@atlasauth/backend 0.18.0 → 0.20.0

package/dist/client/integrations.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.integrationsResource = integrationsResource;
+const request_1 = require("./request");
+function integrationsResource(request) {
+    return {
+        /** `POST /v1/integrations/verify_errors` — record a token an integrated service refused. */
+        reportVerifyError(body) {
+            return request({ method: 'POST', path: '/v1/integrations/verify_errors', body });
+        },
+        /** `GET /v1/integrations/:integration/card` — the agent-sidebar card for a user (by token sub). */
+        card(integration, query) {
+            return request({ method: 'GET', path: `/v1/integrations/${(0, request_1.enc)(integration)}/card`, query });
+        },
+        /** `POST /v1/integrations/:integration/card/actions/revoke_sessions` — sign the user out everywhere (audited with the agent). */
+        revokeSessions(integration, body) {
+            return request({ method: 'POST', path: `/v1/integrations/${(0, request_1.enc)(integration)}/card/actions/revoke_sessions`, body });
+        },
+        /** `GET /v1/public/instances/:id` — the public metadata of an instance (no key needed). */
+        instanceMetadata(instanceId) {
+            return request({ method: 'GET', path: `/v1/public/instances/${(0, request_1.enc)(instanceId)}` });
+        },
+    };
+}
+//# sourceMappingURL=integrations.js.map

package/dist/client/integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.js","sourceRoot":"","sources":["../../src/client/integrations.ts"],"names":[],"mappings":";;AAuEA,oDAsBC;AA7FD,uCAAgD;AAuEhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,4FAA4F;QAC5F,iBAAiB,CAAC,IAA2B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,mGAAmG;QACnG,IAAI,CAAC,WAAmB,EAAE,KAAoC;YAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,iIAAiI;QACjI,cAAc,CACZ,WAAmB,EACnB,IAA2F;YAE3F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,WAAW,CAAC,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,2FAA2F;QAC3F,gBAAgB,CAAC,UAAkB;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/messaging.d.ts

@@ -278,6 +278,16 @@ export type SmsProvider = {
 }[SmsTransport];
 /** Either channel's provider. Narrow on `transport` (or `channel`) to read its config. */
 export type MessagingProvider = EmailProvider | SmsProvider;
+/**
+ * What a singleton GET returns when nothing is configured yet (never a 404).
+ * A configured object carries `configured: true`.
+ */
+export interface NotConfigured<O extends string = string> {
+    object: O;
+    configured: false;
+    /** What to call to configure it. */
+    message?: string;
+}
 export interface MessagingProviders {
     object: 'messaging_providers';
     email: EmailProvider | null;
@@ -429,6 +439,10 @@ type LegacyInput<T extends string> = Omit<MessagingProviderInput, 'transport'> &
 export declare function messagingResource(request: RequestFn): {
     /** The instance's configured email and SMS providers, secrets omitted. */
     get(): Promise<MessagingProviders>;
+    /** One channel's provider, or `{ configured: false, channel }` when none is set. */
+    channel<C extends "email" | "sms">(channel: C): Promise<(C extends "email" ? EmailProvider : SmsProvider) | (NotConfigured<"messaging_provider"> & {
+        channel: C;
+    })>;
     /**
      * Configure (or update) the email provider. `config` keys are checked per
      * `transport`; on an update of the same transport, omitted keys — including
@@ -462,8 +476,8 @@ export declare function messagingResource(request: RequestFn): {
      * Atlas's sign-in emails without a verified domain ([Atlas test] subjects, capped).
      */
     developmentEmail: {
-        /** 404 when the provider is not in development mode. */
-        get(): Promise<DevelopmentEmail>;
+        /** `{ configured: false }` when the provider is not in development mode. */
+        get(): Promise<DevelopmentEmail | NotConfigured<"development_email">>;
         /** Turn development mode on. 409 `DEVELOPMENT_EMAIL_NOT_ALLOWED` on a production instance. */
         enable(body: EnableDevelopmentEmailBody): Promise<DevelopmentEmail>;
         /** Back to standard mode; the provider stays. */
@@ -476,8 +490,8 @@ export declare function messagingResource(request: RequestFn): {
     };
     /** Managed email: Atlas sets your sending domain up on your own Resend or Brevo account. */
     managedEmail: {
-        /** 404 when none is configured. */
-        get(): Promise<ManagedEmail>;
+        /** `{ configured: false }` when none is configured. */
+        get(): Promise<ManagedEmail | NotConfigured<"managed_email">>;
         /** Register the sending domain; returns the DNS `records` to publish. */
         create(body: CreateManagedEmailBody): Promise<ManagedEmail>;
         /** Re-check the DNS records now; `verified` is true once email can be sent. */

package/dist/client/messaging.js

@@ -14,6 +14,10 @@ function messagingResource(request) {
         get() {
             return request({ method: 'GET', path: '/v1/messaging_providers' });
         },
+        /** One channel's provider, or `{ configured: false, channel }` when none is set. */
+        channel(channel) {
+            return request({ method: 'GET', path: `/v1/messaging_providers/${channel}` });
+        },
         /**
          * Configure (or update) the email provider. `config` keys are checked per
          * `transport`; on an update of the same transport, omitted keys — including
@@ -45,7 +49,7 @@ function messagingResource(request) {
          * Atlas's sign-in emails without a verified domain ([Atlas test] subjects, capped).
          */
         developmentEmail: {
-            /** 404 when the provider is not in development mode. */
+            /** `{ configured: false }` when the provider is not in development mode. */
             get() {
                 return request({ method: 'GET', path: '/v1/messaging_providers/email/development' });
             },
@@ -60,7 +64,7 @@ function messagingResource(request) {
         },
         /** Managed email: Atlas sets your sending domain up on your own Resend or Brevo account. */
         managedEmail: {
-            /** 404 when none is configured. */
+            /** `{ configured: false }` when none is configured. */
             get() {
                 return request({ method: 'GET', path: '/v1/messaging_providers/email/managed' });
             },

package/dist/client/messaging.js.map

@@ -1 +1 @@
-{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAydA,8CAuGC;AAhkBD,uCAAgD;AAydhD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN;;;;;;WAMG;QACH,aAAa,CACX,OAAwB,EACxB,UAA+B,EAAE;YAEjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,gBAAgB,EAAE;YAChB,wDAAwD;YACxD,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,8FAA8F;YAC9F,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,iDAAiD;YACjD,OAAO;gBACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC1F,CAAC;SACF;QACD,4FAA4F;QAC5F,YAAY,EAAE;YACZ,mCAAmC;YACnC,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,yEAAyE;YACzE,MAAM,CAAC,IAA4B;gBACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD;;;;eAIG;YACH,MAAM,CAAC,UAA+B,EAAE;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,uCAAuC;oBAC7C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;SACF;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAoeA,8CA6GC;AAjlBD,uCAAgD;AAoehD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,oFAAoF;QACpF,OAAO,CACL,OAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,OAAO,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN;;;;;;WAMG;QACH,aAAa,CACX,OAAwB,EACxB,UAA+B,EAAE;YAEjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,gBAAgB,EAAE;YAChB,4EAA4E;YAC5E,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,8FAA8F;YAC9F,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,iDAAiD;YACjD,OAAO;gBACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC1F,CAAC;SACF;QACD,4FAA4F;QAC5F,YAAY,EAAE;YACZ,uDAAuD;YACvD,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,yEAAyE;YACzE,MAAM,CAAC,IAA4B;gBACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD;;;;eAIG;YACH,MAAM,CAAC,UAA+B,EAAE;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,uCAAuC;oBAC7C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;SACF;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/oauth-clients.d.ts

@@ -1,6 +1,7 @@
+import { type ProvisioningFields, type ProvisioningInput, type ProvisioningMetadata } from './compliance';
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
-export interface OAuthClient {
+export interface OAuthClient extends ProvisioningFields {
     object: 'oauth_client';
     id: string;
     client_id: string;
@@ -118,6 +119,13 @@ export interface OAuthClientLogoutFields {
 /** Create/rotate reveal the secret exactly once, alongside the client. */
 export interface OAuthClientWithSecret extends OAuthClient {
     client_secret?: string;
+    /** With a `secretRecipient`: the client secret sealed to it (then `client_secret` is absent). */
+    sealed_client_secret?: string;
+    secrets_sealed?: {
+        algorithm: string;
+        recipient: string;
+        fields: string[];
+    };
     note: string;
 }
 export interface RotateOAuthClientSecretBody {
@@ -147,7 +155,7 @@ export interface ClientGrant {
     created_at: number;
     updated_at: number;
 }
-export interface CreateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields, OAuthClientTokenFields {
+export interface CreateOAuthClientBody extends ProvisioningInput, OAuthClientLogoutFields, OAuthClientSubjectFields, OAuthClientTokenFields {
     name: string;
     redirect_uris: string[];
     allowed_scopes?: string[];
@@ -157,8 +165,12 @@ export interface CreateOAuthClientBody extends OAuthClientLogoutFields, OAuthCli
     first_party?: boolean;
     /** How long the issued secret authenticates, in seconds; omit for no expiry. */
     secret_expires_in_seconds?: number;
+    /** Require PKCE. New clients default to true (confidential ones included); send false to opt out. */
+    require_pkce?: boolean;
 }
 export interface UpdateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields, OAuthClientTokenFields {
+    /** Replaces the provisioning metadata. */
+    metadata?: ProvisioningMetadata;
     name?: string;
     redirect_uris?: string[];
     allowed_scopes?: string[];
@@ -250,7 +262,10 @@ export declare function oauthClientsResource(request: RequestFn): {
     import(body: {
         clients: ImportOAuthClientEntry[];
     }, idempotencyKey?: string): Promise<ListPage<ImportedOAuthClient>>;
-    list(): Promise<ListPage<OAuthClient>>;
+    /** `metadata` filters on provisioning tags (`?metadata[key]=value`). */
+    list(params?: {
+        metadata?: ProvisioningMetadata;
+    }): Promise<ListPage<OAuthClient>>;
     get(id: string): Promise<OAuthClient>;
     create(body: CreateOAuthClientBody, idempotencyKey?: string): Promise<OAuthClientWithSecret>;
     update(id: string, body: UpdateOAuthClientBody): Promise<OAuthClient>;

package/dist/client/oauth-clients.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.oauthClientsResource = oauthClientsResource;
+const compliance_1 = require("./compliance");
 const request_1 = require("./request");
 function oauthClientsResource(request) {
     return {
@@ -8,8 +9,9 @@ function oauthClientsResource(request) {
         import(body, idempotencyKey) {
             return request({ method: 'POST', path: '/v1/oauth_clients/import', body, idempotencyKey });
         },
-        list() {
-            return request({ method: 'GET', path: '/v1/oauth_clients' });
+        /** `metadata` filters on provisioning tags (`?metadata[key]=value`). */
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/oauth_clients', query: (0, compliance_1.metadataQuery)(params.metadata) });
         },
         get(id) {
             return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}` });

package/dist/client/oauth-clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AA4QA,oDA+FC;AA3WD,uCAAgD;AA4QhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,yEAAyE;QACzE,mBAAmB,EAAE;YACnB,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,OAAqC,EAAE;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AAoRA,oDAgGC;AApXD,6CAAyH;AACzH,uCAAgD;AAmRhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,SAA8C,EAAE;YACnD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAA,0BAAa,EAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,yEAAyE;QACzE,mBAAmB,EAAE;YACnB,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,OAAqC,EAAE;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/operator.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Operator sign-in (`atlas login`) and token exchange, without a long-lived key.
+ *
+ *  1. `startOperatorLogin()` runs the RFC 8628 device flow against Atlas's own
+ *     sign-in (the operator issuer) with the public `atlas-cli` client: show the
+ *     person `verification_uri_complete` / `user_code`, then
+ *  2. `pollOperatorLogin()` until it returns the operator access token, then
+ *  3. `exchangeOperatorToken()` swaps it (RFC 8693) for a ONE-HOUR Atlas token
+ *     bound to one instance (`ins_…`, Backend API) or app/account (`app_…` /
+ *     `acct_…`, Platform API), with only the scopes you ask for.
+ *
+ * Root actions (create an app or instance, mint a key) need a multi-factor
+ * sign-in within 5 minutes; otherwise the API answers 403 STEP_UP_REQUIRED.
+ */
+export interface OperatorConfiguration {
+    issuer: string;
+    device_authorization_endpoint: string;
+    token_endpoint: string;
+    client_id: string;
+    scope: string;
+    token_exchange_endpoint: string;
+    token_exchange_audience: 'atlas';
+    root_action_max_mfa_age_seconds: number;
+}
+export interface DeviceAuthorization {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export interface OAuthTokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    scope?: string;
+    refresh_token?: string;
+    id_token?: string;
+    issued_token_type?: string;
+}
+export declare class OAuthFlowError extends Error {
+    readonly error: string;
+    readonly status: number;
+    constructor(error: string, message: string, status: number);
+}
+interface Opts {
+    apiUrl?: string;
+    fetch?: typeof fetch;
+}
+/** GET /v1/operator — where the operator device flow and token exchange live. */
+export declare function operatorConfiguration(opts?: Opts): Promise<OperatorConfiguration>;
+export declare function startOperatorLogin(opts?: Opts & {
+    config?: OperatorConfiguration;
+}): Promise<DeviceAuthorization & {
+    config: OperatorConfiguration;
+}>;
+/**
+ * Poll until the person approves (resolves the operator token), denies or the
+ * code expires (throws). Honours `interval` and `slow_down`.
+ */
+export declare function pollOperatorLogin(start: DeviceAuthorization & {
+    config: OperatorConfiguration;
+}, opts?: Opts & {
+    sleep?: (ms: number) => Promise<void>;
+    signal?: AbortSignal;
+}): Promise<OAuthTokenResponse>;
+/** RFC 8693: swap an operator token for a one-hour, resource-bound Atlas token. */
+export declare function exchangeOperatorToken(subjectToken: string, params: {
+    resource: string;
+    scope: string | string[];
+}, opts?: Opts): Promise<OAuthTokenResponse & {
+    resource: string;
+}>;
+/** client_credentials with a partner link's credentials (a partner calling an instance). */
+export declare function partnerLinkToken(clientId: string, clientSecret: string, opts?: Opts & {
+    scope?: string;
+}): Promise<OAuthTokenResponse>;
+/** A key pair for sealed secret delivery; pass `secretRecipient` to the client. */
+export declare function generateSealKeyPair(): {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+    secretRecipient: string;
+};
+/** Open a `sealed_*` field (base64 libsodium sealed box) from an Atlas response. */
+export declare function openSealedSecret(sealedBase64: string, keyPair: {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+}): string;
+/** POST /v1/keys/revoke_leaked — revoke leaked Atlas credentials (no key needed). */
+export declare function revokeLeakedKeys(secrets: string[], opts?: Opts & {
+    url?: string;
+}): Promise<{
+    results: Array<{
+        index: number;
+        kind: string;
+        outcome: 'revoked' | 'already_revoked' | 'not_found';
+    }>;
+}>;
+export { sealBox, openSealedBox } from './sealed-box';

package/dist/client/operator.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openSealedBox = exports.sealBox = exports.OAuthFlowError = void 0;
+exports.operatorConfiguration = operatorConfiguration;
+exports.startOperatorLogin = startOperatorLogin;
+exports.pollOperatorLogin = pollOperatorLogin;
+exports.exchangeOperatorToken = exchangeOperatorToken;
+exports.partnerLinkToken = partnerLinkToken;
+exports.generateSealKeyPair = generateSealKeyPair;
+exports.openSealedSecret = openSealedSecret;
+exports.revokeLeakedKeys = revokeLeakedKeys;
+const sealed_box_1 = require("./sealed-box");
+const toB64 = (b) => btoa(String.fromCharCode(...b));
+const fromB64 = (s) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
+class OAuthFlowError extends Error {
+    error;
+    status;
+    constructor(error, message, status) {
+        super(message);
+        this.error = error;
+        this.status = status;
+        this.name = 'OAuthFlowError';
+    }
+}
+exports.OAuthFlowError = OAuthFlowError;
+const DEFAULT_API = 'https://api.atlasauth.net';
+async function form(fetchImpl, url, body) {
+    const res = await fetchImpl(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+        body: new URLSearchParams(body).toString(),
+    });
+    const json = (await res.json().catch(() => ({})));
+    return { ...json, _status: res.status };
+}
+/** GET /v1/operator — where the operator device flow and token exchange live. */
+async function operatorConfiguration(opts = {}) {
+    const f = opts.fetch ?? globalThis.fetch;
+    const res = await f(`${(opts.apiUrl ?? DEFAULT_API).replace(/\/+$/, '')}/v1/operator`, { headers: { accept: 'application/json' } });
+    if (!res.ok)
+        throw new OAuthFlowError('not_configured', 'The operator issuer is not configured on this deployment.', res.status);
+    return (await res.json());
+}
+async function startOperatorLogin(opts = {}) {
+    const config = opts.config ?? (await operatorConfiguration(opts));
+    const out = await form(opts.fetch ?? globalThis.fetch, config.device_authorization_endpoint, { client_id: config.client_id, scope: config.scope });
+    if (out._status !== 200)
+        throw new OAuthFlowError(String(out.error ?? 'error'), String(out.error_description ?? 'Device authorization failed.'), out._status);
+    return { ...out, config };
+}
+/**
+ * Poll until the person approves (resolves the operator token), denies or the
+ * code expires (throws). Honours `interval` and `slow_down`.
+ */
+async function pollOperatorLogin(start, opts = {}) {
+    const f = opts.fetch ?? globalThis.fetch;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    let interval = Math.max(1, start.interval) * 1000;
+    const deadline = Date.now() + start.expires_in * 1000;
+    while (Date.now() < deadline) {
+        if (opts.signal?.aborted)
+            throw new OAuthFlowError('aborted', 'Sign-in was cancelled.', 0);
+        await sleep(interval);
+        const out = await form(f, start.config.token_endpoint, {
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            device_code: start.device_code,
+            client_id: start.config.client_id,
+        });
+        if (out._status === 200)
+            return out;
+        if (out.error === 'authorization_pending')
+            continue;
+        if (out.error === 'slow_down') {
+            interval += 5000;
+            continue;
+        }
+        throw new OAuthFlowError(String(out.error ?? 'error'), String(out.error_description ?? 'Sign-in failed.'), out._status);
+    }
+    throw new OAuthFlowError('expired_token', 'The sign-in code expired. Run the login again.', 400);
+}
+/** RFC 8693: swap an operator token for a one-hour, resource-bound Atlas token. */
+async function exchangeOperatorToken(subjectToken, params, opts = {}) {
+    const out = await form(opts.fetch ?? globalThis.fetch, `${(opts.apiUrl ?? DEFAULT_API).replace(/\/+$/, '')}/v1/oauth/token`, {
+        grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+        subject_token: subjectToken,
+        subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',
+        audience: 'atlas',
+        resource: params.resource,
+        scope: Array.isArray(params.scope) ? params.scope.join(' ') : params.scope,
+    });
+    if (out._status !== 200) {
+        const err = out.error ?? (Array.isArray(out.errors) ? out.errors[0].code : 'error');
+        const msg = out.error_description ?? (Array.isArray(out.errors) ? out.errors[0].message : 'Token exchange failed.');
+        throw new OAuthFlowError(String(err), String(msg), out._status);
+    }
+    return out;
+}
+/** client_credentials with a partner link's credentials (a partner calling an instance). */
+async function partnerLinkToken(clientId, clientSecret, opts = {}) {
+    const body = { grant_type: 'client_credentials', client_id: clientId, client_secret: clientSecret };
+    if (opts.scope)
+        body.scope = opts.scope;
+    const out = await form(opts.fetch ?? globalThis.fetch, `${(opts.apiUrl ?? DEFAULT_API).replace(/\/+$/, '')}/v1/oauth/token`, body);
+    if (out._status !== 200)
+        throw new OAuthFlowError(String(out.error ?? 'error'), String(out.error_description ?? 'Token request failed.'), out._status);
+    return out;
+}
+/** A key pair for sealed secret delivery; pass `secretRecipient` to the client. */
+function generateSealKeyPair() {
+    const pair = (0, sealed_box_1.generateSealKeyPair)();
+    return { ...pair, secretRecipient: `x25519:${toB64(pair.publicKey)}` };
+}
+/** Open a `sealed_*` field (base64 libsodium sealed box) from an Atlas response. */
+function openSealedSecret(sealedBase64, keyPair) {
+    return new TextDecoder().decode((0, sealed_box_1.openSealedBox)(fromB64(sealedBase64), keyPair.publicKey, keyPair.secretKey));
+}
+/** POST /v1/keys/revoke_leaked — revoke leaked Atlas credentials (no key needed). */
+async function revokeLeakedKeys(secrets, opts = {}) {
+    const f = opts.fetch ?? globalThis.fetch;
+    const res = await f(`${(opts.apiUrl ?? DEFAULT_API).replace(/\/+$/, '')}/v1/keys/revoke_leaked`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', accept: 'application/json' },
+        body: JSON.stringify({ secrets, ...(opts.url ? { url: opts.url } : {}) }),
+    });
+    if (!res.ok)
+        throw new OAuthFlowError('request_failed', `revoke_leaked failed (${res.status}).`, res.status);
+    return (await res.json());
+}
+var sealed_box_2 = require("./sealed-box");
+Object.defineProperty(exports, "sealBox", { enumerable: true, get: function () { return sealed_box_2.sealBox; } });
+Object.defineProperty(exports, "openSealedBox", { enumerable: true, get: function () { return sealed_box_2.openSealedBox; } });
+//# sourceMappingURL=operator.js.map

package/dist/client/operator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/client/operator.ts"],"names":[],"mappings":";;;AA+EA,sDAKC;AAED,gDAKC;AAMD,8CAyBC;AAGD,sDAmBC;AAGD,4CAUC;AAGD,kDAGC;AAGD,4CAEC;AAGD,4CAYC;AAvLD,6CAAiF;AAEjF,MAAM,KAAK,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AA+ChF,MAAa,cAAe,SAAQ,KAAK;IAE5B;IAEA;IAHX,YACW,KAAa,EACtB,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,UAAK,GAAL,KAAK,CAAQ;QAEb,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AATD,wCASC;AAOD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD,KAAK,UAAU,IAAI,CAAC,SAAuB,EAAE,GAAW,EAAE,IAA4B;IACpF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,iFAAiF;AAC1E,KAAK,UAAU,qBAAqB,CAAC,OAAa,EAAE;IACzD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACpI,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,2DAA2D,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;AACrD,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,OAAkD,EAAE;IAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACnJ,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,8BAA8B,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9J,OAAO,EAAE,GAAI,GAAsC,EAAE,MAAM,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CACrC,KAA8D,EAC9D,OAA+E,EAAE;IAEjF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE;YACrD,UAAU,EAAE,8CAA8C;YAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;YAAE,OAAO,GAAoC,CAAC;QACrE,IAAI,GAAG,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QACpD,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,IAAI,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAC;AACnG,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,MAAsD,EACtD,OAAa,EAAE;IAEf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE;QAC3H,UAAU,EAAE,iDAAiD;QAC7D,aAAa,EAAE,YAAY;QAC3B,kBAAkB,EAAE,+CAA+C;QACnE,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;KAC3E,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3G,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC9I,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAA2D,CAAC;AACrE,CAAC;AAED,4FAA4F;AACrF,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,YAAoB,EACpB,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IAC5H,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACnI,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACvJ,OAAO,GAAoC,CAAC;AAC9C,CAAC;AAED,mFAAmF;AACnF,SAAgB,mBAAmB;IACjC,MAAM,IAAI,GAAG,IAAA,gCAAG,GAAE,CAAC;IACnB,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,oFAAoF;AACpF,SAAgB,gBAAgB,CAAC,YAAoB,EAAE,OAAyD;IAC9G,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAA,0BAAI,EAAC,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,gBAAgB,CACpC,OAAiB,EACjB,OAAgC,EAAE;IAElC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,EAAE;QAC/F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,yBAAyB,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7G,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8G,CAAC;AACzI,CAAC;AACD,2CAAsD;AAA7C,qGAAA,OAAO,OAAA;AAAE,2GAAA,aAAa,OAAA"}