@atlasauth/backend 0.17.0 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # @atlasauth/backend changelog
 
+## 0.19.0 — 2026-10-24
+
+### Added
+
+- `createAtlasClientFromEnv()`, `atlasConfigFromEnv()` and `apiBaseFromEnv()`: configure from `ATLAS_SECRET_KEY` and `ATLAS_API_BASE` or `ATLAS_API_URL`.
+- `fx.referalliCall` signs v1 and v2 and sends both header spellings; `requestId` option; `referalliSignatureV2`. `fx.referallyCall` stays as a deprecated alias.
+- Referral settings: `context_cookie` accepts a name or a list, `context_cookies`, `provider_aliases`, `capabilities`, `one_click` / `one_click_presets`, `providers[].aliases`.
+- `client.referrals` can start a one-click install: `POST /v1/instance/referrals/{preset}/install`.
+- `GET /v1/entitlements` (the standard entitlements shape) and `internal` on entitlement overrides.
+
+- Data rights: `privacy` — the data-rights executor protocol any DSAR orchestrator calls (`discover`, `preset`, `lookup`, `createRequest`, `getRequest`, `cancelRequest`) and the instance's orchestrator settings (`orchestrator.get/set/delete`).
+- `dataSubjectRequests.create` accepts the canonical data-rights types (`access`, `deletion`, `closure`, `restriction`, `rectification`, and the alias `erase`); `DataSubjectRequest` carries `canonical_type`, `source`, `case_id`, `external_case`, `trace_id`, `steps`, `retention` and `deletion_effective_at`.
+- `withOptions({ dryRun: true })`: every write is sent with `?dry_run=true` and resolves to a `DryRunResult` (`changes[{ section, before, after }]`) without changing anything.
+- Provisioning fields: `external_ref` and `metadata` on app, instance, secret key, OAuth client, webhook endpoint and Sign in with Atlas app creates (a repeat with the same ref returns the existing object, `idempotent_replay: true`); `metadata` filters on `oauthClients.list`, `webhooks.endpoints.list`, platform `apps.list`, `apps.secretKeys`, `atlasIdApps.list`; `metadataQuery()`.
+- Platform: `apps.sandboxTeardown()` (hard delete of sandbox-tagged resources, with a dry run), `apps.bulkDelete({ metadata, dry_run })`, `apps.cloneConfig()`, `apps.createSecretKey()`.
+- `notices` (`list`, `acknowledge`), `securityAdvisories` (`list`, `acknowledge`, `catalog`), `subProcessors.get()`, and `auditExports` (`list`, `get`, `create`, `update`, `delete`, `test`, `rotateSecret`) with the `AuditCloudEvent` type.
+- `AuditLog.actor` (`type`, `id`, `key_name`, `key_prefix`).
+- Atlas service status: `status` (`service` for the public `GET /v1/status` with component groups, regions and open incidents; `getSubscription`, `updateSubscription`, `disableSubscription`, `rotateFeed` for the incident subscription; `listIncidents`; `listDependencies`, `createDependency`, `getDependency`, `updateDependency`, `deleteDependency`, `refreshDependency` for upstream status pages), with the `StatusSubscription`, `StatusIncident`, `StatusIncidentEventData` and `StatusDependency` types.
+- Webhook events `status_incident.created`, `status_incident.updated` and `status_incident.resolved`.
+- `instance.integrationHealth({ only?, probe? })`, `instance.integrationHealthProviders()`, `instance.embed({ instance, origin?, shape? })`, `design.importBrand({ brandUrl } | { brand })`. `DesignSettings` gains `brand`, `precedence`, `sources`, `ignored`; `AtlasIdAppPreflight` gains `button_rendered_origins`, `authorize_requests_7d`, `fallback_origins`, `homepage_includes_script`.
+- Back-channel logout receivers: `handleBackchannelLogout()` (framework-agnostic), `expressBackchannelLogout()`, `fastifyBackchannelLogout()` / `fastifyBackchannelLogoutPlugin`, and `nextBackchannelLogout()` (also `fetchBackchannelLogout()` for any Fetch-API runtime). They verify the `logout_token`, call your `onLogout({ sub, sid })`, and answer 200, 400 (bad token, not retried) or 503 with `Retry-After` (retried).
+- `instance.preflight({ min_severity, include_suppressed })`, with the `suppressed` and `integrations` fields and the `security_posture` finding group.
+- `instance.unknownFieldsReport({ days })`: the unknown body fields your writes sent, per route, field and key.
+- `instance.openapiDiff({ since })`: operations added, deprecated and removed since a date.
+- `messaging.channel('email' | 'sms')`, and `NotConfigured`: unconfigured singletons now read as `{ configured: false }` instead of a 404 (`messaging.managedEmail.get()`, `messaging.developmentEmail.get()`).
+- `require_pkce` on `oauthClients.create` (new clients default to true).
+- `AtlasErrorCodes.ROUTE_NOT_FOUND`, and `docs_url`, `did_you_mean`, `allowed_methods` on `AtlasErrorItem`.
+
+### Changed
+
+- `ConfigChangelogEntry.changes` is always present (with `values_recorded`), plus `no_op` and `recorded`; `fields` is deprecated. `include_no_op` on `configChangelog.list`.
+
+## 0.18.0 — 2026-10-24
+
+### Added
+
+- Policy acceptance: `policies` (`list`, `create`, `get`, `update`, `delete`, `versions.list/create/get/update/delete/publish/retire`, `listAcceptances`, `exportAcceptancesCsv`, `forUser`, `settings.get/update` for the `pol` session claim) and `policySource` (`get`, `update`, `delete`, `test`, `sync`, `listDeliveries`) for the external policy source.
+- Policy source protocol v1 helpers for the system that serves policies: `verifyPolicyFeedRequest()` (Atlas's signed `GET {endpoint}/policies`) and `signPolicySourceEvent()` (`policy.published` / `policy.retired`), with the `PolicyFeed` types.
+- `RecordUserConsentBody` / `UserConsent`: `policy_version_id`, `content_sha256`, `display`, `scrolled_to_end`, `view_ms`, `locale`.
+
 ## 0.17.0 — 2026-10-24
 
 ### Added

package/dist/backchannel-handlers.d.ts

@@ -0,0 +1,87 @@
+import { LogoutTokenVerifier, type LogoutTokenClaims, type LogoutTokenVerifierOptions } from './logout-token';
+/**
+ * Ready-made receivers for OIDC Back-Channel Logout: Atlas POSTs a signed
+ * `logout_token` (form-encoded) to your client's `backchannel_logout_uri` when
+ * a session ends (signed out elsewhere, revoked, the user banned or deleted).
+ * Each handler verifies the token, calls your `onLogout` with whose session to
+ * end, and answers the way the spec and Atlas's retries expect:
+ *
+ *   200  verified and handled (also for a replayed token you already handled)
+ *   400  the token is bad: Atlas does not retry
+ *   503  your side could not check it right now (keys unreachable, or
+ *        `onLogout` threw): `Retry-After` is set and Atlas retries
+ *
+ * Every response carries `Cache-Control: no-store`. Framework-agnostic core:
+ * {@link handleBackchannelLogout}; adapters for Express, Fastify and Next.js
+ * (App Router route handlers, or any Fetch-API runtime) below.
+ */
+export interface BackchannelLogoutOptions extends LogoutTokenVerifierOptions {
+    /**
+     * End the matching session(s) in your app. `sid` names one session (the
+     * `sid` of the id_token you got at sign-in), `sub` the user (end all of
+     * them when there is no `sid`). Throwing answers 503, so Atlas retries.
+     */
+    onLogout(claims: LogoutTokenClaims): void | Promise<void>;
+    /** Reuse a verifier you already have (keeps its key cache). Built from the options otherwise. */
+    verifier?: LogoutTokenVerifier;
+    /** Seconds in Retry-After on a 503. Default 30. */
+    retryAfterSeconds?: number;
+}
+export interface BackchannelLogoutResponse {
+    status: 200 | 400 | 503;
+    headers: Record<string, string>;
+    body: string;
+}
+/** Pull `logout_token` out of whatever body the framework handed over. */
+export declare function readLogoutToken(body: unknown): string | undefined;
+/** Verify one back-channel logout request body and run `onLogout`. Never throws. */
+export declare function handleBackchannelLogout(body: unknown, options: BackchannelLogoutOptions): Promise<BackchannelLogoutResponse>;
+interface ExpressLikeRequest {
+    body?: unknown;
+    on?(event: string, cb: (chunk?: unknown) => void): unknown;
+}
+interface ExpressLikeResponse {
+    status(code: number): ExpressLikeResponse;
+    set?(headers: Record<string, string>): unknown;
+    setHeader?(name: string, value: string): unknown;
+    send(body: string): unknown;
+}
+/**
+ * Express route handler: `app.post('/auth/backchannel-logout', expressBackchannelLogout({...}))`.
+ * Works with or without `express.urlencoded()` in front of it.
+ */
+export declare function expressBackchannelLogout(options: BackchannelLogoutOptions): (req: ExpressLikeRequest, res: ExpressLikeResponse) => Promise<void>;
+interface FastifyLikeReply {
+    code(status: number): FastifyLikeReply;
+    headers(values: Record<string, string>): FastifyLikeReply;
+    send(body: string): unknown;
+}
+interface FastifyLikeInstance {
+    addContentTypeParser(type: string, opts: {
+        parseAs: 'string';
+    }, parser: (req: unknown, body: string, done: (err: Error | null, body?: unknown) => void) => void): void;
+    hasContentTypeParser?(type: string): boolean;
+    post(path: string, handler: (request: {
+        body?: unknown;
+    }, reply: FastifyLikeReply) => unknown): unknown;
+}
+/** Fastify route handler, for a route whose body is already parsed (or a raw string). */
+export declare function fastifyBackchannelLogout(options: BackchannelLogoutOptions): (request: {
+    body?: unknown;
+}, reply: FastifyLikeReply) => Promise<unknown>;
+/**
+ * Fastify plugin: registers `POST <path>` (default `/auth/backchannel-logout`)
+ * with a form-body parser in its own scope, so nothing else in your app changes:
+ * `app.register(fastifyBackchannelLogoutPlugin, { issuer, clientId, onLogout })`.
+ */
+export declare function fastifyBackchannelLogoutPlugin(app: FastifyLikeInstance, options: BackchannelLogoutOptions & {
+    path?: string;
+}, done?: (err?: Error) => void): void;
+/**
+ * A Fetch-API handler: in `app/api/auth/backchannel-logout/route.ts`,
+ * `export const POST = nextBackchannelLogout({ issuer, clientId, onLogout })`.
+ */
+export declare function nextBackchannelLogout(options: BackchannelLogoutOptions): (request: Request) => Promise<Response>;
+/** Alias of {@link nextBackchannelLogout} for other Fetch-API frameworks. */
+export declare const fetchBackchannelLogout: typeof nextBackchannelLogout;
+export {};

package/dist/backchannel-handlers.js

@@ -0,0 +1,137 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchBackchannelLogout = void 0;
+exports.readLogoutToken = readLogoutToken;
+exports.handleBackchannelLogout = handleBackchannelLogout;
+exports.expressBackchannelLogout = expressBackchannelLogout;
+exports.fastifyBackchannelLogout = fastifyBackchannelLogout;
+exports.fastifyBackchannelLogoutPlugin = fastifyBackchannelLogoutPlugin;
+exports.nextBackchannelLogout = nextBackchannelLogout;
+const logout_token_1 = require("./logout-token");
+/** Pull `logout_token` out of whatever body the framework handed over. */
+function readLogoutToken(body) {
+    if (typeof body === 'string')
+        return new URLSearchParams(body).get('logout_token') ?? undefined;
+    if (body instanceof URLSearchParams)
+        return body.get('logout_token') ?? undefined;
+    if (typeof Buffer !== 'undefined' && Buffer.isBuffer(body))
+        return readLogoutToken(body.toString('utf8'));
+    if (body && typeof body === 'object') {
+        const v = body.logout_token;
+        if (typeof v === 'string')
+            return v;
+        if (Array.isArray(v) && typeof v[0] === 'string')
+            return v[0];
+    }
+    return undefined;
+}
+const verifiers = new WeakMap();
+function verifierFor(options) {
+    if (options.verifier)
+        return options.verifier;
+    let v = verifiers.get(options);
+    if (!v) {
+        v = new logout_token_1.LogoutTokenVerifier(options);
+        verifiers.set(options, v);
+    }
+    return v;
+}
+const json = (status, payload, extra = {}) => ({
+    status,
+    headers: { 'content-type': 'application/json', 'cache-control': 'no-store', ...extra },
+    body: JSON.stringify(payload),
+});
+/** Verify one back-channel logout request body and run `onLogout`. Never throws. */
+async function handleBackchannelLogout(body, options) {
+    const token = readLogoutToken(body);
+    if (!token)
+        return json(400, { error: 'invalid_request', error_description: 'logout_token is missing.' });
+    const result = await verifierFor(options).verify(token);
+    const retryAfter = String(options.retryAfterSeconds ?? 30);
+    if (!result.ok) {
+        // A replay of a token already handled is not an error for the sender.
+        if (result.reason === 'replayed')
+            return json(200, { ok: true, replayed: true });
+        if (result.retryable) {
+            return json(503, { error: 'temporarily_unavailable', error_description: result.detail ?? result.reason }, { 'retry-after': retryAfter });
+        }
+        return json(400, { error: 'invalid_request', error_description: result.detail ?? result.reason });
+    }
+    try {
+        await options.onLogout(result.claims);
+    }
+    catch {
+        return json(503, { error: 'temporarily_unavailable', error_description: 'The session could not be ended.' }, { 'retry-after': retryAfter });
+    }
+    return json(200, { ok: true });
+}
+function readStream(req) {
+    return new Promise((resolve, reject) => {
+        if (!req.on)
+            return resolve('');
+        let data = '';
+        req.on('data', (chunk) => {
+            data += String(chunk);
+            if (data.length > 64 * 1024)
+                reject(new Error('body too large'));
+        });
+        req.on('end', () => resolve(data));
+        req.on('error', (err) => reject(err));
+    });
+}
+/**
+ * Express route handler: `app.post('/auth/backchannel-logout', expressBackchannelLogout({...}))`.
+ * Works with or without `express.urlencoded()` in front of it.
+ */
+function expressBackchannelLogout(options) {
+    return async (req, res) => {
+        let body = req.body;
+        if (body === undefined || (body && typeof body === 'object' && Object.keys(body).length === 0 && req.on)) {
+            body = await readStream(req).catch(() => '');
+        }
+        const out = await handleBackchannelLogout(body, options);
+        res.status(out.status);
+        for (const [k, v] of Object.entries(out.headers)) {
+            if (res.setHeader)
+                res.setHeader(k, v);
+            else
+                res.set?.({ [k]: v });
+        }
+        res.send(out.body);
+    };
+}
+/** Fastify route handler, for a route whose body is already parsed (or a raw string). */
+function fastifyBackchannelLogout(options) {
+    return async (request, reply) => {
+        const out = await handleBackchannelLogout(request.body, options);
+        return reply.code(out.status).headers(out.headers).send(out.body);
+    };
+}
+/**
+ * Fastify plugin: registers `POST <path>` (default `/auth/backchannel-logout`)
+ * with a form-body parser in its own scope, so nothing else in your app changes:
+ * `app.register(fastifyBackchannelLogoutPlugin, { issuer, clientId, onLogout })`.
+ */
+function fastifyBackchannelLogoutPlugin(app, options, done) {
+    if (!app.hasContentTypeParser?.('application/x-www-form-urlencoded')) {
+        app.addContentTypeParser('application/x-www-form-urlencoded', { parseAs: 'string' }, (_req, body, cb) => cb(null, body));
+    }
+    app.post(options.path ?? '/auth/backchannel-logout', fastifyBackchannelLogout(options));
+    done?.();
+}
+// ---------------------------------------------------------------------------
+// Next.js App Router (and any Fetch-API runtime: Remix, Hono, Workers, Bun, Deno)
+/**
+ * A Fetch-API handler: in `app/api/auth/backchannel-logout/route.ts`,
+ * `export const POST = nextBackchannelLogout({ issuer, clientId, onLogout })`.
+ */
+function nextBackchannelLogout(options) {
+    return async (request) => {
+        const text = await request.text().catch(() => '');
+        const out = await handleBackchannelLogout(text, options);
+        return new Response(out.body, { status: out.status, headers: out.headers });
+    };
+}
+/** Alias of {@link nextBackchannelLogout} for other Fetch-API frameworks. */
+exports.fetchBackchannelLogout = nextBackchannelLogout;
+//# sourceMappingURL=backchannel-handlers.js.map

package/dist/backchannel-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backchannel-handlers.js","sourceRoot":"","sources":["../src/backchannel-handlers.ts"],"names":[],"mappings":";;;AAuCA,0CAUC;AAqBD,0DAmBC;AAiCD,4DAcC;AAqBD,4DAKC;AAOD,wEAUC;AASD,sDAMC;AAlMD,iDAA8G;AAsC9G,0EAA0E;AAC1E,SAAgB,eAAe,CAAC,IAAa;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;IAChG,IAAI,IAAI,YAAY,eAAe;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;IAClF,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,GAAI,IAAgC,CAAC,YAAY,CAAC;QACzD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,OAAO,EAAiD,CAAC;AAE/E,SAAS,WAAW,CAAC,OAAiC;IACpD,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC9C,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,IAAI,kCAAmB,CAAC,OAAO,CAAC,CAAC;QACrC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,MAA2C,EAAE,OAAgC,EAAE,QAAgC,EAAE,EAA6B,EAAE,CAAC,CAAC;IAC9J,MAAM;IACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE;IACtF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;CAC9B,CAAC,CAAC;AAEH,oFAAoF;AAC7E,KAAK,UAAU,uBAAuB,CAAC,IAAa,EAAE,OAAiC;IAC5F,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,sEAAsE;QACtE,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3I,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,iCAAiC,EAAE,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9I,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACjC,CAAC;AAgBD,SAAS,UAAU,CAAC,GAAuB;IACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACvB,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;YACtB,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,OAAiC;IACxE,OAAO,KAAK,EAAE,GAAuB,EAAE,GAAwB,EAAiB,EAAE;QAChF,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACpB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACnH,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,SAAS;gBAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;;gBAClC,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC;AACJ,CAAC;AAoBD,yFAAyF;AACzF,SAAgB,wBAAwB,CAAC,OAAiC;IACxE,OAAO,KAAK,EAAE,OAA2B,EAAE,KAAuB,EAAoB,EAAE;QACtF,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,8BAA8B,CAC5C,GAAwB,EACxB,OAAqD,EACrD,IAA4B;IAE5B,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,mCAAmC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,oBAAoB,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3H,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,0BAA0B,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC;IACxF,IAAI,EAAE,EAAE,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,kFAAkF;AAElF;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,OAAiC;IACrE,OAAO,KAAK,EAAE,OAAgB,EAAqB,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzD,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAChE,QAAA,sBAAsB,GAAG,qBAAqB,CAAC"}

package/dist/client/activity.d.ts

@@ -75,12 +75,21 @@ export interface ConfigChangelogEntry {
         type: string;
         id: string | null;
     } | null;
-    changes?: Array<{
+    /**
+     * Always present: one entry per changed field. On an older entry that recorded
+     * only field names, `values_recorded` is false and before/after are null.
+     */
+    changes: Array<{
         section: string;
         before: unknown;
         after: unknown;
+        values_recorded: boolean;
     }>;
-    /** Changed field names, when no before/after was recorded. */
+    /** True when the write changed nothing. */
+    no_op: boolean;
+    /** What the source recorded: before/after values, field names only, or nothing. */
+    recorded: 'diff' | 'fields' | 'none';
+    /** @deprecated read `changes[].section`. */
     fields?: string[];
 }
 export interface ListConfigChangelogParams extends CursorParams {
@@ -88,6 +97,8 @@ export interface ListConfigChangelogParams extends CursorParams {
     action?: string;
     /** Only changes at or after this ISO-8601 date. */
     since?: string;
+    /** false = leave out writes that changed nothing. */
+    include_no_op?: boolean;
 }
 export declare function eventsResource(request: RequestFn): {
     /** The activity feed, newest first, cursor-paginated (limit up to 100). */

package/dist/client/activity.js.map

@@ -1 +1 @@
-{"version":3,"file":"activity.js","sourceRoot":"","sources":["../../src/client/activity.ts"],"names":[],"mappings":";;AA8EA,wCAOC;AAED,sCAOC;AAED,0DAaC;AA/BD,SAAgB,cAAc,CAAC,OAAkB;IAC/C,OAAO;QACL,2EAA2E;QAC3E,IAAI,CAAC,SAAmC,EAAE;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,0FAA0F;QAC1F,GAAG,CAAC,SAA4B,EAAE;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI,CACF,SAAoC,EAAE;YAOtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"activity.js","sourceRoot":"","sources":["../../src/client/activity.ts"],"names":[],"mappings":";;AAwFA,wCAOC;AAED,sCAOC;AAED,0DAaC;AA/BD,SAAgB,cAAc,CAAC,OAAkB;IAC/C,OAAO;QACL,2EAA2E;QAC3E,IAAI,CAAC,SAAmC,EAAE;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,0FAA0F;QAC1F,GAAG,CAAC,SAA4B,EAAE;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI,CACF,SAAoC,EAAE;YAOtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/audit-logs.d.ts

@@ -3,6 +3,13 @@ import type { CursorPage, CursorParams } from './types';
 export interface AuditLog {
     object: 'audit_log';
     id: string;
+    /** Who acted; `key_name` names the secret or platform key when a key did. */
+    actor?: {
+        type: string;
+        id: string | null;
+        key_name: string | null;
+        key_prefix: string | null;
+    };
     actor_type: string;
     actor_id: string | null;
     action: string;

package/dist/client/audit-logs.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-logs.js","sourceRoot":"","sources":["../../src/client/audit-logs.ts"],"names":[],"mappings":";;AAoBA,8CAMC;AAND,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,IAAI,CAAC,SAA8B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"audit-logs.js","sourceRoot":"","sources":["../../src/client/audit-logs.ts"],"names":[],"mappings":";;AAsBA,8CAMC;AAND,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,IAAI,CAAC,SAA8B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/compliance.d.ts

@@ -0,0 +1,216 @@
+import { type QueryParams, type RequestFn } from './request';
+import type { ListPage } from './types';
+/** Provisioning tags on a resource (`?metadata[key]=value` filters lists). */
+export type ProvisioningMetadata = Record<string, string | number | boolean>;
+/** The provisioning fields every tagged resource carries. */
+export interface ProvisioningFields {
+    metadata?: Record<string, unknown>;
+    /** Your idempotent-create key. */
+    external_ref?: string | null;
+    /** On a create that sent a ref: true when the existing object was returned (200, no secret). */
+    idempotent_replay?: boolean;
+}
+/** The create-body fields any provisioning create accepts. */
+export interface ProvisioningInput {
+    metadata?: ProvisioningMetadata;
+    /** A stable key of your own: a repeat create with it returns the existing object. */
+    external_ref?: string;
+}
+/** `{ product: 'x' }` → `{ 'metadata[product]': 'x' }` for a list query. */
+export declare function metadataQuery(filter: Record<string, string | number | boolean> | undefined): QueryParams;
+export interface InstanceNotice {
+    object: 'instance_notice';
+    id: string;
+    date: string;
+    type: 'behavior_change' | 'deprecation' | 'new';
+    tags: Array<'breaking' | 'behaviour' | 'security'>;
+    title: string;
+    summary: string;
+    affects: string[];
+    docs_url: string;
+    changelog_id: string;
+    applies: boolean;
+    /** One sentence about this instance. */
+    detail: string | null;
+    count: number | null;
+    first_seen_at: number | null;
+    emailed_at: number | null;
+    acknowledged_at: number | null;
+}
+export interface SecurityAdvisory {
+    object: 'security_advisory';
+    id: string;
+    published: string;
+    severity: 'low' | 'medium' | 'high' | 'critical';
+    title: string;
+    summary: string;
+    affects: string[];
+    fixed_on: string;
+    action: string;
+    docs_url: string;
+    /** Absent on the public catalog. */
+    applies?: boolean;
+    detail?: string | null;
+    count?: number | null;
+    first_seen_at?: number | null;
+    emailed_at?: number | null;
+    acknowledged_at?: number | null;
+}
+export declare function noticesResource(request: RequestFn): {
+    /** Behaviour changes that affect this instance; `all: true` includes ones that do not apply. */
+    list(params?: {
+        all?: boolean;
+    }): Promise<ListPage<InstanceNotice> & {
+        unacknowledged: number;
+        changelog_url: string;
+    }>;
+    acknowledge(id: string): Promise<InstanceNotice>;
+};
+export declare function securityAdvisoriesResource(request: RequestFn): {
+    /** Every advisory, with whether it applies to this instance. */
+    list(): Promise<ListPage<SecurityAdvisory> & {
+        applying: number;
+    }>;
+    acknowledge(id: string): Promise<SecurityAdvisory>;
+    /** The public catalog (no instance data). */
+    catalog(): Promise<ListPage<SecurityAdvisory>>;
+};
+export interface SubProcessor {
+    object: 'sub_processor';
+    id: string;
+    name: string;
+    role: 'atlas_sub_processor' | 'engaged_by_you';
+    source: 'atlas' | 'integration' | 'referral_platform' | 'consent_manager' | 'email_provider' | 'sms_provider' | 'log_stream' | 'audit_export' | 'webhook_endpoint';
+    purpose: string;
+    data: string[];
+    location: string | null;
+    enabled_by: string | null;
+    url: string | null;
+}
+export interface SubProcessorList {
+    object: 'sub_processor_view';
+    instance_id: string;
+    roles: Record<string, string>;
+    data_region: string | null;
+    processor: {
+        name: string;
+        role: string;
+        url: string;
+    };
+    atlas_sub_processors: SubProcessor[];
+    engaged_by_you: SubProcessor[];
+    dpa_url: string;
+}
+export declare function subProcessorsResource(request: RequestFn): {
+    /** Who processes this instance's end-user data, and in which role. */
+    get(): Promise<SubProcessorList>;
+};
+export type AuditExportType = 'webhook' | 's3';
+export interface AuditExport {
+    object: 'audit_export';
+    id: string;
+    name: string;
+    type: AuditExportType;
+    enabled: boolean;
+    status: 'active' | 'failing';
+    action_filter: string[] | null;
+    /** Non-secret fields plus has_* markers. */
+    destination: Record<string, string | boolean>;
+    cursor: {
+        id: string | null;
+        created_at: number | null;
+    };
+    consecutive_failures: number;
+    last_error: string | null;
+    last_delivered_at: number | null;
+    exported_count: number;
+    mandatory_actions: string[];
+    /** Webhook exports, on create and rotateSecret only. */
+    secret?: string;
+    created_at: number;
+    updated_at: number;
+}
+export type AuditExportDestination = {
+    url: string;
+} | {
+    endpoint: string;
+    bucket: string;
+    region?: string;
+    prefix?: string;
+    access_key_id: string;
+    secret_access_key: string;
+};
+export interface CreateAuditExportBody {
+    name: string;
+    type: AuditExportType;
+    destination: AuditExportDestination;
+    /** Action names or prefixes; key and data-rights events are always exported. null = everything. */
+    action_filter?: string[] | null;
+    enabled?: boolean;
+    /** Also export the last N hours (0–720). */
+    backfill_hours?: number;
+}
+export interface UpdateAuditExportBody {
+    name?: string;
+    /** Merged; a secret left out is kept. */
+    destination?: Partial<Record<string, string>>;
+    action_filter?: string[] | null;
+    enabled?: boolean;
+}
+/** An audit entry as the export sends it (CloudEvents 1.0, structured JSON). */
+export interface AuditCloudEvent {
+    specversion: '1.0';
+    id: string;
+    source: string;
+    /** `net.atlasauth.audit.<action>` */
+    type: string;
+    subject?: string;
+    time: string;
+    datacontenttype: 'application/json';
+    atlasinstance: string;
+    data: {
+        actor: {
+            type: string;
+            id: string | null;
+            key_name: string | null;
+            key_prefix: string | null;
+        };
+        action: string;
+        resource: {
+            type: string | null;
+            id: string | null;
+        } | null;
+        org: {
+            id: string;
+        } | null;
+        trace: string | null;
+        ip: string | null;
+        metadata: Record<string, unknown>;
+    };
+}
+export interface AuditExportTestResult {
+    object: 'audit_export_test';
+    id: string;
+    ok: boolean;
+    status: number | null;
+    error: string | null;
+    location: string | null;
+    event: AuditCloudEvent;
+}
+export declare function auditExportsResource(request: RequestFn): {
+    list(): Promise<ListPage<AuditExport> & {
+        mandatory_actions: string[];
+    }>;
+    get(id: string): Promise<AuditExport>;
+    /** A webhook export's signing secret is in this response only. */
+    create(body: CreateAuditExportBody, idempotencyKey?: string): Promise<AuditExport>;
+    update(id: string, body: UpdateAuditExportBody): Promise<AuditExport>;
+    delete(id: string): Promise<{
+        object: "audit_export";
+        id: string;
+        deleted: true;
+    }>;
+    /** Send one synthetic `audit_export.test` event now. */
+    test(id: string): Promise<AuditExportTestResult>;
+    rotateSecret(id: string): Promise<AuditExport>;
+};

package/dist/client/compliance.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.metadataQuery = metadataQuery;
+exports.noticesResource = noticesResource;
+exports.securityAdvisoriesResource = securityAdvisoriesResource;
+exports.subProcessorsResource = subProcessorsResource;
+exports.auditExportsResource = auditExportsResource;
+const request_1 = require("./request");
+/** `{ product: 'x' }` → `{ 'metadata[product]': 'x' }` for a list query. */
+function metadataQuery(filter) {
+    const out = {};
+    for (const [k, v] of Object.entries(filter ?? {}))
+        out[`metadata[${k}]`] = String(v);
+    return out;
+}
+function noticesResource(request) {
+    return {
+        /** Behaviour changes that affect this instance; `all: true` includes ones that do not apply. */
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/instance/notices', query: params.all ? { all: 'true' } : undefined });
+        },
+        acknowledge(id) {
+            return request({ method: 'POST', path: `/v1/instance/notices/${(0, request_1.enc)(id)}/acknowledge` });
+        },
+    };
+}
+function securityAdvisoriesResource(request) {
+    return {
+        /** Every advisory, with whether it applies to this instance. */
+        list() {
+            return request({ method: 'GET', path: '/v1/security_advisories' });
+        },
+        acknowledge(id) {
+            return request({ method: 'POST', path: `/v1/security_advisories/${(0, request_1.enc)(id)}/acknowledge` });
+        },
+        /** The public catalog (no instance data). */
+        catalog() {
+            return request({ method: 'GET', path: '/v1/public/security_advisories' });
+        },
+    };
+}
+function subProcessorsResource(request) {
+    return {
+        /** Who processes this instance's end-user data, and in which role. */
+        get() {
+            return request({ method: 'GET', path: '/v1/instance/sub_processors' });
+        },
+    };
+}
+function auditExportsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/audit_exports' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/audit_exports/${(0, request_1.enc)(id)}` });
+        },
+        /** A webhook export's signing secret is in this response only. */
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/audit_exports', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/audit_exports/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/audit_exports/${(0, request_1.enc)(id)}` });
+        },
+        /** Send one synthetic `audit_export.test` event now. */
+        test(id) {
+            return request({ method: 'POST', path: `/v1/audit_exports/${(0, request_1.enc)(id)}/test` });
+        },
+        rotateSecret(id) {
+            return request({ method: 'POST', path: `/v1/audit_exports/${(0, request_1.enc)(id)}/rotate_secret` });
+        },
+    };
+}
+//# sourceMappingURL=compliance.js.map

package/dist/client/compliance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance.js","sourceRoot":"","sources":["../../src/client/compliance.ts"],"names":[],"mappings":";;AAyBA,sCAIC;AA4CD,0CAUC;AAED,gEAcC;AAqCD,sDAOC;AAmFD,oDA0BC;AA5PD,uCAAkE;AAwBlE,4EAA4E;AAC5E,SAAgB,aAAa,CAAC,MAA6D;IACzF,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC;AACb,CAAC;AA4CD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,gGAAgG;QAChG,IAAI,CAAC,SAA4B,EAAE;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,WAAW,CAAC,EAAU;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;QAC1F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CAAC,OAAkB;IAC3D,OAAO;QACL,gEAAgE;QAChE,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,WAAW,CAAC,EAAU;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,6CAA6C;QAC7C,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAqCD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,sEAAsE;QACtE,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC;AAmFD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,kEAAkE;QAClE,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,wDAAwD;QACxD,IAAI,CAAC,EAAU;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzF,CAAC;KACF,CAAC;AACJ,CAAC"}