@atlasauth/backend 0.22.0 → 0.24.0

package/dist/client/operator.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.openSealedBox = exports.sealBox = exports.OAuthFlowError = void 0;
 exports.operatorConfiguration = operatorConfiguration;
+exports.startDeviceAuthorization = startDeviceAuthorization;
+exports.pollDeviceAuthorization = pollDeviceAuthorization;
 exports.startOperatorLogin = startOperatorLogin;
 exports.pollOperatorLogin = pollOperatorLogin;
 exports.exchangeOperatorToken = exchangeOperatorToken;
@@ -42,27 +44,41 @@ async function operatorConfiguration(opts = {}) {
     return (await res.json());
 }
 /**
- * Start the device flow. With `audience` (one of the configuration's
- * `audiences`), the operator token is minted FOR that other product
- * (`aud=<audience>`, sent as the RFC 8707 `resource`): hand it to that product;
- * Atlas's own token exchange refuses it.
+ * Start an RFC 8628 device flow against any Atlas instance's OAuth server, for a
+ * CLI or TV app of your own: `issuer` is the instance's issuer (its Frontend API
+ * host, e.g. `https://acme-fapi.atlasauth.net`) and `clientId` an OAuth client
+ * with the `urn:ietf:params:oauth:grant-type:device_code` grant. Show the person
+ * `verification_uri_complete` (or `verification_uri` + `user_code`), then
+ * {@link pollDeviceAuthorization}. A confidential client passes `clientSecret`.
  */
-async function startOperatorLogin(opts = {}) {
-    const config = opts.config ?? (await operatorConfiguration(opts));
-    const out = await form(opts.fetch ?? globalThis.fetch, config.device_authorization_endpoint, {
+async function startDeviceAuthorization(params, opts = {}) {
+    const base = params.issuer.replace(/\/+$/, '');
+    const config = {
+        device_authorization_endpoint: `${base}/oauth2/device_authorization`,
+        token_endpoint: `${base}/oauth2/token`,
+        client_id: params.clientId,
+        ...(params.clientSecret ? { client_secret: params.clientSecret } : {}),
+    };
+    const scope = Array.isArray(params.scope) ? params.scope.join(' ') : params.scope;
+    return startDevice(opts.fetch ?? globalThis.fetch, config, { scope, resource: params.resource });
+}
+async function startDevice(f, config, params) {
+    const out = await form(f, config.device_authorization_endpoint, {
         client_id: config.client_id,
-        scope: config.scope,
-        ...(opts.audience ? { resource: opts.audience } : {}),
+        ...(config.client_secret ? { client_secret: config.client_secret } : {}),
+        ...(params.scope ? { scope: params.scope } : {}),
+        ...(params.resource ? { resource: params.resource } : {}),
     });
     if (out._status !== 200)
         throw new OAuthFlowError(String(out.error ?? 'error'), String(out.error_description ?? 'Device authorization failed.'), out._status);
     return { ...out, config };
 }
 /**
- * Poll until the person approves (resolves the operator token), denies or the
- * code expires (throws). Honours `interval` and `slow_down`.
+ * Poll the token endpoint until the person approves (resolves the tokens),
+ * denies (`access_denied`) or the code expires (`expired_token`); both throw an
+ * {@link OAuthFlowError}. Honours `interval` and adds 5 s on each `slow_down`.
  */
-async function pollOperatorLogin(start, opts = {}) {
+async function pollDeviceAuthorization(start, opts = {}) {
     const f = opts.fetch ?? globalThis.fetch;
     const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     let interval = Math.max(1, start.interval) * 1000;
@@ -75,6 +91,7 @@ async function pollOperatorLogin(start, opts = {}) {
             grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
             device_code: start.device_code,
             client_id: start.config.client_id,
+            ...(start.config.client_secret ? { client_secret: start.config.client_secret } : {}),
         });
         if (out._status === 200)
             return out;
@@ -88,6 +105,24 @@ async function pollOperatorLogin(start, opts = {}) {
     }
     throw new OAuthFlowError('expired_token', 'The sign-in code expired. Run the login again.', 400);
 }
+/**
+ * Start the device flow. With `audience` (one of the configuration's
+ * `audiences`), the operator token is minted FOR that other product
+ * (`aud=<audience>`, sent as the RFC 8707 `resource`): hand it to that product;
+ * Atlas's own token exchange refuses it.
+ */
+async function startOperatorLogin(opts = {}) {
+    const config = opts.config ?? (await operatorConfiguration(opts));
+    const out = await startDevice(opts.fetch ?? globalThis.fetch, config, { scope: config.scope, resource: opts.audience });
+    return { ...out, config };
+}
+/**
+ * Poll until the person approves (resolves the operator token), denies or the
+ * code expires (throws). Honours `interval` and `slow_down`.
+ */
+async function pollOperatorLogin(start, opts = {}) {
+    return pollDeviceAuthorization(start, opts);
+}
 /** RFC 8693: swap an operator token for a one-hour, resource-bound Atlas token. */
 async function exchangeOperatorToken(subjectToken, params, opts = {}) {
     const out = await form(opts.fetch ?? globalThis.fetch, `${(opts.apiUrl ?? DEFAULT_API).replace(/\/+$/, '')}/v1/oauth/token`, {

package/dist/client/operator.js.map

@@ -1 +1 @@
-{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/client/operator.ts"],"names":[],"mappings":";;;AAmFA,sDAKC;AAQD,gDAWC;AAMD,8CAyBC;AAGD,sDAmBC;AAGD,4CAUC;AAGD,kDAGC;AAGD,4CAEC;AAGD,4CAYC;AAvMD,6CAAiF;AAEjF,MAAM,KAAK,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAmDhF,MAAa,cAAe,SAAQ,KAAK;IAE5B;IAEA;IAHX,YACW,KAAa,EACtB,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,UAAK,GAAL,KAAK,CAAQ;QAEb,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AATD,wCASC;AAOD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD,KAAK,UAAU,IAAI,CAAC,SAAuB,EAAE,GAAW,EAAE,IAA4B;IACpF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,iFAAiF;AAC1E,KAAK,UAAU,qBAAqB,CAAC,OAAa,EAAE;IACzD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACpI,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,2DAA2D,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAAqE,EAAE;IAEvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,6BAA6B,EAAE;QAC3F,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,8BAA8B,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9J,OAAO,EAAE,GAAI,GAAsC,EAAE,MAAM,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CACrC,KAA8D,EAC9D,OAA+E,EAAE;IAEjF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE;YACrD,UAAU,EAAE,8CAA8C;YAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;YAAE,OAAO,GAAoC,CAAC;QACrE,IAAI,GAAG,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QACpD,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,IAAI,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAC;AACnG,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,MAAsD,EACtD,OAAa,EAAE;IAEf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE;QAC3H,UAAU,EAAE,iDAAiD;QAC7D,aAAa,EAAE,YAAY;QAC3B,kBAAkB,EAAE,+CAA+C;QACnE,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;KAC3E,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3G,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC9I,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAA2D,CAAC;AACrE,CAAC;AAED,4FAA4F;AACrF,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,YAAoB,EACpB,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IAC5H,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACnI,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACvJ,OAAO,GAAoC,CAAC;AAC9C,CAAC;AAED,mFAAmF;AACnF,SAAgB,mBAAmB;IACjC,MAAM,IAAI,GAAG,IAAA,gCAAG,GAAE,CAAC;IACnB,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,oFAAoF;AACpF,SAAgB,gBAAgB,CAAC,YAAoB,EAAE,OAAyD;IAC9G,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAA,0BAAI,EAAC,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,gBAAgB,CACpC,OAAiB,EACjB,OAAgC,EAAE;IAElC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,EAAE;QAC/F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,yBAAyB,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7G,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8G,CAAC;AACzI,CAAC;AACD,2CAAsD;AAA7C,qGAAA,OAAO,OAAA;AAAE,2GAAA,aAAa,OAAA"}
+{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/client/operator.ts"],"names":[],"mappings":";;;AAmFA,sDAKC;AAUD,4DAaC;AA8BD,0DA0BC;AAQD,gDAMC;AAMD,8CAKC;AAGD,sDAmBC;AAGD,4CAUC;AAGD,kDAGC;AAGD,4CAEC;AAGD,4CAYC;AA7PD,6CAAiF;AAEjF,MAAM,KAAK,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAmDhF,MAAa,cAAe,SAAQ,KAAK;IAE5B;IAEA;IAHX,YACW,KAAa,EACtB,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,UAAK,GAAL,KAAK,CAAQ;QAEb,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AATD,wCASC;AAOD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD,KAAK,UAAU,IAAI,CAAC,SAAuB,EAAE,GAAW,EAAE,IAA4B;IACpF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,iFAAiF;AAC1E,KAAK,UAAU,qBAAqB,CAAC,OAAa,EAAE;IACzD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACpI,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,2DAA2D,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,wBAAwB,CAC5C,MAAiH,EACjH,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAwB;QAClC,6BAA6B,EAAE,GAAG,IAAI,8BAA8B;QACpE,cAAc,EAAE,GAAG,IAAI,eAAe;QACtC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAClF,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AACnG,CAAC;AAUD,KAAK,UAAU,WAAW,CACxB,CAAe,EACf,MAA2B,EAC3B,MAA6C;IAE7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,6BAA6B,EAAE;QAC9D,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,8BAA8B,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9J,OAAO,EAAE,GAAI,GAAsC,EAAE,MAAM,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,uBAAuB,CAC3C,KAA4D,EAC5D,OAA8F,EAAE;IAEhG,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE;YACrD,UAAU,EAAE,8CAA8C;YAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;YACjC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;YAAE,OAAO,GAAoC,CAAC;QACrE,IAAI,GAAG,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QACpD,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,IAAI,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAAqE,EAAE;IAEvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxH,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CACrC,KAA8D,EAC9D,OAA+E,EAAE;IAEjF,OAAO,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,MAAsD,EACtD,OAAa,EAAE;IAEf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE;QAC3H,UAAU,EAAE,iDAAiD;QAC7D,aAAa,EAAE,YAAY;QAC3B,kBAAkB,EAAE,+CAA+C;QACnE,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;KAC3E,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3G,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC9I,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAA2D,CAAC;AACrE,CAAC;AAED,4FAA4F;AACrF,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,YAAoB,EACpB,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IAC5H,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACnI,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACvJ,OAAO,GAAoC,CAAC;AAC9C,CAAC;AAED,mFAAmF;AACnF,SAAgB,mBAAmB;IACjC,MAAM,IAAI,GAAG,IAAA,gCAAG,GAAE,CAAC;IACnB,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,oFAAoF;AACpF,SAAgB,gBAAgB,CAAC,YAAoB,EAAE,OAAyD;IAC9G,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAA,0BAAI,EAAC,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,gBAAgB,CACpC,OAAiB,EACjB,OAAgC,EAAE;IAElC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,EAAE;QAC/F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,yBAAyB,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7G,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8G,CAAC;AACzI,CAAC;AACD,2CAAsD;AAA7C,qGAAA,OAAO,OAAA;AAAE,2GAAA,aAAa,OAAA"}

package/dist/framework-bridge.d.ts

@@ -0,0 +1,98 @@
+import type { MigrationTokenExtractor } from './migration-bridge';
+/**
+ * Zero-logout bridge for the SELF-HOSTED frameworks (Auth.js, Lucia,
+ * Passport, iron-session, Devise, Django): their presets, and the token
+ * extractors `migrationBridge({ extractToken })` takes.
+ *
+ * Two families:
+ *
+ *   - Database sessions (Auth.js database strategy, Lucia, express-session
+ *     stores, Django's database backend, Rails' activerecord-session_store):
+ *     preset mode `session_table`. The cookie carries an opaque id; Atlas finds
+ *     sha256(id) among the sessions you imported. Lucia, Auth.js and Django
+ *     cookies are read as they are; express-session's cookie is signed
+ *     (`s:<id>.<signature>`), so {@link expressSessionExtractor} pulls the id out.
+ *
+ *   - Sealed cookies (Auth.js JWT strategy, iron-session, Rails' cookie store
+ *     under Devise, Django's signed-cookie backend): there is no session row to
+ *     import — the cookie IS the session, and only your app's secret opens it.
+ *     The extractor opens it ON YOUR SERVER and hands Atlas a short-lived
+ *     BRIDGE ASSERTION instead: an HS256 JWT (`iss` = `urn:atlas:bridge:<source>`,
+ *     `sub` = the user id you exported, `jti` = the old session's id) signed
+ *     with a bridge secret you generate and store in the bridge settings
+ *     (`shared_secret`). Your AUTH_SECRET / secret_key_base / SECRET_KEY /
+ *     iron password never leave your server; Atlas verifies the assertion,
+ *     spends its `jti` once, and signs the user in.
+ */
+/** The issuer of a bridge assertion for a source. */
+export declare function bridgeAssertionIssuer(source: string): string;
+/** Lifetime of a bridge assertion: it is exchanged immediately, once. */
+export declare const BRIDGE_ASSERTION_TTL_SECONDS = 120;
+export interface BridgeAssertion {
+    source: string;
+    /** The source user id (the `user.id` your export wrote). */
+    sub: string;
+    /** The old session's own id, so the session exchanges once (single-use ledger). */
+    sessionKey: string;
+    email?: string | null;
+    name?: string | null;
+    /** The old session had already passed a second factor. */
+    mfa?: boolean;
+}
+/** Sign a bridge assertion with the bridge secret (HS256). */
+export declare function signBridgeAssertion(assertion: BridgeAssertion, bridgeSecret: string, now?: Date): Promise<string>;
+/**
+ * Auth.js / NextAuth, either session strategy. A database-session cookie is
+ * returned as it is (preset `authjs`); a JWT-strategy cookie is decrypted with
+ * `secret` (AUTH_SECRET / NEXTAUTH_SECRET, or the rotation list) and turned
+ * into a bridge assertion (preset `authjs_jwt`, needs `bridgeSecret`).
+ */
+export declare function authJsExtractor(options: {
+    secret?: string | readonly string[];
+    bridgeSecret?: string;
+    cookieName?: string;
+}): MigrationTokenExtractor;
+/**
+ * Passport / express-session: the session id out of the signed `connect.sid`
+ * cookie (preset `passport`). Pass `secrets` (your `session({ secret })`) to
+ * check the signature as express-session does.
+ */
+export declare function expressSessionExtractor(options?: {
+    cookieName?: string;
+    secrets?: string | readonly string[];
+}): MigrationTokenExtractor;
+/**
+ * iron-session: unseal the cookie with your session password and assert the
+ * user at `userIdPath` (default: `userId`, then `user.id`, then `id`).
+ */
+export declare function ironSessionExtractor(options: {
+    cookieName: string;
+    password: string | Readonly<Record<string, string>>;
+    bridgeSecret: string;
+    userIdPath?: string;
+    emailPath?: string;
+}): MigrationTokenExtractor;
+/**
+ * Devise on Rails' cookie store: decrypt `_<app>_session` with
+ * `secret_key_base` and assert the Warden user (`scope`, default `user`).
+ */
+export declare function deviseExtractor(options: {
+    cookieName: string;
+    secretKeyBase: string | readonly string[];
+    bridgeSecret: string;
+    scope?: string;
+    keyDigest?: 'SHA-256' | 'SHA-1';
+}): MigrationTokenExtractor;
+/**
+ * Django's signed-cookie session backend: verify the cookie with SECRET_KEY
+ * (then SECRET_KEY_FALLBACKS) and assert `_auth_user_id`.
+ */
+export declare function djangoSignedCookieExtractor(options: {
+    secretKey: string | readonly string[];
+    bridgeSecret: string;
+    cookieName?: string;
+    /** SESSION_COOKIE_AGE (default two weeks). */
+    maxAgeSeconds?: number;
+}): MigrationTokenExtractor;
+/** The preset ids this module registers (for docs and the settings UI). */
+export declare const FRAMEWORK_BRIDGE_PRESETS: string[];

package/dist/framework-bridge.js

@@ -0,0 +1,264 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FRAMEWORK_BRIDGE_PRESETS = exports.BRIDGE_ASSERTION_TTL_SECONDS = void 0;
+exports.bridgeAssertionIssuer = bridgeAssertionIssuer;
+exports.signBridgeAssertion = signBridgeAssertion;
+exports.authJsExtractor = authJsExtractor;
+exports.expressSessionExtractor = expressSessionExtractor;
+exports.ironSessionExtractor = ironSessionExtractor;
+exports.deviseExtractor = deviseExtractor;
+exports.djangoSignedCookieExtractor = djangoSignedCookieExtractor;
+const jose_1 = require("jose");
+const framework_sessions_1 = require("./framework-sessions");
+const migration_presets_1 = require("./migration-presets");
+/**
+ * Zero-logout bridge for the SELF-HOSTED frameworks (Auth.js, Lucia,
+ * Passport, iron-session, Devise, Django): their presets, and the token
+ * extractors `migrationBridge({ extractToken })` takes.
+ *
+ * Two families:
+ *
+ *   - Database sessions (Auth.js database strategy, Lucia, express-session
+ *     stores, Django's database backend, Rails' activerecord-session_store):
+ *     preset mode `session_table`. The cookie carries an opaque id; Atlas finds
+ *     sha256(id) among the sessions you imported. Lucia, Auth.js and Django
+ *     cookies are read as they are; express-session's cookie is signed
+ *     (`s:<id>.<signature>`), so {@link expressSessionExtractor} pulls the id out.
+ *
+ *   - Sealed cookies (Auth.js JWT strategy, iron-session, Rails' cookie store
+ *     under Devise, Django's signed-cookie backend): there is no session row to
+ *     import — the cookie IS the session, and only your app's secret opens it.
+ *     The extractor opens it ON YOUR SERVER and hands Atlas a short-lived
+ *     BRIDGE ASSERTION instead: an HS256 JWT (`iss` = `urn:atlas:bridge:<source>`,
+ *     `sub` = the user id you exported, `jti` = the old session's id) signed
+ *     with a bridge secret you generate and store in the bridge settings
+ *     (`shared_secret`). Your AUTH_SECRET / secret_key_base / SECRET_KEY /
+ *     iron password never leave your server; Atlas verifies the assertion,
+ *     spends its `jti` once, and signs the user in.
+ */
+/** The issuer of a bridge assertion for a source. */
+function bridgeAssertionIssuer(source) {
+    return `urn:atlas:bridge:${source}`;
+}
+/** Lifetime of a bridge assertion: it is exchanged immediately, once. */
+exports.BRIDGE_ASSERTION_TTL_SECONDS = 120;
+/** Sign a bridge assertion with the bridge secret (HS256). */
+async function signBridgeAssertion(assertion, bridgeSecret, now = new Date()) {
+    if (!bridgeSecret || bridgeSecret.length < 32)
+        throw new Error('The bridge secret must be at least 32 characters (generate one with `openssl rand -base64 48`).');
+    const iat = Math.floor(now.getTime() / 1000);
+    return new jose_1.SignJWT({
+        ...(assertion.email ? { email: assertion.email } : {}),
+        ...(assertion.name ? { name: assertion.name } : {}),
+        ...(assertion.mfa ? { amr: ['pwd', 'mfa'] } : {}),
+    })
+        .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
+        .setIssuer(bridgeAssertionIssuer(assertion.source))
+        .setSubject(assertion.sub)
+        .setJti(assertion.sessionKey)
+        .setIssuedAt(iat)
+        .setExpirationTime(iat + exports.BRIDGE_ASSERTION_TTL_SECONDS)
+        .sign(new TextEncoder().encode(bridgeSecret));
+}
+async function sha256Hex(value) {
+    const d = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value)));
+    return Array.from(d, (b) => b.toString(16).padStart(2, '0')).join('');
+}
+// ── extractors ──────────────────────────────────────────────────────────────
+/**
+ * Auth.js / NextAuth, either session strategy. A database-session cookie is
+ * returned as it is (preset `authjs`); a JWT-strategy cookie is decrypted with
+ * `secret` (AUTH_SECRET / NEXTAUTH_SECRET, or the rotation list) and turned
+ * into a bridge assertion (preset `authjs_jwt`, needs `bridgeSecret`).
+ */
+function authJsExtractor(options) {
+    return async ({ cookies }) => {
+        const found = (0, framework_sessions_1.readAuthJsSessionCookie)(cookies, { cookieName: options.cookieName });
+        if (!found)
+            return undefined;
+        const kind = (0, framework_sessions_1.authJsSessionTokenKind)(found.value);
+        if (kind === 'database')
+            return decodeURIComponent(found.value);
+        if (kind !== 'jwt' || !options.secret || !options.bridgeSecret)
+            return undefined;
+        const claims = await (0, framework_sessions_1.decodeAuthJsSessionToken)(found.value, { secret: options.secret, salt: found.name });
+        if (!claims?.sub)
+            return undefined;
+        return signBridgeAssertion({
+            source: 'authjs',
+            sub: claims.sub,
+            sessionKey: typeof claims.jti === 'string' && claims.jti ? claims.jti : await sha256Hex(found.value),
+            email: claims.email ?? null,
+            name: claims.name ?? null,
+        }, options.bridgeSecret);
+    };
+}
+/**
+ * Passport / express-session: the session id out of the signed `connect.sid`
+ * cookie (preset `passport`). Pass `secrets` (your `session({ secret })`) to
+ * check the signature as express-session does.
+ */
+function expressSessionExtractor(options = {}) {
+    return async ({ cookies }) => {
+        const raw = cookies[options.cookieName ?? framework_sessions_1.EXPRESS_SESSION_COOKIE];
+        if (!raw)
+            return undefined;
+        return (await (0, framework_sessions_1.unsignExpressSessionCookie)(raw, options.secrets)) ?? undefined;
+    };
+}
+/**
+ * iron-session: unseal the cookie with your session password and assert the
+ * user at `userIdPath` (default: `userId`, then `user.id`, then `id`).
+ */
+function ironSessionExtractor(options) {
+    return async ({ cookies }) => {
+        const raw = cookies[options.cookieName];
+        if (!raw)
+            return undefined;
+        const data = await (0, framework_sessions_1.unsealIronSession)(raw, options.password);
+        if (!data)
+            return undefined;
+        const sub = options.userIdPath
+            ? (0, framework_sessions_1.sessionValueAt)(data, options.userIdPath)
+            : ((0, framework_sessions_1.sessionValueAt)(data, 'userId') ?? (0, framework_sessions_1.sessionValueAt)(data, 'user.id') ?? (0, framework_sessions_1.sessionValueAt)(data, 'id'));
+        if (!sub)
+            return undefined;
+        return signBridgeAssertion({
+            source: 'iron_session',
+            sub,
+            sessionKey: await sha256Hex(raw),
+            email: (0, framework_sessions_1.sessionValueAt)(data, options.emailPath ?? 'user.email') ?? (0, framework_sessions_1.sessionValueAt)(data, 'email'),
+        }, options.bridgeSecret);
+    };
+}
+/**
+ * Devise on Rails' cookie store: decrypt `_<app>_session` with
+ * `secret_key_base` and assert the Warden user (`scope`, default `user`).
+ */
+function deviseExtractor(options) {
+    return async ({ cookies }) => {
+        const raw = cookies[options.cookieName];
+        if (!raw)
+            return undefined;
+        const session = await (0, framework_sessions_1.decryptRailsCookie)(raw, {
+            secretKeyBase: options.secretKeyBase,
+            cookieName: options.cookieName,
+            ...(options.keyDigest ? { keyDigest: options.keyDigest } : {}),
+        });
+        const user = session ? (0, framework_sessions_1.deviseSessionUser)(session, options.scope) : null;
+        if (!user)
+            return undefined;
+        const sid = typeof session.session_id === 'string' && session.session_id ? session.session_id : await sha256Hex(raw);
+        return signBridgeAssertion({ source: 'devise', sub: user.id, sessionKey: sid }, options.bridgeSecret);
+    };
+}
+/**
+ * Django's signed-cookie session backend: verify the cookie with SECRET_KEY
+ * (then SECRET_KEY_FALLBACKS) and assert `_auth_user_id`.
+ */
+function djangoSignedCookieExtractor(options) {
+    return async ({ cookies }) => {
+        const raw = cookies[options.cookieName ?? framework_sessions_1.DJANGO_SESSION_COOKIE];
+        if (!raw)
+            return undefined;
+        const data = await (0, framework_sessions_1.decodeDjangoSignedCookie)(raw, { secretKey: options.secretKey, maxAgeSeconds: options.maxAgeSeconds ?? 1209600 });
+        const user = data ? (0, framework_sessions_1.djangoSessionUser)(data) : null;
+        if (!user)
+            return undefined;
+        return signBridgeAssertion({ source: 'django', sub: user.id, sessionKey: await sha256Hex(raw) }, options.bridgeSecret);
+    };
+}
+// ── presets ─────────────────────────────────────────────────────────────────
+const AUTHJS_COOKIES = [...framework_sessions_1.AUTHJS_SESSION_COOKIES];
+const AUTHJS_CLEAR = [
+    ...framework_sessions_1.AUTHJS_SESSION_COOKIES.map((c) => `${c}*`),
+    '__Host-authjs.csrf-token',
+    'authjs.csrf-token',
+    '__Secure-authjs.callback-url',
+    'authjs.callback-url',
+    '__Host-next-auth.csrf-token',
+    'next-auth.csrf-token',
+    '__Secure-next-auth.callback-url',
+    'next-auth.callback-url',
+];
+/** A sealed-cookie preset: Atlas verifies the bridge assertion with the stored shared secret. */
+function assertionPreset(id, source, label, cookies, extra) {
+    return {
+        id,
+        label,
+        mode: 'jwt',
+        jwt: {
+            issuer: bridgeAssertionIssuer(source),
+            algorithms: ['HS256'],
+            allowSharedSecret: true,
+            claims: { subject: 'sub', email: 'email', name: 'name', sessionKey: 'jti', mfa: 'amr:mfa' },
+        },
+        cookies,
+        ...extra,
+    };
+}
+const FRAMEWORK_PRESETS = [
+    {
+        id: 'authjs',
+        label: 'Auth.js (database sessions)',
+        mode: 'session_table',
+        cookies: AUTHJS_COOKIES,
+        clearCookies: AUTHJS_CLEAR,
+        notes: 'Database strategy: the cookie is the sessionToken your adapter stored; import the sessions table. With the JWT strategy use the authjs_jwt preset.',
+    },
+    assertionPreset('authjs_jwt', 'authjs', 'Auth.js (JWT sessions)', AUTHJS_COOKIES, {
+        clearCookies: AUTHJS_CLEAR,
+        notes: 'The cookie is a JWE encrypted with AUTH_SECRET. Pass authJsExtractor({ secret: AUTH_SECRET, bridgeSecret }) to the middleware: it decrypts the cookie on your server and sends a one-time bridge assertion signed with the bridge secret stored in these settings.',
+    }),
+    {
+        id: 'lucia',
+        label: 'Lucia',
+        mode: 'session_table',
+        defaults: { cookie_name: framework_sessions_1.LUCIA_SESSION_COOKIE },
+        cookies: ['{cookie_name}'],
+        notes: 'The cookie holds the session token; the export hashes v2/v3 session ids, and reads guide-style sessions (id = sha256 of the token) as they are.',
+    },
+    {
+        id: 'passport',
+        label: 'Passport.js (express-session)',
+        mode: 'session_table',
+        defaults: { cookie_name: framework_sessions_1.EXPRESS_SESSION_COOKIE },
+        cookies: ['{cookie_name}'],
+        notes: 'The connect.sid cookie is signed (s:<id>.<signature>): pass expressSessionExtractor() to the middleware so Atlas gets the session id. Import the sessions from your express-session store.',
+    },
+    assertionPreset('iron_session', 'iron_session', 'iron-session', ['{cookie_name}'], {
+        vars: { cookie_name: 'The iron-session cookieName' },
+        notes: 'Pass ironSessionExtractor({ cookieName, password, bridgeSecret }) to the middleware: it unseals the cookie with your session password on your server.',
+    }),
+    assertionPreset('devise', 'devise', 'Devise (Rails cookie store)', ['{cookie_name}'], {
+        vars: { cookie_name: 'The Rails session cookie (_yourapp_session)' },
+        clearCookies: ['{cookie_name}', 'remember_user_token'],
+        notes: 'Pass deviseExtractor({ cookieName, secretKeyBase, bridgeSecret }) to the middleware (Node in front of, or beside, the Rails app): it decrypts the session cookie with secret_key_base on your server. JSON cookie serializer only.',
+    }),
+    {
+        id: 'devise_active_record',
+        label: 'Devise (activerecord-session_store)',
+        mode: 'session_table',
+        vars: { cookie_name: 'The Rails session cookie (_yourapp_session)' },
+        cookies: ['{cookie_name}'],
+        clearCookies: ['{cookie_name}', 'remember_user_token'],
+        notes: 'The cookie holds the public session id; Atlas matches sha256 of it, which is the private id Rack stored.',
+    },
+    {
+        id: 'django',
+        label: 'Django (database sessions)',
+        mode: 'session_table',
+        defaults: { cookie_name: framework_sessions_1.DJANGO_SESSION_COOKIE },
+        cookies: ['{cookie_name}'],
+        notes: 'The sessionid cookie is the django_session key; import sessions.session with the export.',
+    },
+    assertionPreset('django_signed_cookies', 'django', 'Django (signed-cookie sessions)', ['{cookie_name}'], {
+        defaults: { cookie_name: framework_sessions_1.DJANGO_SESSION_COOKIE },
+        notes: 'Pass djangoSignedCookieExtractor({ secretKey: SECRET_KEY, bridgeSecret }) to the middleware: it verifies the cookie with SECRET_KEY on your server.',
+    }),
+];
+for (const preset of FRAMEWORK_PRESETS)
+    (0, migration_presets_1.registerMigrationBridgePreset)(preset, { replace: true });
+/** The preset ids this module registers (for docs and the settings UI). */
+exports.FRAMEWORK_BRIDGE_PRESETS = FRAMEWORK_PRESETS.map((p) => p.id);
+//# sourceMappingURL=framework-bridge.js.map

package/dist/framework-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-bridge.js","sourceRoot":"","sources":["../src/framework-bridge.ts"],"names":[],"mappings":";;;AA+CA,sDAEC;AAkBD,kDAeC;AAeD,0CAwBC;AAOD,0DAMC;AAMD,oDA0BC;AAMD,0CAoBC;AAMD,kEAeC;AArND,+BAA+B;AAC/B,6DAe8B;AAE9B,2DAAgG;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,qDAAqD;AACrD,SAAgB,qBAAqB,CAAC,MAAc;IAClD,OAAO,oBAAoB,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,yEAAyE;AAC5D,QAAA,4BAA4B,GAAG,GAAG,CAAC;AAchD,8DAA8D;AACvD,KAAK,UAAU,mBAAmB,CAAC,SAA0B,EAAE,YAAoB,EAAE,MAAY,IAAI,IAAI,EAAE;IAChH,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;IAClK,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,OAAO,IAAI,cAAO,CAAC;QACjB,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAChD,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;SAClD,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;SACzB,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;SAC5B,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,GAAG,oCAA4B,CAAC;SACrD,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACpC,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,OAI/B;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAAA,4CAAuB,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,2CAAsB,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QACjF,MAAM,MAAM,GAAG,MAAM,IAAA,6CAAwB,EAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM,EAAE,GAAG;YAAE,OAAO,SAAS,CAAC;QACnC,OAAO,mBAAmB,CACxB;YACE,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,UAAU,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YACpG,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;SAC1B,EACD,OAAO,CAAC,YAAY,CACrB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,UAAyE,EAAE;IACjH,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,2CAAsB,CAAC,CAAC;QAClE,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,CAAC,MAAM,IAAA,+CAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,SAAS,CAAC;IAC/E,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAMpC;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAA,sCAAiB,EAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU;YAC5B,CAAC,CAAC,IAAA,mCAAc,EAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;YAC1C,CAAC,CAAC,CAAC,IAAA,mCAAc,EAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAA,mCAAc,EAAC,IAAI,EAAE,SAAS,CAAC,IAAI,IAAA,mCAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,mBAAmB,CACxB;YACE,MAAM,EAAE,cAAc;YACtB,GAAG;YACH,UAAU,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC;YAChC,KAAK,EAAE,IAAA,mCAAc,EAAC,IAAI,EAAE,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC,IAAI,IAAA,mCAAc,EAAC,IAAI,EAAE,OAAO,CAAC;SAChG,EACD,OAAO,CAAC,YAAY,CACrB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,OAM/B;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAA,uCAAkB,EAAC,GAAG,EAAE;YAC5C,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,sCAAiB,EAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,OAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,OAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACxH,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxG,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,OAM3C;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,0CAAqB,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAA,6CAAwB,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,OAAO,EAAE,CAAC,CAAC;QACpI,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAA,sCAAiB,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACzH,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,MAAM,cAAc,GAAG,CAAC,GAAG,2CAAsB,CAAC,CAAC;AACnD,MAAM,YAAY,GAAG;IACnB,GAAG,2CAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7C,0BAA0B;IAC1B,mBAAmB;IACnB,8BAA8B;IAC9B,qBAAqB;IACrB,6BAA6B;IAC7B,sBAAsB;IACtB,iCAAiC;IACjC,wBAAwB;CACzB,CAAC;AAEF,iGAAiG;AACjG,SAAS,eAAe,CAAC,EAAU,EAAE,MAAc,EAAE,KAAa,EAAE,OAAiB,EAAE,KAAqC;IAC1H,OAAO;QACL,EAAE;QACF,KAAK;QACL,IAAI,EAAE,KAAK;QACX,GAAG,EAAE;YACH,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;YACrC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,iBAAiB,EAAE,IAAI;YACvB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE;SAC5F;QACD,OAAO;QACP,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAA4B;IACjD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,cAAc;QACvB,YAAY,EAAE,YAAY;QAC1B,KAAK,EAAE,oJAAoJ;KAC5J;IACD,eAAe,CAAC,YAAY,EAAE,QAAQ,EAAE,wBAAwB,EAAE,cAAc,EAAE;QAChF,YAAY,EAAE,YAAY;QAC1B,KAAK,EACH,oQAAoQ;KACvQ,CAAC;IACF;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE,WAAW,EAAE,yCAAoB,EAAE;QAC/C,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,KAAK,EAAE,iJAAiJ;KACzJ;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,+BAA+B;QACtC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE,WAAW,EAAE,2CAAsB,EAAE;QACjD,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,KAAK,EAAE,4LAA4L;KACpM;IACD,eAAe,CAAC,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,eAAe,CAAC,EAAE;QACjF,IAAI,EAAE,EAAE,WAAW,EAAE,6BAA6B,EAAE;QACpD,KAAK,EAAE,uJAAuJ;KAC/J,CAAC;IACF,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,6BAA6B,EAAE,CAAC,eAAe,CAAC,EAAE;QACpF,IAAI,EAAE,EAAE,WAAW,EAAE,6CAA6C,EAAE;QACpE,YAAY,EAAE,CAAC,eAAe,EAAE,qBAAqB,CAAC;QACtD,KAAK,EAAE,oOAAoO;KAC5O,CAAC;IACF;QACE,EAAE,EAAE,sBAAsB;QAC1B,KAAK,EAAE,qCAAqC;QAC5C,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,EAAE,WAAW,EAAE,6CAA6C,EAAE;QACpE,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,YAAY,EAAE,CAAC,eAAe,EAAE,qBAAqB,CAAC;QACtD,KAAK,EAAE,0GAA0G;KAClH;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE,WAAW,EAAE,0CAAqB,EAAE;QAChD,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,KAAK,EAAE,0FAA0F;KAClG;IACD,eAAe,CAAC,uBAAuB,EAAE,QAAQ,EAAE,iCAAiC,EAAE,CAAC,eAAe,CAAC,EAAE;QACvG,QAAQ,EAAE,EAAE,WAAW,EAAE,0CAAqB,EAAE;QAChD,KAAK,EAAE,qJAAqJ;KAC7J,CAAC;CACH,CAAC;AAEF,KAAK,MAAM,MAAM,IAAI,iBAAiB;IAAE,IAAA,iDAA6B,EAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAEjG,2EAA2E;AAC9D,QAAA,wBAAwB,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC"}