@atlasauth/backend 0.18.0 → 0.20.0

package/dist/client/privacy.d.ts

@@ -0,0 +1,127 @@
+import { type RequestFn } from './request';
+/**
+ * The data-rights executor protocol (v2) — the routes any DSAR orchestrator
+ * calls to find a person and carry out a request against their identity data
+ * (needs a key with `privacy:execute`) — and the instance's own data-rights
+ * orchestrator, where Atlas opens a case when an account deletion is scheduled
+ * (needs `instance:read` / `instance:write`).
+ */
+export type PrivacyCanonicalType = 'access' | 'deletion' | 'closure' | 'restriction' | 'rectification';
+export type PrivacyRequestStatus = 'pending' | 'scheduled' | 'processing' | 'completed' | 'completed_with_retention' | 'rejected' | 'no_match' | 'cancelled';
+export interface PrivacySubject {
+    iss?: string;
+    sub?: string;
+    ext?: string;
+    principal?: string;
+}
+export interface PrivacyLookupResult {
+    object: 'privacy_lookup';
+    status: 'found' | 'no_match';
+    subjectId: string | null;
+    matchedBy: 'atlas.sub' | 'atlas.ext' | 'email' | 'email_unverified' | null;
+    detail: string | null;
+    principal?: string;
+}
+export interface PrivacyRequest {
+    object: 'privacy_request';
+    id: string;
+    type: PrivacyCanonicalType;
+    canonicalType: PrivacyCanonicalType;
+    requestedType: string;
+    status: PrivacyRequestStatus;
+    subjectId: string;
+    caseId: string | null;
+    executeAfter: string | null;
+    eta: string | null;
+    detail: string | null;
+    retention: Array<{
+        category: string;
+        basis: string;
+        until: string;
+    }>;
+    steps: Array<{
+        name: string;
+        status: string;
+        reason?: string;
+        at?: number;
+    }>;
+    trace: string | null;
+    createdAt: string;
+    updatedAt: string;
+    completedAt: string | null;
+    /** On `getRequest` once done. */
+    result?: unknown;
+}
+export interface CreatePrivacyRequestBody {
+    subjectId: string;
+    type: PrivacyCanonicalType | 'export' | 'erasure' | 'erase';
+    caseId: string;
+    /** ISO 8601 or epoch ms: nothing is erased before it. */
+    executeAfter?: string | number;
+    reason?: string;
+}
+export interface PrivacyOrchestrator {
+    object: 'privacy_orchestrator';
+    configured: boolean;
+    enabled: boolean;
+    provider: string | null;
+    name: string | null;
+    case_url: string | null;
+    cancel_url: string | null;
+    auth_header: string;
+    auth_scheme: string;
+    api_key_set: boolean;
+    signing_secret_set: boolean;
+    use_partner_link: boolean;
+    open_closure_cases: boolean;
+    completion_webhook: Record<string, unknown> | null;
+    last_case_at: number | null;
+    last_error: string | null;
+    last_error_at: number | null;
+    presets: Array<Record<string, unknown>>;
+    /** Only on the write that minted it. */
+    signing_secret?: string;
+    /** Only on the write that created the completion endpoint. */
+    completion_webhook_secret?: string;
+}
+export interface PrivacyOrchestratorInput {
+    /** A preset id (`cookiemunch`, `custom`) or your own lower-case id. */
+    provider?: string;
+    name?: string;
+    enabled?: boolean;
+    case_url?: string | null;
+    /** Must contain `{id}`. */
+    cancel_url?: string | null;
+    auth_header?: string;
+    auth_scheme?: 'bearer' | 'raw';
+    api_key?: string | null;
+    /** Call through the partner link the orchestrator granted Atlas (partner id = provider). */
+    use_partner_link?: boolean;
+    open_closure_cases?: boolean;
+    sign_requests?: boolean;
+    completion_webhook_url?: string | null;
+}
+export declare function privacyResource(request: RequestFn): {
+    /** What this executor speaks (public). */
+    discover(): Promise<Record<string, unknown>>;
+    /** A ready-made orchestrator connection profile, e.g. `cookiemunch` (public). */
+    preset(id: string): Promise<Record<string, unknown>>;
+    /** Find a person: `atlas.sub` alone when present, then `atlas.ext`, then emails. */
+    lookup(body: {
+        emails?: string[];
+        atlas?: PrivacySubject;
+    }): Promise<PrivacyLookupResult>;
+    /** Open a request (or get the existing one for the same case). */
+    createRequest(body: CreatePrivacyRequestBody, idempotencyKey?: string): Promise<PrivacyRequest>;
+    getRequest(id: string): Promise<PrivacyRequest>;
+    /** Cancel before it runs: nothing is erased, the account stays. */
+    cancelRequest(id: string, idempotencyKey?: string): Promise<PrivacyRequest>;
+    orchestrator: {
+        get(): Promise<PrivacyOrchestrator>;
+        /** Connect or update; new secrets come back once. */
+        set(body: PrivacyOrchestratorInput): Promise<PrivacyOrchestrator>;
+        delete(): Promise<PrivacyOrchestrator & {
+            deleted: boolean;
+        }>;
+    };
+};

package/dist/client/privacy.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.privacyResource = privacyResource;
+const request_1 = require("./request");
+function privacyResource(request) {
+    return {
+        /** What this executor speaks (public). */
+        discover() {
+            return request({ method: 'GET', path: '/v1/privacy' });
+        },
+        /** A ready-made orchestrator connection profile, e.g. `cookiemunch` (public). */
+        preset(id) {
+            return request({ method: 'GET', path: `/v1/privacy/presets/${(0, request_1.enc)(id)}` });
+        },
+        /** Find a person: `atlas.sub` alone when present, then `atlas.ext`, then emails. */
+        lookup(body) {
+            return request({ method: 'POST', path: '/v1/privacy/lookup', body });
+        },
+        /** Open a request (or get the existing one for the same case). */
+        createRequest(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/privacy/requests', body, idempotencyKey });
+        },
+        getRequest(id) {
+            return request({ method: 'GET', path: `/v1/privacy/requests/${(0, request_1.enc)(id)}` });
+        },
+        /** Cancel before it runs: nothing is erased, the account stays. */
+        cancelRequest(id, idempotencyKey) {
+            return request({ method: 'POST', path: `/v1/privacy/requests/${(0, request_1.enc)(id)}/cancel`, idempotencyKey });
+        },
+        orchestrator: {
+            get() {
+                return request({ method: 'GET', path: '/v1/instance/privacy_orchestrator' });
+            },
+            /** Connect or update; new secrets come back once. */
+            set(body) {
+                return request({ method: 'PUT', path: '/v1/instance/privacy_orchestrator', body });
+            },
+            delete() {
+                return request({ method: 'DELETE', path: '/v1/instance/privacy_orchestrator' });
+            },
+        },
+    };
+}
+//# sourceMappingURL=privacy.js.map

package/dist/client/privacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy.js","sourceRoot":"","sources":["../../src/client/privacy.ts"],"names":[],"mappings":";;AA8GA,0CAsCC;AApJD,uCAAgD;AA8GhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,0CAA0C;QAC1C,QAAQ;YACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,iFAAiF;QACjF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,oFAAoF;QACpF,MAAM,CAAC,IAAmD;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,kEAAkE;QAClE,aAAa,CAAC,IAA8B,EAAE,cAAuB;YACnE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,aAAa,CAAC,EAAU,EAAE,cAAuB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,YAAY,EAAE;YACZ,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,qDAAqD;YACrD,GAAG,CAAC,IAA8B;gBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAClF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/referrals.d.ts

@@ -11,7 +11,7 @@ import type { UserReferralResult } from './users';
  * call is retried, and `user.referral_attributed` is sent when it resolves.
  *
  * `provider` is `webhook` (the Atlas referral protocol, which any platform can
- * implement; see {@link verifyReferralRequest}), `referally` (the built-in
+ * implement; see {@link verifyReferralRequest}), `referalli` (the built-in
  * Referalli adapter: `endpoint_url` is your Referalli base URL, plus
  * `connection_id`, `signing_secret` and optionally `tracking_token`) or
  * another built-in vendor adapter.
@@ -49,6 +49,10 @@ export interface ReferralProviderInfo {
     needs: Array<'endpoint_url' | 'signing_secret' | 'api_key' | 'connection_id' | 'tracking_token'>;
     /** The vendor's own first-party tracking cookie, suggested when this provider is picked. */
     default_context_cookie: string | null;
+    /** Every cookie the vendor has written, in the order Atlas tries them. */
+    default_context_cookies?: string[];
+    /** Retired spellings of `id`, accepted on write (for example `referally` for `referalli`). */
+    aliases?: string[];
     docs_url: string | null;
 }
 /** Fraud and bot protection for referred sign-ups (`security` on the settings). */
@@ -117,9 +121,9 @@ export interface ReferralInboundStatus {
     } | null;
 }
 /** A referral program whose script or cookie the browser reads. */
-export type ReferralBrowserSource = 'referally' | 'rewardful' | 'tolt' | 'promotekit' | 'firstpromoter' | 'partnerstack' | 'dub';
+export type ReferralBrowserSource = 'referalli' | 'rewardful' | 'tolt' | 'promotekit' | 'firstpromoter' | 'partnerstack' | 'dub';
 /** Which consent manager decides on the tracking cookie's ids: `auto` (any common one), one manager, or `app` (only the app's own decision). */
-export type ReferralConsentProvider = 'auto' | 'cookiemunch' | 'onetrust' | 'cookiebot' | 'didomi' | 'usercentrics' | 'osano' | 'cookieyes' | 'complianz' | 'klaro' | 'tcf' | 'consent_mode' | 'app';
+export type ReferralConsentProvider = 'auto' | 'atlasconsent' | 'cookiemunch' | 'onetrust' | 'cookiebot' | 'didomi' | 'usercentrics' | 'osano' | 'cookieyes' | 'complianz' | 'klaro' | 'tcf' | 'consent_mode' | 'gpc' | 'app';
 /** What a platform answers to a ping. */
 export interface ReferralPing {
     ok: boolean;
@@ -141,6 +145,27 @@ export interface ReferralPing {
     error_code?: string | null;
     error?: string | null;
 }
+/** A one-click (OAuth) install a deployment offers for a referral platform. */
+export interface ReferralOneClick {
+    id: string;
+    name: string;
+    available: boolean;
+    /** What the connection is saved as: `referalli` or `webhook` (the generic protocol). */
+    provider: string;
+    scope: string;
+    redirect_uri: string;
+}
+/** `POST /v1/instance/referrals/{preset}/install`. */
+export interface ReferralInstall {
+    object: 'referral_install';
+    preset: string;
+    provider: string;
+    /** Send the merchant here to pick an organization and program. */
+    authorize_url: string;
+    redirect_uri: string;
+    /** Epoch ms; the link lasts 15 minutes. */
+    expires_at: number;
+}
 /** `GET /v1/instance/referrals`. */
 export interface ReferralSettings {
     object: 'referral_settings';
@@ -159,8 +184,18 @@ export interface ReferralSettings {
     api_key_set: boolean;
     /** Query parameters that carry a referral code, in priority order (default `ref`, `via`, `aff`). */
     url_params: string[];
-    /** First-party tracking cookie read under consent; null = never read a cookie. */
+    /** The first tracking cookie read under consent; null = never read a cookie. `context_cookies` lists them all. */
     context_cookie: string | null;
+    /** Every tracking cookie, in the order they are tried. */
+    context_cookies?: string[];
+    /** Retired spellings of `provider` that are still accepted on write. */
+    provider_aliases?: string[];
+    /** What the chosen provider can do now: its built-in capabilities plus what its last ping advertised. */
+    capabilities?: ReferralProviderCapabilities | null;
+    /** One-click connect to Referalli (the `referalli` preset). */
+    one_click?: ReferralOneClick | null;
+    /** Every platform this deployment offers a one-click install for. */
+    one_click_presets?: ReferralOneClick[];
     consent_category: string;
     consent_fallback_category: string | null;
     /** Every new user becomes a referrer (gets a code and link from the platform). */
@@ -170,7 +205,7 @@ export interface ReferralSettings {
     /** How long a sign-up waits for the platform (100-5000 ms, default 3000). */
     timeout_ms: number;
     security: ReferralSecuritySettings;
-    /** Public tracking token (the `referally` adapter derives the code lookup from it). */
+    /** Public tracking token (the `referalli` adapter derives the code lookup from it). */
     tracking_token?: string | null;
     /** Public, CORS-enabled lookup with `{code}` for "X invited you" on hosted sign-up. */
     code_lookup_url?: string | null;
@@ -221,7 +256,10 @@ export interface UpdateReferralSettingsBody {
     inbound_endpoint_id?: string | null;
     /** 1-10 names of `[A-Za-z0-9_.-]{1,40}`. */
     url_params?: string[];
-    context_cookie?: string | null;
+    /** A cookie name, or a list of up to 5 tried in order; null clears. */
+    context_cookie?: string | string[] | null;
+    /** The same with a list; wins over `context_cookie`. */
+    context_cookies?: string[] | null;
     consent_category?: string;
     consent_fallback_category?: string | null;
     auto_enroll_users?: boolean;
@@ -433,6 +471,15 @@ export declare function referralsResource(request: RequestFn): {
         kind?: ReferralCallKind;
         error_code?: string;
     }, idempotencyKey?: string): Promise<ReferralRetryFailedResult>;
+    /**
+     * `POST /v1/instance/referrals/{preset}/install` — start a one-click
+     * connection to a referral platform (`referalli`, or any id in
+     * `one_click_presets`). 422 `REFERRALS_NOT_CONFIGURED` when the deployment
+     * does not offer it; connect with a key or signing secret then.
+     */
+    install(preset: string, body?: {
+        return_to?: string | null;
+    }): Promise<ReferralInstall>;
     /**
      * `POST /v1/instance/referrals/simulate` — send a sign-up call for a fake
      * user (`atlas_test_<random>`, never stored) with an optional code, and

package/dist/client/referrals.js

@@ -38,6 +38,15 @@ function referralsResource(request) {
         retryFailed(filter = {}, idempotencyKey) {
             return request({ method: 'POST', path: '/v1/instance/referrals/calls/retry_failed', body: filter, idempotencyKey });
         },
+        /**
+         * `POST /v1/instance/referrals/{preset}/install` — start a one-click
+         * connection to a referral platform (`referalli`, or any id in
+         * `one_click_presets`). 422 `REFERRALS_NOT_CONFIGURED` when the deployment
+         * does not offer it; connect with a key or signing secret then.
+         */
+        install(preset, body = {}) {
+            return request({ method: 'POST', path: `/v1/instance/referrals/${(0, request_1.enc)(preset)}/install`, body });
+        },
         /**
          * `POST /v1/instance/referrals/simulate` — send a sign-up call for a fake
          * user (`atlas_test_<random>`, never stored) with an optional code, and

package/dist/client/referrals.js.map

@@ -1 +1 @@
-{"version":3,"file":"referrals.js","sourceRoot":"","sources":["../../src/client/referrals.ts"],"names":[],"mappings":";;AAoaA,8CAmEC;AAveD,uCAAgD;AAoahD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,8FAA8F;QAC9F,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,+EAA+E;QAC/E,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD;;;WAGG;QACH,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,uEAAuE;QACvE,SAAS,CAAC,SAAkC,EAAE;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,EAAU,EAAE,cAAuB;YAC3C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;gBACrD,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,6GAA6G;QAC7G,WAAW,CACT,SAA2D,EAAE,EAC7D,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACtH,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,OAA0B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,IAA0B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,iDAAiD;QACjD,WAAW,CAAC,EAAU;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD;;;WAGG;QACH,UAAU,CAAC,MAAc;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"referrals.js","sourceRoot":"","sources":["../../src/client/referrals.ts"],"names":[],"mappings":";;AA8cA,8CA4EC;AA1hBD,uCAAgD;AA8chD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,8FAA8F;QAC9F,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,+EAA+E;QAC/E,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD;;;WAGG;QACH,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,uEAAuE;QACvE,SAAS,CAAC,SAAkC,EAAE;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,EAAU,EAAE,cAAuB;YAC3C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;gBACrD,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,6GAA6G;QAC7G,WAAW,CACT,SAA2D,EAAE,EAC7D,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACtH,CAAC;QACD;;;;;WAKG;QACH,OAAO,CAAC,MAAc,EAAE,OAAsC,EAAE;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,OAA0B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,IAA0B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,iDAAiD;QACjD,WAAW,CAAC,EAAU;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD;;;WAGG;QACH,UAAU,CAAC,MAAc;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/request.d.ts

@@ -38,6 +38,60 @@ export interface AtlasClientConfig {
      * newer API version. Not called in strict mode, where the write fails instead.
      */
     onUnknownFields?: (event: UnknownFieldsEvent) => void;
+    /**
+     * Dry run: every write (POST/PUT/PATCH/DELETE) is sent with `?dry_run=true`,
+     * so Atlas validates it and answers with the changes it WOULD make
+     * ({@link DryRunResult}) without changing anything. Use it for a single plan
+     * with `client.withOptions({ dryRun: true })`; the method's declared return
+     * type is then a `DryRunResult` at runtime.
+     */
+    dryRun?: boolean;
+    /**
+     * Sealed secret delivery: an `x25519:<public key>` (see `generateSealKeyPair`
+     * in `@atlasauth/backend`). Sent as `X-Secret-Recipient` on every request, so
+     * every shown-once secret in a response arrives sealed (`sealed_secret`, …)
+     * instead of in plaintext. Open it with `openSealedSecret`.
+     */
+    secretRecipient?: string;
+}
+/** One change a write would make (or made), in the config-changelog shape. */
+export interface DryRunChange {
+    section: string;
+    before: unknown;
+    after: unknown;
+}
+/** What a write answers with `?dry_run=true` (see {@link AtlasClientConfig.dryRun}). */
+export interface DryRunResult {
+    object: 'dry_run';
+    dry_run: true;
+    /**
+     * `native`: the endpoint's own dry run, validated in full. `rollback`: the
+     * real write ran in a transaction that was rolled back, every side effect
+     * held back, validated in full. `plan`: validation could not run to the end
+     * (a third-party call decided the outcome); see `validation_skipped`.
+     */
+    mode: 'native' | 'rollback' | 'plan';
+    validated: boolean;
+    method: string;
+    path: string;
+    changes: DryRunChange[];
+    /** The same non-fatal warnings the real write returns (e.g. `origin_still_referenced`). */
+    warnings?: Array<{
+        code: string;
+        message?: string;
+        [key: string]: unknown;
+    }>;
+    would_return?: unknown;
+    /** The status the real write would answer with (`rollback` mode). */
+    would_return_status?: number;
+    /** Side effects held back: `email`, `sms`, `voice`, `push`, `outbound_network`, `redis`, `cache`, `file`. */
+    suppressed?: string[];
+    /** `plan` mode: why validation did not run to the end. */
+    validation_skipped?: {
+        reason: 'external_call' | 'database' | 'unsupported_response';
+        detail: string;
+    };
+    note: string;
 }
 /** What {@link AtlasClientConfig.onUnknownFields} receives. */
 export interface UnknownFieldsEvent {
@@ -48,7 +102,7 @@ export interface UnknownFieldsEvent {
     fields: string[];
 }
 /** Per-client settings `withOptions` can override. */
-export type AtlasRequestSettings = Pick<AtlasClientConfig, 'strict' | 'onUnknownFields'>;
+export type AtlasRequestSettings = Pick<AtlasClientConfig, 'strict' | 'onUnknownFields' | 'dryRun'>;
 /** A raw (non-JSON) request body, e.g. image bytes for a design-asset upload. */
 export interface RawBody {
     data: Blob | ArrayBuffer | ArrayBufferView;
@@ -74,6 +128,8 @@ export interface RequestOptions {
     raw?: boolean;
     /** Per-request override of {@link AtlasClientConfig.strict}. */
     strict?: boolean;
+    /** Extra request headers. */
+    headers?: Record<string, string>;
 }
 /** Serialize a query object to a string, dropping null/undefined, spreading arrays. */
 export declare function serializeQuery(query: QueryParams | undefined): string;
@@ -89,6 +145,7 @@ export declare function createRequest(config: AtlasClientConfig): RequestFn;
 export interface KeyedRequestConfig extends AtlasRequestSettings {
     apiUrl?: string;
     fetch?: typeof fetch;
+    secretRecipient?: string;
 }
 /**
  * The request core for any bearer key: the secret key (`sk_...`) of the

package/dist/client/request.js

@@ -49,11 +49,15 @@ function createKeyedRequest(key, config) {
         throw new Error('No fetch implementation found. Pass { fetch } to createAtlasClient on a runtime without a global fetch.');
     }
     return async function request(options) {
-        const url = joinUrl(base, options.path) + serializeQuery(options.query);
+        const dryRun = config.dryRun === true && options.method !== 'GET';
+        const url = joinUrl(base, options.path) + serializeQuery(dryRun ? { ...options.query, dry_run: 'true' } : options.query);
         const headers = {
+            ...(options.headers ?? {}),
             authorization: `Bearer ${key}`,
             accept: 'application/json',
         };
+        if (config.secretRecipient)
+            headers['x-secret-recipient'] = config.secretRecipient;
         let body;
         if (options.rawBody !== undefined) {
             const { data, contentType } = options.rawBody;
@@ -68,7 +72,7 @@ function createKeyedRequest(key, config) {
             headers['content-type'] = 'application/json';
             body = JSON.stringify(options.body);
         }
-        if (options.idempotencyKey) {
+        if (options.idempotencyKey && !dryRun) {
             headers['idempotency-key'] = options.idempotencyKey;
         }
         const strict = options.strict ?? config.strict;

package/dist/client/request.js.map

@@ -1 +1 @@
-{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/client/request.ts"],"names":[],"mappings":";;;AAuFA,wCAYC;AAGD,kBAEC;AAYD,sCAKC;AAYD,gDAoEC;AAzMD,mCAA6D;AA+D7D,sEAAsE;AACzD,QAAA,eAAe,GAAG,2BAA2B,CAAC;AAsB3D,uFAAuF;AACvF,SAAgB,cAAc,CAAC,KAA8B;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS;YAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAgB,GAAG,CAAC,OAAe;IACjC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAClF,CAAC;AAQD,SAAgB,aAAa,CAAC,MAAyB;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAQD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,GAAW,EAAE,MAA0B;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,uBAAe,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACnD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,UAAU,OAAO,CAAI,OAAuB;QACtD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAExE,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,IAAyB,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;YAC9C,MAAM,IAAI,GACR,WAAW,IAAI,CAAC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;YAC/B,IAAI,GAAG,IAA2B,CAAC;QACrC,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrD,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,CAAC;YAChE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,OAAO;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAEnD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAc,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB;IAC1C,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,OAA2B,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG;YACP;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,OAAO,IAAI,wCAAwC,QAAQ,CAAC,MAAM,EAAE;aAC9E;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,qBAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/client/request.ts"],"names":[],"mappings":";;;AA0IA,wCAYC;AAGD,kBAEC;AAYD,sCAKC;AAaD,gDAuEC;AAhQD,mCAA6D;AAgH7D,sEAAsE;AACzD,QAAA,eAAe,GAAG,2BAA2B,CAAC;AAwB3D,uFAAuF;AACvF,SAAgB,cAAc,CAAC,KAA8B;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS;YAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAgB,GAAG,CAAC,OAAe;IACjC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAClF,CAAC;AAQD,SAAgB,aAAa,CAAC,MAAyB;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AASD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,GAAW,EAAE,MAA0B;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,uBAAe,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACnD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,UAAU,OAAO,CAAI,OAAuB;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;QAClE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAEzH,MAAM,OAAO,GAA2B;YACtC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YAC1B,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,MAAM,CAAC,eAAe;YAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QACnF,IAAI,IAAyB,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;YAC9C,MAAM,IAAI,GACR,WAAW,IAAI,CAAC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;YAC/B,IAAI,GAAG,IAA2B,CAAC;QACrC,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrD,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,CAAC;YAChE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,OAAO;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAEnD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAc,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB;IAC1C,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,OAA2B,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG;YACP;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,OAAO,IAAI,wCAAwC,QAAQ,CAAC,MAAM,EAAE;aAC9E;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,qBAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}

package/dist/client/sealed-box.d.ts

@@ -0,0 +1,7 @@
+export declare function beforeNm(publicKey: Uint8Array, secretKey: Uint8Array): Uint8Array;
+export declare function generateSealKeyPair(): {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+};
+export declare function sealBox(message: Uint8Array | string, recipientPublicKey: Uint8Array): Uint8Array;
+export declare function openSealedBox(sealed: Uint8Array, publicKey: Uint8Array, secretKey: Uint8Array): Uint8Array;

package/dist/client/sealed-box.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.beforeNm = beforeNm;
+exports.generateSealKeyPair = generateSealKeyPair;
+exports.sealBox = sealBox;
+exports.openSealedBox = openSealedBox;
+const ed25519_1 = require("@noble/curves/ed25519");
+const salsa_1 = require("@noble/ciphers/salsa");
+const blake2b_1 = require("@noble/hashes/blake2b");
+/**
+ * libsodium `crypto_box_seal` / `crypto_box_seal_open`, in pure JS so the
+ * client keeps running on every runtime (Node, Deno, Bun, edge, browsers).
+ *
+ *   nonce = BLAKE2b-192(epk ‖ pk);  k = HSalsa20(X25519(sk, pk), 0¹⁶)
+ *   box   = epk ‖ XSalsa20-Poly1305(k, nonce, message)
+ */
+const SIGMA = new Uint32Array([0x61707865, 0x3320646e, 0x79622d32, 0x6b206574]);
+function u32(b) {
+    const out = new Uint32Array(b.length / 4);
+    for (let i = 0; i < out.length; i += 1)
+        out[i] = (b[i * 4] | (b[i * 4 + 1] << 8) | (b[i * 4 + 2] << 16) | (b[i * 4 + 3] << 24)) >>> 0;
+    return out;
+}
+function beforeNm(publicKey, secretKey) {
+    const shared = ed25519_1.x25519.getSharedSecret(secretKey, publicKey);
+    const out = new Uint32Array(8);
+    (0, salsa_1.hsalsa)(SIGMA, u32(shared), new Uint32Array(4), out);
+    const bytes = new Uint8Array(32);
+    out.forEach((w, i) => {
+        bytes[i * 4] = w & 0xff;
+        bytes[i * 4 + 1] = (w >>> 8) & 0xff;
+        bytes[i * 4 + 2] = (w >>> 16) & 0xff;
+        bytes[i * 4 + 3] = (w >>> 24) & 0xff;
+    });
+    return bytes;
+}
+function nonceFor(epk, pk) {
+    const input = new Uint8Array(64);
+    input.set(epk, 0);
+    input.set(pk, 32);
+    return (0, blake2b_1.blake2b)(input, { dkLen: 24 });
+}
+function generateSealKeyPair() {
+    const secretKey = ed25519_1.x25519.utils.randomPrivateKey();
+    return { publicKey: ed25519_1.x25519.getPublicKey(secretKey), secretKey };
+}
+function sealBox(message, recipientPublicKey) {
+    const plain = typeof message === 'string' ? new TextEncoder().encode(message) : message;
+    const eph = generateSealKeyPair();
+    const boxed = (0, salsa_1.xsalsa20poly1305)(beforeNm(recipientPublicKey, eph.secretKey), nonceFor(eph.publicKey, recipientPublicKey)).encrypt(plain);
+    const out = new Uint8Array(32 + boxed.length);
+    out.set(eph.publicKey, 0);
+    out.set(boxed, 32);
+    return out;
+}
+function openSealedBox(sealed, publicKey, secretKey) {
+    if (sealed.length < 48)
+        throw new Error('openSealedBox: too short');
+    const epk = sealed.subarray(0, 32);
+    return (0, salsa_1.xsalsa20poly1305)(beforeNm(epk, secretKey), nonceFor(epk, publicKey)).decrypt(sealed.subarray(32));
+}
+//# sourceMappingURL=sealed-box.js.map

package/dist/client/sealed-box.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed-box.js","sourceRoot":"","sources":["../../src/client/sealed-box.ts"],"names":[],"mappings":";;AAoBA,4BAYC;AASD,kDAGC;AAED,0BAQC;AAED,sCAIC;AA5DD,mDAA+C;AAC/C,gDAAgE;AAChE,mDAAgD;AAEhD;;;;;;GAMG;AAEH,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhF,SAAS,GAAG,CAAC,CAAa;IACxB,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1I,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,QAAQ,CAAC,SAAqB,EAAE,SAAqB;IACnE,MAAM,MAAM,GAAG,gBAAM,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAA,cAAM,EAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnB,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;QACpC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QACrC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAe,EAAE,EAAc;IAC/C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClB,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAClB,OAAO,IAAA,iBAAO,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAgB,mBAAmB;IACjC,MAAM,SAAS,GAAG,gBAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IAClD,OAAO,EAAE,SAAS,EAAE,gBAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED,SAAgB,OAAO,CAAC,OAA4B,EAAE,kBAA8B;IAClF,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,IAAA,wBAAgB,EAAC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxI,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC1B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,aAAa,CAAC,MAAkB,EAAE,SAAqB,EAAE,SAAqB;IAC5F,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,IAAA,wBAAgB,EAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3G,CAAC"}

package/dist/client/sessions.d.ts

@@ -59,6 +59,16 @@ export interface MintedSession {
     custom_data?: Record<string, unknown> | null;
 }
 /** A JWT minted from a named JWT template. */
+/** An identity-integration token (claims: /schemas/integration-token-v1.json). */
+export interface SessionIntegrationToken {
+    object: 'integration_token';
+    integration: string;
+    product: string;
+    jwt: string;
+    /** Seconds until the token expires (at most 120). */
+    expires_in: number;
+    audience: string;
+}
 export interface SessionTemplateToken {
     object: string;
     jwt: string;
@@ -98,9 +108,10 @@ export declare function sessionsResource(request: RequestFn): {
      * effective write per minute, so calling it on every request is safe.
      */
     touch(id: string): Promise<TouchedSession>;
-    /**
-     * `POST /v1/sessions/:id/tokens/:template` — mint a token from a named JWT
-     * template for this session. The reserved name `session` is refused.
-     */
-    getToken(id: string, template: string): Promise<SessionTemplateToken>;
+    getToken: {
+        (id: string, template: string): Promise<SessionTemplateToken>;
+        (id: string, options: {
+            for: string;
+        }): Promise<SessionIntegrationToken>;
+    };
 };

package/dist/client/sessions.js

@@ -3,6 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sessionsResource = sessionsResource;
 const request_1 = require("./request");
 function sessionsResource(request) {
+    function getToken(id, what) {
+        if (typeof what === 'object') {
+            return request({ method: 'POST', path: `/v1/sessions/${(0, request_1.enc)(id)}/integration_tokens/${(0, request_1.enc)(what.for)}` });
+        }
+        return request({ method: 'POST', path: `/v1/sessions/${(0, request_1.enc)(id)}/tokens/${(0, request_1.enc)(what)}` });
+    }
     return {
         /**
          * `POST /v1/sessions` — mint a session for a user without the sign-in flow.
@@ -46,16 +52,7 @@ function sessionsResource(request) {
         touch(id) {
             return request({ method: 'POST', path: `/v1/sessions/${(0, request_1.enc)(id)}/touch` });
         },
-        /**
-         * `POST /v1/sessions/:id/tokens/:template` — mint a token from a named JWT
-         * template for this session. The reserved name `session` is refused.
-         */
-        getToken(id, template) {
-            return request({
-                method: 'POST',
-                path: `/v1/sessions/${(0, request_1.enc)(id)}/tokens/${(0, request_1.enc)(template)}`,
-            });
-        },
+        getToken,
     };
 }
 //# sourceMappingURL=sessions.js.map

package/dist/client/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/client/sessions.ts"],"names":[],"mappings":";;AAsEA,4CAuDC;AA7HD,uCAAgD;AAsEhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL;;;WAGG;QACH,MAAM,CAAC,MAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,wDAAwD;QACxD,IAAI,CAAC,MAA0B;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;WAIG;QACH,aAAa,CAAC,EAAU,EAAE,UAA0C;YAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;QACD;;;WAGG;QACH,gBAAgB,CAAC,EAAU,EAAE,KAA8B;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjH,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,QAAQ,CAAC,EAAU,EAAE,QAAgB;YACnC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/client/sessions.ts"],"names":[],"mappings":";;AAiFA,4CA+DC;AAhJD,uCAAgD;AAiFhD,SAAgB,gBAAgB,CAAC,OAAkB;IAYjD,SAAS,QAAQ,CAAC,EAAU,EAAE,IAA8B;QAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO;QACL;;;WAGG;QACH,MAAM,CAAC,MAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,wDAAwD;QACxD,IAAI,CAAC,MAA0B;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;WAIG;QACH,aAAa,CAAC,EAAU,EAAE,UAA0C;YAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;QACD;;;WAGG;QACH,gBAAgB,CAAC,EAAU,EAAE,KAA8B;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjH,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC"}