@aauth/proxy - npm Package Compare versions

Comparing version 0.5.0 to 1.0.1

dist/access-mode.d.ts

+export type KnownAccessMode = 'agent-token' | 'person-token' | 'session-token' | 'auth-token' | 'per-call';
+export declare const KNOWN_ACCESS_MODES: readonly KnownAccessMode[];
+export declare function isKnownAccessMode(v: string | undefined): v is KnownAccessMode;
+export interface AgentSetup {
+    /** false when the agent token carries no `ps` claim. */
+    hasPersonServer: boolean;
+}
+export type AccessModePlan = {
+    kind: 'undeclared';
+} | {
+    kind: 'satisfiable';
+    mode: KnownAccessMode;
+} | {
+    kind: 'unsatisfiable';
+    mode: KnownAccessMode;
+    reason: string;
+};
+export declare function planAccessMode(declared: string | undefined, setup: AgentSetup): AccessModePlan;
+/** One-line reason string for a plan, for surfacing to the LLM. */
+export declare function planReason(plan: AccessModePlan): string | undefined;
+//# sourceMappingURL=access-mode.d.ts.map

dist/access-mode.d.ts.map

+{"version":3,"file":"access-mode.d.ts","sourceRoot":"","sources":["../src/access-mode.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,eAAe,GACvB,aAAa,GACb,cAAc,GACd,eAAe,GACf,YAAY,GACZ,UAAU,CAAA;AAEd,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAMxD,CAAA;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,CAAC,IAAI,eAAe,CAE7E;AAED,MAAM,WAAW,UAAU;IACzB,wDAAwD;IACxD,eAAe,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAKpE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,UAAU,GAAG,cAAc,CA2B9F;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAEnE"}

dist/access-mode.js

+// access_mode planning.
+//
+// `access_mode` is an IANA registry (protocol §Resource Metadata, §AAuth Access
+// Mode Value Registry), not a closed list: -11 defines four values, R3 -02 adds
+// `per-call`, and extensions may add more. Three outcomes, and only three:
+//
+//   undeclared    — absent, or a value this agent does not recognize. Call the
+//                   resource and read the AAuth-Requirement it returns. NEVER an
+//                   error: the declaration is advisory, the runtime requirement
+//                   is authoritative.
+//   satisfiable   — recognized, and this agent's setup can complete it. Plan
+//                   against it and skip the speculative call.
+//   unsatisfiable — recognized, and this agent cannot complete it. Skip the
+//                   resource (or operation) and say why. An agent whose agent
+//                   token carries no `ps` claim cannot obtain a person token,
+//                   and so cannot complete person-token, auth-token or per-call
+//                   access — it should learn that here, not at a 401.
+//
+// Mirrors the `@aauth/protocol` surface named in the AAuth -11 package contract
+// (planAccessMode / AgentSetup / AccessModePlan / KnownAccessMode). Kept local
+// while @aauth/protocol is unpublished; swap the implementation for an import
+// when it ships — the types are identical by construction.
+export const KNOWN_ACCESS_MODES = [
+    'agent-token',
+    'person-token',
+    'session-token',
+    'auth-token',
+    'per-call',
+];
+export function isKnownAccessMode(v) {
+    return v !== undefined && KNOWN_ACCESS_MODES.includes(v);
+}
+const NO_PS = 'this agent token carries no `ps` claim, so the agent has no person server to obtain a person token from';
+export function planAccessMode(declared, setup) {
+    if (!isKnownAccessMode(declared))
+        return { kind: 'undeclared' };
+    switch (declared) {
+        // Identity only: every request already carries an agent token.
+        case 'agent-token':
+            return { kind: 'satisfiable', mode: declared };
+        // Resource-managed: the resource runs its own consent flow and hands back a
+        // session token via AAuth-Access. No PS involved.
+        case 'session-token':
+            return { kind: 'satisfiable', mode: declared };
+        // All three need a person token, which only a person server issues. A
+        // resource MUST have verified a person token before it issues a resource
+        // token, so auth-token and per-call are unreachable without one too.
+        case 'person-token':
+        case 'auth-token':
+        case 'per-call':
+            return setup.hasPersonServer
+                ? { kind: 'satisfiable', mode: declared }
+                : {
+                    kind: 'unsatisfiable',
+                    mode: declared,
+                    reason: `access_mode "${declared}" requires a person token, and ${NO_PS}`,
+                };
+    }
+}
+/** One-line reason string for a plan, for surfacing to the LLM. */
+export function planReason(plan) {
+    return plan.kind === 'unsatisfiable' ? plan.reason : undefined;
+}
+//# sourceMappingURL=access-mode.js.map

dist/access-mode.js.map

+{"version":3,"file":"access-mode.js","sourceRoot":"","sources":["../src/access-mode.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,sCAAsC;AACtC,6EAA6E;AAC7E,8DAA8D;AAC9D,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,sEAAsE;AACtE,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,2DAA2D;AAS3D,MAAM,CAAC,MAAM,kBAAkB,GAA+B;IAC5D,aAAa;IACb,cAAc;IACd,eAAe;IACf,YAAY;IACZ,UAAU;CACX,CAAA;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAqB;IACrD,OAAO,CAAC,KAAK,SAAS,IAAK,kBAAwC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;AACjF,CAAC;AAYD,MAAM,KAAK,GACT,yGAAyG,CAAA;AAE3G,MAAM,UAAU,cAAc,CAAC,QAA4B,EAAE,KAAiB;IAC5E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;IAE/D,QAAQ,QAAQ,EAAE,CAAC;QACjB,+DAA+D;QAC/D,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;QAEhD,4EAA4E;QAC5E,kDAAkD;QAClD,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;QAEhD,sEAAsE;QACtE,yEAAyE;QACzE,qEAAqE;QACrE,KAAK,cAAc,CAAC;QACpB,KAAK,YAAY,CAAC;QAClB,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,eAAe;gBAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzC,CAAC,CAAC;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,gBAAgB,QAAQ,kCAAkC,KAAK,EAAE;iBAC1E,CAAA;IACT,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,IAAoB;IAC7C,OAAO,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAChE,CAAC"}

dist/jwt.d.ts

+export declare function decodeJwtHeader(jwt: string): Record<string, unknown>;
+export declare function decodeJwtPayload(jwt: string): Record<string, unknown>;
+/** The `ps` claim on an agent token. Absent → the agent has no person server and
+ *  cannot obtain a person token, and so cannot complete `person-token`,
+ *  `auth-token` or `per-call` access. Malformed tokens read as no PS. */
+export declare function agentTokenPs(agentToken: string): string | undefined;
+/** Seconds-since-epoch `exp`, or undefined when absent/unparseable. */
+export declare function jwtExp(jwt: string): number | undefined;
+interface ThumbprintableJwk {
+    kty?: string;
+    crv?: string;
+    x?: string;
+    y?: string;
+    n?: string;
+    e?: string;
+}
+/**
+ * RFC 7638 JWK thumbprint (SHA-256, base64url). Used as the cache key discriminator
+ * for person tokens: every person token binds the agent's key through `cnf`, so a
+ * change in this value invalidates all of them at once (protocol §Person Token
+ * Endpoint).
+ */
+export declare function jwkThumbprint(jwk: ThumbprintableJwk): Promise<string>;
+export {};
+//# sourceMappingURL=jwt.d.ts.map

dist/jwt.d.ts.map

+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAUA,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEpE;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAErE;AAWD;;yEAEyE;AACzE,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOnE;AAED,uEAAuE;AACvE,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOtD;AAED,UAAU,iBAAiB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,CAAC,CAAC,EAAE,MAAM,CAAA;CACX;AAQD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB3E"}

dist/jwt.js

+// Unverified JWT decoding + RFC 7638 JWK thumbprints.
+//
+// Decoding only — nothing here verifies a signature. The agent proxy reads its
+// own agent token to learn whether it has a `ps` claim (which decides whether
+// the person-token / auth-token flows are reachable at all) and reads `exp` off
+// tokens it holds. Verification is the recipient's job.
+//
+// Platform-neutral: base64url by hand and WebCrypto for SHA-256, so the core
+// stays workerd-safe (no node:crypto, no Buffer).
+export function decodeJwtHeader(jwt) {
+    return decodeSegment(jwt, 0);
+}
+export function decodeJwtPayload(jwt) {
+    return decodeSegment(jwt, 1);
+}
+function decodeSegment(jwt, index) {
+    const seg = jwt.split('.')[index];
+    if (!seg)
+        throw new Error('malformed JWT');
+    const b64 = seg.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = b64 + '='.repeat((4 - (b64.length % 4)) % 4);
+    const bytes = Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+    return JSON.parse(new TextDecoder().decode(bytes));
+}
+/** The `ps` claim on an agent token. Absent → the agent has no person server and
+ *  cannot obtain a person token, and so cannot complete `person-token`,
+ *  `auth-token` or `per-call` access. Malformed tokens read as no PS. */
+export function agentTokenPs(agentToken) {
+    try {
+        const ps = decodeJwtPayload(agentToken).ps;
+        return typeof ps === 'string' && ps ? ps : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Seconds-since-epoch `exp`, or undefined when absent/unparseable. */
+export function jwtExp(jwt) {
+    try {
+        const exp = decodeJwtPayload(jwt).exp;
+        return typeof exp === 'number' ? exp : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function base64url(bytes) {
+    let s = '';
+    for (const b of new Uint8Array(bytes))
+        s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/**
+ * RFC 7638 JWK thumbprint (SHA-256, base64url). Used as the cache key discriminator
+ * for person tokens: every person token binds the agent's key through `cnf`, so a
+ * change in this value invalidates all of them at once (protocol §Person Token
+ * Endpoint).
+ */
+export async function jwkThumbprint(jwk) {
+    let canonical;
+    switch (jwk.kty) {
+        case 'OKP':
+            canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x });
+            break;
+        case 'EC':
+            canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
+            break;
+        case 'RSA':
+            canonical = JSON.stringify({ e: jwk.e, kty: jwk.kty, n: jwk.n });
+            break;
+        default:
+            throw new Error(`jwkThumbprint: unsupported kty ${jwk.kty}`);
+    }
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(canonical));
+    return base64url(digest);
+}
+//# sourceMappingURL=jwt.js.map

dist/jwt.js.map

+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,wDAAwD;AACxD,EAAE;AACF,6EAA6E;AAC7E,kDAAkD;AAElD,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,KAAa;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IACnE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAA4B,CAAA;AAC/E,CAAC;AAED;;yEAEyE;AACzE,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAA;QAC1C,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAA;QACrC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAWD,SAAS,SAAS,CAAC,KAAkB;IACnC,IAAI,CAAC,GAAG,EAAE,CAAA;IACV,KAAK,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAClE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAsB;IACxD,IAAI,SAAiB,CAAA;IACrB,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC;QAChB,KAAK,KAAK;YACR,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAA;YACpE,MAAK;QACP,KAAK,IAAI;YACP,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAA;YAC9E,MAAK;QACP,KAAK,KAAK;YACR,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAA;YAChE,MAAK;QACP;YACE,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IACzF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;AAC1B,CAAC"}

dist/vocab/annotations.d.ts

+export declare const OPENAPI_ACCESS_MODE_KEY = "x-aauth-access-mode";
+export declare const OPENAPI_BUDGET_KEY = "x-aauth-budget";
+export declare const MCP_ACCESS_MODE_KEY = "aauth.dev/access-mode";
+export declare const MCP_BUDGET_KEY = "aauth.dev/budget";
+export interface OperationAnnotations {
+    /** The operation's own access mode, when it carries one. Never `session-token`:
+     *  R3 forbids that value in an annotation, and a value we see anyway is dropped. */
+    access_mode?: string;
+    /** true when invoking this operation draws down a budget. */
+    budget?: boolean;
+}
+/** Read the two annotations off an OpenAPI (or AsyncAPI) Operation Object. */
+export declare function readOpenApiAnnotations(op: Record<string, unknown> | undefined): OperationAnnotations;
+/** Read the two annotations off an MCP Tool's `_meta`. */
+export declare function readMcpToolAnnotations(tool: {
+    _meta?: Record<string, unknown>;
+} | undefined): OperationAnnotations;
+/**
+ * The access mode that actually applies to one operation.
+ *
+ * - An annotation replaces the resource-wide default outright (never intersects).
+ * - `budget: true` implies at least `auth-token`, because a budget is carried in
+ *   the auth token's `budget` claim. Where the access mode annotation is absent,
+ *   `budget: true` implies `auth-token` rather than the resource default; a
+ *   resource MUST NOT pair `budget: true` with `agent-token` or `person-token`,
+ *   and an agent that sees that combination anyway MUST treat it as `auth-token`.
+ * - Absent everything, the protocol default is `agent-token`.
+ */
+export declare function effectiveAccessMode(annotations: OperationAnnotations | undefined, resourceWide: string | undefined): string;
+//# sourceMappingURL=annotations.d.ts.map

dist/vocab/annotations.d.ts.map

+{"version":3,"file":"annotations.d.ts","sourceRoot":"","sources":["../../src/vocab/annotations.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,uBAAuB,wBAAwB,CAAA;AAC5D,eAAO,MAAM,kBAAkB,mBAAmB,CAAA;AAClD,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAC1D,eAAO,MAAM,cAAc,qBAAqB,CAAA;AAEhD,MAAM,WAAW,oBAAoB;IACnC;wFACoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAmBD,8EAA8E;AAC9E,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,oBAAoB,CAEpG;AAED,0DAA0D;AAC1D,wBAAgB,sBAAsB,CACpC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,SAAS,GACpD,oBAAoB,CAEtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,oBAAoB,GAAG,SAAS,EAC7C,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,CAOR"}

dist/vocab/annotations.js

+// Operation access annotations (R3 -02 §Operation Access Annotations).
+//
+// An agent cannot read R3 documents, so R3 alone tells it nothing about what any
+// one operation requires. What it CAN read is the vocabulary — the OpenAPI
+// document, the MCP tool list — because it has to parse that to make the call at
+// all. The annotations state, alongside each operation, which credential it needs
+// and whether it draws down a budget.
+//
+// Encodings (R3 -02 §Vocabulary Encodings):
+//
+//   OpenAPI  Operation Object   x-aauth-access-mode       x-aauth-budget
+//   MCP      Tool `_meta`       aauth.dev/access-mode     aauth.dev/budget
+//   AsyncAPI Operation Object   x-aauth-access-mode       x-aauth-budget
+//
+// Three rules govern how they combine with the resource-wide `access_mode`
+// (§Applying Annotations):
+//
+//   1. Sparse. An operation with no annotation takes the resource's access_mode.
+//   2. Replacing, not intersecting. A `person-token` annotation on a resource
+//      declaring `auth-token` LOWERS the requirement for that operation.
+//   3. Advisory. A resource MAY return any AAuth-Requirement at runtime whatever
+//      it published. Annotations let the agent plan; the runtime requirement is
+//      authoritative. Nothing here is ever enforced.
+export const OPENAPI_ACCESS_MODE_KEY = 'x-aauth-access-mode';
+export const OPENAPI_BUDGET_KEY = 'x-aauth-budget';
+export const MCP_ACCESS_MODE_KEY = 'aauth.dev/access-mode';
+export const MCP_BUDGET_KEY = 'aauth.dev/budget';
+function readAnnotations(source, accessModeKey, budgetKey) {
+    if (!source)
+        return {};
+    const out = {};
+    const mode = source[accessModeKey];
+    // `session-token` MUST NOT appear in an annotation: a resource that manages
+    // its own authorization does so for the whole resource and says so in
+    // access_mode. Drop it rather than honour it.
+    if (typeof mode === 'string' && mode && mode !== 'session-token')
+        out.access_mode = mode;
+    const budget = source[budgetKey];
+    if (typeof budget === 'boolean')
+        out.budget = budget;
+    return out;
+}
+/** Read the two annotations off an OpenAPI (or AsyncAPI) Operation Object. */
+export function readOpenApiAnnotations(op) {
+    return readAnnotations(op, OPENAPI_ACCESS_MODE_KEY, OPENAPI_BUDGET_KEY);
+}
+/** Read the two annotations off an MCP Tool's `_meta`. */
+export function readMcpToolAnnotations(tool) {
+    return readAnnotations(tool?._meta, MCP_ACCESS_MODE_KEY, MCP_BUDGET_KEY);
+}
+/**
+ * The access mode that actually applies to one operation.
+ *
+ * - An annotation replaces the resource-wide default outright (never intersects).
+ * - `budget: true` implies at least `auth-token`, because a budget is carried in
+ *   the auth token's `budget` claim. Where the access mode annotation is absent,
+ *   `budget: true` implies `auth-token` rather than the resource default; a
+ *   resource MUST NOT pair `budget: true` with `agent-token` or `person-token`,
+ *   and an agent that sees that combination anyway MUST treat it as `auth-token`.
+ * - Absent everything, the protocol default is `agent-token`.
+ */
+export function effectiveAccessMode(annotations, resourceWide) {
+    const annotated = annotations?.access_mode;
+    const base = annotated ?? resourceWide ?? 'agent-token';
+    if (annotations?.budget === true && (base === 'agent-token' || base === 'person-token')) {
+        return 'auth-token';
+    }
+    return base;
+}
+//# sourceMappingURL=annotations.js.map

dist/vocab/annotations.js.map

+{"version":3,"file":"annotations.js","sourceRoot":"","sources":["../../src/vocab/annotations.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,iFAAiF;AACjF,2EAA2E;AAC3E,iFAAiF;AACjF,kFAAkF;AAClF,sCAAsC;AACtC,EAAE;AACF,4CAA4C;AAC5C,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,EAAE;AACF,2EAA2E;AAC3E,2BAA2B;AAC3B,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,yEAAyE;AACzE,iFAAiF;AACjF,gFAAgF;AAChF,qDAAqD;AAErD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAA;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAA;AAClD,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAA;AAC1D,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAA;AAUhD,SAAS,eAAe,CACtB,MAA2C,EAC3C,aAAqB,EACrB,SAAiB;IAEjB,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,MAAM,GAAG,GAAyB,EAAE,CAAA;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;IAClC,4EAA4E;IAC5E,sEAAsE;IACtE,8CAA8C;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,IAAI,KAAK,eAAe;QAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAA;IACxF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;IAChC,IAAI,OAAO,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;IACpD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,EAAuC;IAC5E,OAAO,eAAe,CAAC,EAAE,EAAE,uBAAuB,EAAE,kBAAkB,CAAC,CAAA;AACzE,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,sBAAsB,CACpC,IAAqD;IAErD,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,cAAc,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA6C,EAC7C,YAAgC;IAEhC,MAAM,SAAS,GAAG,WAAW,EAAE,WAAW,CAAA;IAC1C,MAAM,IAAI,GAAG,SAAS,IAAI,YAAY,IAAI,aAAa,CAAA;IACvD,IAAI,WAAW,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,cAAc,CAAC,EAAE,CAAC;QACxF,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

dist/agent.d.ts

 import { fetch as signedFetch } from '@hellocoop/httpsig';
-import type { L1Entry } from './store.js';
+import type { KnownAccessMode } from './access-mode.js';
+import type { L1Entry, PersonTokenStore } from './store.js';
 export type AgentSigningKey = Parameters<typeof signedFetch>[1]['signingKey'];
 /**
  * Optional hints forwarded verbatim as extra body parameters in every POST to
- * the PS token endpoint (AAuth spec §8.1). All fields are optional; include only
- * those the host has learned about the user.
+ * the PS auth token endpoint (protocol §Agent Token Request). All fields are
+ * optional; include only those the host has learned about the user.
  */
@@ -21,2 +22,7 @@ export interface PSTokenHints {
 }
+/** Opaque per-resource session token from the AAuth-Access header. */
+export interface SessionTokenStore {
+    get(resource: string): Promise<string | undefined>;
+    set(resource: string, token: string): Promise<void>;
+}
 export interface ProxyConfig {
@@ -26,5 +32,20 @@ psUrl: string;
     agentToken: string;
-    /** Extra parameters forwarded to every PS token endpoint request. */
+    /**
+     * The mission this agent is operating under, as the base64url SHA-256 of the
+     * approved mission JSON. Forwarded to the PS's person token endpoint, which
+     * stamps it into the person token; from there the resource copies it into the
+     * resource token and the PS into the auth token. No PS implements
+     * `mission_endpoint` yet — the claim path is built regardless.
+     */
+    missionS256?: string;
+    /** Extra parameters forwarded to every PS auth token endpoint request. */
     psHints?: PSTokenHints;
     /**
+     * Person-token cache. Keyed (resource, mission_s256); flushed whole when the
+     * agent's signing key changes. Defaults to a per-config in-memory store.
+     */
+    personTokens?: PersonTokenStore;
+    /** Session-token store for `session-token` resources. Defaults to per-config memory. */
+    sessionTokens?: SessionTokenStore;
+    /**
      * Called with each auth_token received from the PS before it is used.
@@ -41,2 +62,6 @@ * Hosts can use this to record or validate the PS sub across exchanges.
 }
+export interface InvokeOptions {
+    /** Overrides ProxyConfig.missionS256 for this call. */
+    missionS256?: string;
+}
 export interface Interaction {
@@ -54,9 +79,63 @@ url: string;
     interaction: Interaction;
+}
+/**
+ * The resource (or this operation) declares an access mode this agent's setup
+ * cannot complete — typically `auth-token` or `person-token` at an agent whose
+ * agent token carries no `ps` claim. No request was made. Case (c) of the
+ * three-way access_mode plan: the agent learns this before planning rather
+ * than at a 401.
+ */
+ | {
+    kind: 'skipped';
+    resource: string;
+    opId: string;
+    mode: KnownAccessMode;
+    reason: string;
 };
 export type InteractionHandler = (url: string, code: string) => Promise<void> | void;
 export declare function makeAgentPoll(cfg: ProxyConfig): (url: string) => Promise<Response>;
+interface PSMetadata {
+    /** Renamed from `token_endpoint` in -11. */
+    auth_token_endpoint: string;
+    /** New in -11, REQUIRED. */
+    person_token_endpoint?: string;
+    interaction_endpoint?: string;
+    mission_endpoint?: string;
+}
+type PersonTokenOutcome = {
+    kind: 'token';
+    personToken: string;
+} | {
+    kind: 'interaction';
+    interaction: Interaction;
+} | {
+    kind: 'result';
+    status: number;
+    body: unknown;
+};
+/**
+ * Obtain a person token for one resource, from cache or from the PS.
+ *
+ * A resource MUST have verified a person token before it issues a resource token,
+ * and the agent MUST present one on every authorization endpoint request
+ * (protocol §Person Token, §Authorization Endpoint Request) — so this sits in
+ * front of the whole authorize-first path, not only of `person-token` resources.
+ *
+ * The PS MAY require the user to approve the agent acting at this resource before
+ * issuing, and answers `202` with `requirement=interaction`. That is surfaced
+ * like any other interaction; the caller drives it and retries, and the second
+ * request gets a `200`.
+ */
+export declare function obtainPersonToken(cfg: ProxyConfig, ps: PSMetadata, resource: string, missionS256?: string): Promise<PersonTokenOutcome>;
+/**
+ * Drop every cached person token. Call when the agent's signing key rotates —
+ * every person token binds the same key through `cnf`, so none of them survive.
+ * `obtainPersonToken` also detects rotation on its own via the key thumbprint;
+ * this is the explicit hook for a host that knows a rotation happened.
+ */
+export declare function flushPersonTokens(cfg: ProxyConfig): Promise<void>;
 type Poller = (url: string) => Promise<Response>;
 export declare function pollUntilDone(poll: Poller, locationUrl: string, timeoutMs?: number, onPoll?: (elapsedMs: number) => void | Promise<void>): Promise<Response>;
-export declare function invokeAtResource(cfg: ProxyConfig, l1: L1Entry, operationId: string, args?: InvokeArgs): Promise<InvokeResult>;
-export declare function invokeAtResourceComplete(cfg: ProxyConfig, l1: L1Entry, operationId: string, onInteraction: InteractionHandler, args?: InvokeArgs, maxRounds?: number, pollTimeoutMs?: number, onPoll?: (elapsedMs: number) => void | Promise<void>): Promise<{
+export declare function invokeAtResource(cfg: ProxyConfig, l1: L1Entry, operationId: string, args?: InvokeArgs, opts?: InvokeOptions): Promise<InvokeResult>;
+export declare function invokeAtResourceComplete(cfg: ProxyConfig, l1: L1Entry, operationId: string, onInteraction: InteractionHandler, args?: InvokeArgs, maxRounds?: number, pollTimeoutMs?: number, onPoll?: (elapsedMs: number) => void | Promise<void>, opts?: InvokeOptions): Promise<{
     status: number;
@@ -63,0 +142,0 @@ body: unknown;

dist/agent.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEzC,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;AAE7E;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,EAAE,eAAe,CAAA;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtD;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,WAAW,CAAA;CAAE,CAAA;AAErD,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAOpF,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAGlF;AAoED,KAAK,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAShD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,SAAU,EACnB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACnD,OAAO,CAAC,QAAQ,CAAC,CAUnB;AA8CD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,WAAW,EAChB,EAAE,EAAE,OAAO,EACX,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,YAAY,CAAC,CAgHvB;AAMD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,WAAW,EAChB,EAAE,EAAE,OAAO,EACX,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,kBAAkB,EACjC,IAAI,GAAE,UAAe,EACrB,SAAS,SAAI,EACb,aAAa,SAAU,EACvB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACnD,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAW5C;AAID,wBAAsB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAElG"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAIvE,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE3D,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;AAE7E;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAClD,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,EAAE,eAAe,CAAA;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B,wFAAwF;IACxF,aAAa,CAAC,EAAE,iBAAiB,CAAA;IACjC;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtD;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,WAAW,CAAA;CAAE;AACnD;;;;;;GAMG;GACD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9F,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAqEpF,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAGlF;AA6CD,UAAU,UAAU;IAClB,4CAA4C;IAC5C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,4BAA4B;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AA+CD,KAAK,kBAAkB,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,WAAW,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAA;AAErD;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,WAAW,EAChB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC,CA4C7B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AA4BD,KAAK,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAShD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,SAAU,EACnB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACnD,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAqFD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,WAAW,EAChB,EAAE,EAAE,OAAO,EACX,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,UAAe,EACrB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAkNvB;AAMD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,WAAW,EAChB,EAAE,EAAE,OAAO,EACX,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,kBAAkB,EACjC,IAAI,GAAE,UAAe,EACrB,SAAS,SAAI,EACb,aAAa,SAAU,EACvB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EACpD,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAY5C;AAID,wBAAsB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAElG"}

dist/agent.js

@@ -1,41 +0,87 @@
-// agent proxy — the user's AAuth agent. v0 core: the authorize-first R3 invoke flow
-// against the resource proxy, exchanging at the PS.
+// agent proxy — the user's AAuth agent. The invoke flow against an AAuth
+// resource, obtaining person tokens and auth tokens at the PS.
 //
-// invoke() is non-blocking: when an interaction is required (PS consent or the
-// resource's OAuth bootstrap) it RETURNS the interaction (url + code + poll URL)
-// rather than completing it, so a caller — the MCP server — can surface the URL
-// to the user. invokeComplete() drives it to completion for programmatic use,
-// performing the interaction via a callback and polling.
+// The shape of the flow is the one the protocol describes: pick an opening
+// credential from what the resource declared, make the request, read any
+// AAuth-Requirement, satisfy it, retry. The declaration only saves round trips —
+// the runtime requirement is authoritative and can escalate at any point.
 //
-// Built directly on @hellocoop/httpsig (the @aauth/mcp-agent package is
-// 401-challenge-driven and has no R3/authorize-first path, mirroring the
+// invoke() is non-blocking: when an interaction is required (PS consent, a person
+// token the PS wants the user to approve, or the resource's own OAuth bootstrap)
+// it RETURNS the interaction (url + code + poll URL) rather than completing it,
+// so a caller — the MCP server — can surface the URL to the user.
+// invokeComplete() drives it to completion for programmatic use, performing the
+// interaction via a callback and polling.
+//
+// Built directly on @hellocoop/httpsig (the @aauth/agent package is
+// 401-challenge-driven and has no authorize-first path, mirroring the
 // resource-side finding).
 import { fetch as signedFetch } from '@hellocoop/httpsig';
+import { planAccessMode } from './access-mode.js';
+import { agentTokenPs, jwkThumbprint } from './jwt.js';
 import { routeOperation } from './resource.js';
-function signWith(cfg, token) {
-    return (url, init = {}) => signedFetch(url, { ...init, signingKey: cfg.agentPrivateJwk, signatureKey: { type: 'jwt', jwt: token } });
+import { createMemoryPersonTokenStore } from './store.js';
+// The AAuth HTTP Message Signatures profile's base covered components. httpsig
+// applies these itself when no list is passed; we pass an explicit list whenever
+// something must be added to it.
+const BASE_GET = ['@method', '@authority', '@path', 'signature-key'];
+const BASE_BODY = ['@method', '@authority', '@path', 'content-type', 'signature-key'];
+function components(opts) {
+    const base = opts.hasBody ? [...BASE_BODY] : [...BASE_GET];
+    let extended = false;
+    if (opts.hasBody && opts.psOrAs) {
+        base.splice(base.indexOf('content-type') + 1, 0, 'content-digest');
+        extended = true;
+    }
+    if (opts.authorization) {
+        base.splice(base.length - 1, 0, 'authorization');
+        extended = true;
+    }
+    return extended ? base : undefined;
 }
+function signWith(cfg, cred, opts = {}) {
+    return (url, init = {}) => {
+        const headers = { ...(init.headers ?? {}) };
+        if (cred.kind === 'session')
+            headers.authorization = `AAuth ${cred.token}`;
+        const jwt = cred.kind === 'person' || cred.kind === 'auth' ? cred.jwt : cfg.agentToken;
+        const list = components({
+            hasBody: init.body !== undefined,
+            authorization: cred.kind === 'session',
+            psOrAs: opts.psOrAs,
+        });
+        return signedFetch(url, {
+            ...init,
+            headers,
+            signingKey: cfg.agentPrivateJwk,
+            signatureKey: { type: 'jwt', jwt },
+            ...(list ? { components: list } : {}),
+        });
+    };
+}
 export function makeAgentPoll(cfg) {
-    return (url) => signWith(cfg, cfg.agentToken)(url, { method: 'GET', headers: { Prefer: 'wait=20' } });
+    return (url) => signWith(cfg, { kind: 'agent' })(url, { method: 'GET', headers: { Prefer: 'wait=20' } });
 }
-function parseInteraction(requirement) {
-    if (!requirement || !requirement.includes('requirement=interaction'))
+// Parses the AAuth-Requirement header. Unrecognized `requirement=` values are
+// returned as-is: the caller decides, and treats anything it cannot satisfy as a
+// terminal response rather than guessing.
+function parseRequirement(headerValue) {
+    if (!headerValue)
         return undefined;
-    const url = /url="([^"]+)"/.exec(requirement)?.[1];
-    const code = /code="([^"]+)"/.exec(requirement)?.[1];
-    return url && code ? { url, code } : undefined;
-}
-// A per-call escalation challenge (W2): the resource returns 401 with
-// `requirement=auth-token; resource-token="…"` for a conditional/irreversible op.
-// The agent takes that resource token (which carries the call as r3_context) to
-// the PS for a per-call auth token, then retries.
-function parseAuthTokenChallenge(requirement) {
-    if (!requirement || !requirement.includes('requirement=auth-token'))
+    const requirement = /requirement=([A-Za-z0-9_-]+)/.exec(headerValue)?.[1];
+    if (!requirement)
         return undefined;
-    return /resource-token="([^"]+)"/.exec(requirement)?.[1];
+    return {
+        requirement,
+        resourceToken: /resource-token="([^"]+)"/.exec(headerValue)?.[1],
+        url: /url="([^"]+)"/.exec(headerValue)?.[1],
+        code: /code="([^"]+)"/.exec(headerValue)?.[1],
+    };
 }
 function interactionFrom(res) {
-    const parsed = parseInteraction(res.headers.get('aauth-requirement'));
+    const parsed = parseRequirement(res.headers.get('aauth-requirement'));
     const pollUrl = res.headers.get('location') ?? '';
-    return parsed && pollUrl ? { ...parsed, pollUrl } : undefined;
+    return parsed?.requirement === 'interaction' && parsed.url && parsed.code && pollUrl
+        ? { url: parsed.url, code: parsed.code, pollUrl }
+        : undefined;
 }
@@ -54,7 +100,104 @@ async function safeBody(res) {
 }
+// ── Per-config default stores ──
+//
+// Keyed on the ProxyConfig object, which the identity provider resolves
+// per-principal. A process-global cache would leak person and session tokens
+// across tenants in a multi-user host.
+const defaultPersonTokens = new WeakMap();
+const defaultSessionTokens = new WeakMap();
+function personTokenStore(cfg) {
+    if (cfg.personTokens)
+        return cfg.personTokens;
+    let store = defaultPersonTokens.get(cfg);
+    if (!store) {
+        store = createMemoryPersonTokenStore();
+        defaultPersonTokens.set(cfg, store);
+    }
+    return store;
+}
+function sessionTokenStore(cfg) {
+    if (cfg.sessionTokens)
+        return cfg.sessionTokens;
+    let store = defaultSessionTokens.get(cfg);
+    if (!store) {
+        const m = new Map();
+        store = {
+            async get(resource) {
+                return m.get(resource);
+            },
+            async set(resource, token) {
+                m.set(resource, token);
+            },
+        };
+        defaultSessionTokens.set(cfg, store);
+    }
+    return store;
+}
+/**
+ * Obtain a person token for one resource, from cache or from the PS.
+ *
+ * A resource MUST have verified a person token before it issues a resource token,
+ * and the agent MUST present one on every authorization endpoint request
+ * (protocol §Person Token, §Authorization Endpoint Request) — so this sits in
+ * front of the whole authorize-first path, not only of `person-token` resources.
+ *
+ * The PS MAY require the user to approve the agent acting at this resource before
+ * issuing, and answers `202` with `requirement=interaction`. That is surfaced
+ * like any other interaction; the caller drives it and retries, and the second
+ * request gets a `200`.
+ */
+export async function obtainPersonToken(cfg, ps, resource, missionS256) {
+    if (!ps.person_token_endpoint) {
+        return {
+            kind: 'result',
+            status: 0,
+            body: {
+                error: 'ps_missing_person_token_endpoint',
+                error_description: `${cfg.psUrl} publishes no person_token_endpoint; AAuth -11 requires one`,
+            },
+        };
+    }
+    const store = personTokenStore(cfg);
+    const jkt = await jwkThumbprint(cfg.agentPrivateJwk);
+    const key = { resource, ...(missionS256 ? { mission_s256: missionS256 } : {}) };
+    const cached = await store.get(key, jkt);
+    if (cached)
+        return { kind: 'token', personToken: cached };
+    const res = await signWith(cfg, { kind: 'agent' }, { psOrAs: true })(ps.person_token_endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            resource,
+            ...(missionS256 ? { mission_s256: missionS256 } : {}),
+        }),
+    });
+    if (res.status === 202) {
+        const interaction = interactionFrom(res);
+        if (interaction)
+            return { kind: 'interaction', interaction };
+    }
+    if (!res.ok)
+        return { kind: 'result', status: res.status, body: await safeBody(res) };
+    const { person_token, expires_in } = (await res.json());
+    if (!person_token) {
+        return { kind: 'result', status: res.status, body: { error: 'ps_returned_no_person_token' } };
+    }
+    const expiresAt = Math.floor(Date.now() / 1000) + (expires_in ?? 3600);
+    await store.set(key, jkt, person_token, expiresAt);
+    return { kind: 'token', personToken: person_token };
+}
+/**
+ * Drop every cached person token. Call when the agent's signing key rotates —
+ * every person token binds the same key through `cnf`, so none of them survive.
+ * `obtainPersonToken` also detects rotation on its own via the key thumbprint;
+ * this is the explicit hook for a host that knows a rotation happened.
+ */
+export async function flushPersonTokens(cfg) {
+    await personTokenStore(cfg).flush();
+}
 // POST the interaction to the PS so it can try to reach the user (live web
 // session, registered mobile push). On 2xx the PS owns user-reach; the agent
-// blocks on the resource pollUrl until the user completes there. On any
-// non-2xx (including the spec-pending interaction_unavailable error — see
-// AAuth#34) the agent falls back to driving the URL itself.
+// blocks on the pollUrl until the user completes there. On any non-2xx
+// (including the spec-pending interaction_unavailable error — see AAuth#34) the
+// agent falls back to driving the URL itself.
 async function relayInteractionToPS(signAgent, endpoint, interaction) {
@@ -95,13 +238,18 @@ try {
 }
-// Exchange a resource token at the PS for an auth token. capabilities tells the
+// Exchange a resource token at the PS for an auth token. `capabilities` tells the
 // PS the agent can relay interactions to the user, so it returns a 202 consent
 // interaction (surfaced for the caller to drive + retry) rather than requiring a
-// registered mobile device. On PS endpoints this is a token-request parameter,
+// registered mobile device. On PS endpoints this is a request-body parameter,
 // not a header (the AAuth-Capabilities header is for resource requests).
 //
-// cfg.psHints (if set) are spread into the body — all §8.1 optional params.
-// cfg.onAuthToken (if set) is called with the auth_token before it is returned.
-async function exchangeAtPS(signAgent, tokenEndpoint, resourceToken, cfg) {
+// The mission does not appear here: it travels in the person token's
+// `mission_s256`, which the resource copies into the resource token and the PS
+// into the auth token.
+//
+// cfg.psHints (if set) are spread into the body — all §Agent Token Request
+// optional params. cfg.onAuthToken (if set) is called with the auth_token before
+// it is returned.
+async function exchangeAtPS(cfg, authTokenEndpoint, resourceToken) {
     const { capabilities, ...otherHints } = cfg.psHints ?? {};
-    const res = await signAgent(tokenEndpoint, {
+    const res = await signWith(cfg, { kind: 'agent' }, { psOrAs: true })(authTokenEndpoint, {
         method: 'POST',
@@ -127,6 +275,34 @@ headers: { 'content-type': 'application/json' },
 }
-// Resource-parameterized invoke. The new tool surface in server.ts calls into
-// this directly with an L1 entry from store.ts; the legacy invoke() below
-// wraps it for cfg.resourceProxyBase-based callers (tests, demo scripts).
-export async function invokeAtResource(cfg, l1, operationId, args = {}) {
+// ── Authorize-first ──
+/**
+ * POST the resource's authorization endpoint, declaring the operation, and take
+ * back a resource token. The request MUST present a person token via
+ * Signature-Key (protocol §Authorization Endpoint Request) — an agent token gets
+ * `requirement=person-token`.
+ */
+async function authorizeAtResource(cfg, endpoint, personToken, vocabulary, operationId) {
+    const res = await signWith(cfg, { kind: 'person', jwt: personToken })(endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            r3_operations: {
+                vocabulary,
+                // Bare identifiers, scoped to the one discovery endpoint the resource
+                // advertises for this vocabulary (R3 -02 §Operation Identifier Scope).
+                operations: [{ operationId }],
+            },
+        }),
+    });
+    if (!res.ok)
+        return { kind: 'result', status: res.status, body: await safeBody(res) };
+    const { resource_token } = (await res.json());
+    if (!resource_token) {
+        // The resource handled authorization itself and issued no resource token.
+        return { kind: 'result', status: res.status, body: await safeBody(res) };
+    }
+    return { kind: 'resourceToken', resourceToken: resource_token };
+}
+// ── invoke ──
+const MAX_ROUNDS = 6;
+export async function invokeAtResource(cfg, l1, operationId, args = {}, opts = {}) {
     const route = await routeOperation(l1, operationId, args);
@@ -142,3 +318,6 @@ if (route.plan.kind !== 'sync.request') {
     const apiUrl = `${l1.origin}${plan.path}${plan.query ? `?${plan.query}` : ''}`;
-    const requestInit = {
+    // Fixed for the whole flow. A per-call retry MUST present exactly the
+    // parameters the proposal was approved for (R3 -02 §Per-Call Proposals step 3):
+    // the resource recovers the proposal by its hash and rejects any difference.
+    const init = {
         method: plan.method,
@@ -148,91 +327,174 @@ ...(plan.headers ? { headers: plan.headers } : {}),
     };
-    // agent-token access mode: sign with the agent token + go. No PS exchange.
-    // If the resource returns a 401 auth-token challenge, escalate to the PS.
-    if (l1.access_mode === 'agent-token') {
-        const signAgent = signWith(cfg, cfg.agentToken);
-        let res = await signAgent(apiUrl, requestInit);
-        const challenge = res.status === 401 ? parseAuthTokenChallenge(res.headers.get('aauth-requirement')) : undefined;
-        if (challenge) {
-            const ps = await psMetadata(cfg.psUrl);
-            const ex = await exchangeAtPS(signAgent, ps.token_endpoint, challenge, cfg);
-            if (ex.kind !== 'token')
-                return ex;
-            res = await signWith(cfg, ex.authToken)(apiUrl, requestInit);
-            if (res.status === 202) {
-                const interaction = interactionFrom(res);
-                if (interaction)
-                    return { kind: 'interaction', interaction };
+    const missionS256 = opts.missionS256 ?? cfg.missionS256;
+    // Three-way access_mode plan against the mode that applies to THIS operation:
+    // its own annotation when it carries one, the resource-wide access_mode
+    // otherwise (R3 -02 §Applying Annotations).
+    const accessPlan = planAccessMode(route.accessMode, {
+        hasPersonServer: agentTokenPs(cfg.agentToken) !== undefined,
+    });
+    if (accessPlan.kind === 'unsatisfiable') {
+        return {
+            kind: 'skipped',
+            resource: l1.resource,
+            opId: operationId,
+            mode: accessPlan.mode,
+            reason: accessPlan.reason,
+        };
+    }
+    let ps;
+    const needPS = async () => {
+        ps ??= await psMetadata(cfg.psUrl);
+        return ps;
+    };
+    const sessions = sessionTokenStore(cfg);
+    // ── Opening credential ──
+    //
+    // The plan only decides where to start. Everything after this point is the
+    // requirement loop, which is identical in every mode.
+    let cred = { kind: 'agent' };
+    if (accessPlan.kind === 'satisfiable') {
+        switch (accessPlan.mode) {
+            case 'agent-token':
+                break;
+            case 'session-token': {
+                // Resource-managed. Present the session token if we already hold one;
+                // otherwise call with the agent token and let the resource start its own
+                // consent flow with a 202 interaction.
+                const held = await sessions.get(l1.resource);
+                if (held)
+                    cred = { kind: 'session', token: held };
+                break;
             }
+            case 'person-token': {
+                const pt = await obtainPersonToken(cfg, await needPS(), l1.issuer, missionS256);
+                if (pt.kind !== 'token')
+                    return pt;
+                cred = { kind: 'person', jwt: pt.personToken };
+                break;
+            }
+            case 'auth-token':
+            case 'per-call': {
+                // Authorize-first when the resource publishes an authorization_endpoint:
+                // declare the operation, take back a resource token, exchange it at the
+                // PS. Without one, the resource issues resource tokens via 401 instead
+                // (protocol §Resource Access and Resource Tokens) — start with the
+                // person token and let the requirement loop pick up the challenge.
+                const pt = await obtainPersonToken(cfg, await needPS(), l1.issuer, missionS256);
+                if (pt.kind !== 'token')
+                    return pt;
+                cred = { kind: 'person', jwt: pt.personToken };
+                if (l1.authorization_endpoint) {
+                    const authz = await authorizeAtResource(cfg, l1.authorization_endpoint, pt.personToken, route.adapter.vocabUri, operationId);
+                    if (authz.kind !== 'resourceToken')
+                        return authz;
+                    const ex = await exchangeAtPS(cfg, (await needPS()).auth_token_endpoint, authz.resourceToken);
+                    if (ex.kind !== 'token')
+                        return ex;
+                    cred = { kind: 'auth', jwt: ex.authToken };
+                }
+                break;
+            }
         }
-        return { kind: 'result', status: res.status, body: await safeBody(res) };
     }
-    // aauth-access-token / auth-token: R3 flow.
-    if (!l1.authorization_endpoint) {
-        throw new Error(`resource ${l1.resource}: no authorization_endpoint (access_mode ${l1.access_mode} requires R3)`);
-    }
-    const signAgent = signWith(cfg, cfg.agentToken);
-    const ps = await psMetadata(cfg.psUrl);
-    // 1. authorize-first: declare the operation, get a resource token.
-    const authzRes = await signAgent(l1.authorization_endpoint, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({
-            r3_operations: {
-                vocabulary: route.adapter.vocabUri,
-                // Entry shape is vocabulary-specific: {operationId} for plain openapi,
-                // {service, operationId} for openapi-gateway.
-                operations: [route.adapter.formatOperationEntry?.(operationId) ?? { operationId }],
-            },
-        }),
-    });
-    if (!authzRes.ok)
-        return { kind: 'result', status: authzRes.status, body: await safeBody(authzRes) };
-    const { resource_token } = (await authzRes.json());
-    // 2. exchange at the PS for an auth token (surface a consent interaction if any).
-    const ex = await exchangeAtPS(signAgent, ps.token_endpoint, resource_token, cfg);
-    if (ex.kind !== 'token')
-        return ex;
-    // 3. call the resource. Writes carry the body; the agent signs over it so the
-    // proxy's content-digest check (and the r3_context it packs on escalation)
-    // match the actual call.
-    const callWith = (token) => signWith(cfg, token)(apiUrl, requestInit);
-    let apiRes = await callWith(ex.authToken);
-    // First contact: a resource-issued interaction (e.g. OAuth bootstrap). Try
-    // the PS's interaction_endpoint first so it can use its own user-reach
-    // channels (live web session, mobile push). On any non-2xx — including the
-    // spec-pending interaction_unavailable error (AAuth#34) and any PS that
-    // hasn't implemented the endpoint yet — surface the interaction so the
-    // caller can drive it (layer 2: local OS open / layer 3: text+QR).
-    if (apiRes.status === 202) {
-        const interaction = interactionFrom(apiRes);
-        if (interaction) {
-            const engaged = ps.interaction_endpoint
-                ? await relayInteractionToPS(signAgent, ps.interaction_endpoint, interaction)
-                : false;
-            if (!engaged)
-                return { kind: 'interaction', interaction };
-            const poll = (url) => signWith(cfg, cfg.agentToken)(url, { method: 'GET', headers: { Prefer: 'wait=20' } });
-            const completed = await pollUntilDone(poll, interaction.pollUrl, 180_000);
-            if (completed.status === 202)
-                return { kind: 'interaction', interaction };
-            apiRes = await callWith(ex.authToken);
+    // ── Requirement loop ──
+    //
+    // Make the request, read any AAuth-Requirement, satisfy it, retry. `satisfied`
+    // stops the loop from chasing the same requirement twice with the same
+    // credential, which is what a resource that will never be satisfiable looks
+    // like from here.
+    const satisfied = new Set();
+    for (let round = 0; round < MAX_ROUNDS; round++) {
+        const res = await signWith(cfg, cred)(apiUrl, init);
+        // A resource MAY replace the agent's session token on any response.
+        const access = res.headers.get('aauth-access');
+        if (access) {
+            await sessions.set(l1.resource, access);
+            if (cred.kind !== 'auth' && cred.kind !== 'person')
+                cred = { kind: 'session', token: access };
         }
-    }
-    // Per-call escalation (W2): a conditional/irreversible op returns a 401
-    // auth-token challenge. Take its resource token (which carries the call as
-    // r3_context) to the PS for a per-call auth token, then retry the same call.
-    // If the PS needs consent first, it returns a 202 interaction we surface.
-    const challenge = apiRes.status === 401 ? parseAuthTokenChallenge(apiRes.headers.get('aauth-requirement')) : undefined;
-    if (challenge) {
-        const stepEx = await exchangeAtPS(signAgent, ps.token_endpoint, challenge, cfg);
-        if (stepEx.kind !== 'token')
-            return stepEx;
-        apiRes = await callWith(stepEx.authToken);
-        if (apiRes.status === 202) {
-            const interaction = interactionFrom(apiRes);
-            if (interaction)
-                return { kind: 'interaction', interaction };
+        const req = parseRequirement(res.headers.get('aauth-requirement'));
+        if (!req)
+            return { kind: 'result', status: res.status, body: await safeBody(res) };
+        const marker = `${req.requirement}:${cred.kind}`;
+        if (satisfied.has(marker)) {
+            return { kind: 'result', status: res.status, body: await safeBody(res) };
         }
+        satisfied.add(marker);
+        switch (req.requirement) {
+            case 'agent-token': {
+                // The resource wants the agent's own identity token specifically.
+                if (cred.kind === 'agent') {
+                    return { kind: 'result', status: res.status, body: await safeBody(res) };
+                }
+                cred = { kind: 'agent' };
+                continue;
+            }
+            case 'person-token': {
+                const pt = await obtainPersonToken(cfg, await needPS(), l1.issuer, missionS256);
+                if (pt.kind !== 'token')
+                    return pt;
+                cred = { kind: 'person', jwt: pt.personToken };
+                continue;
+            }
+            case 'auth-token': {
+                // Also the per-call path: for an `r3_per_call` operation the resource
+                // builds a proposal from this call's concrete parameters, persists it
+                // under its hash, and returns a resource token carrying only the
+                // `r3_uri`/`r3_s256` reference. The agent exchanges it and retries the
+                // identical call (R3 -02 §Per-Call Proposals).
+                if (!req.resourceToken) {
+                    return { kind: 'result', status: res.status, body: await safeBody(res) };
+                }
+                const ex = await exchangeAtPS(cfg, (await needPS()).auth_token_endpoint, req.resourceToken);
+                if (ex.kind !== 'token')
+                    return ex;
+                cred = { kind: 'auth', jwt: ex.authToken };
+                continue;
+            }
+            case 'interaction': {
+                const interaction = interactionFrom(res);
+                if (!interaction) {
+                    return { kind: 'result', status: res.status, body: await safeBody(res) };
+                }
+                // Try the PS's interaction endpoint first so it can use its own
+                // user-reach channels (live web session, mobile push). On any non-2xx —
+                // including the spec-pending interaction_unavailable error (AAuth#34)
+                // and any PS that hasn't implemented the endpoint yet — surface the
+                // interaction so the caller can drive it (layer 2: local OS open;
+                // layer 3: text + QR).
+                const meta = await needPS().catch(() => undefined);
+                const engaged = meta?.interaction_endpoint
+                    ? await relayInteractionToPS(signWith(cfg, { kind: 'agent' }), meta.interaction_endpoint, interaction)
+                    : false;
+                if (!engaged)
+                    return { kind: 'interaction', interaction };
+                const completed = await pollUntilDone(makeAgentPoll(cfg), interaction.pollUrl, 180_000);
+                if (completed.status === 202)
+                    return { kind: 'interaction', interaction };
+                const settled = completed.headers.get('aauth-access');
+                if (settled) {
+                    await sessions.set(l1.resource, settled);
+                    cred = { kind: 'session', token: settled };
+                }
+                continue;
+            }
+            default:
+                // A requirement value this build does not know. The agent MUST NOT
+                // treat the response as satisfiable; surface it verbatim.
+                return {
+                    kind: 'result',
+                    status: res.status,
+                    body: {
+                        error: 'unsupported_requirement',
+                        requirement: req.requirement,
+                        detail: await safeBody(res),
+                    },
+                };
+        }
     }
-    return { kind: 'result', status: apiRes.status, body: await safeBody(apiRes) };
+    return {
+        kind: 'result',
+        status: 429,
+        body: { error: 'requirement_loop', detail: `${l1.resource} kept challenging after ${MAX_ROUNDS} rounds` },
+    };
 }
@@ -243,9 +505,11 @@ // Drive invokeAtResource to completion: perform each interaction via
 // URLs to the LLM caller instead.
-export async function invokeAtResourceComplete(cfg, l1, operationId, onInteraction, args = {}, maxRounds = 5, pollTimeoutMs = 180_000, onPoll) {
-    // Poll deferred URLs signed with the agent token (long-poll via Prefer: wait).
-    const poll = (url) => signWith(cfg, cfg.agentToken)(url, { method: 'GET', headers: { Prefer: 'wait=20' } });
+export async function invokeAtResourceComplete(cfg, l1, operationId, onInteraction, args = {}, maxRounds = 5, pollTimeoutMs = 180_000, onPoll, opts = {}) {
+    const poll = makeAgentPoll(cfg);
     for (let round = 0; round < maxRounds; round++) {
-        const result = await invokeAtResource(cfg, l1, operationId, args);
+        const result = await invokeAtResource(cfg, l1, operationId, args, opts);
         if (result.kind === 'result')
             return { status: result.status, body: result.body };
+        if (result.kind === 'skipped') {
+            return { status: 0, body: { error: 'access_mode_unsatisfiable', ...result } };
+        }
         await onInteraction(result.interaction.url, result.interaction.code);
@@ -259,4 +523,4 @@ await pollUntilDone(poll, result.interaction.pollUrl, pollTimeoutMs, onPoll);
 export async function deleteAtAdmin(cfg, l1, path) {
-    return signWith(cfg, cfg.agentToken)(`${l1.origin}${path}`, { method: 'DELETE' });
+    return signWith(cfg, { kind: 'agent' })(`${l1.origin}${path}`, { method: 'DELETE' });
 }
 //# sourceMappingURL=agent.js.map

dist/agent.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oDAAoD;AACpD,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,yDAAyD;AACzD,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,0BAA0B;AAE1B,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAiB,cAAc,EAAa,MAAM,eAAe,CAAA;AAuDxE,SAAS,QAAQ,CAAC,GAAgB,EAAE,KAAa;IAC/C,OAAO,CAAC,GAAW,EAAE,OAA6E,EAAE,EAAE,EAAE,CACtG,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,eAAe,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;AAC7G,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAgB;IAC5C,OAAO,CAAC,GAAW,EAAE,EAAE,CACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;AACzF,CAAC;AAED,SAAS,gBAAgB,CAAC,WAA0B;IAClD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAAE,OAAO,SAAS,CAAA;IACtF,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACpD,OAAO,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAChD,CAAC;AAED,sEAAsE;AACtE,kFAAkF;AAClF,gFAAgF;AAChF,kDAAkD;AAClD,SAAS,uBAAuB,CAAC,WAA0B;IACzD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAAE,OAAO,SAAS,CAAA;IACrF,OAAO,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,GAAa;IACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAA;IACrE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;IACjD,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/D,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAOD,KAAK,UAAU,UAAU,CAAC,KAAa;IACrC,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAe,CAAA;AAChH,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AACxE,0EAA0E;AAC1E,4DAA4D;AAC5D,KAAK,UAAU,oBAAoB,CACjC,SAAsB,EACtB,QAAgB,EAChB,WAAwB;IAExB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,aAAa;gBACnB,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,IAAI,EAAE,WAAW,CAAC,IAAI;aACvB,CAAC;SACH,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,EAAE,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAID,+EAA+E;AAC/E,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,WAAmB,EACnB,SAAS,GAAG,OAAO,EACnB,MAAoD;IAEpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACxB,MAAM,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAA;IAClC,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAA;IACjC,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACnD,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAA;QAClC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;QAC7C,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AASD,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,yEAAyE;AACzE,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,KAAK,UAAU,YAAY,CACzB,SAAsB,EACtB,aAAqB,EACrB,aAAqB,EACrB,GAAgB;IAEhB,MAAM,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAA;IACzD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE;QACzC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,cAAc,EAAE,aAAa;YAC7B,YAAY,EAAE,YAAY,IAAI,CAAC,aAAa,CAAC;YAC7C,GAAG,UAAU;SACd,CAAC;KACH,CAAC,CAAA;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;IAC9D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAA;IACrF,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAA;IACnE,IAAI,GAAG,CAAC,WAAW;QAAE,MAAM,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;IACtD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;AACjD,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAgB,EAChB,EAAW,EACX,WAAmB,EACnB,OAAmB,EAAE;IAErB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;IACzD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE;SAC3E,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACvB,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;IAC9E,MAAM,WAAW,GAAG;QAClB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAA;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,EAAE,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;QAC/C,IAAI,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAC9C,MAAM,SAAS,GACb,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAChG,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;YAC3E,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,CAAA;YAClC,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;YAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;gBACxC,IAAI,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;YAC9D,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAA;IAC1E,CAAC;IAED,4CAA4C;IAC5C,IAAI,CAAC,EAAE,CAAC,sBAAsB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,YAAY,EAAE,CAAC,QAAQ,4CAA4C,EAAE,CAAC,WAAW,eAAe,CACjG,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;IAC/C,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAEtC,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,sBAAsB,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa,EAAE;gBACb,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;gBAClC,uEAAuE;gBACvE,8CAA8C;gBAC9C,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;aACnF;SACF,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QACd,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IACpF,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAA;IAEhF,kFAAkF;IAClF,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;IAChF,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,CAAA;IAElC,8EAA8E;IAC9E,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAE7E,IAAI,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;IAEzC,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QAC3C,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,EAAE,CAAC,oBAAoB;gBACrC,CAAC,CAAC,MAAM,oBAAoB,CAAC,SAAS,EAAE,EAAE,CAAC,oBAAoB,EAAE,WAAW,CAAC;gBAC7E,CAAC,CAAC,KAAK,CAAA;YACT,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;YACzD,MAAM,IAAI,GAAW,CAAC,GAAG,EAAE,EAAE,CAC3B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;YACvF,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACzE,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;YACzE,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;QACvC,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,SAAS,GACb,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtG,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;QAC/E,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,MAAM,CAAA;QAC1C,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACzC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;YAC3C,IAAI,WAAW;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;QAC9D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAA;AAChF,CAAC;AAED,qEAAqE;AACrE,8EAA8E;AAC9E,+EAA+E;AAC/E,kCAAkC;AAClC,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAgB,EAChB,EAAW,EACX,WAAmB,EACnB,aAAiC,EACjC,OAAmB,EAAE,EACrB,SAAS,GAAG,CAAC,EACb,aAAa,GAAG,OAAO,EACvB,MAAoD;IAEpD,+EAA+E;IAC/E,MAAM,IAAI,GAAW,CAAC,GAAG,EAAE,EAAE,CAC3B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;IACvF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;QACjE,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;QACjF,MAAM,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QACpE,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;AAC/D,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAgB,EAAE,EAAW,EAAE,IAAY;IAC7E,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;AACnF,CAAC"}
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,+DAA+D;AAC/D,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,iFAAiF;AACjF,0EAA0E;AAC1E,EAAE;AACF,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAChF,kEAAkE;AAClE,gFAAgF;AAChF,0CAA0C;AAC1C,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,0BAA0B;AAE1B,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AA4GzD,+EAA+E;AAC/E,iFAAiF;AACjF,iCAAiC;AACjC,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,CAAC,CAAA;AACpE,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,CAAC,CAAA;AAErF,SAAS,UAAU,CAAC,IAKnB;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAA;IAC1D,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAA;QAClE,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC,CAAA;QAChD,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACpC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAgB,EAAE,IAAgB,EAAE,OAA6B,EAAE;IACnF,OAAO,CAAC,GAAW,EAAE,OAA0B,EAAE,EAAqB,EAAE;QACtE,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAA;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,aAAa,GAAG,SAAS,IAAI,CAAC,KAAK,EAAE,CAAA;QAC1E,MAAM,GAAG,GACP,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAA;QAC5E,MAAM,IAAI,GAAG,UAAU,CAAC;YACtB,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS;YAChC,aAAa,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS;YACtC,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAA;QACF,OAAO,WAAW,CAAC,GAAG,EAAE;YACtB,GAAG,IAAI;YACP,OAAO;YACP,UAAU,EAAE,GAAG,CAAC,eAAe;YAC/B,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE;YAClC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC;AAID,MAAM,UAAU,aAAa,CAAC,GAAgB;IAC5C,OAAO,CAAC,GAAW,EAAE,EAAE,CACrB,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;AAC5F,CAAC;AAWD,8EAA8E;AAC9E,iFAAiF;AACjF,0CAA0C;AAC1C,SAAS,gBAAgB,CAAC,WAA0B;IAClD,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAA;IAClC,MAAM,WAAW,GAAG,8BAA8B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACzE,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAA;IAClC,OAAO;QACL,WAAW;QACX,aAAa,EAAE,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3C,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;KAC9C,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAa;IACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAA;IACrE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;IACjD,OAAO,MAAM,EAAE,WAAW,KAAK,aAAa,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO;QAClF,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE;QACjD,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAaD,KAAK,UAAU,UAAU,CAAC,KAAa;IACrC,OAAO,CAAC,MAAM,CACZ,MAAM,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,CAAC,CACzE,CAAC,IAAI,EAAE,CAAe,CAAA;AACzB,CAAC;AAED,kCAAkC;AAClC,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,uCAAuC;AAEvC,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAiC,CAAA;AACxE,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAAkC,CAAA;AAE1E,SAAS,gBAAgB,CAAC,GAAgB;IACxC,IAAI,GAAG,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC,YAAY,CAAA;IAC7C,IAAI,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,4BAA4B,EAAE,CAAA;QACtC,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAgB;IACzC,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,GAAG,CAAC,aAAa,CAAA;IAC/C,IAAI,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,IAAI,GAAG,EAAkB,CAAA;QACnC,KAAK,GAAG;YACN,KAAK,CAAC,GAAG,CAAC,QAAQ;gBAChB,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACxB,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK;gBACvB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YACxB,CAAC;SACF,CAAA;QACD,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACtC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAgB,EAChB,EAAc,EACd,QAAgB,EAChB,WAAoB;IAEpB,IAAI,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,CAAC;YACT,IAAI,EAAE;gBACJ,KAAK,EAAE,kCAAkC;gBACzC,iBAAiB,EAAE,GAAG,GAAG,CAAC,KAAK,6DAA6D;aAC7F;SACF,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,eAAmC,CAAC,CAAA;IACxE,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IAE/E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACxC,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IAEzD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,qBAAqB,EAAE;QAC7F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ;YACR,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;KACH,CAAC,CAAA;IAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;IAC9D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAA;IAErF,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAGrD,CAAA;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,CAAA;IAC/F,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAA;IACtE,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,CAAA;IAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAA;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAgB;IACtD,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAA;AACrC,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,uEAAuE;AACvE,gFAAgF;AAChF,8CAA8C;AAC9C,KAAK,UAAU,oBAAoB,CACjC,SAAsB,EACtB,QAAgB,EAChB,WAAwB;IAExB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,aAAa;gBACnB,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,IAAI,EAAE,WAAW,CAAC,IAAI;aACvB,CAAC;SACH,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,EAAE,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAID,+EAA+E;AAC/E,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,WAAmB,EACnB,SAAS,GAAG,OAAO,EACnB,MAAoD;IAEpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACxB,MAAM,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAA;IAClC,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAA;IACjC,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACnD,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAA;QAClC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;QAC7C,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAOD,kFAAkF;AAClF,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,qEAAqE;AACrE,+EAA+E;AAC/E,uBAAuB;AACvB,EAAE;AACF,2EAA2E;AAC3E,iFAAiF;AACjF,kBAAkB;AAClB,KAAK,UAAU,YAAY,CACzB,GAAgB,EAChB,iBAAyB,EACzB,aAAqB;IAErB,MAAM,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAA;IACzD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE;QACtF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,cAAc,EAAE,aAAa;YAC7B,YAAY,EAAE,YAAY,IAAI,CAAC,aAAa,CAAC;YAC7C,GAAG,UAAU;SACd,CAAC;KACH,CAAC,CAAA;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;IAC9D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAA;IACrF,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAA;IACnE,IAAI,GAAG,CAAC,WAAW;QAAE,MAAM,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;IACtD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;AACjD,CAAC;AAED,wBAAwB;AAExB;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAgB,EAChB,QAAgB,EAChB,WAAmB,EACnB,UAAkB,EAClB,WAAmB;IAEnB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC9E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa,EAAE;gBACb,UAAU;gBACV,sEAAsE;gBACtE,uEAAuE;gBACvE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;aAC9B;SACF,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAA;IACrF,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgC,CAAA;IAC5E,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,0EAA0E;QAC1E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAA;IAC1E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,CAAA;AACjE,CAAC;AAED,eAAe;AAEf,MAAM,UAAU,GAAG,CAAC,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAgB,EAChB,EAAW,EACX,WAAmB,EACnB,OAAmB,EAAE,EACrB,OAAsB,EAAE;IAExB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;IACzD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE;SAC3E,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACvB,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;IAC9E,sEAAsE;IACtE,gFAAgF;IAChF,6EAA6E;IAC7E,MAAM,IAAI,GAAsB;QAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAA;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAA;IAEvD,8EAA8E;IAC9E,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,UAAU,GAAmB,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE;QAClE,eAAe,EAAE,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS;KAC5D,CAAC,CAAA;IACF,IAAI,UAAU,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAA;IACH,CAAC;IAED,IAAI,EAA0B,CAAA;IAC9B,MAAM,MAAM,GAAG,KAAK,IAAyB,EAAE;QAC7C,EAAE,KAAK,MAAM,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAClC,OAAO,EAAE,CAAA;IACX,CAAC,CAAA;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEvC,2BAA2B;IAC3B,EAAE;IACF,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,IAAI,GAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAExC,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACtC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;YACxB,KAAK,aAAa;gBAChB,MAAK;YAEP,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,sEAAsE;gBACtE,yEAAyE;gBACzE,uCAAuC;gBACvC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;gBAC5C,IAAI,IAAI;oBAAE,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;gBACjD,MAAK;YACP,CAAC;YAED,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;gBAC/E,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO;oBAAE,OAAO,EAAE,CAAA;gBAClC,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,EAAE,CAAA;gBAC9C,MAAK;YACP,CAAC;YAED,KAAK,YAAY,CAAC;YAClB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,yEAAyE;gBACzE,wEAAwE;gBACxE,uEAAuE;gBACvE,mEAAmE;gBACnE,mEAAmE;gBACnE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;gBAC/E,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO;oBAAE,OAAO,EAAE,CAAA;gBAClC,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,EAAE,CAAA;gBAE9C,IAAI,EAAE,CAAC,sBAAsB,EAAE,CAAC;oBAC9B,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACrC,GAAG,EACH,EAAE,CAAC,sBAAsB,EACzB,EAAE,CAAC,WAAW,EACd,KAAK,CAAC,OAAO,CAAC,QAAQ,EACtB,WAAW,CACZ,CAAA;oBACD,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;wBAAE,OAAO,KAAK,CAAA;oBAChD,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,mBAAmB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAA;oBAC7F,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO;wBAAE,OAAO,EAAE,CAAA;oBAClC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,EAAE,CAAA;gBAC5C,CAAC;gBACD,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,EAAE;IACF,+EAA+E;IAC/E,uEAAuE;IACvE,4EAA4E;IAC5E,kBAAkB;IAClB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IAEnC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAEnD,oEAAoE;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QAC9C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAAE,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QAC/F,CAAC;QAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAA;QAClE,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAA;QAElF,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAA;QAChD,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAA;QAC1E,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAErB,QAAQ,GAAG,CAAC,WAAW,EAAE,CAAC;YACxB,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,kEAAkE;gBAClE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAA;gBAC1E,CAAC;gBACD,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;gBACxB,SAAQ;YACV,CAAC;YAED,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;gBAC/E,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO;oBAAE,OAAO,EAAE,CAAA;gBAClC,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,EAAE,CAAA;gBAC9C,SAAQ;YACV,CAAC;YAED,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,sEAAsE;gBACtE,sEAAsE;gBACtE,iEAAiE;gBACjE,uEAAuE;gBACvE,+CAA+C;gBAC/C,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;oBACvB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAA;gBAC1E,CAAC;gBACD,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,mBAAmB,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;gBAC3F,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO;oBAAE,OAAO,EAAE,CAAA;gBAClC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,EAAE,CAAA;gBAC1C,SAAQ;YACV,CAAC;YAED,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;gBACxC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAA;gBAC1E,CAAC;gBACD,gEAAgE;gBAChE,wEAAwE;gBACxE,sEAAsE;gBACtE,oEAAoE;gBACpE,kEAAkE;gBAClE,uBAAuB;gBACvB,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;gBAClD,MAAM,OAAO,GAAG,IAAI,EAAE,oBAAoB;oBACxC,CAAC,CAAC,MAAM,oBAAoB,CACxB,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAChC,IAAI,CAAC,oBAAoB,EACzB,WAAW,CACZ;oBACH,CAAC,CAAC,KAAK,CAAA;gBACT,IAAI,CAAC,OAAO;oBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;gBACzD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACvF,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;gBACzE,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBACrD,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;oBACxC,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;gBAC5C,CAAC;gBACD,SAAQ;YACV,CAAC;YAED;gBACE,mEAAmE;gBACnE,0DAA0D;gBAC1D,OAAO;oBACL,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE;wBACJ,KAAK,EAAE,yBAAyB;wBAChC,WAAW,EAAE,GAAG,CAAC,WAAW;wBAC5B,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC;qBAC5B;iBACF,CAAA;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,2BAA2B,UAAU,SAAS,EAAE;KAC1G,CAAA;AACH,CAAC;AAED,qEAAqE;AACrE,8EAA8E;AAC9E,+EAA+E;AAC/E,kCAAkC;AAClC,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAgB,EAChB,EAAW,EACX,WAAmB,EACnB,aAAiC,EACjC,OAAmB,EAAE,EACrB,SAAS,GAAG,CAAC,EACb,aAAa,GAAG,OAAO,EACvB,MAAoD,EACpD,OAAsB,EAAE;IAExB,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACvE,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;QACjF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,MAAM,EAAE,EAAE,CAAA;QAC/E,CAAC;QACD,MAAM,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QACpE,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;AAC/D,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAgB,EAAE,EAAW,EAAE,IAAY;IAC7E,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;AACtF,CAAC"}

dist/identity-local.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"identity-local.d.ts","sourceRoot":"","sources":["../src/identity-local.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,YAAY,CAAA;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AA+BrD,wBAAgB,YAAY,IAAI,WAAW,CAS1C;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/D,OAAO,CAAC,WAAW,CAAC,CAkBtB;AAqBD,wBAAgB,+BAA+B,IAAI,gBAAgB,CAqBlE"}
+{"version":3,"file":"identity-local.d.ts","sourceRoot":"","sources":["../src/identity-local.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,YAAY,CAAA;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AA+BrD,wBAAgB,YAAY,IAAI,WAAW,CAS1C;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/D,OAAO,CAAC,WAAW,CAAC,CAkBtB;AAqBD,wBAAgB,+BAA+B,IAAI,gBAAgB,CAwBlE"}

dist/identity-local.js

@@ -85,2 +85,5 @@ // @aauth/proxy/local — the Node-only identity adapter for the stdio server.
     return {
+        peek() {
+            return cached ?? undefined;
+        },
         async resolve({ local }) {
@@ -87,0 +90,0 @@ if (cached) {

dist/identity-local.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"identity-local.js","sourceRoot":"","sources":["../src/identity-local.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAChF,+EAA+E;AAC/E,2EAA2E;AAC3E,sFAAsF;AAEtF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAIxF,6EAA6E;AAC7E,2EAA2E;AAC3E,iEAAiE;AACjE,8EAA8E;AAC9E,2EAA2E;AAC3E,SAAS,qBAAqB,CAAyD,GAAM;IAC3F,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,GAAG,CAAA;IAC9C,MAAM,OAAO,GACX,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;QACtD,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO;YACpD,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO;gBACnD,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO;oBACnD,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO;wBACnD,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,wEAAwE;QACxE,MAAM,IAAI,KAAK,CACb,+FAA+F,GAAG,CAAC,GAAG,QAAQ,GAAG,CAAC,GAAG,EAAE,CACxH,CAAA;IACH,CAAC;IACD,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAA;IAC5E,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAA;IAEhD,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,uBAAuB;QACnC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,+BAA+B,EAAE,MAAM,CAAC,CAAA;IAE3F,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAA;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAA8D,EAAE;IAEhE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAA;IACxF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAA;IACvG,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;IACjG,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,oBAAoB,CAAC,CAAA;IAEzG,+EAA+E;IAC/E,wCAAwC;IACxC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;IAE5F,OAAO;QACL,KAAK;QACL,eAAe,EAAE,qBAAqB,CAAC,UAAU,CAA+B;QAChF,UAAU,EAAE,YAAY,CAAC,GAAG;KAC7B,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,YAAY,CAAC,GAAW,EAAE,UAAU,GAAG,EAAE;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QACxF,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,mCAAmC;AACnC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,6CAA6C;AAC7C,MAAM,UAAU,+BAA+B;IAC7C,IAAI,MAAM,GAAuB,IAAI,CAAA;IACrC,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE;YACrB,IAAI,MAAM,EAAE,CAAC;gBACX,0DAA0D;gBAC1D,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;gBAC9E,wDAAwD;gBACxD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;gBAC3E,MAAM,GAAG,IAAI,CAAA;YACf,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;gBACxC,MAAM,GAAG,YAAY,EAAE,CAAA;gBACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;YACvC,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAA;YACvE,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;YAChD,MAAM,GAAG,MAAM,wBAAwB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QACvC,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"identity-local.js","sourceRoot":"","sources":["../src/identity-local.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAChF,+EAA+E;AAC/E,2EAA2E;AAC3E,sFAAsF;AAEtF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAIxF,6EAA6E;AAC7E,2EAA2E;AAC3E,iEAAiE;AACjE,8EAA8E;AAC9E,2EAA2E;AAC3E,SAAS,qBAAqB,CAAyD,GAAM;IAC3F,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,GAAG,CAAA;IAC9C,MAAM,OAAO,GACX,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;QACtD,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO;YACpD,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO;gBACnD,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO;oBACnD,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO;wBACnD,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,wEAAwE;QACxE,MAAM,IAAI,KAAK,CACb,+FAA+F,GAAG,CAAC,GAAG,QAAQ,GAAG,CAAC,GAAG,EAAE,CACxH,CAAA;IACH,CAAC;IACD,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAA;IAC5E,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAA;IAEhD,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,uBAAuB;QACnC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,+BAA+B,EAAE,MAAM,CAAC,CAAA;IAE3F,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAA;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAA8D,EAAE;IAEhE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAA;IACxF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAA;IACvG,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;IACjG,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,oBAAoB,CAAC,CAAA;IAEzG,+EAA+E;IAC/E,wCAAwC;IACxC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;IAE5F,OAAO;QACL,KAAK;QACL,eAAe,EAAE,qBAAqB,CAAC,UAAU,CAA+B;QAChF,UAAU,EAAE,YAAY,CAAC,GAAG;KAC7B,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,YAAY,CAAC,GAAW,EAAE,UAAU,GAAG,EAAE;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QACxF,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,mCAAmC;AACnC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,6CAA6C;AAC7C,MAAM,UAAU,+BAA+B;IAC7C,IAAI,MAAM,GAAuB,IAAI,CAAA;IACrC,OAAO;QACL,IAAI;YACF,OAAO,MAAM,IAAI,SAAS,CAAA;QAC5B,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE;YACrB,IAAI,MAAM,EAAE,CAAC;gBACX,0DAA0D;gBAC1D,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;gBAC9E,wDAAwD;gBACxD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;gBAC3E,MAAM,GAAG,IAAI,CAAA;YACf,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;gBACxC,MAAM,GAAG,YAAY,EAAE,CAAA;gBACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;YACvC,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAA;YACvE,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;YAChD,MAAM,GAAG,MAAM,wBAAwB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QACvC,CAAC;KACF,CAAA;AACH,CAAC"}

dist/identity.d.ts

@@ -12,3 +12,4 @@ import type { ProxyConfig } from './agent.js';
     }): Promise<BootstrapStatus>;
+    peek?(): ProxyConfig | undefined;
 }
 //# sourceMappingURL=identity.d.ts.map

dist/identity.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAA;AAE9B,MAAM,WAAW,gBAAgB;IAI/B,OAAO,CAAC,GAAG,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;CAC3D"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAA;AAE9B,MAAM,WAAW,gBAAgB;IAI/B,OAAO,CAAC,GAAG,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAK1D,IAAI,CAAC,IAAI,WAAW,GAAG,SAAS,CAAA;CACjC"}

dist/index.d.ts

@@ -1,3 +0,6 @@
-export { invokeAtResource, invokeAtResourceComplete, makeAgentPoll, pollUntilDone } from './agent.js';
-export type { AgentSigningKey, Interaction, InteractionHandler, InvokeArgs, InvokeResult, ProxyConfig, PSTokenHints, } from './agent.js';
+export { flushPersonTokens, invokeAtResource, invokeAtResourceComplete, makeAgentPoll, obtainPersonToken, pollUntilDone, } from './agent.js';
+export type { AgentSigningKey, Interaction, InteractionHandler, InvokeArgs, InvokeOptions, InvokeResult, ProxyConfig, PSTokenHints, SessionTokenStore, } from './agent.js';
+export { isKnownAccessMode, KNOWN_ACCESS_MODES, planAccessMode, planReason } from './access-mode.js';
+export type { AccessModePlan, AgentSetup, KnownAccessMode } from './access-mode.js';
+export { agentTokenPs, decodeJwtHeader, decodeJwtPayload, jwkThumbprint, jwtExp } from './jwt.js';
 export { buildProxyTools } from './tools.js';
@@ -12,5 +15,5 @@ export type { ProxyDeps } from './tools.js';
 export type { CachedIndex, RegistryCache, RegistryEntry, RegistryIndex } from './registry.js';
-export { createFsL1Store } from './store.js';
-export type { AccessMode, L1Entry, L1Store } from './store.js';
+export { createFsL1Store, createFsPersonTokenStore, createMemoryPersonTokenStore, } from './store.js';
+export type { AccessMode, L1Entry, L1Store, PersonTokenKey, PersonTokenStore, } from './store.js';
 export * from './vocab/index.js';
 //# sourceMappingURL=index.d.ts.map

dist/index.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AACrG,YAAY,EACV,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,YAAY,GACb,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAEtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE9C,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,cAAc,EACd,SAAS,GACV,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,iBAAiB,EACjB,QAAQ,EACR,eAAe,EACf,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AACjF,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7F,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAE9D,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACpG,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEnF,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAEjG,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAEtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE9C,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,cAAc,EACd,SAAS,GACV,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,iBAAiB,EACjB,QAAQ,EACR,eAAe,EACf,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AACjF,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7F,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,UAAU,EACV,OAAO,EACP,OAAO,EACP,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAA;AAEnB,cAAc,kBAAkB,CAAA"}

dist/index.js

@@ -6,3 +6,5 @@ // Public API for @aauth/proxy (core, workerd-safe — no fs/stdio/local-keys at
 // separately from "@aauth/proxy/local".
-export { invokeAtResource, invokeAtResourceComplete, makeAgentPoll, pollUntilDone } from './agent.js';
+export { flushPersonTokens, invokeAtResource, invokeAtResourceComplete, makeAgentPoll, obtainPersonToken, pollUntilDone, } from './agent.js';
+export { isKnownAccessMode, KNOWN_ACCESS_MODES, planAccessMode, planReason } from './access-mode.js';
+export { agentTokenPs, decodeJwtHeader, decodeJwtPayload, jwkThumbprint, jwtExp } from './jwt.js';
 export { buildProxyTools } from './tools.js';
@@ -12,4 +14,4 @@ export { canonicalizeHost } from './host.js';
 export { createFsRegistryCache, fetchRegistry, registryUrl } from './registry.js';
-export { createFsL1Store } from './store.js';
+export { createFsL1Store, createFsPersonTokenStore, createMemoryPersonTokenStore, } from './store.js';
 export * from './vocab/index.js';
 //# sourceMappingURL=index.js.map

dist/index.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,wCAAwC;AAExC,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAWrG,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAK5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAG5C,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,cAAc,EACd,SAAS,GACV,MAAM,eAAe,CAAA;AAStB,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAGjF,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAG5C,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,wCAAwC;AAExC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,YAAY,CAAA;AAanB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAGpG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAEjG,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAK5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAG5C,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,cAAc,EACd,SAAS,GACV,MAAM,eAAe,CAAA;AAStB,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAGjF,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,YAAY,CAAA;AASnB,cAAc,kBAAkB,CAAA"}

dist/resource.d.ts

 import type { AccessMode, L1Entry } from './store.js';
-import type { InvocationPlan, InvokeArgs, OpDetail, OpSummary, VocabAdapter } from './vocab/index.js';
+import type { InvocationPlan, InvokeArgs, OpDetail, OperationAnnotations, OpSummary, VocabAdapter } from './vocab/index.js';
 export interface AAuthResourceMeta {
     issuer: string;
     client_name?: string;
+    name?: string;
     description?: string;
@@ -10,3 +11,3 @@ access_mode?: AccessMode;
     authorization_endpoint?: string;
-    r3_vocabularies?: Record<string, string | Record<string, string>>;
+    r3_vocabularies?: Record<string, string>;
     jwks_uri?: string;
@@ -16,3 +17,3 @@ }
     vocabUri: string;
-    docUrl: string | Record<string, string>;
+    docUrl: string;
     adapter: VocabAdapter;
@@ -37,2 +38,6 @@ }
     plan: InvocationPlan;
+    /** This operation's own access annotations, {} when it carries none. */
+    annotations: OperationAnnotations;
+    /** The mode that applies to this call: annotation if present, else the resource's. */
+    accessMode: string;
 }
@@ -39,0 +44,0 @@ export declare function routeOperation(l1: L1Entry, opId: string, args: InvokeArgs, docCache?: DocCache): Promise<RoutedOperation>;

dist/resource.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,SAAS,EACT,YAAY,EACb,MAAM,kBAAkB,CAAA;AAEzB,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,UAAU,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAI/B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvC,OAAO,EAAE,YAAY,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,iBAAiB,CAAA;IACvB,YAAY,EAAE,WAAW,EAAE,CAAA;CAC5B;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAwB/E;AAuCD,MAAM,WAAW,QAAQ;IACvB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IAC9C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C;AAED,wBAAgB,oBAAoB,IAAI,QAAQ,CAU/C;AA+BD,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,OAAO,EACX,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,GAAE,QAA0B,GACnC,OAAO,CAAC,SAAS,EAAE,CAAC,CAStB;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,OAAO,EACX,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,GAAE,QAA0B,GACnC,OAAO,CAAC,QAAQ,EAAE,CAAC,CASrB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,YAAY,CAAA;IACrB,IAAI,EAAE,cAAc,CAAA;CACrB;AAMD,wBAAsB,cAAc,CAClC,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,QAAQ,GAAE,QAA0B,GACnC,OAAO,CAAC,eAAe,CAAC,CAW1B;AAQD,wBAAgB,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAiBrD"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,oBAAoB,EACpB,SAAS,EACT,YAAY,EACb,MAAM,kBAAkB,CAAA;AAEzB,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,UAAU,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAG/B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,YAAY,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,iBAAiB,CAAA;IACvB,YAAY,EAAE,WAAW,EAAE,CAAA;CAC5B;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAwB/E;AAuCD,MAAM,WAAW,QAAQ;IACvB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IAC9C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C;AAED,wBAAgB,oBAAoB,IAAI,QAAQ,CAU/C;AA2CD,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,OAAO,EACX,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,GAAE,QAA0B,GACnC,OAAO,CAAC,SAAS,EAAE,CAAC,CAStB;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,OAAO,EACX,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,GAAE,QAA0B,GACnC,OAAO,CAAC,QAAQ,EAAE,CAAC,CASrB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,YAAY,CAAA;IACrB,IAAI,EAAE,cAAc,CAAA;IACpB,wEAAwE;IACxE,WAAW,EAAE,oBAAoB,CAAA;IACjC,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAA;CACnB;AAMD,wBAAsB,cAAc,CAClC,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,QAAQ,GAAE,QAA0B,GACnC,OAAO,CAAC,eAAe,CAAC,CAiB1B;AAQD,wBAAgB,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAiBrD"}

dist/resource.js

@@ -11,3 +11,3 @@ // Fetch + validate a resource's well-known doc; pick vocabulary adapters
 import { canonicalizeHost } from './host.js';
-import { getAdapter, supportedVocabUris } from './vocab/index.js';
+import { effectiveAccessMode, getAdapter, supportedVocabUris } from './vocab/index.js';
 export async function fetchResource(hostOrUrl) {
@@ -43,6 +43,8 @@ const canonical = canonicalizeHost(hostOrUrl);
     }
-    if (meta.access_mode !== undefined &&
-        !['agent-token', 'aauth-access-token', 'auth-token'].includes(meta.access_mode)) {
-        throw new Error(`resource ${host}: invalid access_mode ${meta.access_mode}`);
-    }
+    // access_mode is NOT validated against a closed list. The value set is an IANA
+    // registry (protocol §AAuth Access Mode Value Registry) and the declaration is
+    // advisory, so an unrecognized value is not an error — the agent adds the
+    // resource, treats the mode as undeclared, and reads the runtime
+    // AAuth-Requirement instead (see access-mode.ts).
+    //
     // description is enforced at the registry on submit; agent-proxy-side is lenient
@@ -55,3 +57,3 @@ // so direct-URL adds of resources without a description still work.
         const docUrl = advertised[uri];
-        if (!docUrl)
+        if (typeof docUrl !== 'string' || !docUrl)
             continue;
@@ -102,2 +104,14 @@ const adapter = getAdapter(uri);
 }
+// Resolve an operation's access annotations against the resource-wide
+// access_mode and flatten the result onto the summary the LLM reads: `access_mode`
+// is always the mode that actually applies to THIS operation, and `budget` appears
+// only when the operation draws one down. Advisory throughout — the agent never
+// enforces either, and a resource may return any AAuth-Requirement at runtime.
+function withEffectiveAccess(op, resourceWide) {
+    const resolved = { ...op, access_mode: effectiveAccessMode(op.annotations, resourceWide) };
+    if (op.annotations?.budget === true)
+        resolved.budget = true;
+    delete resolved.annotations;
+    return resolved;
+}
 export async function listOperationsForResource(l1, query, docCache = defaultDocCache) {
@@ -108,3 +122,3 @@ const out = [];
         for (const summary of v.adapter.listOperations(doc, query)) {
-            out.push(summary);
+            out.push(withEffectiveAccess(summary, l1.access_mode));
         }
@@ -119,3 +133,3 @@ }
         for (const detail of v.adapter.getOperations(doc, opIds)) {
-            out.push(detail);
+            out.push(withEffectiveAccess(detail, l1.access_mode));
         }
@@ -134,3 +148,9 @@ }
             const plan = v.adapter.buildInvocation(doc, opId, args);
-            return { adapter: v.adapter, plan };
+            const annotations = v.adapter.annotationsFor(doc, opId);
+            return {
+                adapter: v.adapter,
+                plan,
+                annotations,
+                accessMode: effectiveAccessMode(annotations, l1.access_mode),
+            };
         }
@@ -155,3 +175,3 @@ catch {
         issuer: r.meta.issuer.replace(/\/+$/, ''),
-        name: r.meta.client_name?.trim() || r.host,
+        name: r.meta.name?.trim() || r.meta.client_name?.trim() || r.host,
         description: r.meta.description ?? '',
@@ -158,0 +178,0 @@ access_mode: inferredMode,

dist/resource.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"resource.js","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,kFAAkF;AAClF,+DAA+D;AAC/D,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,oFAAoF;AACpF,mDAAmD;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAqCjE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IAC7C,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAA;IAC7D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAClC,MAAM,GAAG,GAAG,GAAG,MAAM,kCAAkC,CAAA;IAEvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAA;IACF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,uBAAuB,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,gBAAgB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IAE1E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAA;IACpD,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IAE5B,OAAO;QACL,IAAI;QACJ,MAAM;QACN,IAAI;QACJ,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;KACrD,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB,EAAE,IAAY,EAAE,MAAc;IACrE,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAC,CAAA;IACrE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,0BAA0B,IAAI,CAAC,MAAM,cAAc,MAAM,GAAG,CAAC,CAAA;IAC/F,CAAC;IACD,IACE,IAAI,CAAC,WAAW,KAAK,SAAS;QAC9B,CAAC,CAAC,aAAa,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAC/E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,yBAAyB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IAC9E,CAAC;IACD,iFAAiF;IACjF,oEAAoE;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,UAA2D;IAC7E,MAAM,GAAG,GAAkB,EAAE,CAAA;IAC7B,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAiBD,MAAM,UAAU,oBAAoB;IAClC,MAAM,CAAC,GAAG,IAAI,GAAG,EAAmB,CAAA;IACpC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG;YAChB,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACjB,CAAC;KACF,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,0EAA0E;AAC1E,+CAA+C;AAC/C,MAAM,eAAe,GAAG,oBAAoB,EAAE,CAAA;AAE9C,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB;IAC9C,OAAO,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,KAAkB,EAAE,KAAe;IACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,MAAgC;IACjD,MAAM,GAAG,GAAkB,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAW,EACX,KAAc,EACd,WAAqB,eAAe;IAEpC,MAAM,GAAG,GAAgB,EAAE,CAAA;IAC3B,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;QACnD,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAW,EACX,KAAe,EACf,WAAqB,eAAe;IAEpC,MAAM,GAAG,GAAe,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;QACnD,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAOD,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAW,EACX,IAAY,EACZ,IAAgB,EAChB,WAAqB,eAAe;IAEpC,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;YACvD,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAA;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,gBAAgB,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAA;AACzE,CAAC;AAED,yDAAyD;AACzD,EAAE;AACF,4EAA4E;AAC5E,sEAAsE;AACtE,0EAA0E;AAC1E,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,CAAkB;IAC1C,MAAM,YAAY,GAChB,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IACtF,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,IAAI;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI;QAC1C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE;QACrC,WAAW,EAAE,YAAY;QACzB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB;YAC/B,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAC3D,CAAC,CAAC,EAAE,CAAC;QACP,aAAa,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAChC,CAAA;AACH,CAAC"}
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,kFAAkF;AAClF,+DAA+D;AAC/D,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,oFAAoF;AACpF,mDAAmD;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAsCtF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IAC7C,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAA;IAC7D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAClC,MAAM,GAAG,GAAG,GAAG,MAAM,kCAAkC,CAAA;IAEvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAA;IACF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,uBAAuB,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,gBAAgB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IAE1E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAA;IACpD,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IAE5B,OAAO;QACL,IAAI;QACJ,MAAM;QACN,IAAI;QACJ,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;KACrD,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB,EAAE,IAAY,EAAE,MAAc;IACrE,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAC,CAAA;IACrE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,0BAA0B,IAAI,CAAC,MAAM,cAAc,MAAM,GAAG,CAAC,CAAA;IAC/F,CAAC;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,0EAA0E;IAC1E,iEAAiE;IACjE,kDAAkD;IAClD,EAAE;IACF,iFAAiF;IACjF,oEAAoE;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,UAAkC;IACpD,MAAM,GAAG,GAAkB,EAAE,CAAA;IAC7B,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM;YAAE,SAAQ;QACnD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAiBD,MAAM,UAAU,oBAAoB;IAClC,MAAM,CAAC,GAAG,IAAI,GAAG,EAAmB,CAAA;IACpC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG;YAChB,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACjB,CAAC;KACF,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,0EAA0E;AAC1E,+CAA+C;AAC/C,MAAM,eAAe,GAAG,oBAAoB,EAAE,CAAA;AAE9C,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB;IAC9C,OAAO,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,KAAkB,EAAE,KAAe;IACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,MAAgC;IACjD,MAAM,GAAG,GAAkB,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,sEAAsE;AACtE,mFAAmF;AACnF,mFAAmF;AACnF,gFAAgF;AAChF,+EAA+E;AAC/E,SAAS,mBAAmB,CAAsB,EAAK,EAAE,YAAgC;IACvF,MAAM,QAAQ,GAAM,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,mBAAmB,CAAC,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAA;IAC7F,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI;QAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAA;IAC3D,OAAO,QAAQ,CAAC,WAAW,CAAA;IAC3B,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAW,EACX,KAAc,EACd,WAAqB,eAAe;IAEpC,MAAM,GAAG,GAAgB,EAAE,CAAA;IAC3B,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;QACnD,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;QACxD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAW,EACX,KAAe,EACf,WAAqB,eAAe;IAEpC,MAAM,GAAG,GAAe,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;QACnD,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAWD,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAW,EACX,IAAY,EACZ,IAAgB,EAChB,WAAqB,eAAe;IAEpC,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;YACvD,MAAM,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YACvD,OAAO;gBACL,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,IAAI;gBACJ,WAAW;gBACX,UAAU,EAAE,mBAAmB,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC;aAC7D,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,gBAAgB,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAA;AACzE,CAAC;AAED,yDAAyD;AACzD,EAAE;AACF,4EAA4E;AAC5E,sEAAsE;AACtE,0EAA0E;AAC1E,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,CAAkB;IAC1C,MAAM,YAAY,GAChB,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IACtF,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,IAAI;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI;QACjE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE;QACrC,WAAW,EAAE,YAAY;QACzB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB;YAC/B,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAC3D,CAAC,CAAC,EAAE,CAAC;QACP,aAAa,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAChC,CAAA;AACH,CAAC"}

dist/store.d.ts

@@ -1,2 +0,12 @@
-export type AccessMode = 'agent-token' | 'aauth-access-token' | 'auth-token';
+import type { KnownAccessMode } from './access-mode.js';
+export type { KnownAccessMode } from './access-mode.js';
+/**
+ * `access_mode` as it arrives from a resource's well-known document.
+ *
+ * Not a closed union: the value set is an IANA registry (protocol §AAuth Access
+ * Mode Value Registry), so an agent must carry unrecognized values intact rather
+ * than reject them. `KnownAccessMode` names the ones this build can plan against;
+ * anything else is treated as undeclared (see access-mode.ts).
+ */
+export type AccessMode = KnownAccessMode | (string & {});
 export interface L1Entry {
@@ -13,3 +23,3 @@ resource: string;
         vocabUri: string;
-        docUrl: string | Record<string, string>;
+        docUrl: string;
     }>;
@@ -29,2 +39,24 @@ added: string;
 }): L1Store;
+export interface PersonTokenKey {
+    /** The resource's HTTPS URL — the `aud` of the issued token. */
+    resource: string;
+    /** The mission the agent is operating under, when it named one. */
+    mission_s256?: string;
+}
+export interface PersonTokenStore {
+    /**
+     * A cached, unexpired person token for this key, or undefined. Presenting an
+     * `agentJkt` other than the one the cache holds flushes the entire cache first.
+     */
+    get(key: PersonTokenKey, agentJkt: string): Promise<string | undefined>;
+    set(key: PersonTokenKey, agentJkt: string, token: string, expiresAt: number): Promise<void>;
+    /** Drop every cached person token. */
+    flush(): Promise<void>;
+}
+/** Process-lifetime person-token cache. The default for hosts that inject none. */
+export declare function createMemoryPersonTokenStore(): PersonTokenStore;
+/** Filesystem-backed person-token cache at ~/.aauth/proxy/person-tokens.json. */
+export declare function createFsPersonTokenStore(opts?: {
+    dir?: string;
+}): PersonTokenStore;
 //# sourceMappingURL=store.d.ts.map

dist/store.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,oBAAoB,GAAG,YAAY,CAAA;AAE5E,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,UAAU,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAG/B,aAAa,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAAA;IACnF,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAKD,MAAM,WAAW,OAAO;IACtB,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAC1B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IAC/C,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAQD,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CA+CpE"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEvD,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEvD;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAExD,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,UAAU,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B,aAAa,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1D,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAKD,MAAM,WAAW,OAAO;IACtB,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAC1B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IAC/C,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAQD,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CA+CpE;AAeD,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACvE,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3F,sCAAsC;IACtC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AA4BD,mFAAmF;AACnF,wBAAgB,4BAA4B,IAAI,gBAAgB,CA6B/D;AAED,iFAAiF;AACjF,wBAAgB,wBAAwB,CAAC,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,gBAAgB,CA+CtF"}

dist/store.js

@@ -1,5 +0,7 @@
-// L1 — added resources. The L1Store interface lets a host inject its own
-// backend; the stdio server uses the filesystem default (createFsL1Store),
-// backed by ~/.aauth/proxy/resources.json.
+// L1 — added resources, plus the person-token cache.
 //
+// The L1Store interface lets a host inject its own backend; the stdio server
+// uses the filesystem default (createFsL1Store), backed by
+// ~/.aauth/proxy/resources.json.
+//
 // The agent proxy writes here on add_resource (always), on first successful auth at a
@@ -64,2 +66,90 @@ // resource (touches last_used), and on remove_resource. No PS-side state is
 }
+function cacheKey(key) {
+    return `${key.resource}${key.mission_s256 ?? ''}`;
+}
+// 30s of slack so a token isn't handed out moments before it expires mid-flight.
+const EXPIRY_SKEW_SECS = 30;
+function usable(rec) {
+    if (!rec)
+        return undefined;
+    return rec.expires_at - EXPIRY_SKEW_SECS > Date.now() / 1000 ? rec.person_token : undefined;
+}
+/** Process-lifetime person-token cache. The default for hosts that inject none. */
+export function createMemoryPersonTokenStore() {
+    let jkt;
+    const tokens = new Map();
+    return {
+        async get(key, agentJkt) {
+            if (jkt !== agentJkt) {
+                tokens.clear();
+                jkt = agentJkt;
+                return undefined;
+            }
+            return usable(tokens.get(cacheKey(key)));
+        },
+        async set(key, agentJkt, token, expiresAt) {
+            if (jkt !== agentJkt) {
+                tokens.clear();
+                jkt = agentJkt;
+            }
+            tokens.set(cacheKey(key), {
+                resource: key.resource,
+                ...(key.mission_s256 ? { mission_s256: key.mission_s256 } : {}),
+                person_token: token,
+                expires_at: expiresAt,
+            });
+        },
+        async flush() {
+            tokens.clear();
+            jkt = undefined;
+        },
+    };
+}
+/** Filesystem-backed person-token cache at ~/.aauth/proxy/person-tokens.json. */
+export function createFsPersonTokenStore(opts = {}) {
+    const stateDir = opts.dir ?? join(homedir(), '.aauth', 'proxy');
+    const path = join(stateDir, 'person-tokens.json');
+    function load() {
+        if (!existsSync(path))
+            return { tokens: [] };
+        try {
+            return JSON.parse(readFileSync(path, 'utf8'));
+        }
+        catch {
+            return { tokens: [] };
+        }
+    }
+    function save(file) {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, JSON.stringify(file, null, 2), { mode: 0o600 });
+    }
+    return {
+        async get(key, agentJkt) {
+            const file = load();
+            if (file.agent_jkt !== agentJkt) {
+                save({ agent_jkt: agentJkt, tokens: [] });
+                return undefined;
+            }
+            const k = cacheKey(key);
+            return usable(file.tokens.find((t) => cacheKey(t) === k));
+        },
+        async set(key, agentJkt, token, expiresAt) {
+            const file = load();
+            const next = file.agent_jkt === agentJkt ? file : { agent_jkt: agentJkt, tokens: [] };
+            next.agent_jkt = agentJkt;
+            const k = cacheKey(key);
+            next.tokens = next.tokens.filter((t) => cacheKey(t) !== k);
+            next.tokens.push({
+                resource: key.resource,
+                ...(key.mission_s256 ? { mission_s256: key.mission_s256 } : {}),
+                person_token: token,
+                expires_at: expiresAt,
+            });
+            save(next);
+        },
+        async flush() {
+            save({ tokens: [] });
+        },
+    };
+}
 //# sourceMappingURL=store.js.map

dist/store.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,2CAA2C;AAC3C,EAAE;AACF,sFAAsF;AACtF,4EAA4E;AAC5E,4DAA4D;AAE5D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAmCzC,gFAAgF;AAChF,gDAAgD;AAChD,MAAM,UAAU,eAAe,CAAC,OAAyB,EAAE;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;IAE/C,SAAS,IAAI;QACX,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;QACjD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAW,CAAA;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,SAAS,IAAI,CAAC,IAAY;QACxB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/C,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,OAAO,IAAI,EAAE,CAAC,SAAS,CAAA;QACzB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,OAAO,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;QAC1D,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAA;YAC1E,IAAI,GAAG,IAAI,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;;gBACpC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC/B,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;YAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAA;YACvD,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI;YACd,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;YACnB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;YAC7D,IAAI,CAAC,KAAK;gBAAE,OAAM;YAClB,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAC1C,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,6EAA6E;AAC7E,2DAA2D;AAC3D,iCAAiC;AACjC,EAAE;AACF,sFAAsF;AACtF,4EAA4E;AAC5E,4DAA4D;AAE5D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AA6CzC,gFAAgF;AAChF,gDAAgD;AAChD,MAAM,UAAU,eAAe,CAAC,OAAyB,EAAE;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;IAE/C,SAAS,IAAI;QACX,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;QACjD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAW,CAAA;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,SAAS,IAAI,CAAC,IAAY;QACxB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/C,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,OAAO,IAAI,EAAE,CAAC,SAAS,CAAA;QACzB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,OAAO,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;QAC1D,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAA;YAC1E,IAAI,GAAG,IAAI,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;;gBACpC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC/B,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;YAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAA;YACvD,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI;YACd,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;YACnB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;YAC7D,IAAI,CAAC,KAAK;gBAAE,OAAM;YAClB,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAC1C,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC;AA+CD,SAAS,QAAQ,CAAC,GAAmB;IACnC,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,IAAI,EAAE,EAAE,CAAA;AACpD,CAAC;AAED,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAE3B,SAAS,MAAM,CAAC,GAAkC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,OAAO,GAAG,CAAC,UAAU,GAAG,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7F,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,4BAA4B;IAC1C,IAAI,GAAuB,CAAA;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAA;IACnD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ;YACrB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,MAAM,CAAC,KAAK,EAAE,CAAA;gBACd,GAAG,GAAG,QAAQ,CAAA;gBACd,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAC1C,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS;YACvC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,MAAM,CAAC,KAAK,EAAE,CAAA;gBACd,GAAG,GAAG,QAAQ,CAAA;YAChB,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,YAAY,EAAE,KAAK;gBACnB,UAAU,EAAE,SAAS;aACtB,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,GAAG,GAAG,SAAS,CAAA;QACjB,CAAC;KACF,CAAA;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CAAC,OAAyB,EAAE;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAA;IAEjD,SAAS,IAAI;QACX,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;QAC5C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAoB,CAAA;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;QACvB,CAAC;IACH,CAAC;IAED,SAAS,IAAI,CAAC,IAAqB;QACjC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACrE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ;YACrB,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;YACnB,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAChC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;gBACzC,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;YACvB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC3D,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS;YACvC,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;YACnB,MAAM,IAAI,GACR,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;YAC1E,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;YACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;YACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,YAAY,EAAE,KAAK;gBACnB,UAAU,EAAE,SAAS;aACtB,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,CAAC;QACD,KAAK,CAAC,KAAK;YACT,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QACtB,CAAC;KACF,CAAA;AACH,CAAC"}

dist/tools.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAMxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAOlD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAW,OAAO,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAA;IACX,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,EAAE,gBAAgB,CAAA;IAG1B,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAMnB,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAI7H,WAAW,CAAC,EAAE;QACZ,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;QAC/E,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QACzC,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KACzC,CAAA;IAGD,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;CACtC;AAqBD,wBAAsB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA+QvF"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AASxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAOlD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAW,OAAO,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAA;IACX,aAAa,EAAE,aAAa,CAAA;IAC5B,QAAQ,EAAE,gBAAgB,CAAA;IAG1B,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAMnB,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAI7H,WAAW,CAAC,EAAE;QACZ,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;QAC/E,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QACzC,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KACzC,CAAA;IAGD,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;CACtC;AAqBD,wBAAsB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA+TvF"}

dist/tools.js

@@ -12,4 +12,6 @@ // The eight-tool v1 discovery surface (design.md §"Tool surface"), built against
 import { z } from 'zod';
+import { planAccessMode } from './access-mode.js';
 import { deleteAtAdmin, invokeAtResource } from './agent.js';
 import { canonicalizeHost } from './host.js';
+import { agentTokenPs } from './jwt.js';
 import { fetchRegistry } from './registry.js';
@@ -50,2 +52,23 @@ import { fetchResource, getOperationsForResource, listOperationsForResource, toL1Entry, } from './resource.js';
     const describeWithL1 = (base) => `${base}\n\nCurrently added resources: ${l1Snapshot}`;
+    // What this agent's setup can complete. An agent token with no `ps` claim has
+    // no person server, so nothing beyond `agent-token` and `session-token` is
+    // reachable — the listing tools say so up front instead of letting the LLM
+    // plan against a resource that will 401.
+    //
+    // Peek only: a listing tool must not provoke an enclave signature to mint an
+    // agent token. When nothing is resolved yet the annotation is simply omitted —
+    // it is advisory, and `invoke` still refuses an unsatisfiable mode outright.
+    function peekSetup() {
+        const cfg = identity.peek?.();
+        return cfg ? { hasPersonServer: agentTokenPs(cfg.agentToken) !== undefined } : undefined;
+    }
+    // The `skip_reason` field on a listed resource: present only when this agent
+    // cannot complete the mode the resource declares. Advisory — an unrecognized
+    // or absent access_mode never produces one.
+    function skipReason(accessMode, setup) {
+        if (!setup)
+            return undefined;
+        const plan = planAccessMode(accessMode, setup);
+        return plan.kind === 'unsatisfiable' ? plan.reason : undefined;
+    }
     async function requireL1(resource) {
@@ -65,3 +88,3 @@ const canonical = canonicalizeHost(resource);
     server.registerTool('find_resources', {
-        description: describeWithL1('Search the AAuth registry for discoverable resources by free-text query against name/description. Returns each result tagged `added: true` if already in your local resource set.'),
+        description: describeWithL1('Search the AAuth registry for discoverable resources by free-text query against name/description. Returns each result tagged `added: true` if already in your local resource set. A result carrying `skip_reason` declares an access_mode this agent cannot complete — do not add or plan against it.'),
         inputSchema: { query: z.string().optional() },
@@ -72,2 +95,3 @@ }, async ({ query }) => {
             return text(BOOTSTRAP_GUIDANCE);
+        const setup = { hasPersonServer: agentTokenPs(c.cfg.agentToken) !== undefined };
         try {
@@ -87,2 +111,3 @@ const index = await fetchRegistry(c.cfg, registryCache);
                 const host = canonicalizeHost(r.issuer)?.host ?? r.issuer;
+                const reason = skipReason(r.access_mode, setup);
                 return {
@@ -94,2 +119,3 @@ resource: host,
                     added: added.has(host),
+                    ...(reason ? { skip_reason: reason } : {}),
                     ...(r.logo_uri ? { logo_uri: r.logo_uri } : {}),
@@ -123,13 +149,18 @@ };
     server.registerTool('list_resources', {
-        description: 'Return your locally added resources with name, description, access_mode, last_used, and how many vocabularies the agent proxy picked. Cheap; safe to call anytime.',
+        description: 'Return your locally added resources with name, description, access_mode, last_used, and how many vocabularies the agent proxy picked. A resource carrying `skip_reason` declares an access_mode this agent cannot complete — invoke will refuse it without calling out. Cheap; safe to call anytime.',
     }, async () => {
-        const entries = (await l1.list()).map((e) => ({
-            resource: e.resource,
-            name: e.name,
-            description: e.description,
-            access_mode: e.access_mode,
-            vocabularies: e.picked_vocabs.map((v) => v.vocabUri),
-            added: e.added,
-            last_used: e.last_used,
-        }));
+        const setup = peekSetup();
+        const entries = (await l1.list()).map((e) => {
+            const reason = skipReason(e.access_mode, setup);
+            return {
+                resource: e.resource,
+                name: e.name,
+                description: e.description,
+                access_mode: e.access_mode,
+                vocabularies: e.picked_vocabs.map((v) => v.vocabUri),
+                added: e.added,
+                last_used: e.last_used,
+                ...(reason ? { skip_reason: reason } : {}),
+            };
+        });
         return json(entries);
@@ -149,3 +180,10 @@ });
     server.registerTool('list_operations', {
-        description: describeWithL1('List operations a resource exposes. Optional `query` is either free-text (matched against opId/summary/tags) or an OpenAPI path prefix (e.g. "/crm/v3/objects/contacts/*"). Returns summaries only — schemas are fetched via get_operations to keep token cost flat. Each op carries `kind` (sync.request/async.send/async.receive).'),
+        description: describeWithL1('List operations a resource exposes. Optional `query` is either free-text (matched against opId/summary/tags) or an OpenAPI path prefix (e.g. "/crm/v3/objects/contacts/*"). Returns summaries only — schemas are fetched via get_operations to keep token cost flat.\n\n' +
+            'Each op carries `kind` (sync.request/async.send/async.receive) and `access_mode`, the credential that operation needs — read it before you plan:\n' +
+            '- `agent-token` — no authorization step; the agent already holds what it needs.\n' +
+            '- `person-token` — one call to the person server first; no user prompt in the common case.\n' +
+            '- `session-token` — the resource runs its own login/consent flow once.\n' +
+            '- `auth-token` — an authorization round trip through the person server; may prompt the user.\n' +
+            '- `per-call` — the resource authorizes each invocation against that call\'s parameters. It WILL block on a person every time. Do not plan unattended work around these.\n\n' +
+            '`budget: true` means invoking the operation draws down a spending budget. All of this is advisory — the resource may still challenge at runtime.'),
         inputSchema: { resource: z.string(), query: z.string().optional() },
@@ -165,3 +203,3 @@ }, async ({ resource, query }) => {
     server.registerTool('get_operations', {
-        description: describeWithL1('Batch fetch full schemas (params, request body, response) for one or more operations on a resource. Separate from list_operations because schemas dominate token cost.'),
+        description: describeWithL1('Batch fetch full schemas (params, request body, response) for one or more operations on a resource. Separate from list_operations because schemas dominate token cost. Each detail also carries the operation\'s `access_mode` and `budget`, as list_operations returns them.'),
         inputSchema: { resource: z.string(), op_ids: z.array(z.string()) },
@@ -181,3 +219,3 @@ }, async ({ resource, op_ids }) => {
     server.registerTool('invoke', {
-        description: describeWithL1('Invoke an operation on a resource. Pass `path_params`, `query`, `body` (object) as needed. If authorization is required, the client opens the auth URL automatically — call invoke again after authorization completes. async.receive operations return `subscribe_requires_subagent` (v.next).'),
+        description: describeWithL1('Invoke an operation on a resource. Pass `path_params`, `query`, `body` (object) as needed. If authorization is required, the client opens the auth URL automatically — call invoke again after authorization completes. async.receive operations return `subscribe_requires_subagent` (v.next). An operation whose access_mode this agent cannot complete is refused without any request being made, with the reason stated.'),
         inputSchema: {
@@ -212,2 +250,10 @@ resource: z.string(),
         }
+        // Case (c) of the access_mode plan: recognized, and this agent cannot
+        // complete it. No request was made and none will be — say why and let the
+        // LLM route around the resource rather than retry into a 401.
+        if (result.kind === 'skipped') {
+            return text(`Skipped ${result.resource} / ${result.opId}: ${result.reason}.\n\n` +
+                `This operation's access_mode is "${result.mode}". Retrying will not help. ` +
+                `Use a different resource or operation, or bootstrap an agent identity bound to a person server.`);
+        }
         if (result.kind === 'interaction') {
@@ -214,0 +260,0 @@ // onComplete resolves the UserStore pending-auth waiter when the poll finishes.

dist/tools.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,8EAA8E;AAC9E,+EAA+E;AAC/E,gDAAgD;AAChD,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,0BAA0B;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,KAAK,CAAA;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7C,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,SAAS,GACV,MAAM,eAAe,CAAA;AA8BtB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;AAC/E,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AAE7D,MAAM,kBAAkB,GAAG;;;;;;;;;;;wFAW6D,CAAA;AAExF,qFAAqF;AACrF,8EAA8E;AAC9E,gBAAgB;AAChB,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAiB,EAAE,IAAe;IACtE,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAA;IAEtD,6EAA6E;IAC7E,8EAA8E;IAC9E,wCAAwC;IACxC,KAAK,UAAU,SAAS;QACtB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;QACrE,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;QAC1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;IACtC,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE,CAC9C,GAAG,IAAI,kCAAkC,UAAU,EAAE,CAAA;IAEvD,KAAK,UAAU,SAAS,CACtB,QAAgB;QAEhB,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAA;QAC/E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK;YACR,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,GAAG,EAAE,uBAAuB,SAAS,CAAC,IAAI,wBAAwB,SAAS,CAAC,IAAI,WAAW;aAC5F,CAAA;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;IAChC,CAAC;IAED,2BAA2B;IAE3B,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EAAE,cAAc,CACzB,mLAAmL,CACpL;QACD,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;KAC9C,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClB,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAA;QAC3B,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YACvD,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS;iBAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACZ,IAAI,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAA;gBACnB,OAAO,CACL,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAChC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACvC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CACnC,CAAA;YACH,CAAC,CAAC;iBACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,CAAA;gBACzD,OAAO;oBACL,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChD,CAAA;YACH,CAAC,CAAC,CAAA;YACJ,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,WAAW,EAAE,cAAc,CACzB,4UAA4U,CAC7U;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;KACtC,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;YAChC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtB,OAAO,IAAI,CAAC;gBACV,KAAK,EAAE,KAAK,CAAC,QAAQ;gBACrB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;aACzD,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EACT,oKAAoK;KACvK,EACD,KAAK,IAAI,EAAE;QACT,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YACpD,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC,CAAA;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;IACtB,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,WAAW,EAAE,cAAc,CACzB,yKAAyK,CAC1K;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;KACtC,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IACrF,CAAC,CACF,CAAA;IAED,mBAAmB;IAEnB,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,WAAW,EAAE,cAAc,CACzB,sUAAsU,CACvU;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;KACpE,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;YACtE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAA;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACjE,CAAC;IACH,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EAAE,cAAc,CACzB,wKAAwK,CACzK;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;KACnE,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;YAC1E,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,yBAA0B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAChE,CAAC;IACH,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,QAAQ,EACR;QACE,WAAW,EAAE,cAAc,CACzB,iSAAiS,CAClS;QACD,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;YACjB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;SACnD;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;QACtD,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAA;QAC3B,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrC,MAAM,UAAU,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QAE3D,0EAA0E;QAC1E,uEAAuE;QACvE,4EAA4E;QAC5E,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;YAClF,OAAO,IAAI,CACT,qBAAqB,KAAK,CAAC,EAAE,CAAC,QAAQ,4BAA4B;gBAClE,sEAAsE,CACvE,CAAA;QACH,CAAC;QAED,IAAI,MAAoB,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACxD,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAClC,gFAAgF;YAChF,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;YAErE,mFAAmF;YACnF,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YAEnH,2EAA2E;YAC3E,MAAM,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;YAEnD,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,SAAS,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;YAC3E,MAAM,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;YACxC,OAAO,IAAI,CACT,8BAA8B,KAAK,CAAC,EAAE,CAAC,QAAQ,OAAO;gBACtD,iEAAiE;gBACjE,kEAAkE;gBAClE,0DAA0D;gBAC1D,8DAA8D;gBAC9D,+JAA+J;gBAC/J,sBAAsB,OAAO,MAAM;gBACnC,cAAc;gBACd,WAAW,EAAE,cAAc;gBAC3B,mBAAmB,CACpB,CAAA;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;QAClF,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IAC3D,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,WAAW,EAAE,cAAc,CACzB,mJAAmJ,CACpJ;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;KACtC,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAA;QAC3B,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,eAAe,CAAC,CAAA;YACjE,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAA;YACtD,OAAO,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,iBAAiB,KAAK,CAAC,EAAE,CAAC,QAAQ,GAAG,CAAC,CAAA;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,8EAA8E;AAC9E,+EAA+E;AAC/E,gDAAgD;AAChD,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,0BAA0B;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,KAAK,CAAA;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7C,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,SAAS,GACV,MAAM,eAAe,CAAA;AA8BtB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;AAC/E,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AAE7D,MAAM,kBAAkB,GAAG;;;;;;;;;;;wFAW6D,CAAA;AAExF,qFAAqF;AACrF,8EAA8E;AAC9E,gBAAgB;AAChB,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAiB,EAAE,IAAe;IACtE,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAA;IAEtD,6EAA6E;IAC7E,8EAA8E;IAC9E,wCAAwC;IACxC,KAAK,UAAU,SAAS;QACtB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;QACrE,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;QAC1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;IACtC,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE,CAC9C,GAAG,IAAI,kCAAkC,UAAU,EAAE,CAAA;IAEvD,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,yCAAyC;IACzC,EAAE;IACF,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,SAAS,SAAS;QAChB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAA;QAC7B,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1F,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,4CAA4C;IAC5C,SAAS,UAAU,CAAC,UAA8B,EAAE,KAA6B;QAC/E,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAA;QAC5B,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC9C,OAAO,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAChE,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,QAAgB;QAEhB,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAA;QAC/E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK;YACR,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,GAAG,EAAE,uBAAuB,SAAS,CAAC,IAAI,wBAAwB,SAAS,CAAC,IAAI,WAAW;aAC5F,CAAA;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;IAChC,CAAC;IAED,2BAA2B;IAE3B,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EAAE,cAAc,CACzB,uSAAuS,CACxS;QACD,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;KAC9C,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClB,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAA;QAC3B,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAe,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAA;QAC3F,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YACvD,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS;iBAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACZ,IAAI,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAA;gBACnB,OAAO,CACL,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAChC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACvC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CACnC,CAAA;YACH,CAAC,CAAC;iBACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,CAAA;gBACzD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;gBAC/C,OAAO;oBACL,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1C,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChD,CAAA;YACH,CAAC,CAAC,CAAA;YACJ,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,WAAW,EAAE,cAAc,CACzB,4UAA4U,CAC7U;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;KACtC,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;YAChC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtB,OAAO,IAAI,CAAC;gBACV,KAAK,EAAE,KAAK,CAAC,QAAQ;gBACrB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;aACzD,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EACT,sSAAsS;KACzS,EACD,KAAK,IAAI,EAAE;QACT,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;QACzB,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;YAC/C,OAAO;gBACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,YAAY,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACpD,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAA;QACH,CAAC,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;IACtB,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,WAAW,EAAE,cAAc,CACzB,yKAAyK,CAC1K;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;KACtC,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IACrF,CAAC,CACF,CAAA;IAED,mBAAmB;IAEnB,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,WAAW,EAAE,cAAc,CACzB,0QAA0Q;YACxQ,oJAAoJ;YACpJ,mFAAmF;YACnF,8FAA8F;YAC9F,0EAA0E;YAC1E,gGAAgG;YAChG,6KAA6K;YAC7K,kJAAkJ,CACrJ;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;KACpE,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;YACtE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAA;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACjE,CAAC;IACH,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EAAE,cAAc,CACzB,+QAA+Q,CAChR;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;KACnE,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;YAC1E,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,yBAA0B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAChE,CAAC;IACH,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,QAAQ,EACR;QACE,WAAW,EAAE,cAAc,CACzB,8ZAA8Z,CAC/Z;QACD,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;YACjB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;SACnD;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;QACtD,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAA;QAC3B,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrC,MAAM,UAAU,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QAE3D,0EAA0E;QAC1E,uEAAuE;QACvE,4EAA4E;QAC5E,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;YAClF,OAAO,IAAI,CACT,qBAAqB,KAAK,CAAC,EAAE,CAAC,QAAQ,4BAA4B;gBAClE,sEAAsE,CACvE,CAAA;QACH,CAAC;QAED,IAAI,MAAoB,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACxD,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,8DAA8D;QAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,IAAI,CACT,WAAW,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,OAAO;gBAClE,oCAAoC,MAAM,CAAC,IAAI,6BAA6B;gBAC5E,iGAAiG,CACpG,CAAA;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAClC,gFAAgF;YAChF,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;YAErE,mFAAmF;YACnF,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YAEnH,2EAA2E;YAC3E,MAAM,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;YAEnD,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,SAAS,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;YAC3E,MAAM,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;YACxC,OAAO,IAAI,CACT,8BAA8B,KAAK,CAAC,EAAE,CAAC,QAAQ,OAAO;gBACtD,iEAAiE;gBACjE,kEAAkE;gBAClE,0DAA0D;gBAC1D,8DAA8D;gBAC9D,+JAA+J;gBAC/J,sBAAsB,OAAO,MAAM;gBACnC,cAAc;gBACd,WAAW,EAAE,cAAc;gBAC3B,mBAAmB,CACpB,CAAA;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;QAClF,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IAC3D,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,WAAW,EAAE,cAAc,CACzB,mJAAmJ,CACpJ;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;KACtC,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAA;QAC3B,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,eAAe,CAAC,CAAA;YACjE,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAA;YACtD,OAAO,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,iBAAiB,KAAK,CAAC,EAAE,CAAC,QAAQ,GAAG,CAAC,CAAA;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

dist/vocab/index.d.ts

 import type { VocabAdapter } from './types.js';
 export * from './types.js';
+export * from './annotations.js';
 export { OpenAPIAdapter } from './openapi.js';
-export { OpenAPIGatewayAdapter } from './openapi-gateway.js';
 export declare function getAdapter(vocabUri: string): VocabAdapter | undefined;
 export declare function supportedVocabUris(): string[];
 //# sourceMappingURL=index.d.ts.map

dist/vocab/index.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vocab/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAU5D,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAErE;AAED,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vocab/index.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAS7C,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAErE;AAED,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C"}

dist/vocab/index.js

 // Vocabulary adapter registry. The agent proxy picks adapters at resource-load time by
 // walking `r3_vocabularies` from the well-known doc and selecting every URN
 // it has an adapter for.
+//
+// `urn:aauth:vocabulary:openapi-gateway` was removed in R3 -02 (aauth-dev/AAuth
+// issue #72): operation identifiers are scoped to the one discovery endpoint a
+// resource advertises per vocabulary (R3 -02 §Operation Identifier Scope), so a
+// resource fronting several backend services either presents them as a single
+// valid definition or exposes them under separate resource identifiers. There is
+// no composite `service:operationId` identity and no `{service, operationId}`
+// entry shape any more.
 import { OpenAPIAdapter } from './openapi.js';
-import { OpenAPIGatewayAdapter } from './openapi-gateway.js';
 export * from './types.js';
+export * from './annotations.js';
 export { OpenAPIAdapter } from './openapi.js';
-export { OpenAPIGatewayAdapter } from './openapi-gateway.js';
 const ADAPTERS = {
     'urn:aauth:vocabulary:openapi': new OpenAPIAdapter(),
-    'urn:aauth:vocabulary:openapi-gateway': new OpenAPIGatewayAdapter(),
     // 'urn:aauth:vocabulary:asyncapi': new AsyncAPIAdapter(),   // Phase 3
-    // 'urn:aauth:vocabulary:mcp-tools': new MCPToolsAdapter(),  // future
-    // 'urn:aauth:vocabulary:graphql':   new GraphQLAdapter(),   // future
+    // 'urn:aauth:vocabulary:mcp':      new MCPAdapter(),        // future
+    // 'urn:aauth:vocabulary:graphql':  new GraphQLAdapter(),    // future
 };
@@ -16,0 +22,0 @@ export function getAdapter(vocabUri) {

dist/vocab/index.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vocab/index.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,4EAA4E;AAC5E,yBAAyB;AAEzB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAG5D,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAE5D,MAAM,QAAQ,GAAiC;IAC7C,8BAA8B,EAAE,IAAI,cAAc,EAAE;IACpD,sCAAsC,EAAE,IAAI,qBAAqB,EAAkB;IACnF,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;CACvE,CAAA;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAC9B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vocab/index.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,4EAA4E;AAC5E,yBAAyB;AACzB,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAC9E,wBAAwB;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAG7C,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,MAAM,QAAQ,GAAiC;IAC7C,8BAA8B,EAAE,IAAI,cAAc,EAAE;IACpD,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;CACvE,CAAA;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAC9B,CAAC"}

dist/vocab/openapi.d.ts

@@ -0,1 +1,2 @@
+import type { OperationAnnotations } from './annotations.js';
 import type { InvocationPlan, InvokeArgs, OpDetail, OpSummary, VocabAdapter } from './types.js';
@@ -12,2 +13,3 @@ declare const HTTP_METHODS: readonly ["get", "post", "put", "delete", "patch", "head", "options"];
     responses?: Record<string, unknown>;
+    [ext: string]: unknown;
 }
@@ -31,2 +33,3 @@ type OpenAPIPathItem = Partial<Record<HttpMethod, OpenAPIOperation>> & {
     responses?: Record<string, unknown>;
+    annotations: OperationAnnotations;
 }
@@ -42,2 +45,3 @@ export interface OpenAPIVocabDoc {
     getOperations(doc: OpenAPIVocabDoc, opIds: string[]): OpDetail[];
+    annotationsFor(doc: OpenAPIVocabDoc, opId: string): OperationAnnotations;
     buildInvocation(doc: OpenAPIVocabDoc, opId: string, args: InvokeArgs): InvocationPlan;
@@ -44,0 +48,0 @@ }

dist/vocab/openapi.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/vocab/openapi.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,SAAS,EACT,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,QAAA,MAAM,YAAY,uEAAwE,CAAA;AAC1F,KAAK,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAA;AAE/C,UAAU,gBAAgB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,UAAU,CAAC,EAAE,OAAO,EAAE,CAAA;IACtB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED,KAAK,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,GAAG;IACrE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAA;CACvB,CAAA;AAED,UAAU,UAAU;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,UAAU,CAAC,EAAE,OAAO,EAAE,CAAA;IACtB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,UAAU,CAAA;IACf,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;CAC7B;AAsDD,qBAAa,cAAe,YAAW,YAAY,CAAC,eAAe,CAAC;IAClE,QAAQ,CAAC,QAAQ,kCAAiC;IAE5C,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAOjD,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE;IAiBjE,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE;IAqBhE,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,cAAc;CAkBtF"}
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/vocab/openapi.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,SAAS,EACT,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,QAAA,MAAM,YAAY,uEAAwE,CAAA;AAC1F,KAAK,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAA;AAK/C,UAAU,gBAAgB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,UAAU,CAAC,EAAE,OAAO,EAAE,CAAA;IACtB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,KAAK,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,GAAG;IACrE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAA;CACvB,CAAA;AAED,UAAU,UAAU;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,UAAU,CAAC,EAAE,OAAO,EAAE,CAAA;IACtB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,WAAW,EAAE,oBAAoB,CAAA;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,UAAU,CAAA;IACf,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;CAC7B;AA8DD,qBAAa,cAAe,YAAW,YAAY,CAAC,eAAe,CAAC;IAClE,QAAQ,CAAC,QAAQ,kCAAiC;IAE5C,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAOjD,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE;IAkBjE,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE;IAsBhE,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,oBAAoB;IAIxE,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,cAAc;CAkBtF"}

dist/vocab/openapi.js

@@ -7,2 +7,3 @@ // OpenAPI 3.x vocabulary adapter. All ops are `sync.request`.
 // Both are bounded; the caller decides on a result cap.
+import { readOpenApiAnnotations } from './annotations.js';
 const HTTP_METHODS = ['get', 'post', 'put', 'delete', 'patch', 'head', 'options'];
@@ -27,2 +28,3 @@ function indexOperations(doc) {
                 responses: op.responses,
+                annotations: readOpenApiAnnotations(op),
             });
@@ -58,2 +60,8 @@ }
 }
+// Annotations are sparse: emit the field only when the operation carries one, so
+// unannotated documents cost nothing extra in the listing the LLM reads.
+function annotationsField(op) {
+    const a = op.annotations ?? {};
+    return Object.keys(a).length > 0 ? { annotations: a } : {};
+}
 export class OpenAPIAdapter {
@@ -81,2 +89,3 @@ vocabUri = 'urn:aauth:vocabulary:openapi';
                 tags: op.tags,
+                ...annotationsField(op),
             });
@@ -100,2 +109,3 @@ }
                 tags: op.tags,
+                ...annotationsField(op),
                 paramsSchema: op.parameters,
@@ -108,2 +118,5 @@ bodySchema: op.requestBody,
     }
+    annotationsFor(doc, opId) {
+        return getOps(doc).get(opId)?.annotations ?? {};
+    }
     buildInvocation(doc, opId, args) {
@@ -110,0 +123,0 @@ const op = getOps(doc).get(opId);

dist/vocab/openapi.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../../src/vocab/openapi.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,2CAA2C;AAC3C,kFAAkF;AAClF,qFAAqF;AACrF,wDAAwD;AAUxD,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAU,CAAA;AAuC1F,SAAS,eAAe,CAAC,GAAe;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAA;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;YACvB,IAAI,CAAC,EAAE,EAAE,WAAW;gBAAE,SAAQ;YAC9B,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE;gBACtB,IAAI,EAAE,EAAE,CAAC,WAAW;gBACpB,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;gBAC5B,IAAI;gBACJ,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,WAAW;gBACrC,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;gBAClE,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,SAAS,EAAE,EAAE,CAAC,SAAS;aACxB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,EAAc,EAAE,KAAa;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,sEAAsE;IACtE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAChE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC/D,CAAC;IACD,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;IAC7B,OAAO,CACL,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjC,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAChD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAC7D,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,aAAqC,EAAE;IAC5E,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE,CACrD,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAC3C,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,2DAA2D;AAC3D,SAAS,MAAM,CAAC,GAAoB;IAClC,IAAI,GAAG,CAAC,GAAG,YAAY,GAAG;QAAE,OAAO,GAAG,CAAC,GAAG,CAAA;IAC1C,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAA;IACb,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,OAAO,cAAc;IAChB,QAAQ,GAAG,8BAA8B,CAAA;IAElD,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,CAAA;QAC5C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAA;IAC3C,CAAC;IAED,cAAc,CAAC,GAAoB,EAAE,KAAc;QACjD,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAA;QACrB,MAAM,GAAG,GAAgB,EAAE,CAAA;QAC3B,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBAAE,SAAQ;YAC7B,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,EAAE,CAAC,IAAI;aACd,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,aAAa,CAAC,GAAoB,EAAE,KAAe;QACjD,MAAM,GAAG,GAAe,EAAE,CAAA;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACxB,IAAI,CAAC,EAAE;gBAAE,SAAQ;YACjB,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,YAAY,EAAE,EAAE,CAAC,UAAU;gBAC3B,UAAU,EAAE,EAAE,CAAC,WAAW;gBAC1B,cAAc,EAAE,EAAE,CAAC,SAAS;aAC7B,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,eAAe,CAAC,GAAoB,EAAE,IAAY,EAAE,IAAgB;QAClE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACtB,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI;YACJ,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,KAAK,SAAS;gBACpB,CAAC,CAAC;oBACE,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE;oBACnE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC7D;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../../src/vocab/openapi.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,2CAA2C;AAC3C,kFAAkF;AAClF,qFAAqF;AACrF,wDAAwD;AAExD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAUzD,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAU,CAAA;AA4C1F,SAAS,eAAe,CAAC,GAAe;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAA;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;YACvB,IAAI,CAAC,EAAE,EAAE,WAAW;gBAAE,SAAQ;YAC9B,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE;gBACtB,IAAI,EAAE,EAAE,CAAC,WAAW;gBACpB,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;gBAC5B,IAAI;gBACJ,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,WAAW;gBACrC,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;gBAClE,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,SAAS,EAAE,EAAE,CAAC,SAAS;gBACvB,WAAW,EAAE,sBAAsB,CAAC,EAAE,CAAC;aACxC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,EAAc,EAAE,KAAa;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,sEAAsE;IACtE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAChE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC/D,CAAC;IACD,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;IAC7B,OAAO,CACL,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjC,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAChD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAC7D,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,aAAqC,EAAE;IAC5E,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE,CACrD,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAC3C,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,2DAA2D;AAC3D,SAAS,MAAM,CAAC,GAAoB;IAClC,IAAI,GAAG,CAAC,GAAG,YAAY,GAAG;QAAE,OAAO,GAAG,CAAC,GAAG,CAAA;IAC1C,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAA;IACb,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,iFAAiF;AACjF,yEAAyE;AACzE,SAAS,gBAAgB,CAAC,EAAc;IACtC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,IAAI,EAAE,CAAA;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,MAAM,OAAO,cAAc;IAChB,QAAQ,GAAG,8BAA8B,CAAA;IAElD,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,CAAA;QAC5C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAA;IAC3C,CAAC;IAED,cAAc,CAAC,GAAoB,EAAE,KAAc;QACjD,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAA;QACrB,MAAM,GAAG,GAAgB,EAAE,CAAA;QAC3B,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBAAE,SAAQ;YAC7B,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,GAAG,gBAAgB,CAAC,EAAE,CAAC;aACxB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,aAAa,CAAC,GAAoB,EAAE,KAAe;QACjD,MAAM,GAAG,GAAe,EAAE,CAAA;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACxB,IAAI,CAAC,EAAE;gBAAE,SAAQ;YACjB,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,GAAG,gBAAgB,CAAC,EAAE,CAAC;gBACvB,YAAY,EAAE,EAAE,CAAC,UAAU;gBAC3B,UAAU,EAAE,EAAE,CAAC,WAAW;gBAC1B,cAAc,EAAE,EAAE,CAAC,SAAS;aAC7B,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,cAAc,CAAC,GAAoB,EAAE,IAAY;QAC/C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,EAAE,CAAA;IACjD,CAAC;IAED,eAAe,CAAC,GAAoB,EAAE,IAAY,EAAE,IAAgB;QAClE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACtB,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI;YACJ,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,KAAK,SAAS;gBACpB,CAAC,CAAC;oBACE,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE;oBACnE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC7D;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;IACH,CAAC;CACF"}

dist/vocab/types.d.ts

@@ -0,1 +1,2 @@
+import type { OperationAnnotations } from './annotations.js';
 export type OpKind = 'sync.request' | 'async.send' | 'async.receive';
@@ -10,2 +11,16 @@ export interface OpSummary {
     tags?: string[];
+    /**
+     * The operation's own access annotations, when the vocabulary document carries
+     * them. Sparse by design — absent means "takes the resource-wide access_mode".
+     * resource.ts resolves these against the L1 entry before the LLM sees them.
+     */
+    annotations?: OperationAnnotations;
+    /**
+     * The access mode that actually applies to this operation: the annotation when
+     * present, the resource-wide `access_mode` otherwise. Filled in by resource.ts,
+     * not by adapters. Advisory — the runtime AAuth-Requirement is authoritative.
+     */
+    access_mode?: string;
+    /** true when invoking this operation draws down a budget. Omitted when false. */
+    budget?: boolean;
 }
@@ -43,8 +58,9 @@ export interface OpDetail extends OpSummary {
     readonly vocabUri: string;
-    load(source: string | Record<string, string>): Promise<Doc>;
+    load(source: string): Promise<Doc>;
     listOperations(doc: Doc, query?: string): OpSummary[];
     getOperations(doc: Doc, opIds: string[]): OpDetail[];
     buildInvocation(doc: Doc, opId: string, args: InvokeArgs): InvocationPlan;
-    formatOperationEntry?(opId: string): Record<string, unknown>;
+    /** This operation's access annotations, or {} when it carries none. */
+    annotationsFor(doc: Doc, opId: string): OperationAnnotations;
 }
 //# sourceMappingURL=types.d.ts.map

dist/vocab/types.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vocab/types.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,MAAM,GAAG,cAAc,GAAG,YAAY,GAAG,eAAe,CAAA;AAEpE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,QAAS,SAAQ,SAAS;IAKzC,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAKL,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,YAAY,CAAC,GAAG,GAAG,OAAO;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAGzB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3D,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAAA;IACrD,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;IACpD,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,cAAc,CAAA;IAIzE,oBAAoB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC7D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vocab/types.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAE5D,MAAM,MAAM,MAAM,GAAG,cAAc,GAAG,YAAY,GAAG,eAAe,CAAA;AAEpE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf;;;;OAIG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iFAAiF;IACjF,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,QAAS,SAAQ,SAAS;IAKzC,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAKL,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,YAAY,CAAC,GAAG,GAAG,OAAO;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAKzB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAClC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAAA;IACrD,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;IACpD,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,cAAc,CAAA;IACzE,uEAAuE;IACvE,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAAA;CAC7D"}

dist/vocab/types.js

@@ -7,6 +7,9 @@ // Vocabulary adapter contract. A resource advertises one or more vocabularies
 //   - turn (opId, args) into an InvocationPlan the agent proxy's `invoke` can execute
+//   - read each operation's access annotations (R3 -02 §Operation Access
+//     Annotations) off the vocabulary document
 //
 // See design.md §"Vocabularies". The LLM never sees `vocab` — it sees
-// `kind` (sync.request | async.send | async.receive) on each OpSummary.
+// `kind` (sync.request | async.send | async.receive) on each OpSummary, plus
+// the operation's effective `access_mode` / `budget`.
 export {};
 //# sourceMappingURL=types.js.map

dist/vocab/types.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/vocab/types.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,6EAA6E;AAC7E,4BAA4B;AAC5B,sEAAsE;AACtE,iEAAiE;AACjE,sFAAsF;AACtF,EAAE;AACF,sEAAsE;AACtE,wEAAwE"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/vocab/types.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,6EAA6E;AAC7E,4BAA4B;AAC5B,sEAAsE;AACtE,iEAAiE;AACjE,sFAAsF;AACtF,yEAAyE;AACzE,+CAA+C;AAC/C,EAAE;AACF,sEAAsE;AACtE,6EAA6E;AAC7E,sDAAsD"}

package.json

 {
   "name": "@aauth/proxy",
-  "version": "0.5.0",
+  "version": "1.0.1",
   "description": "The user's AAuth agent in MCP form — discovery, identity, interaction relay",
@@ -48,3 +48,3 @@ "type": "module",
   "dependencies": {
-    "@aauth/local-keys": "^1.1.0",
+    "@aauth/local-keys": "^2.0.0",
     "@hellocoop/httpsig": "^2.0.0",
@@ -51,0 +51,0 @@ "@modelcontextprotocol/sdk": "^1.29.0",

dist/vocab/openapi-gateway.d.ts

-import { type OpenAPIVocabDoc } from './openapi.js';
-import type { InvocationPlan, InvokeArgs, OpDetail, OpSummary, VocabAdapter } from './types.js';
-export interface GatewayVocabDoc {
-    services: Record<string, OpenAPIVocabDoc>;
-}
-export declare class OpenAPIGatewayAdapter implements VocabAdapter<GatewayVocabDoc> {
-    readonly vocabUri = "urn:aauth:vocabulary:openapi-gateway";
-    load(source: string | Record<string, string>): Promise<GatewayVocabDoc>;
-    listOperations(doc: GatewayVocabDoc, query?: string): OpSummary[];
-    getOperations(doc: GatewayVocabDoc, opIds: string[]): OpDetail[];
-    buildInvocation(doc: GatewayVocabDoc, compositeId: string, args: InvokeArgs): InvocationPlan;
-    formatOperationEntry(compositeId: string): Record<string, unknown>;
-}
-//# sourceMappingURL=openapi-gateway.d.ts.map

dist/vocab/openapi-gateway.d.ts.map

-{"version":3,"file":"openapi-gateway.d.ts","sourceRoot":"","sources":["../../src/vocab/openapi-gateway.ts"],"names":[],"mappings":"AAWA,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AACnE,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,SAAS,EACT,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;CAC1C;AAYD,qBAAa,qBAAsB,YAAW,YAAY,CAAC,eAAe,CAAC;IACzE,QAAQ,CAAC,QAAQ,0CAAyC;IAEpD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAa7E,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE;IAUjE,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE;IAahE,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,cAAc;IAW5F,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAGnE"}

dist/vocab/openapi-gateway.js

-// OpenAPI Gateway vocabulary adapter (urn:aauth:vocabulary:openapi-gateway,
-// AAuth R3 §OpenAPI Gateway Vocabulary). For resources that front MULTIPLE
-// OpenAPI-described services behind a single resource identifier — e.g. a
-// Google APIs proxy exposing gmail/calendar/people/… as separate specs.
-//
-// Discovery: the r3_vocabularies value is not a single URL but an object
-// mapping stable service labels → per-service OpenAPI spec URLs. Operation
-// identity is the pair (service, operationId); the agent-facing composite id
-// is `service:operationId` (unambiguous — ':' appears in no operationId).
-// R3 operation entries are { service, operationId } objects.
-import { OpenAPIAdapter } from './openapi.js';
-// Reuses the plain adapter's per-doc indexing/search/planning; this class only
-// adds the service dimension.
-const openapi = new OpenAPIAdapter();
-function splitId(compositeId) {
-    const i = compositeId.indexOf(':');
-    if (i === -1)
-        throw new Error(`openapi-gateway: operation id must be service:operationId, got ${compositeId}`);
-    return { service: compositeId.slice(0, i), operationId: compositeId.slice(i + 1) };
-}
-export class OpenAPIGatewayAdapter {
-    vocabUri = 'urn:aauth:vocabulary:openapi-gateway';
-    async load(source) {
-        if (typeof source === 'string' || source === null) {
-            throw new Error('openapi-gateway: discovery value must be an object mapping service labels to OpenAPI URLs');
-        }
-        const services = {};
-        await Promise.all(Object.entries(source).map(async ([label, url]) => {
-            services[label] = await openapi.load(url);
-        }));
-        return { services };
-    }
-    listOperations(doc, query) {
-        const out = [];
-        for (const [label, serviceDoc] of Object.entries(doc.services)) {
-            for (const op of openapi.listOperations(serviceDoc, query)) {
-                out.push({ ...op, opId: `${label}:${op.opId}`, tags: [label, ...(op.tags ?? [])] });
-            }
-        }
-        return out;
-    }
-    getOperations(doc, opIds) {
-        const out = [];
-        for (const compositeId of opIds) {
-            const { service, operationId } = splitId(compositeId);
-            const serviceDoc = doc.services[service];
-            if (!serviceDoc)
-                continue;
-            for (const detail of openapi.getOperations(serviceDoc, [operationId])) {
-                out.push({ ...detail, opId: compositeId, tags: [service, ...(detail.tags ?? [])] });
-            }
-        }
-        return out;
-    }
-    buildInvocation(doc, compositeId, args) {
-        const { service, operationId } = splitId(compositeId);
-        const serviceDoc = doc.services[service];
-        if (!serviceDoc)
-            throw new Error(`openapi-gateway: unknown service ${service}`);
-        // Per-service docs publish agent-facing paths relative to the resource
-        // origin (the gateway's generated specs label-prefix their paths), so the
-        // plain adapter's plan is already correct.
-        return openapi.buildInvocation(serviceDoc, operationId, args);
-    }
-    // R3 operation entries carry the pair, not the composite string.
-    formatOperationEntry(compositeId) {
-        return splitId(compositeId);
-    }
-}
-//# sourceMappingURL=openapi-gateway.js.map

dist/vocab/openapi-gateway.js.map

-{"version":3,"file":"openapi-gateway.js","sourceRoot":"","sources":["../../src/vocab/openapi-gateway.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,wEAAwE;AACxE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,6DAA6D;AAE7D,OAAO,EAAE,cAAc,EAAwB,MAAM,cAAc,CAAA;AAanE,+EAA+E;AAC/E,8BAA8B;AAC9B,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAA;AAEpC,SAAS,OAAO,CAAC,WAAmB;IAClC,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,WAAW,EAAE,CAAC,CAAA;IAC9G,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAA;AACpF,CAAC;AAED,MAAM,OAAO,qBAAqB;IACvB,QAAQ,GAAG,sCAAsC,CAAA;IAE1D,KAAK,CAAC,IAAI,CAAC,MAAuC;QAChD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAA;QAC9G,CAAC;QACD,MAAM,QAAQ,GAAoC,EAAE,CAAA;QACpD,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE;YAChD,QAAQ,CAAC,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC3C,CAAC,CAAC,CACH,CAAA;QACD,OAAO,EAAE,QAAQ,EAAE,CAAA;IACrB,CAAC;IAED,cAAc,CAAC,GAAoB,EAAE,KAAc;QACjD,MAAM,GAAG,GAAgB,EAAE,CAAA;QAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;YACrF,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,aAAa,CAAC,GAAoB,EAAE,KAAe;QACjD,MAAM,GAAG,GAAe,EAAE,CAAA;QAC1B,KAAK,MAAM,WAAW,IAAI,KAAK,EAAE,CAAC;YAChC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;YACrD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACxC,IAAI,CAAC,UAAU;gBAAE,SAAQ;YACzB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;YACrF,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,eAAe,CAAC,GAAoB,EAAE,WAAmB,EAAE,IAAgB;QACzE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;QACrD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACxC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAA;QAC/E,uEAAuE;QACvE,0EAA0E;QAC1E,2CAA2C;QAC3C,OAAO,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;IAC/D,CAAC;IAED,iEAAiE;IACjE,oBAAoB,CAAC,WAAmB;QACtC,OAAO,OAAO,CAAC,WAAW,CAAC,CAAA;IAC7B,CAAC;CACF"}

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

193995

41.6%

Number of package files

66

13.79%

Lines of code

2397

49.16%

Number of low quality alerts

1

-50%

Dependency changes

• + Added

  @aauth/local-keys@2.0.0
  (transitive)

• - Removed

  @aauth/local-keys@1.3.0
  (transitive)

• - Removed

  jose@5.10.0
  (transitive)

• Updated

  @aauth/local-keys@^2.0.0