@atlasauth/backend 0.21.0 → 0.23.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @atlasauth/backend changelog
 
+## Unreleased
+
+## 0.23.0 — 2026-10-25
+
+### Added
+
+- `jwtTemplates.create` and `jwtTemplates.update` take `settings` (`lifetime_seconds` 10–86400, `audience`, `algorithm`, `signing_secret`); `JwtTemplate` returns `settings`. `update` accepts claims, settings or both.
+- `instance.integrations.rotateEventsSecret(id, { overlap_seconds })`: rotate an integration's event signing secret, with the old one still signing during the overlap.
+- `startDeviceAuthorization({ issuer, clientId, clientSecret?, scope?, resource? })` and `pollDeviceAuthorization(start)`: the RFC 8628 device flow against any instance's OAuth server, for a CLI of your own. `startOperatorLogin` / `pollOperatorLogin` now use them.
+- `authenticatedWithin(claims, maxAgeSeconds)` and `usedMultiFactor(claims)`: step-up checks on a verified token's `auth_time`, `acr` and `amr`.
+
+## 0.22.0 — 2026-10-25
+
+### Added
+
+- `platform.atlasIdApps.provisionedAccounts` (`list`, `create`, `get`, `remove`, `rotatePassword`): test and review accounts for a Sign in with Atlas app (reviewer logins, CI, demos), confined to that app. Passwords come back once. Takes `platform:atlas_id_apps:provision` or the per-app `atlas_id_apps:<app id>:provision` scope.
+- `platform.domains` (`list`, `claim`, `verify`, `remove`): the account's DNS-verified domains.
+- `test_mode` and `provisioned_verified_domains_only` on Sign in with Atlas apps (`update` accepts them); `AtlasErrorCodes.TEST_ACCOUNT_RESTRICTED`, `PROVISIONED_ACCOUNT_LIMIT_REACHED`, `DOMAIN_NOT_VERIFIED`.
+
 ## 0.21.0 — 2026-10-24
 
 - Per-call integration audiences (`getToken({ for, cbid })`), partner platforms, operator tokens for partner products.

package/dist/client/error.d.ts

@@ -69,6 +69,12 @@ export declare const AtlasErrorCodes: {
     readonly REFERRAL_CODE_TAKEN: "REFERRAL_CODE_TAKEN";
     /** 422 — managed WAF provision/deprovision on an instance with no WAF configuration saved (`meta.action`). */
     readonly MANAGED_WAF_NOT_CONFIGURED: "MANAGED_WAF_NOT_CONFIGURED";
+    /** 403 — a Sign in with Atlas test or review account used outside the app it was made for. */
+    readonly TEST_ACCOUNT_RESTRICTED: "TEST_ACCOUNT_RESTRICTED";
+    /** 409 — the account already holds its maximum number of test and review accounts (`meta.limit`). */
+    readonly PROVISIONED_ACCOUNT_LIMIT_REACHED: "PROVISIONED_ACCOUNT_LIMIT_REACHED";
+    /** 422 — the setting or address needs a domain the account has verified, and this one is not. */
+    readonly DOMAIN_NOT_VERIFIED: "DOMAIN_NOT_VERIFIED";
     /** The billing plan still has subscribers and cannot be removed. */
     readonly PLAN_IN_USE: "PLAN_IN_USE";
     /** The key is valid but for another API surface (e.g. a platform key on the Backend API). */

package/dist/client/error.js

@@ -59,6 +59,12 @@ exports.AtlasErrorCodes = {
     REFERRAL_CODE_TAKEN: 'REFERRAL_CODE_TAKEN',
     /** 422 — managed WAF provision/deprovision on an instance with no WAF configuration saved (`meta.action`). */
     MANAGED_WAF_NOT_CONFIGURED: 'MANAGED_WAF_NOT_CONFIGURED',
+    /** 403 — a Sign in with Atlas test or review account used outside the app it was made for. */
+    TEST_ACCOUNT_RESTRICTED: 'TEST_ACCOUNT_RESTRICTED',
+    /** 409 — the account already holds its maximum number of test and review accounts (`meta.limit`). */
+    PROVISIONED_ACCOUNT_LIMIT_REACHED: 'PROVISIONED_ACCOUNT_LIMIT_REACHED',
+    /** 422 — the setting or address needs a domain the account has verified, and this one is not. */
+    DOMAIN_NOT_VERIFIED: 'DOMAIN_NOT_VERIFIED',
     /** The billing plan still has subscribers and cannot be removed. */
     PLAN_IN_USE: 'PLAN_IN_USE',
     /** The key is valid but for another API surface (e.g. a platform key on the Backend API). */

package/dist/client/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AA0BA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,6BAA6B,EAAE,+BAA+B;IAC9D,mEAAmE;IACnE,uBAAuB,EAAE,yBAAyB;IAClD,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,wGAAwG;IACxG,cAAc,EAAE,gBAAgB;IAChC,0FAA0F;IAC1F,aAAa,EAAE,eAAe;IAC9B,uIAAuI;IACvI,eAAe,EAAE,iBAAiB;IAClC,oFAAoF;IACpF,6BAA6B,EAAE,+BAA+B;IAC9D,8EAA8E;IAC9E,6BAA6B,EAAE,+BAA+B;IAC9D,6HAA6H;IAC7H,+BAA+B,EAAE,iCAAiC;IAClE,kGAAkG;IAClG,sCAAsC,EAAE,wCAAwC;IAChF,2GAA2G;IAC3G,wBAAwB,EAAE,0BAA0B;IACpD,2EAA2E;IAC3E,mBAAmB,EAAE,qBAAqB;IAC1C,8GAA8G;IAC9G,0BAA0B,EAAE,4BAA4B;IACxD,oEAAoE;IACpE,WAAW,EAAE,aAAa;IAC1B,6FAA6F;IAC7F,iBAAiB,EAAE,mBAAmB;IACtC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,+FAA+F;IAC/F,eAAe,EAAE,iBAAiB;IAClC,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,4FAA4F;IAC5F,oBAAoB,EAAE,sBAAsB;IAC5C,yFAAyF;IACzF,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;IAClC,aAAa,EAAE,eAAe;IAC9B,kBAAkB,EAAE,oBAAoB;IACxC,gBAAgB,EAAE,kBAAkB;IACpC,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACZ,CAAC"}
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AA0BA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,6BAA6B,EAAE,+BAA+B;IAC9D,mEAAmE;IACnE,uBAAuB,EAAE,yBAAyB;IAClD,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,wGAAwG;IACxG,cAAc,EAAE,gBAAgB;IAChC,0FAA0F;IAC1F,aAAa,EAAE,eAAe;IAC9B,uIAAuI;IACvI,eAAe,EAAE,iBAAiB;IAClC,oFAAoF;IACpF,6BAA6B,EAAE,+BAA+B;IAC9D,8EAA8E;IAC9E,6BAA6B,EAAE,+BAA+B;IAC9D,6HAA6H;IAC7H,+BAA+B,EAAE,iCAAiC;IAClE,kGAAkG;IAClG,sCAAsC,EAAE,wCAAwC;IAChF,2GAA2G;IAC3G,wBAAwB,EAAE,0BAA0B;IACpD,2EAA2E;IAC3E,mBAAmB,EAAE,qBAAqB;IAC1C,8GAA8G;IAC9G,0BAA0B,EAAE,4BAA4B;IACxD,8FAA8F;IAC9F,uBAAuB,EAAE,yBAAyB;IAClD,qGAAqG;IACrG,iCAAiC,EAAE,mCAAmC;IACtE,iGAAiG;IACjG,mBAAmB,EAAE,qBAAqB;IAC1C,oEAAoE;IACpE,WAAW,EAAE,aAAa;IAC1B,6FAA6F;IAC7F,iBAAiB,EAAE,mBAAmB;IACtC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,+FAA+F;IAC/F,eAAe,EAAE,iBAAiB;IAClC,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,4FAA4F;IAC5F,oBAAoB,EAAE,sBAAsB;IAC5C,yFAAyF;IACzF,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;IAClC,aAAa,EAAE,eAAe;IAC9B,kBAAkB,EAAE,oBAAoB;IACxC,gBAAgB,EAAE,kBAAkB;IACpC,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACZ,CAAC"}

package/dist/client/index.d.ts

@@ -580,9 +580,7 @@ declare function buildNamespaces(request: RequestFn): {
         list(): Promise<import("./types").ListPage<import("./jwt-templates").JwtTemplate>>;
         get(name: string): Promise<import("./jwt-templates").JwtTemplate>;
         create(body: import("./jwt-templates").CreateJwtTemplateBody): Promise<import("./jwt-templates").JwtTemplate>;
-        update(name: string, body: {
-            claims: Record<string, string>;
-        }): Promise<import("./jwt-templates").JwtTemplate>;
+        update(name: string, body: import("./jwt-templates").UpdateJwtTemplateBody): Promise<import("./jwt-templates").JwtTemplate>;
         delete(name: string): Promise<{
             object: "jwt_template";
             name: string;
@@ -1195,6 +1193,18 @@ declare function buildNamespaces(request: RequestFn): {
                 url: string;
                 secret: string;
             }>;
+            rotateEventsSecret(id: string, body?: {
+                overlap_seconds?: number;
+            }): Promise<{
+                object: "integration_events_secret";
+                integration: string;
+                endpoint_id: string;
+                url: string;
+                secret: string;
+                overlap_seconds: number;
+                previous_secret_expires_at: number | null;
+                warning: string;
+            }>;
             atlasIdToken(id: string, accessToken: string): Promise<import("./instance").IntegrationTokenResponse>;
             chatly: {
                 get(): Promise<import("./instance").ChatlyIntegration>;

package/dist/client/instance.d.ts

@@ -28,8 +28,31 @@ export interface Instance {
      */
     allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
     auth_config: Metadata;
+    /**
+     * Sign-in methods that are switched on but not offered to users, because they
+     * need an email provider and the instance has none (email is bring-your-own).
+     * They become active on their own once a provider is configured.
+     */
+    inactive_methods?: InactiveMethod[];
+    /** Methods that still work, minus the parts that need email (e.g. password without reset). */
+    limited_methods?: LimitedMethod[];
     created_at: number;
 }
+/** A switched-on sign-in method that is not offered to users, and why. */
+export interface InactiveMethod {
+    method: 'password' | 'email_code' | 'email_link';
+    reason: 'email_provider_required';
+}
+/**
+ * A sign-in method that works, minus parts that need email: password sign-in
+ * for users who already hold a password, without reset (and without sign-up
+ * while sign-up must verify the address by email).
+ */
+export interface LimitedMethod {
+    method: 'password';
+    reason: 'email_provider_required';
+    unavailable: Array<'password_reset' | 'password_sign_up'>;
+}
 /**
  * How an allowed origin signs in: `redirect` (hosted-redirect OIDC: the app
  * never runs the embedded components), `embedded` (the sign-in components run
@@ -55,12 +78,32 @@ export interface InstanceUpdateResult {
     allowed_origins: string[];
     allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
     auth_config: Metadata;
+    /**
+     * The write is accepted even when a method needs an email provider the
+     * instance does not have yet (Terraform or config import may add it later in
+     * the same apply). Such methods are listed here and are not offered to users
+     * until a provider is configured.
+     */
+    inactive_methods?: InactiveMethod[];
+    /** Methods that still work, minus the parts that need email. */
+    limited_methods?: LimitedMethod[];
 }
+/**
+ * Setup-check codes about sign-in methods that need email. The full list is at
+ * `GET /v1/instance/preflight/codes`; a finding's `code` may be any of them.
+ *
+ * - `email_provider_missing`: an enabled method needs email and the instance has no
+ *   email provider (`subject.methods` names them). A warning while the methods are
+ *   inactive, an error while users with a password cannot reset it.
+ * - `instance_sign_in_unused` (info): the instance's own sign-in methods are on but
+ *   every user signs in with Sign in with Atlas.
+ */
+export type EmailSignInPreflightCode = 'email_provider_missing' | 'email_sign_in_available' | 'instance_sign_in_unused' | 'no_usable_sign_in_methods' | 'sign_up_unreachable';
 /** One problem (or note) the setup check found. */
 export interface PreflightFinding {
     severity: 'error' | 'warning' | 'info';
     /** Stable snake_case identifier, e.g. `oauth_provider_missing_credentials`. */
-    code: string;
+    code: EmailSignInPreflightCode | (string & {});
     /** What is wrong, in a plain sentence. */
     message: string;
     /** What to do about it, in a plain sentence. */
@@ -720,6 +763,23 @@ export declare function instanceResource(request: RequestFn): {
             url: string;
             secret: string;
         }>;
+        /**
+         * Rotate the event receiver's signing secret (shown once). With
+         * `overlap_seconds` (at most 604800) the old secret keeps signing every
+         * delivery as a second Atlas-Signature entry until `previous_secret_expires_at`.
+         */
+        rotateEventsSecret(id: string, body?: {
+            overlap_seconds?: number;
+        }): Promise<{
+            object: "integration_events_secret";
+            integration: string;
+            endpoint_id: string;
+            url: string;
+            secret: string;
+            overlap_seconds: number;
+            previous_secret_expires_at: number | null;
+            warning: string;
+        }>;
         /** An integration token for a Sign in with Atlas user (their Atlas ID access token). */
         atlasIdToken(id: string, accessToken: string): Promise<IntegrationTokenResponse>;
         chatly: {

package/dist/client/instance.js

@@ -93,6 +93,14 @@ function instanceResource(request) {
             revealEventsSecret(id) {
                 return request({ method: 'POST', path: `/v1/instance/integrations/${encodeURIComponent(id)}/events_secret` });
             },
+            /**
+             * Rotate the event receiver's signing secret (shown once). With
+             * `overlap_seconds` (at most 604800) the old secret keeps signing every
+             * delivery as a second Atlas-Signature entry until `previous_secret_expires_at`.
+             */
+            rotateEventsSecret(id, body = {}) {
+                return request({ method: 'POST', path: `/v1/instance/integrations/${encodeURIComponent(id)}/events_secret/rotate`, body });
+            },
             /** An integration token for a Sign in with Atlas user (their Atlas ID access token). */
             atlasIdToken(id, accessToken) {
                 return request({

package/dist/client/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAymBA,4CA8IC;AA9ID,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS,CAAC,SAA0B,EAAE;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD;;;;WAIG;QACH,mBAAmB,CAAC,SAA4B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,mGAAmG;QACnG,WAAW,CAAC,MAA2C;YACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,iBAAiB,CAAC,SAA+C,EAAE;YACjE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC9G,CAAC,CAAC;QACL,CAAC;QACD,oEAAoE;QACpE,0BAA0B;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,MAAsF;YAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,YAAY,EAAE;YACZ,+FAA+F;YAC/F,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,yFAAyF;YACzF,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,OAA6B,EAAE;gBACvE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC3D,IAAI;oBACJ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,2FAA2F;YAC3F,UAAU,CACR,EAAU,EACV,QAAmF,EAAE;gBAErF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,4DAA4D;YAC5D,kBAAkB,CAAC,EAAU;gBAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAChH,CAAC;YACD,wFAAwF;YACxF,YAAY,CAAC,EAAU,EAAE,WAAmB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,kBAAkB;oBAC3E,IAAI,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AA4pBA,4CAkKC;AAlKD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS,CAAC,SAA0B,EAAE;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD;;;;WAIG;QACH,mBAAmB,CAAC,SAA4B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,mGAAmG;QACnG,WAAW,CAAC,MAA2C;YACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,iBAAiB,CAAC,SAA+C,EAAE;YACjE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC9G,CAAC,CAAC;QACL,CAAC;QACD,oEAAoE;QACpE,0BAA0B;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,MAAsF;YAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,YAAY,EAAE;YACZ,+FAA+F;YAC/F,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,yFAAyF;YACzF,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,OAA6B,EAAE;gBACvE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC3D,IAAI;oBACJ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,2FAA2F;YAC3F,UAAU,CACR,EAAU,EACV,QAAmF,EAAE;gBAErF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,4DAA4D;YAC5D,kBAAkB,CAAC,EAAU;gBAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAChH,CAAC;YACD;;;;eAIG;YACH,kBAAkB,CAChB,EAAU,EACV,OAAqC,EAAE;gBAWvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7H,CAAC;YACD,wFAAwF;YACxF,YAAY,CAAC,EAAU,EAAE,WAAmB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,kBAAkB;oBAC3E,IAAI,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/jwt-templates.d.ts

@@ -4,20 +4,45 @@ export interface JwtTemplate {
     object: 'jwt_template';
     name: string;
     claims: Record<string, string>;
+    /** Non-secret mint settings; the HS256 secret is never returned. */
+    settings?: {
+        lifetime_seconds: number | null;
+        audience: string | null;
+        algorithm: 'RS256' | 'HS256';
+        has_signing_secret: boolean;
+    };
+}
+/**
+ * Per-template mint settings. `lifetime_seconds` is 10–86400 (default: the
+ * instance session-token lifetime, 60 s); null clears a value on update.
+ */
+export interface JwtTemplateSettingsInput {
+    lifetime_seconds?: number | null;
+    audience?: string | null;
+    algorithm?: 'RS256' | 'HS256';
+    /** HS256 shared secret, at least 16 characters. Write-only. */
+    signing_secret?: string;
 }
 export interface CreateJwtTemplateBody {
     name: string;
+    /**
+     * Claim → expression. `{{org.id}}`, `{{org.membership_id}}` and `{{org.role}}`
+     * resolve per session from the active organization at mint time.
+     */
     claims: Record<string, string>;
+    settings?: JwtTemplateSettingsInput;
+}
+export interface UpdateJwtTemplateBody {
+    claims?: Record<string, string>;
+    settings?: JwtTemplateSettingsInput;
 }
 export declare function jwtTemplatesResource(request: RequestFn): {
     list(): Promise<ListPage<JwtTemplate>>;
     /** Fetched by template name. */
     get(name: string): Promise<JwtTemplate>;
     create(body: CreateJwtTemplateBody): Promise<JwtTemplate>;
-    /** Only the claims are updatable; the name is the key. */
-    update(name: string, body: {
-        claims: Record<string, string>;
-    }): Promise<JwtTemplate>;
+    /** Claims and/or settings; the name is the key and cannot change. */
+    update(name: string, body: UpdateJwtTemplateBody): Promise<JwtTemplate>;
     delete(name: string): Promise<{
         object: "jwt_template";
         name: string;

package/dist/client/jwt-templates.js

@@ -14,7 +14,7 @@ function jwtTemplatesResource(request) {
         create(body) {
             return request({ method: 'POST', path: '/v1/jwt_templates', body });
         },
-        /** Only the claims are updatable; the name is the key. */
+        /** Claims and/or settings; the name is the key and cannot change. */
         update(name, body) {
             return request({ method: 'PATCH', path: `/v1/jwt_templates/${(0, request_1.enc)(name)}`, body });
         },

package/dist/client/jwt-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-templates.js","sourceRoot":"","sources":["../../src/client/jwt-templates.ts"],"names":[],"mappings":";;AAcA,oDAoBC;AAlCD,uCAAgD;AAchD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,gCAAgC;QAChC,GAAG,CAAC,IAAY;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,0DAA0D;QAC1D,MAAM,CAAC,IAAY,EAAE,IAAwC;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"jwt-templates.js","sourceRoot":"","sources":["../../src/client/jwt-templates.ts"],"names":[],"mappings":";;AA2CA,oDAoBC;AA/DD,uCAAgD;AA2ChD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,gCAAgC;QAChC,GAAG,CAAC,IAAY;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,qEAAqE;QACrE,MAAM,CAAC,IAAY,EAAE,IAA2B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/operator.d.ts

@@ -54,6 +54,41 @@ interface Opts {
 }
 /** GET /v1/operator — where the operator device flow and token exchange live. */
 export declare function operatorConfiguration(opts?: Opts): Promise<OperatorConfiguration>;
+/**
+ * Start an RFC 8628 device flow against any Atlas instance's OAuth server, for a
+ * CLI or TV app of your own: `issuer` is the instance's issuer (its Frontend API
+ * host, e.g. `https://acme-fapi.atlasauth.net`) and `clientId` an OAuth client
+ * with the `urn:ietf:params:oauth:grant-type:device_code` grant. Show the person
+ * `verification_uri_complete` (or `verification_uri` + `user_code`), then
+ * {@link pollDeviceAuthorization}. A confidential client passes `clientSecret`.
+ */
+export declare function startDeviceAuthorization(params: {
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    scope?: string | string[];
+    resource?: string;
+}, opts?: Pick<Opts, 'fetch'>): Promise<DeviceAuthorization & {
+    config: DeviceFlowEndpoints;
+}>;
+/** Where a device flow runs: {@link startDeviceAuthorization} fills it from the issuer. */
+export interface DeviceFlowEndpoints {
+    device_authorization_endpoint: string;
+    token_endpoint: string;
+    client_id: string;
+    client_secret?: string;
+}
+/**
+ * Poll the token endpoint until the person approves (resolves the tokens),
+ * denies (`access_denied`) or the code expires (`expired_token`); both throw an
+ * {@link OAuthFlowError}. Honours `interval` and adds 5 s on each `slow_down`.
+ */
+export declare function pollDeviceAuthorization(start: DeviceAuthorization & {
+    config: DeviceFlowEndpoints;
+}, opts?: Pick<Opts, 'fetch'> & {
+    sleep?: (ms: number) => Promise<void>;
+    signal?: AbortSignal;
+}): Promise<OAuthTokenResponse>;
 /**
  * Start the device flow. With `audience` (one of the configuration's
  * `audiences`), the operator token is minted FOR that other product

package/dist/client/operator.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.openSealedBox = exports.sealBox = exports.OAuthFlowError = void 0;
 exports.operatorConfiguration = operatorConfiguration;
+exports.startDeviceAuthorization = startDeviceAuthorization;
+exports.pollDeviceAuthorization = pollDeviceAuthorization;
 exports.startOperatorLogin = startOperatorLogin;
 exports.pollOperatorLogin = pollOperatorLogin;
 exports.exchangeOperatorToken = exchangeOperatorToken;
@@ -42,27 +44,41 @@ async function operatorConfiguration(opts = {}) {
     return (await res.json());
 }
 /**
- * Start the device flow. With `audience` (one of the configuration's
- * `audiences`), the operator token is minted FOR that other product
- * (`aud=<audience>`, sent as the RFC 8707 `resource`): hand it to that product;
- * Atlas's own token exchange refuses it.
+ * Start an RFC 8628 device flow against any Atlas instance's OAuth server, for a
+ * CLI or TV app of your own: `issuer` is the instance's issuer (its Frontend API
+ * host, e.g. `https://acme-fapi.atlasauth.net`) and `clientId` an OAuth client
+ * with the `urn:ietf:params:oauth:grant-type:device_code` grant. Show the person
+ * `verification_uri_complete` (or `verification_uri` + `user_code`), then
+ * {@link pollDeviceAuthorization}. A confidential client passes `clientSecret`.
  */
-async function startOperatorLogin(opts = {}) {
-    const config = opts.config ?? (await operatorConfiguration(opts));
-    const out = await form(opts.fetch ?? globalThis.fetch, config.device_authorization_endpoint, {
+async function startDeviceAuthorization(params, opts = {}) {
+    const base = params.issuer.replace(/\/+$/, '');
+    const config = {
+        device_authorization_endpoint: `${base}/oauth2/device_authorization`,
+        token_endpoint: `${base}/oauth2/token`,
+        client_id: params.clientId,
+        ...(params.clientSecret ? { client_secret: params.clientSecret } : {}),
+    };
+    const scope = Array.isArray(params.scope) ? params.scope.join(' ') : params.scope;
+    return startDevice(opts.fetch ?? globalThis.fetch, config, { scope, resource: params.resource });
+}
+async function startDevice(f, config, params) {
+    const out = await form(f, config.device_authorization_endpoint, {
         client_id: config.client_id,
-        scope: config.scope,
-        ...(opts.audience ? { resource: opts.audience } : {}),
+        ...(config.client_secret ? { client_secret: config.client_secret } : {}),
+        ...(params.scope ? { scope: params.scope } : {}),
+        ...(params.resource ? { resource: params.resource } : {}),
     });
     if (out._status !== 200)
         throw new OAuthFlowError(String(out.error ?? 'error'), String(out.error_description ?? 'Device authorization failed.'), out._status);
     return { ...out, config };
 }
 /**
- * Poll until the person approves (resolves the operator token), denies or the
- * code expires (throws). Honours `interval` and `slow_down`.
+ * Poll the token endpoint until the person approves (resolves the tokens),
+ * denies (`access_denied`) or the code expires (`expired_token`); both throw an
+ * {@link OAuthFlowError}. Honours `interval` and adds 5 s on each `slow_down`.
  */
-async function pollOperatorLogin(start, opts = {}) {
+async function pollDeviceAuthorization(start, opts = {}) {
     const f = opts.fetch ?? globalThis.fetch;
     const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     let interval = Math.max(1, start.interval) * 1000;
@@ -75,6 +91,7 @@ async function pollOperatorLogin(start, opts = {}) {
             grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
             device_code: start.device_code,
             client_id: start.config.client_id,
+            ...(start.config.client_secret ? { client_secret: start.config.client_secret } : {}),
         });
         if (out._status === 200)
             return out;
@@ -88,6 +105,24 @@ async function pollOperatorLogin(start, opts = {}) {
     }
     throw new OAuthFlowError('expired_token', 'The sign-in code expired. Run the login again.', 400);
 }
+/**
+ * Start the device flow. With `audience` (one of the configuration's
+ * `audiences`), the operator token is minted FOR that other product
+ * (`aud=<audience>`, sent as the RFC 8707 `resource`): hand it to that product;
+ * Atlas's own token exchange refuses it.
+ */
+async function startOperatorLogin(opts = {}) {
+    const config = opts.config ?? (await operatorConfiguration(opts));
+    const out = await startDevice(opts.fetch ?? globalThis.fetch, config, { scope: config.scope, resource: opts.audience });
+    return { ...out, config };
+}
+/**
+ * Poll until the person approves (resolves the operator token), denies or the
+ * code expires (throws). Honours `interval` and `slow_down`.
+ */
+async function pollOperatorLogin(start, opts = {}) {
+    return pollDeviceAuthorization(start, opts);
+}
 /** RFC 8693: swap an operator token for a one-hour, resource-bound Atlas token. */
 async function exchangeOperatorToken(subjectToken, params, opts = {}) {
     const out = await form(opts.fetch ?? globalThis.fetch, `${(opts.apiUrl ?? DEFAULT_API).replace(/\/+$/, '')}/v1/oauth/token`, {

package/dist/client/operator.js.map

@@ -1 +1 @@
-{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/client/operator.ts"],"names":[],"mappings":";;;AAmFA,sDAKC;AAQD,gDAWC;AAMD,8CAyBC;AAGD,sDAmBC;AAGD,4CAUC;AAGD,kDAGC;AAGD,4CAEC;AAGD,4CAYC;AAvMD,6CAAiF;AAEjF,MAAM,KAAK,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAmDhF,MAAa,cAAe,SAAQ,KAAK;IAE5B;IAEA;IAHX,YACW,KAAa,EACtB,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,UAAK,GAAL,KAAK,CAAQ;QAEb,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AATD,wCASC;AAOD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD,KAAK,UAAU,IAAI,CAAC,SAAuB,EAAE,GAAW,EAAE,IAA4B;IACpF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,iFAAiF;AAC1E,KAAK,UAAU,qBAAqB,CAAC,OAAa,EAAE;IACzD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACpI,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,2DAA2D,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAAqE,EAAE;IAEvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,6BAA6B,EAAE;QAC3F,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,8BAA8B,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9J,OAAO,EAAE,GAAI,GAAsC,EAAE,MAAM,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CACrC,KAA8D,EAC9D,OAA+E,EAAE;IAEjF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE;YACrD,UAAU,EAAE,8CAA8C;YAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;YAAE,OAAO,GAAoC,CAAC;QACrE,IAAI,GAAG,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QACpD,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,IAAI,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAC;AACnG,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,MAAsD,EACtD,OAAa,EAAE;IAEf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE;QAC3H,UAAU,EAAE,iDAAiD;QAC7D,aAAa,EAAE,YAAY;QAC3B,kBAAkB,EAAE,+CAA+C;QACnE,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;KAC3E,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3G,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC9I,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAA2D,CAAC;AACrE,CAAC;AAED,4FAA4F;AACrF,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,YAAoB,EACpB,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IAC5H,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACnI,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACvJ,OAAO,GAAoC,CAAC;AAC9C,CAAC;AAED,mFAAmF;AACnF,SAAgB,mBAAmB;IACjC,MAAM,IAAI,GAAG,IAAA,gCAAG,GAAE,CAAC;IACnB,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,oFAAoF;AACpF,SAAgB,gBAAgB,CAAC,YAAoB,EAAE,OAAyD;IAC9G,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAA,0BAAI,EAAC,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,gBAAgB,CACpC,OAAiB,EACjB,OAAgC,EAAE;IAElC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,EAAE;QAC/F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,yBAAyB,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7G,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8G,CAAC;AACzI,CAAC;AACD,2CAAsD;AAA7C,qGAAA,OAAO,OAAA;AAAE,2GAAA,aAAa,OAAA"}
+{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/client/operator.ts"],"names":[],"mappings":";;;AAmFA,sDAKC;AAUD,4DAaC;AA8BD,0DA0BC;AAQD,gDAMC;AAMD,8CAKC;AAGD,sDAmBC;AAGD,4CAUC;AAGD,kDAGC;AAGD,4CAEC;AAGD,4CAYC;AA7PD,6CAAiF;AAEjF,MAAM,KAAK,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAmDhF,MAAa,cAAe,SAAQ,KAAK;IAE5B;IAEA;IAHX,YACW,KAAa,EACtB,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,UAAK,GAAL,KAAK,CAAQ;QAEb,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AATD,wCASC;AAOD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD,KAAK,UAAU,IAAI,CAAC,SAAuB,EAAE,GAAW,EAAE,IAA4B;IACpF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,iFAAiF;AAC1E,KAAK,UAAU,qBAAqB,CAAC,OAAa,EAAE;IACzD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACpI,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,2DAA2D,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,wBAAwB,CAC5C,MAAiH,EACjH,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAwB;QAClC,6BAA6B,EAAE,GAAG,IAAI,8BAA8B;QACpE,cAAc,EAAE,GAAG,IAAI,eAAe;QACtC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAClF,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AACnG,CAAC;AAUD,KAAK,UAAU,WAAW,CACxB,CAAe,EACf,MAA2B,EAC3B,MAA6C;IAE7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,6BAA6B,EAAE;QAC9D,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,8BAA8B,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9J,OAAO,EAAE,GAAI,GAAsC,EAAE,MAAM,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,uBAAuB,CAC3C,KAA4D,EAC5D,OAA8F,EAAE;IAEhG,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE;YACrD,UAAU,EAAE,8CAA8C;YAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;YACjC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;YAAE,OAAO,GAAoC,CAAC;QACrE,IAAI,GAAG,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QACpD,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,IAAI,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAAqE,EAAE;IAEvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxH,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CACrC,KAA8D,EAC9D,OAA+E,EAAE;IAEjF,OAAO,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,MAAsD,EACtD,OAAa,EAAE;IAEf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE;QAC3H,UAAU,EAAE,iDAAiD;QAC7D,aAAa,EAAE,YAAY;QAC3B,kBAAkB,EAAE,+CAA+C;QACnE,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;KAC3E,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3G,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC9I,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAA2D,CAAC;AACrE,CAAC;AAED,4FAA4F;AACrF,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,YAAoB,EACpB,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IAC5H,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACnI,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACvJ,OAAO,GAAoC,CAAC;AAC9C,CAAC;AAED,mFAAmF;AACnF,SAAgB,mBAAmB;IACjC,MAAM,IAAI,GAAG,IAAA,gCAAG,GAAE,CAAC;IACnB,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,oFAAoF;AACpF,SAAgB,gBAAgB,CAAC,YAAoB,EAAE,OAAyD;IAC9G,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAA,0BAAI,EAAC,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,gBAAgB,CACpC,OAAiB,EACjB,OAAgC,EAAE;IAElC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,EAAE;QAC/F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,yBAAyB,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7G,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8G,CAAC;AACzI,CAAC;AACD,2CAAsD;AAA7C,qGAAA,OAAO,OAAA;AAAE,2GAAA,aAAa,OAAA"}

package/dist/client/platform.d.ts

@@ -364,6 +364,88 @@ export interface AtlasIdApp extends ProvisioningFields {
     previous_secret_expires_at?: number | null;
     /** When the current client secret was issued (epoch ms); null for a public app. */
     secret_issued_at?: number | null;
+    /** Test sign-in mode: `+atlas_test` addresses on a verified domain sign in to this app with the fixed code 424242. */
+    test_mode?: boolean;
+    /** Test and review accounts must use an address on a domain you verified. */
+    provisioned_verified_domains_only?: boolean;
+}
+/** A Sign in with Atlas test or review account: confined to the app(s) it was made for. */
+export interface AtlasIdProvisionedAccount {
+    object: 'atlas_id_provisioned_account';
+    id: string;
+    /** The Atlas ID subject the app sees. */
+    sub: string;
+    email: string | null;
+    email_verified: boolean;
+    label: string;
+    kind: 'provisioned' | 'test_mode' | 'developer';
+    provisioned_by: 'app' | 'staff';
+    app_ids: string[];
+    apps: Array<{
+        id: string;
+        client_id: string;
+        name: string;
+    }>;
+    any_app: boolean;
+    two_factor_exempt: boolean;
+    /** Epoch ms; null = never expires. */
+    expires_at: number | null;
+    expired: boolean;
+    developer_account_id: string | null;
+    created_by: {
+        type: string;
+        id: string;
+    };
+    last_sign_in_at: number | null;
+    password_rotated_at: number | null;
+    created_at: number;
+    updated_at: number;
+    /** Only on create and password rotation: the password, returned exactly once. */
+    password?: string;
+    /** With a `secretRecipient`: the password sealed to it. */
+    sealed_password?: string;
+    note?: string;
+}
+export interface AtlasIdProvisionedAccountList {
+    object: 'list';
+    data: AtlasIdProvisionedAccount[];
+    /** The account-wide cap (default 25). */
+    limit: number;
+    /** Test accounts the account holds across all its apps. */
+    total: number;
+}
+export interface CreateAtlasIdProvisionedAccountBody {
+    email: string;
+    /** What the account is for, e.g. "app-store reviewer". */
+    label: string;
+    /** At least 12 characters. Omit it and Atlas generates one. Returned once either way. */
+    password?: string;
+    /** Default true. */
+    email_verified?: boolean;
+    /** Never asked for a second factor when signing in to this app. A risk you opt into. */
+    two_factor_exempt?: boolean;
+    /** Epoch ms or ISO 8601; omit or null for a non-expiring account. */
+    expires_at?: number | string | null;
+}
+export interface RotateAtlasIdProvisionedPasswordBody {
+    /** At least 12 characters; omit it and Atlas generates one. */
+    password?: string;
+}
+/** A domain the account claimed; verified ones gate test sign-in mode. */
+export interface AccountDomain {
+    object: 'account_domain';
+    id: string;
+    domain: string;
+    verified: boolean;
+    verified_at: number | null;
+    last_checked_at: number | null;
+    verification: {
+        type: 'TXT';
+        name: string;
+        value: string;
+    };
+    record_found?: boolean;
+    created_at: number;
 }
 /** Create / rotate response: confidential apps carry the client secret exactly once. */
 export interface AtlasIdAppWithSecret extends AtlasIdApp {
@@ -466,6 +548,10 @@ export interface UpdateAtlasIdAppBody extends AtlasIdAppFields {
      * this app's users. Setting it the first time returns `webhook_secret` once; null removes it.
      */
     webhook_url?: string | null;
+    /** Turn test sign-in mode on or off. Turning it on needs a verified domain on the account. */
+    test_mode?: boolean;
+    /** Require test and review accounts to use an address on a domain you verified. */
+    provisioned_verified_domains_only?: boolean;
 }
 export interface AccountAuditRecord {
     object: 'account_audit_log';
@@ -697,9 +783,42 @@ declare function platformNamespaces(request: RequestFn): {
          * each delivery too. 409 without a webhook.
          */
         rotateWebhookSecret(id: string, body?: RotateAtlasIdAppSecretBody): Promise<AtlasIdAppWithSecret>;
+        /**
+         * Test and review accounts for this app: real Atlas accounts confined to
+         * it (reviewer logins, CI, demos). Needs `platform:atlas_id_apps:provision`
+         * or the per-app `atlas_id_apps:<app id>:provision` scope. Passwords come
+         * back exactly once, on create and on rotation (pass `secretRecipient` to
+         * receive them sealed).
+         */
+        provisionedAccounts: {
+            list(appId: string): Promise<AtlasIdProvisionedAccountList>;
+            create(appId: string, body: CreateAtlasIdProvisionedAccountBody, idempotencyKey?: string): Promise<AtlasIdProvisionedAccount>;
+            get(appId: string, accountId: string): Promise<AtlasIdProvisionedAccount>;
+            /** Deletes the account and ends every session and grant it holds. */
+            remove(appId: string, accountId: string): Promise<{
+                object: "atlas_id_provisioned_account";
+                id: string;
+                deleted: true;
+                sessions_ended: number;
+            }>;
+            /** A new password (yours, or one Atlas generates), returned once. */
+            rotatePassword(appId: string, accountId: string, body?: RotateAtlasIdProvisionedPasswordBody): Promise<AtlasIdProvisionedAccount>;
+        };
         /** Preview a design on the Sign in with Atlas page without saving it. */
         previewDesign(design: AtlasDesign): Promise<DesignPreview>;
     };
+    /** Domains the account verified by DNS; they gate test sign-in mode and the test-account domain restriction. */
+    domains: {
+        list(): Promise<{
+            object: "list";
+            data: AccountDomain[];
+            verified_domains: string[];
+        }>;
+        /** Claim a domain; returns the TXT record to publish. */
+        claim(domain: string): Promise<AccountDomain>;
+        verify(domainId: string): Promise<AccountDomain>;
+        remove(domainId: string): Promise<unknown>;
+    };
     /** The account's Sign in with Atlas publisher name and verified domain. */
     atlasIdPublisher: {
         /** 404 until claimed. */

package/dist/client/platform.js

@@ -293,6 +293,47 @@ function platformNamespaces(request) {
                     body,
                 });
             },
+            /**
+             * Test and review accounts for this app: real Atlas accounts confined to
+             * it (reviewer logins, CI, demos). Needs `platform:atlas_id_apps:provision`
+             * or the per-app `atlas_id_apps:<app id>:provision` scope. Passwords come
+             * back exactly once, on create and on rotation (pass `secretRecipient` to
+             * receive them sealed).
+             */
+            provisionedAccounts: {
+                list(appId) {
+                    return request({ method: 'GET', path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(appId)}/provisioned_accounts` });
+                },
+                create(appId, body, idempotencyKey) {
+                    return request({
+                        method: 'POST',
+                        path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(appId)}/provisioned_accounts`,
+                        body,
+                        idempotencyKey,
+                    });
+                },
+                get(appId, accountId) {
+                    return request({
+                        method: 'GET',
+                        path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(appId)}/provisioned_accounts/${(0, request_1.enc)(accountId)}`,
+                    });
+                },
+                /** Deletes the account and ends every session and grant it holds. */
+                remove(appId, accountId) {
+                    return request({
+                        method: 'DELETE',
+                        path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(appId)}/provisioned_accounts/${(0, request_1.enc)(accountId)}`,
+                    });
+                },
+                /** A new password (yours, or one Atlas generates), returned once. */
+                rotatePassword(appId, accountId, body) {
+                    return request({
+                        method: 'POST',
+                        path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(appId)}/provisioned_accounts/${(0, request_1.enc)(accountId)}/password`,
+                        body,
+                    });
+                },
+            },
             /** Preview a design on the Sign in with Atlas page without saving it. */
             previewDesign(design) {
                 return request({
@@ -302,6 +343,22 @@ function platformNamespaces(request) {
                 });
             },
         },
+        /** Domains the account verified by DNS; they gate test sign-in mode and the test-account domain restriction. */
+        domains: {
+            list() {
+                return request({ method: 'GET', path: '/v1/platform/domains' });
+            },
+            /** Claim a domain; returns the TXT record to publish. */
+            claim(domain) {
+                return request({ method: 'POST', path: '/v1/platform/domains', body: { domain } });
+            },
+            verify(domainId) {
+                return request({ method: 'POST', path: `/v1/platform/domains/${(0, request_1.enc)(domainId)}/verify` });
+            },
+            remove(domainId) {
+                return request({ method: 'DELETE', path: `/v1/platform/domains/${(0, request_1.enc)(domainId)}` });
+            },
+        },
         /** The account's Sign in with Atlas publisher name and verified domain. */
         atlasIdPublisher: {
             /** 404 until claimed. */

package/dist/client/platform.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/client/platform.ts"],"names":[],"mappings":";;AAs5BA,8DAWC;AAj6BD,6CAAyH;AAEzH,uCAMmB;AAugBnB,mFAAmF;AAEnF,SAAS,kBAAkB,CAAC,OAAkB;IAC5C,OAAO;QACL,4DAA4D;QAC5D,MAAM;YACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,kFAAkF;QAClF,IAAI,EAAE;YACJ,IAAI,CAAC,SAAmF,EAAE;gBACxF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,sGAAsG;YACtG,MAAM,CAAC,IAQN;gBACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA0F;gBAC3G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YAClF,CAAC;SACF;QACD,6CAA6C;QAC7C,KAAK,EAAE;YACL,IAAI,CAAC,SAAuE,EAAE;gBAC5E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,EAAE;gBACP,IAAI;oBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,CAAC,IAAuD;oBAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/E,CAAC;gBACD,MAAM,CAAC,EAAU,EAAE,IAA0E;oBAC3F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3F,CAAC;gBACD,MAAM,CAAC,EAAU;oBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtF,CAAC;gBACD,IAAI,CAAC,EAAU;oBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBACzF,CAAC;aACF;SACF;QACD,IAAI,EAAE;YACJ,+EAA+E;YAC/E,IAAI,CAAC,SAAiC,EAAE;gBACtC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAA,0BAAa,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,iEAAiE;YACjE,MAAM,CAAC,OAA8B,EAAE,EAAE,cAAuB;gBAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA2B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,6EAA6E;YAC7E,UAAU,CAAC,GAAmC;gBAC5C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,+BAA+B;oBACrC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG;iBACzC,CAAC,CAAC;YACL,CAAC;YACD;;;eAGG;YACH,eAAe,CAAC,WAAiC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,OAA6B,EAAE;gBACjG,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,+BAA+B;oBACrC,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,gGAAgG;YAChG,WAAW,CAAC,EAAU,EAAE,OAAwB,EAAE,EAAE,cAAuB;gBACzE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,sGAAsG;YACtG,eAAe,CAAC,EAAU,EAAE,OAAoC,EAAE,EAAE,cAAuB;gBACzF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC7G,CAAC;YACD,+DAA+D;YAC/D,OAAO,CAAC,EAAU;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YACrF,CAAC;YACD;;;eAGG;YACH,YAAY,CACV,EAAU,EACV,OAAiC,EAAE,EACnC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;oBAClD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,mDAAmD;YACnD,UAAU,CAAC,EAAU,EAAE,SAA8C,EAAE;gBACrE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,IAAA,0BAAa,EAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC7H,CAAC;YACD,SAAS,EAAE;gBACT,IAAI,CAAC,KAAa;oBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,kFAAkF;gBAClF,MAAM,CACJ,KAAa,EACb,OAAmC,EAAE,EACrC,cAAuB;oBAEvB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY;wBACjD,IAAI;wBACJ,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;gBACD;;;;;mBAKG;gBACH,YAAY,CACV,KAAa,EACb,UAAkB,EAClB,oBAAwD,EACxD,cAAuB;oBAEvB,MAAM,SAAS,GAAG,OAAO,oBAAoB,KAAK,QAAQ,CAAC;oBAC3D,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,IAAA,aAAG,EAAC,UAAU,CAAC,gBAAgB;wBAClF,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;wBAClD,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,cAAc;qBAClE,CAAC,CAAC;gBACL,CAAC;aACF;YACD,yEAAyE;YACzE,QAAQ,CAAC,EAAU,EAAE,cAAuB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBAC7C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,sDAAsD;YACtD,cAAc,CACZ,aAAqB,EACrB,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,mCAAmC;oBACzC,IAAI,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;oBACvC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,+EAA+E;YAC/E,KAAK,CAAC,UAAkB,EAAE,cAAuB;gBAC/C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;oBACjC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,eAAe,EAAE;YACf,8FAA8F;YAC9F,MAAM,CAAC,OAAiC,EAAE,EAAE,cAAuB;gBACjE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,+BAA+B;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,oEAAoE;QACpE,WAAW,EAAE;YACX,IAAI,CAAC,SAA8C,EAAE;gBACnD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,IAAA,0BAAa,EAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,sFAAsF;YACtF,MAAM,CAAC,IAA0B,EAAE,cAAuB;gBACxD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,0DAA0D;YAC1D,MAAM,CAAC,EAAU,EAAE,IAA0B;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+CAA+C;YAC/C,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD;;;eAGG;YACH,YAAY,CAAC,EAAU,EAAE,IAAiC;gBACxD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;oBAC3D,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,gEAAgE;YAChE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;gBAEtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;oBACpE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,kFAAkF;YAClF,qBAAqB,CAAC,EAAU;gBAC9B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B;iBACtE,CAAC,CAAC;YACL,CAAC;YACD,mGAAmG;YACnG,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;eAGG;YACH,SAAS,CAAC,EAAU,EAAE,KAAa;gBACjC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;oBACnD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,oGAAoG;YACpG,WAAW,CAAC,EAAU,EAAE,OAAe;gBACrC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YACD,sFAAsF;YACtF,UAAU,CAAC,EAAU,EAAE,IAAuB;gBAC5C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;oBACzD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD;;;;;;eAMG;YACH,YAAY,CAAC,EAAU,EAAE,UAAyB;gBAChD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;oBACxD,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;iBAClC,CAAC,CAAC;YACL,CAAC;YACD;;;;eAIG;YACH,mBAAmB,CAAC,EAAU,EAAE,IAAiC;gBAC/D,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB;oBACnE,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,aAAa,CAAC,MAAmB;gBAC/B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,2CAA2C;oBACjD,IAAI,EAAE,EAAE,MAAM,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;SACF;QACD,2EAA2E;QAC3E,gBAAgB,EAAE;YAChB,yBAAyB;YACzB,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4EAA4E;YAC5E,GAAG,CAAC,IAA6B;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,6CAA6C;YAC7C,MAAM,CAAC,IAA+B;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,mDAAmD;YACnD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QACD,uEAAuE;QACvE,eAAe,EAAE;YACf,IAAI,CAAC,SAAoC,EAAE;gBAMzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;SACF;QACD,yFAAyF;QACzF,YAAY,EAAE;YACZ,MAAM,CAAC,IAAqB,EAAE,UAAoC,EAAE;gBAClE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;oBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,+DAA+D;YAC/D,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAUD,SAAgB,yBAAyB,CAAC,MAAiC;IACzE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,4BAAkB,EAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAC9B,WAAW,CAAC,SAA+B;YACzC,OAAO,yBAAyB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/client/platform.ts"],"names":[],"mappings":";;AA0iCA,8DAWC;AArjCD,6CAAyH;AAEzH,uCAMmB;AAulBnB,mFAAmF;AAEnF,SAAS,kBAAkB,CAAC,OAAkB;IAC5C,OAAO;QACL,4DAA4D;QAC5D,MAAM;YACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,kFAAkF;QAClF,IAAI,EAAE;YACJ,IAAI,CAAC,SAAmF,EAAE;gBACxF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,sGAAsG;YACtG,MAAM,CAAC,IAQN;gBACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA0F;gBAC3G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YAClF,CAAC;SACF;QACD,6CAA6C;QAC7C,KAAK,EAAE;YACL,IAAI,CAAC,SAAuE,EAAE;gBAC5E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,EAAE;gBACP,IAAI;oBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,CAAC,IAAuD;oBAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/E,CAAC;gBACD,MAAM,CAAC,EAAU,EAAE,IAA0E;oBAC3F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3F,CAAC;gBACD,MAAM,CAAC,EAAU;oBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtF,CAAC;gBACD,IAAI,CAAC,EAAU;oBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBACzF,CAAC;aACF;SACF;QACD,IAAI,EAAE;YACJ,+EAA+E;YAC/E,IAAI,CAAC,SAAiC,EAAE;gBACtC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAA,0BAAa,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,iEAAiE;YACjE,MAAM,CAAC,OAA8B,EAAE,EAAE,cAAuB;gBAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA2B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,6EAA6E;YAC7E,UAAU,CAAC,GAAmC;gBAC5C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,+BAA+B;oBACrC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG;iBACzC,CAAC,CAAC;YACL,CAAC;YACD;;;eAGG;YACH,eAAe,CAAC,WAAiC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,OAA6B,EAAE;gBACjG,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,+BAA+B;oBACrC,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,gGAAgG;YAChG,WAAW,CAAC,EAAU,EAAE,OAAwB,EAAE,EAAE,cAAuB;gBACzE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,sGAAsG;YACtG,eAAe,CAAC,EAAU,EAAE,OAAoC,EAAE,EAAE,cAAuB;gBACzF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC7G,CAAC;YACD,+DAA+D;YAC/D,OAAO,CAAC,EAAU;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YACrF,CAAC;YACD;;;eAGG;YACH,YAAY,CACV,EAAU,EACV,OAAiC,EAAE,EACnC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;oBAClD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,mDAAmD;YACnD,UAAU,CAAC,EAAU,EAAE,SAA8C,EAAE;gBACrE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,IAAA,0BAAa,EAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC7H,CAAC;YACD,SAAS,EAAE;gBACT,IAAI,CAAC,KAAa;oBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,kFAAkF;gBAClF,MAAM,CACJ,KAAa,EACb,OAAmC,EAAE,EACrC,cAAuB;oBAEvB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY;wBACjD,IAAI;wBACJ,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;gBACD;;;;;mBAKG;gBACH,YAAY,CACV,KAAa,EACb,UAAkB,EAClB,oBAAwD,EACxD,cAAuB;oBAEvB,MAAM,SAAS,GAAG,OAAO,oBAAoB,KAAK,QAAQ,CAAC;oBAC3D,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,IAAA,aAAG,EAAC,UAAU,CAAC,gBAAgB;wBAClF,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;wBAClD,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,cAAc;qBAClE,CAAC,CAAC;gBACL,CAAC;aACF;YACD,yEAAyE;YACzE,QAAQ,CAAC,EAAU,EAAE,cAAuB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBAC7C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,sDAAsD;YACtD,cAAc,CACZ,aAAqB,EACrB,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,mCAAmC;oBACzC,IAAI,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;oBACvC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,+EAA+E;YAC/E,KAAK,CAAC,UAAkB,EAAE,cAAuB;gBAC/C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;oBACjC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,eAAe,EAAE;YACf,8FAA8F;YAC9F,MAAM,CAAC,OAAiC,EAAE,EAAE,cAAuB;gBACjE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,+BAA+B;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,oEAAoE;QACpE,WAAW,EAAE;YACX,IAAI,CAAC,SAA8C,EAAE;gBACnD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,IAAA,0BAAa,EAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,sFAAsF;YACtF,MAAM,CAAC,IAA0B,EAAE,cAAuB;gBACxD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,0DAA0D;YAC1D,MAAM,CAAC,EAAU,EAAE,IAA0B;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+CAA+C;YAC/C,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD;;;eAGG;YACH,YAAY,CAAC,EAAU,EAAE,IAAiC;gBACxD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;oBAC3D,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,gEAAgE;YAChE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;gBAEtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;oBACpE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,kFAAkF;YAClF,qBAAqB,CAAC,EAAU;gBAC9B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B;iBACtE,CAAC,CAAC;YACL,CAAC;YACD,mGAAmG;YACnG,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;eAGG;YACH,SAAS,CAAC,EAAU,EAAE,KAAa;gBACjC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;oBACnD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,oGAAoG;YACpG,WAAW,CAAC,EAAU,EAAE,OAAe;gBACrC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YACD,sFAAsF;YACtF,UAAU,CAAC,EAAU,EAAE,IAAuB;gBAC5C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;oBACzD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD;;;;;;eAMG;YACH,YAAY,CAAC,EAAU,EAAE,UAAyB;gBAChD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;oBACxD,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;iBAClC,CAAC,CAAC;YACL,CAAC;YACD;;;;eAIG;YACH,mBAAmB,CAAC,EAAU,EAAE,IAAiC;gBAC/D,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB;oBACnE,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD;;;;;;eAMG;YACH,mBAAmB,EAAE;gBACnB,IAAI,CAAC,KAAa;oBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,CAAC;gBAC3G,CAAC;gBACD,MAAM,CACJ,KAAa,EACb,IAAyC,EACzC,cAAuB;oBAEvB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,KAAK,CAAC,uBAAuB;wBACrE,IAAI;wBACJ,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;gBACD,GAAG,CAAC,KAAa,EAAE,SAAiB;oBAClC,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,KAAK,CAAC,yBAAyB,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE;qBACxF,CAAC,CAAC;gBACL,CAAC;gBACD,qEAAqE;gBACrE,MAAM,CACJ,KAAa,EACb,SAAiB;oBAEjB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,QAAQ;wBAChB,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,KAAK,CAAC,yBAAyB,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE;qBACxF,CAAC,CAAC;gBACL,CAAC;gBACD,qEAAqE;gBACrE,cAAc,CACZ,KAAa,EACb,SAAiB,EACjB,IAA2C;oBAE3C,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,KAAK,CAAC,yBAAyB,IAAA,aAAG,EAAC,SAAS,CAAC,WAAW;wBAChG,IAAI;qBACL,CAAC,CAAC;gBACL,CAAC;aACF;YACD,yEAAyE;YACzE,aAAa,CAAC,MAAmB;gBAC/B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,2CAA2C;oBACjD,IAAI,EAAE,EAAE,MAAM,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;SACF;QACD,gHAAgH;QAChH,OAAO,EAAE;YACP,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,yDAAyD;YACzD,KAAK,CAAC,MAAc;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,QAAgB;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,CAAC,QAAgB;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;SACF;QACD,2EAA2E;QAC3E,gBAAgB,EAAE;YAChB,yBAAyB;YACzB,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4EAA4E;YAC5E,GAAG,CAAC,IAA6B;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,6CAA6C;YAC7C,MAAM,CAAC,IAA+B;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,mDAAmD;YACnD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QACD,uEAAuE;QACvE,eAAe,EAAE;YACf,IAAI,CAAC,SAAoC,EAAE;gBAMzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;SACF;QACD,yFAAyF;QACzF,YAAY,EAAE;YACZ,MAAM,CAAC,IAAqB,EAAE,UAAoC,EAAE;gBAClE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;oBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,+DAA+D;YAC/D,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAUD,SAAgB,yBAAyB,CAAC,MAAiC;IACzE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,4BAAkB,EAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAC9B,WAAW,CAAC,SAA+B;YACzC,OAAO,yBAAyB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export * from './jwks-cache';
 export { DiscoveryError, JwksDiscovery, discoveryUrlFor, instanceIdFromPublishableKey } from './discovery';
 export * from './verify';
+export * from './recent-auth';
 export * from './access-control';
 export * from './handshake';
 export * from './better-auth';

package/dist/index.js

@@ -25,6 +25,7 @@ Object.defineProperty(exports, "JwksDiscovery", { enumerable: true, get: functio
 Object.defineProperty(exports, "discoveryUrlFor", { enumerable: true, get: function () { return discovery_1.discoveryUrlFor; } });
 Object.defineProperty(exports, "instanceIdFromPublishableKey", { enumerable: true, get: function () { return discovery_1.instanceIdFromPublishableKey; } });
 __exportStar(require("./verify"), exports);
+__exportStar(require("./recent-auth"), exports);
 __exportStar(require("./access-control"), exports);
 __exportStar(require("./handshake"), exports);
 // Moving from Better Auth: exchange its session cookie once, accept its JWTs for a window.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAGzC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,gDAA8B;AAC9B,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAGzC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}

package/dist/recent-auth.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Step-up checks on a verified Atlas token. Session and template tokens carry
+ * `auth_time` (the first-factor sign-in, or the last step-up), `amr` and `acr`
+ * (`urn:atlas:acr:basic`, `urn:atlas:acr:mfa`, `urn:atlas:acr:step_up`).
+ *
+ *   const auth = await atlas.authenticateRequest(req);
+ *   if (!auth.ok) return res.status(401).end();
+ *   if (!authenticatedWithin(auth.claims, 300)) {
+ *     // Ask the browser to step up (POST /v1/client/me/step_up) and retry.
+ *     return res.status(401).json({ error: 'reauthentication_required', max_age: 300 });
+ *   }
+ */
+/** Whether `auth_time` is within `maxAgeSeconds` of now. A token without `auth_time` never is. */
+export declare function authenticatedWithin(claims: {
+    auth_time?: unknown;
+}, maxAgeSeconds: number, nowMs?: number): boolean;
+/** Whether the session proved a second factor (`acr` is mfa or step_up after an MFA method, or `amr` includes `mfa`). */
+export declare function usedMultiFactor(claims: {
+    acr?: unknown;
+    amr?: unknown;
+}): boolean;

package/dist/recent-auth.js

@@ -0,0 +1,30 @@
+"use strict";
+/**
+ * Step-up checks on a verified Atlas token. Session and template tokens carry
+ * `auth_time` (the first-factor sign-in, or the last step-up), `amr` and `acr`
+ * (`urn:atlas:acr:basic`, `urn:atlas:acr:mfa`, `urn:atlas:acr:step_up`).
+ *
+ *   const auth = await atlas.authenticateRequest(req);
+ *   if (!auth.ok) return res.status(401).end();
+ *   if (!authenticatedWithin(auth.claims, 300)) {
+ *     // Ask the browser to step up (POST /v1/client/me/step_up) and retry.
+ *     return res.status(401).json({ error: 'reauthentication_required', max_age: 300 });
+ *   }
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authenticatedWithin = authenticatedWithin;
+exports.usedMultiFactor = usedMultiFactor;
+/** Whether `auth_time` is within `maxAgeSeconds` of now. A token without `auth_time` never is. */
+function authenticatedWithin(claims, maxAgeSeconds, nowMs = Date.now()) {
+    const at = claims.auth_time;
+    if (typeof at !== 'number' || !Number.isFinite(at))
+        return false;
+    return nowMs / 1000 - at <= maxAgeSeconds;
+}
+/** Whether the session proved a second factor (`acr` is mfa or step_up after an MFA method, or `amr` includes `mfa`). */
+function usedMultiFactor(claims) {
+    if (claims.acr === 'urn:atlas:acr:mfa')
+        return true;
+    return Array.isArray(claims.amr) && claims.amr.includes('mfa');
+}
+//# sourceMappingURL=recent-auth.js.map

package/dist/recent-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recent-auth.js","sourceRoot":"","sources":["../src/recent-auth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAGH,kDAIC;AAGD,0CAGC;AAXD,kGAAkG;AAClG,SAAgB,mBAAmB,CAAC,MAA+B,EAAE,aAAqB,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;IACpH,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI,aAAa,CAAC;AAC5C,CAAC;AAED,yHAAyH;AACzH,SAAgB,eAAe,CAAC,MAAwC;IACtE,IAAI,MAAM,CAAC,GAAG,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/backend",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "dependencies": {
@@ -35,7 +35,7 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "vitest run"
+    "typecheck": "tsgo -p tsconfig.json --noEmit --module preserve --moduleResolution bundler --incremental --tsBuildInfoFile node_modules/.cache/typecheck.tsbuildinfo",
+    "test": "vitest run --no-isolate"
   }
 }