@atlasauth/backend 0.1.7 → 0.4.0

package/dist/client/api-keys.d.ts

@@ -1,5 +1,5 @@
 import { type RequestFn } from './request';
-import type { ListPage } from './types';
+import type { CursorPage, ListPage } from './types';
 export type ApiKeySubjectType = 'user' | 'organization';
 /**
  * An end-user API key — Clerk `api_keys` parity. A tenant mints these for ITS OWN
@@ -56,6 +56,45 @@ export type ApiKeyVerification = {
     claims: Record<string, unknown>;
     last_used_at: number | null;
 };
+/**
+ * §P1-8 a short-lived, offline-verifiable access JWT minted from a long-lived
+ * `ak_` key (`POST /v1/api_keys/token`). Signed with the instance's RS256 key, so
+ * any resource server verifies it against the public JWKS without a round trip.
+ */
+export interface ApiKeyToken {
+    object: 'api_key_token';
+    token: string;
+    token_type: 'Bearer';
+    jti: string;
+    key_id: string;
+    subject_type: ApiKeySubjectType;
+    subject_id: string;
+    scopes: string[];
+    constraints: Record<string, unknown>;
+    expires_in: number;
+    expires_at: number;
+    /** Which JWKS/issuer a verifier should check, so it needn't parse the JWT first. */
+    issuer: string;
+}
+export interface MintApiKeyTokenBody {
+    /** The long-lived `ak_` secret to mint from. */
+    secret: string;
+    /** Requested lifetime; clamped to the key's ceiling, its expiry, and the global cap. */
+    ttl_seconds?: number;
+    audience?: string | string[];
+}
+/** One entry in the revocation feed: an id and when it was revoked. */
+export interface RevokedApiKeyRef {
+    object: 'api_key';
+    id: string;
+    revoked_at: number | null;
+}
+export interface ListRevokedApiKeysQuery {
+    /** An ISO-8601 instant, epoch-millis, or a `next_cursor` from a previous page. */
+    since?: string;
+    /** Page size (server clamps to its own maximum). */
+    limit?: number;
+}
 export declare function apiKeysResource(request: RequestFn): {
     /** Optionally narrowed to one subject. */
     list(query?: {
@@ -74,4 +113,14 @@ export declare function apiKeysResource(request: RequestFn): {
         id: string;
         revoked: true;
     }>;
+    /**
+     * §P1-8 mint a short-lived delegated token from an `ak_` key. Rate-limited —
+     * presenting the secret is the same online credential surface as verify.
+     */
+    mintToken(body: MintApiKeyTokenBody): Promise<ApiKeyToken>;
+    /**
+     * §P1-8 the revocation feed a resource server polls to deny-list revoked keys
+     * while their delegated tokens are still live. Keyset-paginated via `since`.
+     */
+    listRevoked(query?: ListRevokedApiKeysQuery): Promise<CursorPage<RevokedApiKeyRef>>;
 };

package/dist/client/api-keys.js

@@ -26,6 +26,20 @@ function apiKeysResource(request) {
         delete(id) {
             return request({ method: 'DELETE', path: `/v1/api_keys/${(0, request_1.enc)(id)}` });
         },
+        /**
+         * §P1-8 mint a short-lived delegated token from an `ak_` key. Rate-limited —
+         * presenting the secret is the same online credential surface as verify.
+         */
+        mintToken(body) {
+            return request({ method: 'POST', path: '/v1/api_keys/token', body });
+        },
+        /**
+         * §P1-8 the revocation feed a resource server polls to deny-list revoked keys
+         * while their delegated tokens are still live. Keyset-paginated via `since`.
+         */
+        listRevoked(query = {}) {
+            return request({ method: 'GET', path: '/v1/api_keys/revoked', query: { ...query } });
+        },
     };
 }
 //# sourceMappingURL=api-keys.js.map

package/dist/client/api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/client/api-keys.ts"],"names":[],"mappings":";;AAgEA,0CA4BC;AA5FD,uCAAgD;AAgEhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,KAGJ;YACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,qDAAqD;QACrD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,iFAAiF;QACjF,MAAM,CAAC,MAAc;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/client/api-keys.ts"],"names":[],"mappings":";;AA2GA,0CA0CC;AArJD,uCAAgD;AA2GhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,KAGJ;YACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,qDAAqD;QACrD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,iFAAiF;QACjF,MAAM,CAAC,MAAc;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,IAAyB;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD;;;WAGG;QACH,WAAW,CAAC,QAAiC,EAAE;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/captcha.d.ts

@@ -0,0 +1,43 @@
+import { type RequestFn } from './request';
+/**
+ * The verdict `POST /v1/captcha/verify` returns. `success` is the gate decision;
+ * `score` (0..1, higher = more human), `verdict` and `meta` are the provider's
+ * own judgment, surfaced for the caller's risk pipeline.
+ */
+export interface CaptchaVerification {
+    object: 'captcha_verification';
+    success: boolean;
+    /** The action this verification resolved for, or null for the base provider. */
+    action: string | null;
+    /** The provider the token was verified against. */
+    provider: string;
+    /** Normalized 0..1 (higher = more human); absent for pass/fail-only providers. */
+    score?: number;
+    /** Coarse label; `edge` for edge-enforced providers (AWS WAF, PerimeterX, …). */
+    verdict?: 'pass' | 'fail' | 'low_score' | 'edge';
+    /** The provider-issued challenge timestamp, when it returns one. */
+    challenge_ts?: string;
+    /** Provider-specific reason codes / breakdown (server-side only). */
+    meta?: Record<string, unknown>;
+}
+/** Options for a verify call. */
+export interface VerifyCaptchaOptions {
+    /**
+     * The customer-named action to resolve the provider for (e.g. "comment.create").
+     * Omit to use the instance's base provider.
+     */
+    action?: string;
+    /** The end-user's IP, forwarded to the provider when it accepts one (advised). */
+    remoteIp?: string;
+}
+/**
+ * "CAPTCHA anywhere" — verify a token server-side against the instance's
+ * centrally-configured provider. Atlas holds the provider secret and does the
+ * verification, so a tenant protects any action without holding the secret or
+ * writing its own verification code. Fails CLOSED: an unconfigured provider,
+ * missing secret, outage or bad token all come back `success: false`.
+ */
+export declare function captchaResource(request: RequestFn): {
+    /** Verify a CAPTCHA token for an optional action. */
+    verify(token: string, options?: VerifyCaptchaOptions): Promise<CaptchaVerification>;
+};

package/dist/client/captcha.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.captchaResource = captchaResource;
+/**
+ * "CAPTCHA anywhere" — verify a token server-side against the instance's
+ * centrally-configured provider. Atlas holds the provider secret and does the
+ * verification, so a tenant protects any action without holding the secret or
+ * writing its own verification code. Fails CLOSED: an unconfigured provider,
+ * missing secret, outage or bad token all come back `success: false`.
+ */
+function captchaResource(request) {
+    return {
+        /** Verify a CAPTCHA token for an optional action. */
+        verify(token, options = {}) {
+            return request({
+                method: 'POST',
+                path: '/v1/captcha/verify',
+                body: {
+                    token,
+                    ...(options.action ? { action: options.action } : {}),
+                    ...(options.remoteIp ? { remote_ip: options.remoteIp } : {}),
+                },
+            });
+        },
+    };
+}
+//# sourceMappingURL=captcha.js.map

package/dist/client/captcha.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"captcha.js","sourceRoot":"","sources":["../../src/client/captcha.ts"],"names":[],"mappings":";;AA0CA,0CAeC;AAtBD;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,qDAAqD;QACrD,MAAM,CAAC,KAAa,EAAE,UAAgC,EAAE;YACtD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,oBAAoB;gBAC1B,IAAI,EAAE;oBACJ,KAAK;oBACL,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7D;aACF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/index.d.ts

@@ -390,6 +390,33 @@ export declare function createAtlasClient(config: AtlasClientConfig): {
             id: string;
             revoked: true;
         }>;
+        mintToken(body: import("./api-keys").MintApiKeyTokenBody): Promise<import("./api-keys").ApiKeyToken>;
+        listRevoked(query?: import("./api-keys").ListRevokedApiKeysQuery): Promise<import("./types").CursorPage<import("./api-keys").RevokedApiKeyRef>>;
+    };
+    machines: {
+        list(query?: import("./machines").ListMachinesQuery): Promise<import("./machines").MachineListPage>;
+        create(body: import("./machines").CreateMachineBody, idempotencyKey?: string): Promise<import("./machines").MachineWithSecret>;
+        get(id: string): Promise<import("./machines").Machine>;
+        rename(id: string, name: string): Promise<import("./machines").Machine>;
+        patchMetadata(id: string, metadata: import("./machines").MachineMetadata): Promise<import("./machines").Machine>;
+        approve(id: string): Promise<import("./machines").Machine>;
+        revoke(id: string): Promise<import("./machines").Machine>;
+        rotateSecret(id: string): Promise<import("./machines").MachineWithSecret>;
+        rotateKey(id: string, publicKeyPem: string): Promise<import("./machines").Machine>;
+        delete(id: string): Promise<{
+            object: "machine";
+            id: string;
+            deleted: true;
+        }>;
+        organizationMemberships(id: string): Promise<import("./machines").MachineOrganizationMembershipPage>;
+        createEnrolmentToken(body?: import("./machines").CreateEnrolmentTokenBody, idempotencyKey?: string): Promise<import("./machines").MachineEnrolmentTokenWithSecret>;
+        listEnrolmentTokens(): Promise<import("./types").ListPage<import("./machines").MachineEnrolmentToken>>;
+        deleteEnrolmentToken(id: string): Promise<{
+            object: "machine_enrolment_token";
+            id: string;
+            deleted: true;
+        }>;
+        verifyM2mToken(token: string): Promise<import("./machines").M2mTokenVerification>;
     };
     oauthProviders: {
         list(): Promise<import("./types").ListPage<import("./oauth-providers").OAuthProvider>>;
@@ -654,8 +681,18 @@ export declare function createAtlasClient(config: AtlasClientConfig): {
     };
     messaging: {
         get(): Promise<import("./messaging").MessagingProviders>;
-        setEmail(body: import("./messaging").MessagingProviderInput): Promise<import("./messaging").MessagingProvider>;
-        setSms(body: import("./messaging").MessagingProviderInput): Promise<import("./messaging").MessagingProvider>;
+        setEmail: {
+            (body: import("./messaging").EmailProviderInput): Promise<import("./messaging").EmailProvider>;
+            <T extends string>(body: Omit<import("./messaging").MessagingProviderInput, "transport"> & {
+                transport: T;
+            } & (string extends T ? unknown : never)): Promise<import("./messaging").MessagingProvider>;
+        };
+        setSms: {
+            (body: import("./messaging").SmsProviderInput): Promise<import("./messaging").SmsProvider>;
+            <T extends string>(body: Omit<import("./messaging").MessagingProviderInput, "transport"> & {
+                transport: T;
+            } & (string extends T ? unknown : never)): Promise<import("./messaging").MessagingProvider>;
+        };
         deleteChannel(channel: "email" | "sms"): Promise<import("./messaging").DeletedMessagingProvider>;
         test(channel: "email" | "sms", body: {
             to: string;
@@ -743,6 +780,9 @@ export declare function createAtlasClient(config: AtlasClientConfig): {
     tokens: {
         verify(body: import("./tokens").VerifyTokenBody): Promise<import("./tokens").TokenVerification>;
     };
+    captcha: {
+        verify(token: string, options?: import("./captcha").VerifyCaptchaOptions): Promise<import("./captcha").CaptchaVerification>;
+    };
 };
 /** The fully typed client instance `createAtlasClient` returns. */
 export type AtlasClient = ReturnType<typeof createAtlasClient>;
@@ -770,6 +810,7 @@ export * from './sign-in-tokens';
 export * from './audit-logs';
 export * from './jwt-templates';
 export * from './api-keys';
+export * from './machines';
 export * from './oauth-providers';
 export * from './sso-onboarding';
 export * from './scim-provisioning';
@@ -794,3 +835,4 @@ export * from './lti-platforms';
 export * from './instance';
 export * from './instance-security';
 export * from './tokens';
+export * from './captcha';

package/dist/client/index.js

@@ -36,6 +36,7 @@ const sign_in_tokens_1 = require("./sign-in-tokens");
 const audit_logs_1 = require("./audit-logs");
 const jwt_templates_1 = require("./jwt-templates");
 const api_keys_1 = require("./api-keys");
+const machines_1 = require("./machines");
 const oauth_providers_1 = require("./oauth-providers");
 const sso_onboarding_1 = require("./sso-onboarding");
 const scim_provisioning_1 = require("./scim-provisioning");
@@ -60,6 +61,7 @@ const lti_platforms_1 = require("./lti-platforms");
 const instance_1 = require("./instance");
 const instance_security_1 = require("./instance-security");
 const tokens_1 = require("./tokens");
+const captcha_1 = require("./captcha");
 /**
  * The typed management client for the Atlas Backend API — the secret-key
  * surface, the peer of `@clerk/backend`'s `createClerkClient`.
@@ -93,6 +95,8 @@ function createAtlasClient(config) {
         auditLogs: (0, audit_logs_1.auditLogsResource)(request),
         jwtTemplates: (0, jwt_templates_1.jwtTemplatesResource)(request),
         apiKeys: (0, api_keys_1.apiKeysResource)(request),
+        // §9.3 / §P1-7 named machine identities + device registry + enrolment tokens.
+        machines: (0, machines_1.machinesResource)(request),
         oauthProviders: (0, oauth_providers_1.oauthProvidersResource)(request),
         ssoOnboarding: (0, sso_onboarding_1.ssoOnboardingResource)(request),
         scimProvisioning: (0, scim_provisioning_1.scimProvisioningResource)(request),
@@ -117,6 +121,9 @@ function createAtlasClient(config) {
         instance: (0, instance_1.instanceResource)(request),
         instanceSecurity: (0, instance_security_1.instanceSecurityResource)(request),
         tokens: (0, tokens_1.tokensResource)(request),
+        // §5 "captcha anywhere" — verify any CAPTCHA token against the instance's
+        // centrally-configured provider, server-side, with the secret held by Atlas.
+        captcha: (0, captcha_1.captchaResource)(request),
     };
 }
 var request_2 = require("./request");
@@ -147,6 +154,7 @@ __exportStar(require("./sign-in-tokens"), exports);
 __exportStar(require("./audit-logs"), exports);
 __exportStar(require("./jwt-templates"), exports);
 __exportStar(require("./api-keys"), exports);
+__exportStar(require("./machines"), exports);
 __exportStar(require("./oauth-providers"), exports);
 __exportStar(require("./sso-onboarding"), exports);
 __exportStar(require("./scim-provisioning"), exports);
@@ -171,4 +179,5 @@ __exportStar(require("./lti-platforms"), exports);
 __exportStar(require("./instance"), exports);
 __exportStar(require("./instance-security"), exports);
 __exportStar(require("./tokens"), exports);
+__exportStar(require("./captcha"), exports);
 //# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAsDA,8CAkDC;AAxGD,uCAAkE;AAClE,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,qCAA0C;AAE1C;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IAEtC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;KAChC,CAAC;AACJ,CAAC;AAMD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,2CAAyB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAwDA,8CAuDC;AA/GD,uCAAkE;AAClE,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,qCAA0C;AAC1C,uCAA4C;AAE5C;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IAEtC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;KAClC,CAAC;AACJ,CAAC;AAMD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,2CAAyB;AACzB,4CAA0B"}

package/dist/client/machines.d.ts

@@ -0,0 +1,183 @@
+import { type RequestFn } from './request';
+import type { CursorParams, ListPage, Metadata } from './types';
+/**
+ * §9.3 / §P1-7 MACHINE identities + the device registry.
+ *
+ * A machine is a first-class non-human principal with its own secret (`mk_…`),
+ * distinct from an instance API key. §P1-7 layers a DEVICE half on top: a machine
+ * can carry a registered public KEY, a lifecycle `status`, device `metadata`, and
+ * optional org/owner ownership. This namespace is the `sk_`-authenticated
+ * MANAGEMENT surface (list/filter, create, rename, metadata, approve, revoke, key
+ * rotation, delete) plus enrolment-token management and M2M-token verification.
+ *
+ * The device self-serve half (`/v1/machines/enroll`, `/challenge`, `/token`) is a
+ * PUBLIC, credential-presented surface a bootstrapping device calls with no `sk_`,
+ * so it is deliberately NOT part of this secret-key client.
+ */
+/** A machine's lifecycle state. `pending` awaits approval; `revoked` is terminal. */
+export type MachineStatus = 'pending' | 'active' | 'revoked';
+/** Device metadata bag (hostname/os/app_version/last_seen_at/…). */
+export type MachineMetadata = Record<string, unknown>;
+/**
+ * A named machine identity. `secret_hash` is never present on any machine surface
+ * — only a hash is stored, so the `mk_` secret is shown exactly once at
+ * create/rotate (see {@link MachineWithSecret}).
+ */
+export interface Machine {
+    object: 'machine';
+    id: string;
+    name: string;
+    organization_id: string | null;
+    status: MachineStatus;
+    /** JWK thumbprint of the registered device key, or null for a secret-only machine. */
+    public_key_jkt: string | null;
+    metadata: MachineMetadata;
+    enrolled_at: number | null;
+    created_at: number;
+    updated_at: number;
+}
+/** The create / rotate_secret response: the machine plus its `mk_` secret, shown once. */
+export interface MachineWithSecret extends Machine {
+    secret: string;
+}
+export interface CreateMachineBody {
+    name: string;
+    /** Round-7: the user who owns this machine identity. */
+    owner_user_id?: string;
+    /** Round-7: bind the machine to an organization at creation. */
+    organization_id?: string;
+    /** Round-7: free-form data bag stored on the machine. */
+    data?: Metadata;
+    /** Device metadata (hostname/os/app_version/…). */
+    metadata?: MachineMetadata;
+}
+export interface ListMachinesQuery extends CursorParams {
+    status?: MachineStatus;
+    /** Filter by the device's reported hostname. */
+    hostname?: string;
+    /** Round-7: only machines owned by this user. */
+    owner_user_id?: string;
+    /** Round-7: only machines belonging to this organization. */
+    organization_id?: string;
+    /** Round-7: a JSON-encoded metadata match filter. */
+    metadata?: string;
+}
+/**
+ * The machine list page. The envelope is `{ object: 'list', data }`; §P1-7's
+ * cursor fields (`has_more`/`next_cursor`) are present on the round-7 surface and
+ * optional here so the type is honest against both.
+ */
+export interface MachineListPage {
+    object: 'list';
+    data: Machine[];
+    has_more?: boolean;
+    next_cursor?: string | null;
+}
+/**
+ * A machine's org membership, membership-shaped like
+ * `GET /v1/users/:id/organization_memberships`. A machine belongs to at most one
+ * org today, so the list holds 0 or 1 entries; `role` is always null (a machine
+ * holds no org role).
+ */
+export interface MachineOrganizationMembership {
+    object: 'organization_membership';
+    organization_id: string;
+    organization_slug: string;
+    role: null;
+    plan: string | null;
+    joined_at: number;
+}
+export interface MachineOrganizationMembershipPage {
+    object: 'list';
+    data: MachineOrganizationMembership[];
+    has_more: boolean;
+    next_cursor: string | null;
+}
+/** An enrolment token — a short-lived credential a device presents to `/enroll`. */
+export interface MachineEnrolmentToken {
+    object: 'machine_enrolment_token';
+    id: string;
+    organization_id: string | null;
+    max_uses: number;
+    uses: number;
+    expires_at: number;
+    requires_approval: boolean;
+    created_at: number;
+}
+/** The create response: the enrolment token plus its `met_` secret, shown once. */
+export interface MachineEnrolmentTokenWithSecret extends MachineEnrolmentToken {
+    token: string;
+}
+export interface CreateEnrolmentTokenBody {
+    /** Bind machines enrolled with this token to an organization. */
+    organization_id?: string;
+    /** Round-7: the user who will own machines enrolled with this token. */
+    owner_user_id?: string;
+    /** Round-7: free-form data copied onto each enrolled machine. */
+    data?: Metadata;
+    /** Round-7: restrict the token to a single enrolment session. */
+    single_session?: boolean;
+    /** Round-7: the maximum number of machines that may enrol with this token. */
+    max_machines?: number;
+    /** How many times the token may be redeemed (defaults to 1 server-side). */
+    max_uses?: number;
+    /** Token lifetime; defaults to 3600s, capped at one year. */
+    expires_in_seconds?: number;
+    /** When true, enrolled machines start `pending` and must be approved. */
+    requires_approval?: boolean;
+}
+/**
+ * The verify verdict for an M2M credential (Clerk `verifyM2MToken`): resolve a
+ * presented machine secret to its machine. An unknown, rotated, or revoked secret
+ * all resolve to the SAME `{ valid: false }`, so a caller cannot probe which
+ * machines exist.
+ */
+export type M2mTokenVerification = {
+    object: 'm2m_verification';
+    valid: false;
+} | {
+    object: 'm2m_verification';
+    valid: true;
+    machine_id: string;
+    name: string;
+};
+export declare function machinesResource(request: RequestFn): {
+    /** List + filter machines (§P1-7 device-registry query). */
+    list(query?: ListMachinesQuery): Promise<MachineListPage>;
+    /** Create a machine. The `mk_` secret is returned once, here. */
+    create(body: CreateMachineBody, idempotencyKey?: string): Promise<MachineWithSecret>;
+    get(id: string): Promise<Machine>;
+    /** Rename a machine (`PATCH /v1/machines/:id`). */
+    rename(id: string, name: string): Promise<Machine>;
+    /** Merge device metadata (`PATCH /v1/machines/:id/metadata`). */
+    patchMetadata(id: string, metadata: MachineMetadata): Promise<Machine>;
+    /** Approve a `pending` device (→ `active`). */
+    approve(id: string): Promise<Machine>;
+    /** Revoke a machine (→ `revoked`). The record is kept; its key stops minting at once. */
+    revoke(id: string): Promise<Machine>;
+    /** Rotate the `mk_` secret. The new secret is shown once; the old stops working. */
+    rotateSecret(id: string): Promise<MachineWithSecret>;
+    /** Rotate the registered device keypair by supplying the new public key PEM. */
+    rotateKey(id: string, publicKeyPem: string): Promise<Machine>;
+    /** Delete a machine outright (distinct from {@link revoke}, which keeps the record). */
+    delete(id: string): Promise<{
+        object: "machine";
+        id: string;
+        deleted: true;
+    }>;
+    /** The machine's org memberships (0 or 1 entry). */
+    organizationMemberships(id: string): Promise<MachineOrganizationMembershipPage>;
+    /** Mint an enrolment token. The `met_` secret is returned once, here. */
+    createEnrolmentToken(body?: CreateEnrolmentTokenBody, idempotencyKey?: string): Promise<MachineEnrolmentTokenWithSecret>;
+    listEnrolmentTokens(): Promise<ListPage<MachineEnrolmentToken>>;
+    deleteEnrolmentToken(id: string): Promise<{
+        object: "machine_enrolment_token";
+        id: string;
+        deleted: true;
+    }>;
+    /**
+     * Verify a presented M2M credential (`POST /v1/m2m_tokens/verify`). Resolve a
+     * machine secret to its machine; every negative resolves to `{ valid: false }`.
+     */
+    verifyM2mToken(token: string): Promise<M2mTokenVerification>;
+};

package/dist/client/machines.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.machinesResource = machinesResource;
+const request_1 = require("./request");
+function machinesResource(request) {
+    return {
+        /** List + filter machines (§P1-7 device-registry query). */
+        list(query = {}) {
+            return request({ method: 'GET', path: '/v1/machines', query: { ...query } });
+        },
+        /** Create a machine. The `mk_` secret is returned once, here. */
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/machines', body, idempotencyKey });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/machines/${(0, request_1.enc)(id)}` });
+        },
+        /** Rename a machine (`PATCH /v1/machines/:id`). */
+        rename(id, name) {
+            return request({ method: 'PATCH', path: `/v1/machines/${(0, request_1.enc)(id)}`, body: { name } });
+        },
+        /** Merge device metadata (`PATCH /v1/machines/:id/metadata`). */
+        patchMetadata(id, metadata) {
+            return request({ method: 'PATCH', path: `/v1/machines/${(0, request_1.enc)(id)}/metadata`, body: { metadata } });
+        },
+        /** Approve a `pending` device (→ `active`). */
+        approve(id) {
+            return request({ method: 'POST', path: `/v1/machines/${(0, request_1.enc)(id)}/approve` });
+        },
+        /** Revoke a machine (→ `revoked`). The record is kept; its key stops minting at once. */
+        revoke(id) {
+            return request({ method: 'POST', path: `/v1/machines/${(0, request_1.enc)(id)}/revoke` });
+        },
+        /** Rotate the `mk_` secret. The new secret is shown once; the old stops working. */
+        rotateSecret(id) {
+            return request({ method: 'POST', path: `/v1/machines/${(0, request_1.enc)(id)}/rotate_secret` });
+        },
+        /** Rotate the registered device keypair by supplying the new public key PEM. */
+        rotateKey(id, publicKeyPem) {
+            return request({
+                method: 'POST',
+                path: `/v1/machines/${(0, request_1.enc)(id)}/rotate_key`,
+                body: { public_key_pem: publicKeyPem },
+            });
+        },
+        /** Delete a machine outright (distinct from {@link revoke}, which keeps the record). */
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/machines/${(0, request_1.enc)(id)}` });
+        },
+        /** The machine's org memberships (0 or 1 entry). */
+        organizationMemberships(id) {
+            return request({ method: 'GET', path: `/v1/machines/${(0, request_1.enc)(id)}/organization_memberships` });
+        },
+        /** Mint an enrolment token. The `met_` secret is returned once, here. */
+        createEnrolmentToken(body = {}, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/machine_enrolment_tokens', body, idempotencyKey });
+        },
+        listEnrolmentTokens() {
+            return request({ method: 'GET', path: '/v1/machine_enrolment_tokens' });
+        },
+        deleteEnrolmentToken(id) {
+            return request({ method: 'DELETE', path: `/v1/machine_enrolment_tokens/${(0, request_1.enc)(id)}` });
+        },
+        /**
+         * Verify a presented M2M credential (`POST /v1/m2m_tokens/verify`). Resolve a
+         * machine secret to its machine; every negative resolves to `{ valid: false }`.
+         */
+        verifyM2mToken(token) {
+            return request({ method: 'POST', path: '/v1/m2m_tokens/verify', body: { token } });
+        },
+    };
+}
+//# sourceMappingURL=machines.js.map

package/dist/client/machines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machines.js","sourceRoot":"","sources":["../../src/client/machines.ts"],"names":[],"mappings":";;AAwJA,4CA0EC;AAlOD,uCAAgD;AAwJhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,4DAA4D;QAC5D,IAAI,CAAC,QAA2B,EAAE;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,iEAAiE;QACjE,MAAM,CAAC,IAAuB,EAAE,cAAuB;YACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,mDAAmD;QACnD,MAAM,CAAC,EAAU,EAAE,IAAY;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,iEAAiE;QACjE,aAAa,CAAC,EAAU,EAAE,QAAyB;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,+CAA+C;QAC/C,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,yFAAyF;QACzF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,oFAAoF;QACpF,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,gFAAgF;QAChF,SAAS,CAAC,EAAU,EAAE,YAAoB;YACxC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBAC1C,IAAI,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aACvC,CAAC,CAAC;QACL,CAAC;QACD,wFAAwF;QACxF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,oDAAoD;QACpD,uBAAuB,CAAC,EAAU;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,yEAAyE;QACzE,oBAAoB,CAClB,OAAiC,EAAE,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,oBAAoB,CAClB,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QAED;;;WAGG;QACH,cAAc,CAAC,KAAa;YAC1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}