash: null, comparisonCode: null };
-    let decision;
-    let decisionController = new AbortController();
-    let statusKey = '';
-    const assertLive = () => { signal.throwIfAborted(); if (Date.now() >= expires)
-        throw new AccountTrustError('account_enrollment_expired'); };
-    const updateStatus = async (next) => {
-        const key = JSON.stringify(next);
-        if (key === statusKey)
-            return;
-        assertLive();
-        await ctx.onLocalStatus(next);
-        assertLive();
-        statusKey = key;
-        localStatus = next;
-        decision = undefined;
-        decisionController.abort();
-        decisionController = new AbortController();
-        if (next.phase === 'waiting' || next.phase === 'comparing' || next.phase === 'confirming') {
-            const current = decisionController;
-            void ctx.waitForLocalDecision(next, AbortSignal.any([signal, current.signal])).then(value => {
-                if (!current.signal.aborted && !signal.aborted && matchesPendingBridgeDecision(next, value))
-                    decision = value;
-            }).catch(error => { if (!current.signal.aborted && !signal.aborted)
-                expiry.abort(error); });
-        }
-    };
-    const wait = () => abortable((opts.sleepImpl ?? realSleep)(PENDING_APPROVAL_LIMITS.pollIntervalMs), signal);
-    const rpc = (action) => pendingJson(opts, `/api/security/approvals/${ctx.request.requestId}/candidate`, { candidateToken: ctx.candidateToken, action }, signal);
-    let deviceCode;
-    let latest;
-    const checkRejection = async () => {
-        if (decision?.decision !== 'reject' || !matchesPendingBridgeDecision(localStatus, decision))
-            return;
-        await updateStatus({ ...localStatus, phase: 'cancelled', comparisonCode: null });
-        await rpc({ type: 'cancel', expectedRevision: latest?.revision ?? 0 }).catch(() => undefined);
-        throw new Error('Computer approval cancelled locally.');
-    };
-    try {
-        await updateStatus(localStatus);
-        (opts.log ?? console.log)('Waiting for approval in your trusted browser. Run ftown security pair-status to compare, then pair-confirm CODE or pair-reject.');
-        // Retry EXACT create payload: token and request were durable before this first HTTP call.
-        const startBody = { bridgeId: opts.bridgeId, hostname: opts.hostname, platform: opts.platform,
-            approvalMethod: 'pending-v1', accountHint: hint, candidateToken: ctx.candidateToken, enrollment: ctx.request };
-        for (;;) {
-            assertLive();
-            await checkRejection();
-            try {
-                const start = record(await pendingJson(opts, '/api/auth/bridge/pair/start', startBody, signal));
-                deviceCode = text(start.deviceCode, 200);
-                text(start.userCode, 100);
-                text(start.verificationUri, 4096);
-                if (!Number.isInteger(start.intervalMs) || Number(start.intervalMs) < 100 || Number(start.intervalMs) > 60000
-                    || !Number.isInteger(start.expiresInMs) || Number(start.expiresInMs) < 1 || Number(start.expiresInMs) > PENDING_APPROVAL_LIMITS.lifetimeMs)
-                    throw new AccountTrustError('account_enrollment_invalid');
-                break;
-            }
-            catch (error) {
-                if (!(error instanceof PendingNetworkError))
-                    throw error;
-                await wait();
-            }
-        }
-        for (;;) {
-            assertLive();
-            await checkRejection();
-            try {
-                const state = await parsePendingState(await rpc({ type: 'read' }));
-                if (!isDeepStrictEqual(state.request, ctx.request))
-                    throw new AccountTrustError('account_enrollment_invalid');
-                if (latest && state.revision < latest.revision)
-                    throw new AccountTrustError('account_trust_conflict');
-                if (latest && state.revision === latest.revision && !isDeepStrictEqual(state, latest))
-                    throw new AccountTrustError('account_trust_conflict');
-                latest = state;
-                if (['rejected', 'cancelled', 'expired', 'conflict'].includes(state.status)) {
-                    await updateStatus({ ...localStatus, phase: state.status, comparisonCode: null });
-                    throw new Error(`Computer approval ${state.status}. Start a new explicit request.`);
-                }
-                const selectedDecision = decision;
-                if (selectedDecision?.decision === 'reject')
-                    await checkRejection();
-                if (state.status === 'pending') {
-                    await wait();
-                    continue;
-                }
-                if (!('offer' in state))
-                    throw new AccountTrustError('account_enrollment_invalid');
-                const receivedOffer = await parsePendingOffer(state.offer, ctx.request);
-                if (!offer) {
-                    await ctx.pinOffer(receivedOffer);
-                    assertLive();
-                    offer = receivedOffer;
-                    await updateStatus({ ...localStatus, phase: 'waiting', offerHash: await pendingOfferHash(offer), comparisonCode: null });
-                    packet = await createPendingHello(ctx.identity, offer);
-                    assertLive();
-                    await ctx.pinHello(packet.hello);
-                    assertLive();
-                }
-                else if (await pendingOfferHash(receivedOffer) !== await pendingOfferHash(offer))
-                    throw new AccountTrustError('account_trust_conflict');
-                if (!packet)
-                    throw new AccountTrustError('account_enrollment_invalid');
-                if (state.status === 'offered') {
-                    await rpc({ type: 'hello', expectedRevision: state.revision, hello: packet.hello });
-                    continue;
-                }
-                if (!('hello' in state) || await pendingHelloHash(state.hello) !== await pendingHelloHash(packet.hello))
-                    throw new AccountTrustError('account_trust_conflict');
-                if (state.status === 'submitted') {
-                    await wait();
-                    continue;
-                }
-                if (!('reveal' in state))
-                    throw new AccountTrustError('account_enrollment_invalid');
-                const comparisonCode = await pendingComparisonCode(offer, packet.secret, state.reveal);
-                const offerHash = await pendingOfferHash(offer);
-                if (!confirmedOfferHash) {
-                    if (selectedDecision?.decision !== 'confirm' || !matchesPendingBridgeDecision(localStatus, selectedDecision)) {
-                        await updateStatus({ ...localStatus, phase: 'comparing', offerHash, comparisonCode });
-                        await wait();
-                        continue;
-                    }
-                    await updateStatus({ ...localStatus, phase: 'confirming', offerHash, comparisonCode });
-                    confirmedOfferHash = offerHash;
-                }
-                const proof = await createPendingConfirmation(offer, packet.secret, state.reveal, confirmedOfferHash);
-                assertLive();
-                await checkRejection();
-                if (state.status === 'comparing') {
-                    await rpc({ type: 'confirm', expectedRevision: state.revision, confirmation: proof });
-                    continue;
-                }
-                if (!('confirmation' in state) || !isDeepStrictEqual(state.confirmation, proof))
-                    throw new AccountTrustError('account_enrollment_invalid');
-                if (state.status === 'confirmed') {
-                    await wait();
-                    continue;
-                }
-                if (state.status !== 'approved')
-                    throw new AccountTrustError('account_enrollment_invalid');
-                if (!credentials) {
-                    const polled = record(await pendingJson(opts, '/api/auth/bridge/pair/poll', { deviceCode, localPort: opts.localPort }, signal));
-                    if (polled.status === 'pending' || polled.status === 'slow_down') {
-                        await wait();
-                        continue;
-                    }
-                    if (polled.status !== 'approved' || !polled.pendingApproval)
-                        throw new AccountTrustError('account_enrollment_invalid');
-                    credentials = { status: 'approved', ownerId: text(polled.ownerId, 100), token: text(polled.token), refreshToken: text(polled.refreshToken),
-                        centrifugoUrl: text(polled.centrifugoUrl, 4096), userId: text(polled.userId, 254), pendingApproval: state.result };
-                }
-                // The candidate RPC result may be renewed after credentials/pair bundle were consumed.
-                const readTimeout = new AbortController();
-                const readTimer = setTimeout(() => readTimeout.abort(new PendingNetworkError()), PENDING_APPROVAL_LIMITS.requestTimeoutMs);
-                let history;
-                try {
-                    const readSignal = AbortSignal.any([signal, readTimeout.signal]);
-                    history = await abortable(readAccountHistory(opts.apiUrl, credentials.token, readSignal, opts.fetchImpl ?? fetch), readSignal);
-                }
-                finally {
-                    clearTimeout(readTimer);
-                }
-                if (!history)
-                    throw new AccountTrustError('account_approval_required');
-                const readAt = Date.now();
-                assertLive();
-                await checkRejection();
-                const opened = await openPendingResult(ctx.identity, offer, packet.secret, state.reveal, confirmedOfferHash, state.result, history);
-                assertLive();
-                await checkRejection();
-                if (opened.status === 'awaiting-delivery-renewal') {
-                    await wait();
-                    continue;
-                }
-                if (opened.trust.checkpoint.ownerId !== credentials.ownerId)
-                    throw new AccountTrustError('account_enrollment_invalid');
-                await updateStatus({ ...localStatus, phase: 'approved', offerHash, comparisonCode: null });
-                return { ...credentials, pendingApproval: state.result, approvalMethod: 'pending-v1', verifiedAccountTrust: opened.trust, lastServerReadAt: readAt };
-            }
-            catch (error) {
-                // Availability only: malformed proof/history or conflicts never turn into retries.
-                if (!(error instanceof PendingNetworkError) && !(error instanceof Error && error.name === 'AccountReadUnavailable'))
-                    throw error;
-                await wait();
-            }
-        }
-    }
-    catch (error) {
-        let finalPhase = localStatus.phase;
-        if (!['approved', 'rejected', 'cancelled', 'expired', 'conflict'].includes(localStatus.phase)) {
-            const phase = error instanceof AccountTrustError && error.code === 'account_enrollment_expired' ? 'expired'
-                : error instanceof AccountTrustError && error.code === 'account_trust_conflict' ? 'conflict' : 'cancelled';
-            finalPhase = phase;
-            await ctx.onLocalStatus({ ...localStatus, phase, comparisonCode: null }).catch(() => undefined);
-        }
-        if (['rejected', 'expired'].includes(finalPhase))
-            (opts.log ?? console.log)(REMOVED_COMPUTER_HINT);
-        throw error;
-    }
-    finally {
-        clearTimeout(timer);
-        decisionController.abort();
-        expiry.abort();
-        packet = undefined;
-    }
-}
-/** Best effort only; the new process always uses a different request and keeps its own key. */
-export async function cancelPreviousPendingPairing(apiUrl, previous, signal) {
-    const options = { apiUrl };
-    try {
-        const path = `/api/security/approvals/${previous.requestId}/candidate`;
-        const state = await parsePendingState(await pendingJson(options, path, { candidateToken: previous.candidateToken, action: { type: 'read' } }, signal));
-        if (['approved', 'rejected', 'cancelled', 'expired', 'conflict'].includes(state.status))
-            return;
-        await pendingJson(options, path, { candidateToken: previous.candidateToken, action: { type: 'cancel', expectedRevision: state.revision } }, signal);
-    }
-    catch { /* Cancellation cannot grant trust and never causes an automatic fallback. */ }
-}
-async function postJson(fetchImpl, url, body) {
-    const res = await fetchImpl(url, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(body),
-    });
-    if (!res.ok) {
-        throw new Error(`Pairing request failed (${res.status})`);
-    }
-    return res.json();
-}
-//# sourceMappingURL=pairing-client.js.map

package/dist/pairing-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pairing-client.js","sourceRoot":"","sources":["../src/pairing-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAEvG,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,iBAAiB,EACpG,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAG1K,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAErF,mHAAmH;AACnH,MAAM,CAAC,MAAM,qBAAqB,GAAG,0FAA0F,CAAC;AA2EhI,MAAM,SAAS,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAUvF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAuB;IACtD,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,EACJ,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,UAAU,EACV,SAAS,GAAG,KAAK,EACjB,SAAS,GAAG,SAAS,EACrB,GAAG,GAAG,CAAC,GAAW,EAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAC9C,GAAG,IAAI,CAAC;IACT,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAE7J,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAoB,SAAS,EAAE,GAAG,MAAM,6BAA6B,EAAE;QACjG,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAC;IAEH,8DAA8D;IAC9D,IAAI,UAAU,EAAE,CAAC;QACf,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;eAClF,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG;eACpG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,GAAG,KAAK;eACzF,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC,IAAI,KAAK,CAAC,WAAW,GAAG,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChK,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnF,GAAG,CAAC,IAAI,GAAG,WAAW,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,2FAA2F;QAC3F,IAAI,IAAI,CAAC,oBAAoB;YAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aAC9D,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;QAC5F,GAAG,CAAC,qHAAqH,CAAC,CAAC;IAC7H,CAAC;;QAAM,GAAG,CACR,gDAAgD;YAC9C,OAAO,KAAK,CAAC,eAAe,IAAI;YAChC,aAAa,KAAK,CAAC,QAAQ,IAAI;YAC/B,uBAAuB,CAC1B,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAE5H,4EAA4E;IAC5E,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;IAE5B,SAAS,CAAC;QACR,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAmB,SAAS,EAAE,GAAG,MAAM,4BAA4B,EAAE;YAC9F,UAAU;YACV,SAAS;SACV,CAAC,CAAC;QAEH,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC9F,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,IAAI,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;gBAChJ,OAAO;oBACL,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAgB,EAAE,cAAc,EAAE,IAAI,CAAC,cAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxG,CAAC;YACJ,CAAC;YACD,KAAK,SAAS;gBACZ,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,WAAW;gBACd,sEAAsE;gBACtE,MAAM,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;gBAChC,MAAM;YACR,KAAK,QAAQ;gBACX,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACpC,KAAK,SAAS;gBACZ,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,KAAK,UAAU;gBACb,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,KAAK,SAAS;gBACZ,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE;gBACE,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAE,IAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,mBAAoB,SAAQ,KAAK;IACrC,gBAAgB,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC,CAAC;CAClF;AACD,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;IAC3H,OAAO,KAAgC,CAAC;AAC1C,CAAC;AACD,SAAS,IAAI,CAAC,KAAc,EAAE,KAAK,GAAG,KAAK;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;QAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;IACrI,OAAO,KAAK,CAAC;AACf,CAAC;AACD,KAAK,UAAU,SAAS,CAAI,OAAmB,EAAE,MAAmB;IAClE,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAC1E,QAAQ,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnG,IAAI,MAAM,CAAC,OAAO;oBAAE,QAAQ,EAAE,CAAC;YACjC,CAAC,CAAC,CAAC,CAAC,CAAC;IACP,CAAC;YAAS,CAAC;QAAC,IAAI,QAAQ;YAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAAC,CAAC;AAC5E,CAAC;AACD,4FAA4F;AAC5F,KAAK,UAAU,WAAW,CAAC,IAAqD,EAAE,IAAY,EAAE,IAAa,EAAE,QAAqB;IAClI,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;IACvH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,uBAAuB,CAAC,YAAY;QAAE,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAChI,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,mBAAmB,EAAE,CAAC,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE;YACzC,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBACrH,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YAAC,CAAC;YACpE,MAAM,CAAC;gBAAC,IAAI,QAAQ,CAAC,OAAO;oBAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;YAAC,CAAC;YAC3F,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;YAC/G,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;YACvF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,wBAAwB;oBAC9F,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;YAC3F,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACxD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,uBAAuB,CAAC,YAAY,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;YACxK,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAiB,EAAE,CAAC;YAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC;gBACH,SAAS,CAAC;oBACR,IAAI,IAA0C,CAAC;oBAC/C,IAAI,CAAC;wBAAC,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAAC,CAAC;oBACnC,MAAM,CAAC;wBAAC,MAAM,CAAC,cAAc,EAAE,CAAC;wBAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;oBAAC,CAAC;oBACnE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;oBAAC,IAAI,IAAI;wBAAE,MAAM;oBAC9C,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;oBACzB,IAAI,IAAI,GAAG,uBAAuB,CAAC,YAAY;wBAAE,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;oBAC1G,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC;oBAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAY,CAAC;gBAAC,CAAC;gBAC9F,MAAM,CAAC;oBAAC,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;gBAAC,CAAC;YACtE,CAAC;oBAAS,CAAC;gBAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAAC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,GAAG,uBAAuB,CAAC,YAAY;oBAAE,MAAM,EAAE,CAAC;gBAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;QAC/J,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACd,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAuB,EAAE,GAAgC;IACxF,IAAI,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;WACzF,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;IACpL,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrI,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnG,IAAI,KAA+B,CAAC;IAAC,IAAI,MAAqC,CAAC;IAC/E,IAAI,kBAAsC,CAAC;IAAC,IAAI,WAA+C,CAAC;IAChG,IAAI,WAAW,GAAwB,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY;QACjG,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC9F,IAAI,QAA2C,CAAC;IAChD,IAAI,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAC;IAC/C,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO;QAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5I,MAAM,YAAY,GAAG,KAAK,EAAE,IAAyB,EAAE,EAAE;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO;QAC9B,UAAU,EAAE,CAAC;QAAC,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAAC,UAAU,EAAE,CAAC;QAC1D,SAAS,GAAG,GAAG,CAAC;QAAC,WAAW,GAAG,IAAI,CAAC;QAAC,QAAQ,GAAG,SAAS,CAAC;QAC1D,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAAC,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAC;QACvE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC1F,MAAM,OAAO,GAAG,kBAAkB,CAAC;YACnC,KAAK,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBAC1F,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,4BAA4B,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,QAAQ,GAAG,KAAK,CAAC;YAChH,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAG,CAAC,MAAe,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,2BAA2B,GAAG,CAAC,OAAO,CAAC,SAAS,YAAY,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACzK,IAAI,UAA8B,CAAC;IAAC,IAAI,MAAwC,CAAC;IACjF,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE;QAChC,IAAI,QAAQ,EAAE,QAAQ,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,QAAQ,CAAC;YAAE,OAAO;QACpG,MAAM,YAAY,CAAC,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QAChC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,iIAAiI,CAAC,CAAC;QAC7J,0FAA0F;QAC1F,MAAM,SAAS,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YAC3F,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QACjH,SAAS,CAAC;YACR,UAAU,EAAE,CAAC;YACb,MAAM,cAAc,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,6BAA6B,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;gBAChG,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBACvG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK;uBACxG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,uBAAuB,CAAC,UAAU;oBAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;gBACxM,MAAM;YACR,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAAC,MAAM,IAAI,EAAE,CAAC;YAAC,CAAC;QAC7F,CAAC;QACD,SAAS,CAAC;YACR,UAAU,EAAE,CAAC;YACb,MAAM,cAAc,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACnE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC;oBAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;gBAC9G,IAAI,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ;oBAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;gBACtG,IAAI,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC;oBAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;gBAC7I,MAAM,GAAG,KAAK,CAAC;gBACf,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5E,MAAM,YAAY,CAAC,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,MAA2D,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;oBACvI,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,CAAC,MAAM,iCAAiC,CAAC,CAAC;gBACtF,CAAC;gBACD,MAAM,gBAAgB,GAAG,QAAQ,CAAC;gBAClC,IAAI,gBAAgB,EAAE,QAAQ,KAAK,QAAQ;oBAAE,MAAM,cAAc,EAAE,CAAC;gBACpE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAAC,MAAM,IAAI,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAC3D,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;oBAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;gBACnF,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBACxE,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;oBAAC,UAAU,EAAE,CAAC;oBAAC,KAAK,GAAG,aAAa,CAAC;oBACvE,MAAM,YAAY,CAAC,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;oBACzH,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;oBAAC,UAAU,EAAE,CAAC;oBACrE,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAAC,UAAU,EAAE,CAAC;gBACjD,CAAC;qBAAM,IAAI,MAAM,gBAAgB,CAAC,aAAa,CAAC,KAAK,MAAM,gBAAgB,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;gBAC1I,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;gBACvE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC/B,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;oBACpF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,MAAM,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;gBAC/J,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBAAC,MAAM,IAAI,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAC7D,IAAI,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC;oBAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;gBACpF,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBAChD,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,IAAI,gBAAgB,EAAE,QAAQ,KAAK,SAAS,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;wBAC7G,MAAM,YAAY,CAAC,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;wBACtF,MAAM,IAAI,EAAE,CAAC;wBAAC,SAAS;oBACzB,CAAC;oBACD,MAAM,YAAY,CAAC,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;oBACvF,kBAAkB,GAAG,SAAS,CAAC;gBACjC,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;gBACtG,UAAU,EAAE,CAAC;gBACb,MAAM,cAAc,EAAE,CAAC;gBACvB,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBAAC,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACtI,IAAI,CAAC,CAAC,cAAc,IAAI,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC;oBAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;gBAC3I,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBAAC,MAAM,IAAI,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;oBAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;gBAC3F,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,4BAA4B,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;oBAChI,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;wBAAC,MAAM,IAAI,EAAE,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBAC7F,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,eAAe;wBAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;oBACvH,WAAW,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;wBACxI,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBACvH,CAAC;gBACD,uFAAuF;gBACvF,MAAM,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;gBAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,mBAAmB,EAAE,CAAC,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;gBAC3H,IAAI,OAA8B,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;oBACjE,OAAO,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;gBACjI,CAAC;wBAAS,CAAC;oBAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBACtC,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;gBACvE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,UAAU,EAAE,CAAC;gBACxC,MAAM,cAAc,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACpI,UAAU,EAAE,CAAC;gBACb,MAAM,cAAc,EAAE,CAAC;gBACvB,IAAI,MAAM,CAAC,MAAM,KAAK,2BAA2B,EAAE,CAAC;oBAAC,MAAM,IAAI,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAC9E,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO;oBAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;gBACvH,MAAM,YAAY,CAAC,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3F,OAAO,EAAE,GAAG,WAAW,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;YACvJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,mFAAmF;gBACnF,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACjI,MAAM,IAAI,EAAE,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,GAAiC,WAAW,CAAC,KAAK,CAAC;QACjE,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9F,MAAM,KAAK,GAAG,KAAK,YAAY,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,CAAC,CAAC,SAAS;gBACzG,CAAC,CAAC,KAAK,YAAY,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;YAC7G,UAAU,GAAG,KAAK,CAAC;YACnB,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC;QACnG,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,GAAG,SAAS,CAAC;IAAC,CAAC;AACpG,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,MAAc,EAAE,QAAuD,EAAE,MAAmB;IAC7I,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,2BAA2B,QAAQ,CAAC,SAAS,YAAY,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACvJ,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO;QAChG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACtJ,CAAC;IAAC,MAAM,CAAC,CAAC,6EAA6E,CAAC,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,SAAuB,EAAE,GAAW,EAAE,IAAa;IAC5E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;AAClC,CAAC"}

package/dist/rotating-token-refresher.d.ts

@@ -1,42 +0,0 @@
-import type { BridgeAuthResponse } from './bridge-auth.js';
-export interface RotatingTokenRefresherOptions {
-    initialRefreshToken: string;
-    refresh: (refreshToken: string) => Promise<BridgeAuthResponse>;
-    loadPersistedRefreshToken: () => string | undefined;
-    persistRefreshToken: (refreshToken: string) => void;
-    onPersistedTokenRecovery?: () => void;
-    /** Monotonic clock in ms; injectable for tests. */
-    now?: () => number;
-    /** Jitter source in [0, 1); injectable for tests. */
-    random?: () => number;
-}
-/**
- * Owns the bridge's single-use refresh token.
- *
- * Token rotation is single-flight inside this process: if centrifuge-js asks
- * for a token twice concurrently, both callers share one exchange instead of
- * racing the same credential. If another process already rotated the token and
- * persisted its replacement, a rejected in-memory token gets one recovery
- * attempt from disk — the same state repair that previously required restart.
- *
- * Transient failures (network errors, 5xx) arm an exponential cooldown during
- * which getToken() rejects without calling the API, because centrifuge-js
- * retries a failed token fetch every 5-10 s with no growth. The cooldown error
- * is deliberately not an UnauthorizedError: centrifuge-js treats that as
- * permanent and stops retrying for good.
- */
-export declare class RotatingTokenRefresher {
-    private readonly options;
-    private currentRefreshToken;
-    private inFlight;
-    private consecutiveFailures;
-    private cooldownUntil;
-    private readonly now;
-    private readonly random;
-    constructor(options: RotatingTokenRefresherOptions);
-    cooldownRemainingMs(): number;
-    getToken(): Promise<string>;
-    private refreshAndRotate;
-    private armCooldown;
-    private exchange;
-}

package/dist/rotating-token-refresher.js

@@ -1,91 +0,0 @@
-import { UnauthorizedError } from 'centrifuge';
-const COOLDOWN_BASE_MS = 15_000;
-const COOLDOWN_MAX_MS = 600_000;
-/**
- * Owns the bridge's single-use refresh token.
- *
- * Token rotation is single-flight inside this process: if centrifuge-js asks
- * for a token twice concurrently, both callers share one exchange instead of
- * racing the same credential. If another process already rotated the token and
- * persisted its replacement, a rejected in-memory token gets one recovery
- * attempt from disk — the same state repair that previously required restart.
- *
- * Transient failures (network errors, 5xx) arm an exponential cooldown during
- * which getToken() rejects without calling the API, because centrifuge-js
- * retries a failed token fetch every 5-10 s with no growth. The cooldown error
- * is deliberately not an UnauthorizedError: centrifuge-js treats that as
- * permanent and stops retrying for good.
- */
-export class RotatingTokenRefresher {
-    options;
-    currentRefreshToken;
-    inFlight = null;
-    consecutiveFailures = 0;
-    cooldownUntil = 0;
-    now;
-    random;
-    constructor(options) {
-        this.options = options;
-        this.currentRefreshToken = options.initialRefreshToken;
-        this.now = options.now ?? (() => performance.now());
-        this.random = options.random ?? Math.random;
-    }
-    cooldownRemainingMs() {
-        return Math.max(0, this.cooldownUntil - this.now());
-    }
-    getToken() {
-        if (this.inFlight)
-            return this.inFlight;
-        const remaining = this.cooldownRemainingMs();
-        if (remaining > 0) {
-            return Promise.reject(new Error(`Token refresh cooling down for ${Math.ceil(remaining / 1000)}s after ${this.consecutiveFailures} failed attempts`));
-        }
-        const operation = this.refreshAndRotate().finally(() => {
-            if (this.inFlight === operation)
-                this.inFlight = null;
-        });
-        this.inFlight = operation;
-        return operation;
-    }
-    async refreshAndRotate() {
-        try {
-            const token = await this.exchange();
-            this.consecutiveFailures = 0;
-            this.cooldownUntil = 0;
-            return token;
-        }
-        catch (error) {
-            if (!(error instanceof UnauthorizedError))
-                this.armCooldown();
-            throw error;
-        }
-    }
-    armCooldown() {
-        this.consecutiveFailures++;
-        const base = Math.min(COOLDOWN_BASE_MS * 2 ** (this.consecutiveFailures - 1), COOLDOWN_MAX_MS);
-        this.cooldownUntil = this.now() + base * (0.8 + 0.4 * this.random());
-    }
-    async exchange() {
-        let refreshed;
-        try {
-            refreshed = await this.options.refresh(this.currentRefreshToken);
-        }
-        catch (error) {
-            if (!(error instanceof UnauthorizedError))
-                throw error;
-            const persistedToken = this.options.loadPersistedRefreshToken();
-            if (!persistedToken || persistedToken === this.currentRefreshToken) {
-                throw error;
-            }
-            // Another bridge process sharing this data directory completed a
-            // rotation first. Adopt its persisted token and retry exactly once.
-            this.currentRefreshToken = persistedToken;
-            this.options.onPersistedTokenRecovery?.();
-            refreshed = await this.options.refresh(this.currentRefreshToken);
-        }
-        this.currentRefreshToken = refreshed.refreshToken;
-        this.options.persistRefreshToken(this.currentRefreshToken);
-        return refreshed.token;
-    }
-}
-//# sourceMappingURL=rotating-token-refresher.js.map

package/dist/rotating-token-refresher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rotating-token-refresher.js","sourceRoot":"","sources":["../src/rotating-token-refresher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAgB/C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEhC;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,sBAAsB;IAQJ;IAPrB,mBAAmB,CAAS;IAC5B,QAAQ,GAA2B,IAAI,CAAC;IACxC,mBAAmB,GAAG,CAAC,CAAC;IACxB,aAAa,GAAG,CAAC,CAAC;IACT,GAAG,CAAe;IAClB,MAAM,CAAe;IAEtC,YAA6B,OAAsC;QAAtC,YAAO,GAAP,OAAO,CAA+B;QACjE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACvD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IAC9C,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,QAAQ;QACN,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAExC,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,kCAAkC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,kBAAkB,CACnH,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACrD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,iBAAiB,CAAC;gBAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CACnB,gBAAgB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC,EACtD,eAAe,CAChB,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,IAAI,SAA6B,CAAC;QAClC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,iBAAiB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAEvD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;YAChE,IAAI,CAAC,cAAc,IAAI,cAAc,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACnE,MAAM,KAAK,CAAC;YACd,CAAC;YAED,iEAAiE;YACjE,oEAAoE;YACpE,IAAI,CAAC,mBAAmB,GAAG,cAAc,CAAC;YAC1C,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;YAC1C,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC,YAAY,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3D,OAAO,SAAS,CAAC,KAAK,CAAC;IACzB,CAAC;CACF"}