@atlasauth/backend 0.15.0 → 0.17.0

package/dist/oauth-resource.d.ts

@@ -16,6 +16,10 @@ import { type Jwks } from './jwks-cache';
  *    which is exactly what an MCP client needs to discover how to sign in;
  *  - builds the RFC 9728 protected-resource metadata document to serve at
  *    `/.well-known/oauth-protected-resource` on your API's host.
+ *  - accepts OPAQUE access tokens too (an API, client or instance set to the
+ *    `opaque` format): with `introspection` configured, a token that is not a
+ *    JWT is validated at Atlas's introspection endpoint (RFC 7662) with your
+ *    API's own client credentials, and the answer is cached briefly;
  * Framework-agnostic: hand it any request with `method`, `url` and `headers`.
  */
 /** Clock skew tolerated on `exp`/`nbf` and on DPoP proof `iat`. */
@@ -52,6 +56,37 @@ export interface DpopReplayStore {
     /** Record `jti` until `expiresAt` (ms); return false when it was already seen. */
     claim(jti: string, expiresAt: number): Promise<boolean> | boolean;
 }
+/**
+ * Server-provided DPoP nonces (RFC 9449 §8). `current()` is the nonce the API
+ * hands out in the `DPoP-Nonce` response header; `valid()` accepts the nonces
+ * still in force. A verifier given a source requires every DPoP proof to carry
+ * one, answering `use_dpop_nonce` (with a fresh nonce) otherwise.
+ */
+export interface DpopNonceSource {
+    current(): string | Promise<string>;
+    valid(nonce: string): boolean | Promise<boolean>;
+}
+/**
+ * An in-process nonce source: a random nonce per window; the current and the
+ * previous window's nonce are accepted. Use it when one process serves the API
+ * (or with sticky routing); behind several processes, use
+ * {@link hmacDpopNonceSource} with a shared secret.
+ */
+export declare function memoryDpopNonceSource(options?: {
+    windowSeconds?: number;
+    now?: () => number;
+}): DpopNonceSource;
+/**
+ * A stateless nonce source shared by every process holding the same secret (at
+ * least 32 bytes): the nonce for a window is base64url(HMAC-SHA256(secret,
+ * "atlas-dpop-nonce:" ‖ uint64-BE(window number))). A nonce is good in the window
+ * it was issued in and the next one. The derivation is the same in every Atlas
+ * server SDK, so services in different languages sharing the secret agree.
+ */
+export declare function hmacDpopNonceSource(secret: string | Uint8Array, options?: {
+    windowSeconds?: number;
+    now?: () => number;
+}): DpopNonceSource;
 export declare function memoryDpopReplayStore(max?: number): DpopReplayStore;
 export interface AccessTokenVerifierOptions {
     /** Your Atlas instance's issuer (frontend API origin), e.g. https://clerk.example.com. */
@@ -79,12 +114,53 @@ export interface AccessTokenVerifierOptions {
     /** The public origin of this API, for DPoP `htu` when `request.url` is a path. */
     publicOrigin?: string;
     dpopReplayStore?: DpopReplayStore;
+    /**
+     * Require a server-provided nonce in every DPoP proof (RFC 9449 §8). A proof
+     * without a valid one is refused with `use_dpop_nonce`; every result carries
+     * `dpopNonce`, to send as the `DPoP-Nonce` response header (the framework
+     * adapters do). See {@link memoryDpopNonceSource} / {@link hmacDpopNonceSource}.
+     */
+    dpopNonces?: DpopNonceSource;
     /** `WWW-Authenticate` realm. */
     realm?: string;
+    /**
+     * Validate opaque access tokens (and, with `introspectJwts`, JWTs too) at
+     * Atlas's introspection endpoint. The client must be a confidential client
+     * your API lists in its `introspection_client_ids` (or the client the tokens
+     * are issued to).
+     */
+    introspection?: IntrospectionOptions;
     fetchImpl?: typeof fetch;
     now?: () => number;
 }
-export type AccessTokenErrorCode = 'invalid_request' | 'invalid_token' | 'insufficient_scope' | 'invalid_dpop_proof';
+export interface IntrospectionOptions {
+    clientId: string;
+    clientSecret: string;
+    /** Default `${issuer}/oauth2/introspect`. */
+    endpoint?: string;
+    /** How long an active answer is reused, in seconds (default 60; never past the token's `exp`). */
+    cacheTtlSeconds?: number;
+    /** How long an inactive answer is reused, in seconds (default 10; 0 disables). */
+    negativeCacheTtlSeconds?: number;
+    /** Most answers kept (default 10 000). */
+    cacheMax?: number;
+    /**
+     * Also introspect JWT access tokens, so a revoked grant or a banned user is
+     * refused before the token expires (one cached call per token). Default false:
+     * JWTs are verified locally.
+     */
+    introspectJwts?: boolean;
+}
+/**
+ * RFC 7662 introspection with a small TTL cache keyed by the token's SHA-256
+ * (the token itself is never kept). Returns the claims of an active token, or
+ * null for an inactive one; throws when Atlas could not be reached.
+ */
+export declare function createIntrospector(issuer: string, options: IntrospectionOptions, deps?: {
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+}): (token: string) => Promise<AccessTokenClaims | null>;
+export type AccessTokenErrorCode = 'invalid_request' | 'invalid_token' | 'insufficient_scope' | 'invalid_dpop_proof' | 'use_dpop_nonce';
 export type AccessTokenResult = {
     ok: true;
     claims: AccessTokenClaims;
@@ -92,6 +168,8 @@ export type AccessTokenResult = {
     subject: string;
     clientId: string | null;
     dpopBound: boolean;
+    /** With `dpopNonces`: send as the `DPoP-Nonce` response header. */
+    dpopNonce?: string;
 } | {
     ok: false;
     status: 400 | 401 | 403;
@@ -99,6 +177,8 @@ export type AccessTokenResult = {
     description: string;
     /** Set this response header verbatim. */
     wwwAuthenticate: string;
+    /** With `dpopNonces`: send as the `DPoP-Nonce` response header (always, on `use_dpop_nonce`). */
+    dpopNonce?: string;
 };
 /**
  * Build an RFC 6750 / RFC 9449 / RFC 9728 `WWW-Authenticate` challenge.

package/dist/oauth-resource.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = void 0;
+exports.memoryDpopNonceSource = memoryDpopNonceSource;
+exports.hmacDpopNonceSource = hmacDpopNonceSource;
 exports.memoryDpopReplayStore = memoryDpopReplayStore;
+exports.createIntrospector = createIntrospector;
 exports.buildWwwAuthenticate = buildWwwAuthenticate;
 exports.createAccessTokenVerifier = createAccessTokenVerifier;
 exports.verifyAccessToken = verifyAccessToken;
@@ -27,6 +30,10 @@ const algs_1 = require("./algs");
  *    which is exactly what an MCP client needs to discover how to sign in;
  *  - builds the RFC 9728 protected-resource metadata document to serve at
  *    `/.well-known/oauth-protected-resource` on your API's host.
+ *  - accepts OPAQUE access tokens too (an API, client or instance set to the
+ *    `opaque` format): with `introspection` configured, a token that is not a
+ *    JWT is validated at Atlas's introspection endpoint (RFC 7662) with your
+ *    API's own client credentials, and the answer is cached briefly;
  * Framework-agnostic: hand it any request with `method`, `url` and `headers`.
  */
 /** Clock skew tolerated on `exp`/`nbf` and on DPoP proof `iat`. */
@@ -34,6 +41,86 @@ exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = 5;
 /** How old a DPoP proof may be. */
 exports.DPOP_PROOF_MAX_AGE_SECONDS = 300;
 const DPOP_ALGS = ['ES256', 'ES384', 'ES512', 'RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512', 'EdDSA'];
+const DEFAULT_NONCE_WINDOW_SECONDS = 300;
+/**
+ * An in-process nonce source: a random nonce per window; the current and the
+ * previous window's nonce are accepted. Use it when one process serves the API
+ * (or with sticky routing); behind several processes, use
+ * {@link hmacDpopNonceSource} with a shared secret.
+ */
+function memoryDpopNonceSource(options = {}) {
+    const window = (options.windowSeconds ?? DEFAULT_NONCE_WINDOW_SECONDS) * 1000;
+    const now = options.now ?? Date.now;
+    const issued = new Map();
+    const random = () => {
+        const bytes = crypto.getRandomValues(new Uint8Array(32));
+        let bin = '';
+        for (const b of bytes)
+            bin += String.fromCharCode(b);
+        return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    };
+    const at = (epoch) => {
+        let n = issued.get(epoch);
+        if (!n) {
+            n = random();
+            issued.set(epoch, n);
+            for (const e of issued.keys())
+                if (e < epoch - 1)
+                    issued.delete(e);
+        }
+        return n;
+    };
+    return {
+        current: () => at(Math.floor(now() / window)),
+        valid: (nonce) => {
+            const epoch = Math.floor(now() / window);
+            return nonce === at(epoch) || nonce === issued.get(epoch - 1);
+        },
+    };
+}
+/**
+ * A stateless nonce source shared by every process holding the same secret (at
+ * least 32 bytes): the nonce for a window is base64url(HMAC-SHA256(secret,
+ * "atlas-dpop-nonce:" ‖ uint64-BE(window number))). A nonce is good in the window
+ * it was issued in and the next one. The derivation is the same in every Atlas
+ * server SDK, so services in different languages sharing the secret agree.
+ */
+function hmacDpopNonceSource(secret, options = {}) {
+    const key = typeof secret === 'string' ? new TextEncoder().encode(secret) : secret;
+    if (key.length < 32)
+        throw new Error('The DPoP nonce secret must be at least 32 bytes.');
+    const window = (options.windowSeconds ?? DEFAULT_NONCE_WINDOW_SECONDS) * 1000;
+    const now = options.now ?? Date.now;
+    const imported = crypto.subtle.importKey('raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const at = async (epoch) => {
+        const prefix = new TextEncoder().encode('atlas-dpop-nonce:');
+        const msg = new Uint8Array(prefix.length + 8);
+        msg.set(prefix);
+        new DataView(msg.buffer).setBigUint64(prefix.length, BigInt(epoch));
+        const mac = new Uint8Array(await crypto.subtle.sign('HMAC', await imported, msg));
+        let bin = '';
+        for (const b of mac)
+            bin += String.fromCharCode(b);
+        return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    };
+    const epoch = () => Math.floor(now() / window);
+    return {
+        current: () => at(epoch()),
+        valid: async (nonce) => {
+            const e = epoch();
+            const [a, b] = await Promise.all([at(e), at(e - 1)]);
+            return constantTimeEqual(nonce, a) || constantTimeEqual(nonce, b);
+        },
+    };
+}
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
 function memoryDpopReplayStore(max = 10_000) {
     const seen = new Map();
     return {
@@ -53,6 +140,56 @@ function memoryDpopReplayStore(max = 10_000) {
         },
     };
 }
+/**
+ * RFC 7662 introspection with a small TTL cache keyed by the token's SHA-256
+ * (the token itself is never kept). Returns the claims of an active token, or
+ * null for an inactive one; throws when Atlas could not be reached.
+ */
+function createIntrospector(issuer, options, deps = {}) {
+    const endpoint = options.endpoint ?? `${issuer.replace(/\/+$/, '')}/oauth2/introspect`;
+    const now = deps.now ?? Date.now;
+    const doFetch = deps.fetchImpl ?? fetch;
+    const ttl = (options.cacheTtlSeconds ?? 60) * 1000;
+    const negativeTtl = (options.negativeCacheTtlSeconds ?? 10) * 1000;
+    const max = options.cacheMax ?? 10_000;
+    const cache = new Map();
+    const basic = `Basic ${btoa(`${encodeURIComponent(options.clientId)}:${encodeURIComponent(options.clientSecret)}`)}`;
+    return async (token) => {
+        const key = await sha256b64u(token);
+        const hit = cache.get(key);
+        if (hit && hit.until > now())
+            return hit.claims;
+        if (hit)
+            cache.delete(key);
+        const res = await doFetch(endpoint, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded',
+                accept: 'application/json',
+                authorization: basic,
+            },
+            body: new URLSearchParams({ token, token_type_hint: 'access_token' }).toString(),
+        });
+        if (!res.ok)
+            throw new Error(`Introspection failed with HTTP ${res.status}.`);
+        const body = (await res.json());
+        const claims = body.active === true && body.token_use !== 'refresh_token' ? body : null;
+        const until = claims
+            ? Math.min(now() + ttl, typeof claims.exp === 'number' ? claims.exp * 1000 : now() + ttl)
+            : now() + negativeTtl;
+        if (until > now()) {
+            cache.set(key, { claims, until });
+            if (cache.size > max) {
+                for (const [k, v] of cache)
+                    if (v.until <= now())
+                        cache.delete(k);
+                while (cache.size > max)
+                    cache.delete(cache.keys().next().value);
+            }
+        }
+        return claims;
+    };
+}
 function header(req, name) {
     const h = req.headers;
     if (typeof h.get === 'function')
@@ -118,9 +255,13 @@ function createAccessTokenVerifier(options) {
     });
     const audiences = options.audience === false ? null : typeof options.audience === 'string' ? [options.audience] : [...options.audience];
     const replay = options.dpopReplayStore ?? memoryDpopReplayStore();
+    const introspect = options.introspection
+        ? createIntrospector(issuer, options.introspection, { fetchImpl: options.fetchImpl, now: options.now })
+        : null;
     return async (request, extra) => {
         const required = [...(options.requiredScopes ?? []), ...(extra?.requiredScopes ?? [])];
         const scheme = options.requireDpop ? 'DPoP' : 'Bearer';
+        const nonce = options.dpopNonces ? await options.dpopNonces.current() : undefined;
         const fail = (status, error, description, challengeScheme = scheme) => ({
             ok: false,
             status,
@@ -135,6 +276,7 @@ function createAccessTokenVerifier(options) {
                 resourceMetadataUrl: options.resourceMetadataUrl,
                 dpopAlgs: DPOP_ALGS,
             }),
+            ...(nonce ? { dpopNonce: nonce } : {}),
         });
         const authz = header(request, 'authorization');
         if (!authz)
@@ -144,23 +286,47 @@ function createAccessTokenVerifier(options) {
             return fail(400, 'invalid_request', 'Malformed Authorization header.');
         const presentedScheme = m[1].toLowerCase() === 'dpop' ? 'DPoP' : 'Bearer';
         const token = m[2];
-        if (token.split('.').length !== 3)
-            return fail(401, 'invalid_token', 'The access token is malformed.');
-        const keys = await jwks.get((0, jwks_cache_1.readKid)(token));
-        if (!keys || keys.keys.length === 0)
-            return fail(401, 'invalid_token', 'No signing keys are available to verify the token.');
+        const isJwt = token.split('.').length === 3;
         let claims;
-        try {
-            const { payload } = await (0, jose_1.jwtVerify)(token, (0, jose_1.createLocalJWKSet)(keys), {
-                issuer,
-                algorithms: algs_1.ATLAS_SIGNING_ALGS,
-                clockTolerance: exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS,
-                currentDate: new Date(now()),
-            });
-            claims = payload;
+        if (!isJwt || (introspect && options.introspection?.introspectJwts)) {
+            // An opaque token (or a JWT the caller wants checked live) is validated by
+            // Atlas itself.
+            if (!introspect) {
+                return fail(401, 'invalid_token', 'The access token is not a JWT; configure `introspection` to accept opaque tokens.');
+            }
+            let active;
+            try {
+                active = await introspect(token);
+            }
+            catch {
+                return fail(401, 'invalid_token', 'The access token could not be validated right now.');
+            }
+            if (!active)
+                return fail(401, 'invalid_token', 'The access token is invalid or expired.');
+            if (active.iss !== undefined && String(active.iss).replace(/\/+$/, '') !== issuer) {
+                return fail(401, 'invalid_token', 'The access token was issued by another authorization server.');
+            }
+            if (typeof active.exp === 'number' && active.exp * 1000 + exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS * 1000 <= now()) {
+                return fail(401, 'invalid_token', 'The access token is invalid or expired.');
+            }
+            claims = active;
         }
-        catch {
-            return fail(401, 'invalid_token', 'The access token is invalid or expired.');
+        else {
+            const keys = await jwks.get((0, jwks_cache_1.readKid)(token));
+            if (!keys || keys.keys.length === 0)
+                return fail(401, 'invalid_token', 'No signing keys are available to verify the token.');
+            try {
+                const { payload } = await (0, jose_1.jwtVerify)(token, (0, jose_1.createLocalJWKSet)(keys), {
+                    issuer,
+                    algorithms: algs_1.ATLAS_SIGNING_ALGS,
+                    clockTolerance: exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS,
+                    currentDate: new Date(now()),
+                });
+                claims = payload;
+            }
+            catch {
+                return fail(401, 'invalid_token', 'The access token is invalid or expired.');
+            }
         }
         if (claims.token_use !== undefined && claims.token_use !== 'access_token') {
             return fail(401, 'invalid_token', 'The token is not an access token.');
@@ -190,9 +356,10 @@ function createAccessTokenVerifier(options) {
                 publicOrigin: options.publicOrigin,
                 now: now(),
                 replay,
+                nonces: options.dpopNonces,
             });
             if (proofError)
-                return fail(401, 'invalid_dpop_proof', proofError, 'DPoP');
+                return fail(401, proofError.code, proofError.message, 'DPoP');
         }
         const scopes = (claims.scope ?? '').split(' ').filter(Boolean);
         const granted = new Set([...scopes, ...(claims.permissions ?? [])]);
@@ -207,27 +374,29 @@ function createAccessTokenVerifier(options) {
             subject: claims.sub,
             clientId: (claims.client_id ?? claims.azp ?? null),
             dpopBound: !!jkt,
+            ...(nonce ? { dpopNonce: nonce } : {}),
         };
     };
 }
 async function checkDpopProof(proof, ctx) {
+    const refuse = (message) => ({ code: 'invalid_dpop_proof', message });
     let jwk;
     let alg;
     try {
         const h = (0, jose_1.decodeProtectedHeader)(proof);
         if (h.typ !== 'dpop+jwt')
-            return 'The DPoP proof must have typ dpop+jwt.';
+            return refuse('The DPoP proof must have typ dpop+jwt.');
         if (!h.alg || !DPOP_ALGS.includes(h.alg))
-            return 'The DPoP proof uses an unsupported algorithm.';
+            return refuse('The DPoP proof uses an unsupported algorithm.');
         if (!h.jwk || typeof h.jwk !== 'object')
-            return 'The DPoP proof must carry its public key.';
+            return refuse('The DPoP proof must carry its public key.');
         jwk = h.jwk;
         if ('d' in jwk || 'k' in jwk)
-            return 'The DPoP proof key must be a public key.';
+            return refuse('The DPoP proof key must be a public key.');
         alg = h.alg;
     }
     catch {
-        return 'The DPoP proof is malformed.';
+        return refuse('The DPoP proof is malformed.');
     }
     let payload;
     try {
@@ -235,30 +404,36 @@ async function checkDpopProof(proof, ctx) {
         ({ payload } = await (0, jose_1.jwtVerify)(proof, key, { algorithms: [alg], typ: 'dpop+jwt', currentDate: new Date(ctx.now) }));
     }
     catch {
-        return 'The DPoP proof signature is invalid.';
+        return refuse('The DPoP proof signature is invalid.');
     }
     if ((await (0, jose_1.calculateJwkThumbprint)(jwk, 'sha256')) !== ctx.jkt) {
-        return 'The DPoP proof key does not match the token binding.';
+        return refuse('The DPoP proof key does not match the token binding.');
     }
     if (payload.htm !== ctx.method)
-        return 'The DPoP proof htm does not match the request method.';
+        return refuse('The DPoP proof htm does not match the request method.');
     const absolute = /^https?:\/\//i.test(ctx.url) ? ctx.url : ctx.publicOrigin ? new URL(ctx.url, ctx.publicOrigin).toString() : null;
     const expected = absolute ? htuOf(absolute) : null;
     if (!expected || typeof payload.htu !== 'string' || htuOf(payload.htu) !== expected) {
-        return 'The DPoP proof htu does not match the request URL.';
+        return refuse('The DPoP proof htu does not match the request URL.');
     }
     const iat = typeof payload.iat === 'number' ? payload.iat * 1000 : NaN;
     if (!Number.isFinite(iat) ||
         iat > ctx.now + exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS * 1000 ||
         ctx.now - iat > exports.DPOP_PROOF_MAX_AGE_SECONDS * 1000) {
-        return 'The DPoP proof is too old or from the future.';
+        return refuse('The DPoP proof is too old or from the future.');
     }
     if (payload.ath !== (await sha256b64u(ctx.token)))
-        return 'The DPoP proof ath does not match the access token.';
+        return refuse('The DPoP proof ath does not match the access token.');
     if (typeof payload.jti !== 'string' || !payload.jti)
-        return 'The DPoP proof needs a jti.';
+        return refuse('The DPoP proof needs a jti.');
+    if (ctx.nonces) {
+        const nonce = typeof payload.nonce === 'string' ? payload.nonce : '';
+        if (!nonce || !(await ctx.nonces.valid(nonce))) {
+            return { code: 'use_dpop_nonce', message: 'The DPoP proof must carry the nonce from the DPoP-Nonce header.' };
+        }
+    }
     if (!(await ctx.replay.claim(`${ctx.jkt}:${payload.jti}`, iat + exports.DPOP_PROOF_MAX_AGE_SECONDS * 1000))) {
-        return 'The DPoP proof has already been used.';
+        return refuse('The DPoP proof has already been used.');
     }
     return null;
 }

package/dist/oauth-resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-resource.js","sourceRoot":"","sources":["../src/oauth-resource.ts"],"names":[],"mappings":";;;AAiEA,sDAcC;AA6DD,oDAiBC;AAuBD,8DA6GC;AA4DD,8CAKC;AASD,8DAqBC;AAGD,sEAIC;AAvYD,+BAOc;AACd,6CAA6D;AAC7D,iCAA4C;AAE5C;;;;;;;;;;;;;;;;;;GAkBG;AAEH,mEAAmE;AACtD,QAAA,+BAA+B,GAAG,CAAC,CAAC;AACjD,mCAAmC;AACtB,QAAA,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AA8B7G,SAAgB,qBAAqB,CAAC,GAAG,GAAG,MAAM;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,KAAK,CAAC,GAAG,EAAE,SAAS;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;gBACpB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG;wBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACxD,OAAO,IAAI,CAAC,IAAI,GAAG,GAAG;oBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AA+CD,SAAS,MAAM,CAAC,GAAwB,EAAE,IAAY;IACpD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAiG,CAAC;IAChH,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACjE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;AAEhE;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,IAQpC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,IAAI,IAAI,CAAC,mBAAmB;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACjG,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAa;IACrC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtG,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+DAA+D;AAC/D,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,OAAmC;IAEnC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,sBAAS,CAAC;QACzB,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,MAAM,wBAAwB,CAAC;QACtF,UAAU,EAAE,OAAO,CAAC,IAAI;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,SAAS,GACb,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxH,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,IAAI,qBAAqB,EAAE,CAAC;IAElE,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACvF,MAAM,MAAM,GAAsB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1E,MAAM,IAAI,GAAG,CACX,MAAuB,EACvB,KAAkC,EAClC,WAAmB,EACnB,kBAAqC,MAAM,EACxB,EAAE,CAAC,CAAC;YACvB,EAAE,EAAE,KAAK;YACT,MAAM;YACN,KAAK;YACL,WAAW;YACX,eAAe,EAAE,oBAAoB,CAAC;gBACpC,MAAM,EAAE,eAAe;gBACvB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK;gBACL,WAAW;gBACX,KAAK,EAAE,KAAK,KAAK,oBAAoB,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC9E,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,QAAQ,EAAE,SAAS;aACpB,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,0BAA0B,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,gCAAgC,CAAC,CAAC;QAEvG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,oDAAoD,CAAC,CAAC;QAC7H,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;gBAC3E,MAAM;gBACN,UAAU,EAAE,yBAAkB;gBAC9B,cAAc,EAAE,uCAA+B;gBAC/C,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;aAC7B,CAAC,CAAC;YACH,MAAM,GAAG,OAA4B,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,yCAAyC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,mCAAmC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,oDAAoD,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;QAC5B,IAAI,GAAG,IAAI,OAAO,CAAC,WAAW,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;YAC7D,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,mDAAmD,EAAE,MAAM,CAAC,CAAC;YACzG,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,8DAA8D,EAAE,MAAM,CAAC,CAAC;YAC5G,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,CAAC,CAAC;YACxF,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE;gBAC7C,KAAK;gBACL,GAAG;gBACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE;gBAC/C,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;gBACtB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,GAAG,EAAE,GAAG,EAAE;gBACV,MAAM;aACP,CAAC,CAAC;YACH,IAAI,UAAU;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,sDAAsD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM;YACN,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,QAAQ,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI,CAAkB;YACnE,SAAS,EAAE,CAAC,CAAC,GAAG;SACjB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAa,EACb,GAQC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAA,4BAAqB,EAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,GAAG,KAAK,UAAU;YAAE,OAAO,wCAAwC,CAAC;QAC1E,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,+CAA+C,CAAC;QACjG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,2CAA2C,CAAC;QAC5F,GAAG,GAAG,CAAC,CAAC,GAAU,CAAC;QACnB,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG;YAAE,OAAO,0CAA0C,CAAC;QAChF,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,sCAAsC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,MAAM,IAAA,6BAAsB,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;QAC9D,OAAO,sDAAsD,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,uDAAuD,CAAC;IAC/F,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnI,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpF,OAAO,oDAAoD,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IACvE,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,uCAA+B,GAAG,IAAI;QACtD,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,kCAA0B,GAAG,IAAI,EACjD,CAAC;QACD,OAAO,+CAA+C,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,qDAAqD,CAAC;IAChH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,6BAA6B,CAAC;IAC1F,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,kCAA0B,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACpG,OAAO,uCAAuC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qHAAqH;AACrH,SAAgB,iBAAiB,CAC/B,OAA4B,EAC5B,OAAmC;IAEnC,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,IAUzC;IACC,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,qBAAqB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,iCAAiC,EAAE,SAAS;QAC5C,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAgB,6BAA6B,CAAC,QAAgB;IAC5D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,wCAAwC,IAAI,EAAE,CAAC;AACxD,CAAC"}
+{"version":3,"file":"oauth-resource.js","sourceRoot":"","sources":["../src/oauth-resource.ts"],"names":[],"mappings":";;;AAwFA,sDA4BC;AASD,kDA4BC;AASD,sDAcC;AAwED,gDA4CC;AA6CD,oDAiBC;AAuBD,8DA0IC;AAoED,8CAKC;AASD,8DAqBC;AAGD,sEAIC;AAjnBD,+BAOc;AACd,6CAA6D;AAC7D,iCAA4C;AAE5C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,mEAAmE;AACtD,QAAA,+BAA+B,GAAG,CAAC,CAAC;AACjD,mCAAmC;AACtB,QAAA,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAyC7G,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEzC;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,UAA0D,EAAE;IAE5D,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC,GAAG,IAAI,CAAC;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,EAAE,GAAG,CAAC,KAAa,EAAE,EAAE;QAC3B,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,MAAM,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE;gBAAE,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAC7C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;YACzC,OAAO,KAAK,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CACjC,MAA2B,EAC3B,UAA0D,EAAE;IAE5D,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnF,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC,GAAG,IAAI,CAAC;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACzG,MAAM,EAAE,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChB,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAClF,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;IAC/C,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC1B,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACrB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAgB,qBAAqB,CAAC,GAAG,GAAG,MAAM;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,KAAK,CAAC,GAAG,EAAE,SAAS;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;gBACpB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG;wBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACxD,OAAO,IAAI,CAAC,IAAI,GAAG,GAAG;oBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAmED;;;;GAIG;AACH,SAAgB,kBAAkB,CAChC,MAAc,EACd,OAA6B,EAC7B,OAAyD,EAAE;IAE3D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACnD,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,uBAAuB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+D,CAAC;IACrF,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;IAErH,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC;QAChD,IAAI,GAAG;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE3B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,KAAK;aACrB;YACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,QAAQ,EAAE;SACjF,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC,CAAE,IAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/G,MAAM,KAAK,GAAG,MAAM;YAClB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC;YACzF,CAAC,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QACxB,IAAI,KAAK,GAAG,GAAG,EAAE,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;gBACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK;oBAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,EAAE;wBAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAClE,OAAO,KAAK,CAAC,IAAI,GAAG,GAAG;oBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AA+BD,SAAS,MAAM,CAAC,GAAwB,EAAE,IAAY;IACpD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAiG,CAAC;IAChH,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACjE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;AAEhE;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,IAQpC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,IAAI,IAAI,CAAC,mBAAmB;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACjG,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAa;IACrC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtG,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+DAA+D;AAC/D,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,OAAmC;IAEnC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,sBAAS,CAAC;QACzB,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,MAAM,wBAAwB,CAAC;QACtF,UAAU,EAAE,OAAO,CAAC,IAAI;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,SAAS,GACb,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxH,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,IAAI,qBAAqB,EAAE,CAAC;IAClE,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa;QACtC,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACvG,CAAC,CAAC,IAAI,CAAC;IAET,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACvF,MAAM,MAAM,GAAsB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,MAAM,IAAI,GAAG,CACX,MAAuB,EACvB,KAAkC,EAClC,WAAmB,EACnB,kBAAqC,MAAM,EACxB,EAAE,CAAC,CAAC;YACvB,EAAE,EAAE,KAAK;YACT,MAAM;YACN,KAAK;YACL,WAAW;YACX,eAAe,EAAE,oBAAoB,CAAC;gBACpC,MAAM,EAAE,eAAe;gBACvB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK;gBACL,WAAW;gBACX,KAAK,EAAE,KAAK,KAAK,oBAAoB,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC9E,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,QAAQ,EAAE,SAAS;aACpB,CAAC;YACF,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,0BAA0B,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAE5C,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;YACpE,2EAA2E;YAC3E,gBAAgB;YAChB,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,mFAAmF,CAAC,CAAC;YACzH,CAAC;YACD,IAAI,MAAgC,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,oDAAoD,CAAC,CAAC;YAC1F,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,yCAAyC,CAAC,CAAC;YAC1F,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;gBAClF,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,8DAA8D,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,uCAA+B,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;gBAC1G,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,yCAAyC,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,oDAAoD,CAAC,CAAC;YAC7H,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;oBAC3E,MAAM;oBACN,UAAU,EAAE,yBAAkB;oBAC9B,cAAc,EAAE,uCAA+B;oBAC/C,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;iBAC7B,CAAC,CAAC;gBACH,MAAM,GAAG,OAA4B,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,yCAAyC,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,mCAAmC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,oDAAoD,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;QAC5B,IAAI,GAAG,IAAI,OAAO,CAAC,WAAW,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;YAC7D,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,mDAAmD,EAAE,MAAM,CAAC,CAAC;YACzG,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,8DAA8D,EAAE,MAAM,CAAC,CAAC;YAC5G,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,CAAC,CAAC;YACxF,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE;gBAC7C,KAAK;gBACL,GAAG;gBACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE;gBAC/C,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;gBACtB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,GAAG,EAAE,GAAG,EAAE;gBACV,MAAM;gBACN,MAAM,EAAE,OAAO,CAAC,UAAU;aAC3B,CAAC,CAAC;YACH,IAAI,UAAU;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,sDAAsD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM;YACN,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,QAAQ,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI,CAAkB;YACnE,SAAS,EAAE,CAAC,CAAC,GAAG;YAChB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAa,EACb,GASC;IAED,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,oBAA6B,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,IAAI,GAAQ,CAAC;IACb,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAA,4BAAqB,EAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,GAAG,KAAK,UAAU;YAAE,OAAO,MAAM,CAAC,wCAAwC,CAAC,CAAC;QAClF,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,+CAA+C,CAAC,CAAC;QACzG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACpG,GAAG,GAAG,CAAC,CAAC,GAAU,CAAC;QACnB,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC,0CAA0C,CAAC,CAAC;QACxF,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,sCAAsC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,MAAM,IAAA,6BAAsB,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,sDAAsD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,uDAAuD,CAAC,CAAC;IACvG,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnI,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpF,OAAO,MAAM,CAAC,oDAAoD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IACvE,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,uCAA+B,GAAG,IAAI;QACtD,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,kCAA0B,GAAG,IAAI,EACjD,CAAC;QACD,OAAO,MAAM,CAAC,+CAA+C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,qDAAqD,CAAC,CAAC;IACxH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAClG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAAC;QAChH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,kCAA0B,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACpG,OAAO,MAAM,CAAC,uCAAuC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qHAAqH;AACrH,SAAgB,iBAAiB,CAC/B,OAA4B,EAC5B,OAAmC;IAEnC,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,IAUzC;IACC,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,qBAAqB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,iCAAiC,EAAE,SAAS;QAC5C,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAgB,6BAA6B,CAAC,QAAgB;IAC5D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,wCAAwC,IAAI,EAAE,CAAC;AACxD,CAAC"}

package/dist/verify.d.ts

@@ -17,6 +17,7 @@ export interface AtlasBackendOidc {
     clearCookie: typeof oidcClearCookie;
 }
 export { type AuthzClaims, type ProtectCondition, type ProtectOutcome, type ProtectReason, evaluate, hasFromClaims, protectFromClaims, ForbiddenError, isRoleKey, isPermissionKey, } from '@atlasauth/authz';
+import { type LegacyIssuer } from './legacy-issuers';
 /**
  * §7.3 verification by customer backends.
  *
@@ -89,6 +90,16 @@ export interface SessionClaims {
      * `email` under the same opt-in, and only when the user carries one.
      */
     external_id?: string;
+    /**
+     * Present ONLY on a token accepted through `legacyIssuers` (a cutover from
+     * another provider): which issuer minted it and the subject it carried there.
+     * `sub` is already the Atlas user id.
+     */
+    legacy?: {
+        kind: string;
+        issuer: string;
+        sub: string;
+    };
     [claim: string]: unknown;
 }
 /**
@@ -175,10 +186,21 @@ export interface AtlasBackendOptions {
     bapiBaseUrl?: string;
     fetchImpl?: typeof fetch;
     now?: () => number;
+    /**
+     * Cutover from another auth provider (Better Auth): ALSO accept JWTs from
+     * these issuers until each one's `until`, verified against that issuer's own
+     * key set, with `sub` mapped to the Atlas user id (the old id is the user's
+     * `external_id`; mapped through the Backend API unless the issuer has a
+     * `resolveSubject`). The verified claims carry `sub` = the Atlas user id,
+     * `external_id` = the old id and `legacy` = `{ kind, issuer, sub }`, so code
+     * that needs to tell the two apart can. Atlas tokens are unaffected.
+     */
+    legacyIssuers?: readonly LegacyIssuer[];
 }
 export declare class AtlasBackend {
     private readonly options;
     private readonly jwks;
+    private readonly legacy?;
     /**
      * The server-side OIDC relying party (hosted-redirect sign-in) for this
      * instance: `start`, `callback`, `logoutUrl`, `verifyIdToken`. `issuer`,

package/dist/verify.js

@@ -24,6 +24,7 @@ Object.defineProperty(exports, "ForbiddenError", { enumerable: true, get: functi
 Object.defineProperty(exports, "isRoleKey", { enumerable: true, get: function () { return authz_2.isRoleKey; } });
 Object.defineProperty(exports, "isPermissionKey", { enumerable: true, get: function () { return authz_2.isPermissionKey; } });
 const algs_1 = require("./algs");
+const legacy_issuers_1 = require("./legacy-issuers");
 /**
  * §7.3 verification by customer backends.
  *
@@ -64,6 +65,7 @@ function authorized(claims) {
 class AtlasBackend {
     options;
     jwks;
+    legacy;
     /**
      * The server-side OIDC relying party (hosted-redirect sign-in) for this
      * instance: `start`, `callback`, `logoutUrl`, `verifyIdToken`. `issuer`,
@@ -110,6 +112,19 @@ class AtlasBackend {
             verifyIdToken: (token, o) => (0, oidc_1.oidcVerifyIdToken)(token, bind(o)),
             clearCookie: oidc_1.oidcClearCookie,
         };
+        if (options.legacyIssuers && options.legacyIssuers.length > 0) {
+            if (options.legacyIssuers.some((l) => l.issuer === options.issuer)) {
+                throw new Error('AtlasBackend: a legacy issuer cannot be the Atlas `issuer` itself.');
+            }
+            this.legacy = new legacy_issuers_1.LegacyIssuerVerifier({
+                issuers: options.legacyIssuers,
+                secretKey: options.secretKey,
+                bapiBaseUrl: options.bapiBaseUrl,
+                fetchImpl: options.fetchImpl,
+                now: options.now,
+                clockToleranceSeconds: exports.CLOCK_SKEW_SECONDS,
+            });
+        }
         this.jwks = new jwks_cache_1.JwksCache({
             url: hasUrl ? options.jwksUrl : undefined,
             staticJwks: options.jwks,
@@ -137,6 +152,23 @@ class AtlasBackend {
     async verify(token) {
         if (!token || token.split('.').length !== 3)
             return { ok: false, reason: 'malformed' };
+        // A token from a configured legacy issuer (within its window) is verified
+        // against THAT issuer's keys only — never the Atlas keys, and an Atlas
+        // token never reaches the legacy path (the `iss` routes, the signature decides).
+        if (this.legacy) {
+            const entry = this.legacy.match((0, legacy_issuers_1.peekIssuer)(token));
+            if (entry) {
+                const outcome = await this.legacy.verify(token, entry);
+                if (!outcome.ok)
+                    return { ok: false, reason: outcome.reason };
+                const claims = outcome.claims;
+                if (this.options.authorizedParties?.length && claims.azp !== undefined) {
+                    if (!this.options.authorizedParties.includes(claims.azp))
+                        return { ok: false, reason: 'unauthorized_party' };
+                }
+                return authorized(claims);
+            }
+        }
         const keys = await this.jwks.get((0, jwks_cache_1.readKid)(token));
         if (!keys || keys.keys.length === 0) {
             return this.jwks.lastError