@atlasauth/backend 0.28.0 → 0.30.0

package/dist/rp.d.ts

@@ -0,0 +1,189 @@
+/**
+ * `@atlasauth/backend/rp`: the server-side relying party for the hosted
+ * redirect, as `(Request) => Response` handlers for any framework.
+ *
+ *   const rp = createRelyingParty({ issuer, clientId, clientSecret, redirectUri, secret, secretKey });
+ *   app.get('/auth/sign-in', (req) => rp.start(req));
+ *   app.get('/auth/callback', async (req) => {
+ *     const { user, response } = await rp.callback(req);
+ *     // create your session for user.sub, keep user.sid on it, then:
+ *     response.headers.append('set-cookie', yourSessionCookie);
+ *     return response;
+ *   });
+ *
+ * This entry point loads only Web standards (fetch, Web Crypto, Request,
+ * Response, URL) and `jose`, itself Web Crypto only: no `Buffer`, no
+ * `node:*`. It runs unchanged on Node 18+, Deno, Bun and Workers. The full
+ * `@atlasauth/backend` entry (management client, migration bridges, ...) is
+ * never pulled in.
+ *
+ * Everything here is a thin layer over `oidc.start` / `oidc.callback` (state,
+ * nonce and PKCE S256 in one sealed short-lived cookie; ID-token checks with the
+ * algorithm pinned, `iss`, `aud`/`azp`, `exp`/`iat`, `nonce`, `at_hash`) plus
+ * the Atlas session calls a relying party that keeps its own session needs:
+ * keep-alive (`POST /v1/sessions/{id}/touch`) and server-side sign-out
+ * (`POST /v1/sessions/{id}/revoke`).
+ */
+import { type OidcClientAuth, type OidcIdentity, type OidcStartOptions } from './oidc';
+export { AtlasOidcError, isSafeReturnTo, oidcCallback, oidcLogoutUrl, oidcStart, oidcVerifyIdToken, resetOidcCaches } from './oidc';
+export type { OidcIdentity, OidcStartOptions, OidcCallbackOptions, AtlasOidcErrorCode } from './oidc';
+export { AtlasApiError } from './client/error';
+export { BACKCHANNEL_LOGOUT_EVENT, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
+export type { LogoutReplayStore, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions } from './logout-token';
+export { expressBackchannelLogout, fastifyBackchannelLogout, fastifyBackchannelLogoutPlugin, fetchBackchannelLogout, handleBackchannelLogout, } from './backchannel-handlers';
+export type { BackchannelLogoutOptions } from './backchannel-handlers';
+export { ATLAS_WEBHOOK_HEADERS } from './webhook-common';
+export { verifyAtlasWebhook, verifyAtlasWebhookRequest } from './webhooks-web';
+export type { WebhookVerifyFailure, WebhookVerifyResult } from './webhook-common';
+export type { VerifyAtlasWebhookInput } from './webhooks-web';
+export { authenticatedWithin, usedMultiFactor } from './recent-auth';
+export interface RelyingPartyConfig {
+    /** Your instance's issuer: `https://` + its frontend API host. */
+    issuer: string;
+    /** The OAuth client id. */
+    clientId: string;
+    /** The client secret (a confidential client). */
+    clientSecret?: string;
+    /** Token-endpoint authentication. Default `client_secret_basic` with a secret. */
+    clientAuth?: OidcClientAuth;
+    /** The callback URL, registered on the client exactly. */
+    redirectUri: string;
+    /** At least 32 characters: seals the short-lived sign-in cookie. */
+    secret: string;
+    /** Scopes. Default `openid profile email`. */
+    scope?: string;
+    /** Where the callback response sends the browser when the sign-in carried no return path. Default `/`. */
+    afterSignInPath?: string;
+    /** Where Atlas sends the browser after sign-out. Must be registered on the client exactly. */
+    postLogoutRedirectUri?: string;
+    /** The instance secret key (`sk_...`, scope `sessions:write`). Needed for `touchIfDue` and server-side revoke. */
+    secretKey?: string;
+    /** The Backend API origin. Default `https://api.atlasauth.net`. */
+    apiUrl?: string;
+    /** Flow cookie name. Default `atlas_oidc`. */
+    cookieName?: string;
+    /** Minimum time between two keep-alive calls for one session. Default 5 minutes. */
+    touchIntervalMs?: number;
+    fetchImpl?: typeof fetch;
+    /** A clock in epoch milliseconds, for tests. */
+    now?: () => number;
+}
+/** Who signed in: the ID-token claims an app needs, in the token's own names. */
+export interface RelyingPartyUser {
+    sub: string;
+    /** The Atlas session id. Keep it on your session: touch, revoke and back-channel logout all name it. */
+    sid: string | null;
+    email: string | null;
+    /** True only when the ID token says so. Never match accounts on an unverified email. */
+    email_verified: boolean;
+    name: string | null;
+    /** Your own id for the user, when the token carries one. */
+    external_id?: string;
+    /** The organization the sign-in was made in, when there was one. */
+    org_id?: string;
+    org_role?: string;
+    /** When the user last authenticated, epoch seconds. Store it for {@link RelyingParty.requireRecentAuth}. */
+    auth_time: number | null;
+}
+export interface RelyingPartyTokens {
+    id_token: string;
+    access_token: string;
+    refresh_token?: string;
+    /** When the access token expires, epoch milliseconds. */
+    expires_at: number;
+}
+export interface CallbackResult {
+    user: RelyingPartyUser;
+    tokens: RelyingPartyTokens;
+    /** Every verified claim and the organization / SSO context, as `oidc.callback` returns them. */
+    identity: OidcIdentity;
+    /**
+     * A 302 to the return path (or `afterSignInPath`) that already clears the
+     * sign-in cookie. Its headers are mutable: append your own session cookie.
+     */
+    response: Response;
+}
+/** Per-request overrides for {@link RelyingParty.start}. */
+export type StartOverrides = Pick<OidcStartOptions, 'prompt' | 'loginHint' | 'uiLocales' | 'maxAge' | 'organization' | 'returnTo' | 'expectedSub' | 'scope' | 'extraParams'>;
+export type TouchResult = 
+/** Touched less than `touchIntervalMs` ago: nothing sent. Keep your `lastTouchedAt`. */
+{
+    status: 'skipped';
+    lastTouchedAt: number;
+}
+/** Atlas slid the idle window. Store `lastTouchedAt`. */
+ | {
+    status: 'touched';
+    lastTouchedAt: number;
+    idleExpiresAt: string | null;
+}
+/**
+ * The Atlas session has ended (signed out, revoked, timed out, or unknown).
+ * End your own session: it is no longer backed by a live Atlas session.
+ */
+ | {
+    status: 'ended';
+    reason: 'revoked' | 'idle_expired' | 'expired' | 'not_found';
+};
+export interface SignOutOptions {
+    /** The ID token from sign-in: lets Atlas end the session without asking. */
+    idToken?: string;
+    /** The Atlas session id. With a `secretKey`, it is revoked server-side before the redirect. */
+    sid?: string | null;
+    /** Override the configured `postLogoutRedirectUri`. */
+    postLogoutRedirectUri?: string;
+    state?: string;
+}
+export interface RecentAuthOptions {
+    /** The signed-in user's `sub`: the re-authentication must come back as the same user. */
+    sub: string;
+    /** The `auth_time` you stored at sign-in (or after the last step-up). */
+    authTime: number | null | undefined;
+    /** Where to come back to after confirming. Default: the request's own path and query. */
+    returnTo?: string;
+}
+export interface RelyingParty {
+    /**
+     * Begin sign-in: a 302 to `/oauth2/authorize` with the sign-in cookie set.
+     * `prompt`, `login_hint`, `ui_locales`, `max_age`, `organization` and
+     * `return_to` on the request's query are passed through; `overrides` win.
+     */
+    start(request: Request, overrides?: StartOverrides): Promise<Response>;
+    /**
+     * Finish sign-in. Throws {@link AtlasOidcError} on any failure; send its
+     * `clearCookie` as `Set-Cookie` on your error response.
+     */
+    callback(request: Request): Promise<CallbackResult>;
+    /**
+     * Step-up: `null` when `authTime` is within `maxAgeSeconds`; otherwise a 302
+     * that asks the same user to authenticate again (`max_age`, plus
+     * `prompt=login` for 0). The callback then refuses another user or an old
+     * `auth_time`; store the new `user.auth_time` (and `user.sid`). `0` asks
+     * unless the user authenticated in the last {@link CONFIRM_NOW_WINDOW_SECONDS}
+     * seconds, so the request that returns from the confirmation goes through.
+     */
+    requireRecentAuth(request: Request, maxAgeSeconds: number, options: RecentAuthOptions): Promise<Response | null>;
+    /**
+     * Keep the Atlas session alive while the user is active in your app, at
+     * most once per `touchIntervalMs` per session. Call it on each authenticated
+     * request with the `sid` and the time you last touched (0 or null at first).
+     */
+    touchIfDue(sid: string, lastTouchedAt: number | null | undefined): Promise<TouchResult>;
+    /**
+     * End the Atlas session server-side (`POST /v1/sessions/{id}/revoke`); every
+     * app signed in through it gets a back-channel logout. An already-ended
+     * session is `revoked` too; `not_found` means this instance has no such
+     * session (check you use the same instance's secret key). Other failures throw.
+     */
+    revokeSession(sid: string): Promise<'revoked' | 'not_found'>;
+    /**
+     * Sign-out: with a `sid` and a `secretKey`, revokes the Atlas session
+     * server-side first, then 302s the browser to `/oauth2/logout`. End your own
+     * session (clear your cookie on this response) as well.
+     */
+    signOut(options?: SignOutOptions): Promise<Response>;
+}
+/** How long a `requireRecentAuth(…, 0)` confirmation counts, in seconds. */
+export declare const CONFIRM_NOW_WINDOW_SECONDS = 60;
+/** Create the relying party once, at startup; reuse it for every request. */
+export declare function createRelyingParty(config: RelyingPartyConfig): RelyingParty;

package/dist/rp.js

@@ -0,0 +1,224 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONFIRM_NOW_WINDOW_SECONDS = exports.usedMultiFactor = exports.authenticatedWithin = exports.verifyAtlasWebhookRequest = exports.verifyAtlasWebhook = exports.ATLAS_WEBHOOK_HEADERS = exports.handleBackchannelLogout = exports.fetchBackchannelLogout = exports.fastifyBackchannelLogoutPlugin = exports.fastifyBackchannelLogout = exports.expressBackchannelLogout = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.BACKCHANNEL_LOGOUT_EVENT = exports.AtlasApiError = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcCallback = exports.isSafeReturnTo = exports.AtlasOidcError = void 0;
+exports.createRelyingParty = createRelyingParty;
+/**
+ * `@atlasauth/backend/rp`: the server-side relying party for the hosted
+ * redirect, as `(Request) => Response` handlers for any framework.
+ *
+ *   const rp = createRelyingParty({ issuer, clientId, clientSecret, redirectUri, secret, secretKey });
+ *   app.get('/auth/sign-in', (req) => rp.start(req));
+ *   app.get('/auth/callback', async (req) => {
+ *     const { user, response } = await rp.callback(req);
+ *     // create your session for user.sub, keep user.sid on it, then:
+ *     response.headers.append('set-cookie', yourSessionCookie);
+ *     return response;
+ *   });
+ *
+ * This entry point loads only Web standards (fetch, Web Crypto, Request,
+ * Response, URL) and `jose`, itself Web Crypto only: no `Buffer`, no
+ * `node:*`. It runs unchanged on Node 18+, Deno, Bun and Workers. The full
+ * `@atlasauth/backend` entry (management client, migration bridges, ...) is
+ * never pulled in.
+ *
+ * Everything here is a thin layer over `oidc.start` / `oidc.callback` (state,
+ * nonce and PKCE S256 in one sealed short-lived cookie; ID-token checks with the
+ * algorithm pinned, `iss`, `aud`/`azp`, `exp`/`iat`, `nonce`, `at_hash`) plus
+ * the Atlas session calls a relying party that keeps its own session needs:
+ * keep-alive (`POST /v1/sessions/{id}/touch`) and server-side sign-out
+ * (`POST /v1/sessions/{id}/revoke`).
+ */
+const oidc_1 = require("./oidc");
+const error_1 = require("./client/error");
+const request_1 = require("./client/request");
+var oidc_2 = require("./oidc");
+Object.defineProperty(exports, "AtlasOidcError", { enumerable: true, get: function () { return oidc_2.AtlasOidcError; } });
+Object.defineProperty(exports, "isSafeReturnTo", { enumerable: true, get: function () { return oidc_2.isSafeReturnTo; } });
+Object.defineProperty(exports, "oidcCallback", { enumerable: true, get: function () { return oidc_2.oidcCallback; } });
+Object.defineProperty(exports, "oidcLogoutUrl", { enumerable: true, get: function () { return oidc_2.oidcLogoutUrl; } });
+Object.defineProperty(exports, "oidcStart", { enumerable: true, get: function () { return oidc_2.oidcStart; } });
+Object.defineProperty(exports, "oidcVerifyIdToken", { enumerable: true, get: function () { return oidc_2.oidcVerifyIdToken; } });
+Object.defineProperty(exports, "resetOidcCaches", { enumerable: true, get: function () { return oidc_2.resetOidcCaches; } });
+var error_2 = require("./client/error");
+Object.defineProperty(exports, "AtlasApiError", { enumerable: true, get: function () { return error_2.AtlasApiError; } });
+// Back-channel logout: verify the logout_token (typ logout+jwt, events, no nonce, sid/sub, jti replay hook).
+var logout_token_1 = require("./logout-token");
+Object.defineProperty(exports, "BACKCHANNEL_LOGOUT_EVENT", { enumerable: true, get: function () { return logout_token_1.BACKCHANNEL_LOGOUT_EVENT; } });
+Object.defineProperty(exports, "LogoutTokenVerifier", { enumerable: true, get: function () { return logout_token_1.LogoutTokenVerifier; } });
+Object.defineProperty(exports, "memoryLogoutReplayStore", { enumerable: true, get: function () { return logout_token_1.memoryLogoutReplayStore; } });
+Object.defineProperty(exports, "verifyLogoutToken", { enumerable: true, get: function () { return logout_token_1.verifyLogoutToken; } });
+var backchannel_handlers_1 = require("./backchannel-handlers");
+Object.defineProperty(exports, "expressBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.expressBackchannelLogout; } });
+Object.defineProperty(exports, "fastifyBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.fastifyBackchannelLogout; } });
+Object.defineProperty(exports, "fastifyBackchannelLogoutPlugin", { enumerable: true, get: function () { return backchannel_handlers_1.fastifyBackchannelLogoutPlugin; } });
+Object.defineProperty(exports, "fetchBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.fetchBackchannelLogout; } });
+Object.defineProperty(exports, "handleBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.handleBackchannelLogout; } });
+// Webhooks, verified with Web Crypto.
+var webhook_common_1 = require("./webhook-common");
+Object.defineProperty(exports, "ATLAS_WEBHOOK_HEADERS", { enumerable: true, get: function () { return webhook_common_1.ATLAS_WEBHOOK_HEADERS; } });
+var webhooks_web_1 = require("./webhooks-web");
+Object.defineProperty(exports, "verifyAtlasWebhook", { enumerable: true, get: function () { return webhooks_web_1.verifyAtlasWebhook; } });
+Object.defineProperty(exports, "verifyAtlasWebhookRequest", { enumerable: true, get: function () { return webhooks_web_1.verifyAtlasWebhookRequest; } });
+var recent_auth_1 = require("./recent-auth");
+Object.defineProperty(exports, "authenticatedWithin", { enumerable: true, get: function () { return recent_auth_1.authenticatedWithin; } });
+Object.defineProperty(exports, "usedMultiFactor", { enumerable: true, get: function () { return recent_auth_1.usedMultiFactor; } });
+const PASSTHROUGH = [
+    ['prompt', 'prompt'],
+    ['login_hint', 'loginHint'],
+    ['ui_locales', 'uiLocales'],
+    ['organization', 'organization'],
+    ['return_to', 'returnTo'],
+];
+const DEFAULT_TOUCH_INTERVAL_MS = 5 * 60_000;
+/** How long a `requireRecentAuth(…, 0)` confirmation counts, in seconds. */
+exports.CONFIRM_NOW_WINDOW_SECONDS = 60;
+/** Create the relying party once, at startup; reuse it for every request. */
+function createRelyingParty(config) {
+    if (typeof config.secret !== 'string' || config.secret.length < 32) {
+        throw new TypeError('createRelyingParty: `secret` (at least 32 characters) is required to seal the sign-in cookie.');
+    }
+    const afterSignIn = config.afterSignInPath ?? '/';
+    if (!(0, oidc_1.isSafeReturnTo)(afterSignIn))
+        throw new TypeError('createRelyingParty: `afterSignInPath` must be a path starting with a single `/`.');
+    const base = {
+        issuer: config.issuer,
+        clientId: config.clientId,
+        redirectUri: config.redirectUri,
+        secret: config.secret,
+        cookieName: config.cookieName ?? oidc_1.OIDC_FLOW_COOKIE,
+        fetchImpl: config.fetchImpl,
+        now: config.now,
+    };
+    const clock = () => (config.now ?? Date.now)();
+    const doFetch = (input, init) => (config.fetchImpl ?? fetch)(input, init);
+    const interval = config.touchIntervalMs ?? DEFAULT_TOUCH_INTERVAL_MS;
+    async function start(request, overrides = {}) {
+        const query = new URL(request.url).searchParams;
+        const fromQuery = {};
+        for (const [param, key] of PASSTHROUGH) {
+            const v = query.get(param);
+            // A bad return_to from the query is dropped, never an error page.
+            if (v && (key !== 'returnTo' || (0, oidc_1.isSafeReturnTo)(v)))
+                fromQuery[key] = v;
+        }
+        const maxAge = query.get('max_age');
+        if (maxAge !== null && /^\d{1,9}$/.test(maxAge))
+            fromQuery.maxAge = Number(maxAge);
+        const { url, cookie } = await (0, oidc_1.oidcStart)({ ...base, scope: config.scope, ...fromQuery, ...overrides });
+        return redirect(url, [cookie]);
+    }
+    async function callback(request) {
+        const identity = await (0, oidc_1.oidcCallback)({
+            ...base,
+            clientSecret: config.clientSecret,
+            clientAuth: config.clientAuth,
+            query: new URL(request.url).searchParams,
+            cookie: request.headers.get('cookie'),
+        });
+        const c = identity.claims;
+        const user = {
+            sub: identity.sub,
+            sid: identity.sid,
+            email: identity.email,
+            email_verified: identity.emailVerified,
+            name: identity.name,
+            ...(typeof c.external_id === 'string' && c.external_id ? { external_id: c.external_id } : {}),
+            ...(identity.organization ? { org_id: identity.organization.id, org_role: identity.organization.role } : {}),
+            auth_time: identity.authTime,
+        };
+        const tokens = {
+            id_token: identity.idToken,
+            access_token: identity.accessToken,
+            ...(identity.refreshToken ? { refresh_token: identity.refreshToken } : {}),
+            expires_at: identity.expiresAt,
+        };
+        return { user, tokens, identity, response: redirect(identity.returnTo ?? afterSignIn, [identity.clearCookie]) };
+    }
+    async function requireRecentAuth(request, maxAgeSeconds, options) {
+        if (!Number.isSafeInteger(maxAgeSeconds) || maxAgeSeconds < 0) {
+            throw new TypeError('requireRecentAuth: `maxAgeSeconds` must be a whole number of seconds, 0 or more.');
+        }
+        if (typeof options?.sub !== 'string' || !options.sub)
+            throw new TypeError('requireRecentAuth: `sub` is required.');
+        const at = options.authTime;
+        // 0 means "confirm now": it still passes for a minute after the confirmation,
+        // or the request that comes back from it would be sent to confirm again, forever.
+        const allowed = maxAgeSeconds === 0 ? exports.CONFIRM_NOW_WINDOW_SECONDS : maxAgeSeconds;
+        if (typeof at === 'number' && Number.isFinite(at) && clock() / 1000 - at <= allowed)
+            return null;
+        const here = new URL(request.url);
+        const returnTo = options.returnTo ?? `${here.pathname}${here.search}`;
+        const { url, cookie } = await (0, oidc_1.oidcStart)({
+            ...base,
+            scope: config.scope,
+            maxAge: maxAgeSeconds,
+            expectedSub: options.sub,
+            ...(maxAgeSeconds === 0 ? { prompt: 'login' } : {}),
+            ...((0, oidc_1.isSafeReturnTo)(returnTo) ? { returnTo } : {}),
+        });
+        return redirect(url, [cookie]);
+    }
+    function sessionCall(sid, action) {
+        if (!config.secretKey)
+            throw new TypeError(`${action === 'touch' ? 'touchIfDue' : 'revokeSession'}: \`secretKey\` is not configured.`);
+        if (typeof sid !== 'string' || !sid)
+            throw new TypeError('A session id (`sid`) is required.');
+        const url = `${(config.apiUrl ?? request_1.DEFAULT_API_URL).replace(/\/+$/, '')}/v1/sessions/${encodeURIComponent(sid)}/${action}`;
+        return doFetch(url, { method: 'POST', headers: { authorization: `Bearer ${config.secretKey}`, accept: 'application/json' } });
+    }
+    async function touchIfDue(sid, lastTouchedAt) {
+        const now = clock();
+        if (typeof lastTouchedAt === 'number' && now - lastTouchedAt < interval && now >= lastTouchedAt) {
+            return { status: 'skipped', lastTouchedAt };
+        }
+        const res = await sessionCall(sid, 'touch');
+        const body = (await res.json().catch(() => null));
+        if (res.ok) {
+            return { status: 'touched', lastTouchedAt: now, idleExpiresAt: typeof body?.idle_expires_at === 'string' ? body.idle_expires_at : null };
+        }
+        if (res.status === 404)
+            return { status: 'ended', reason: 'not_found' };
+        if (res.status === 409) {
+            const code = errorsOf(body)[0]?.code;
+            if (code === 'SESSION_REVOKED')
+                return { status: 'ended', reason: 'revoked' };
+            if (code === 'SESSION_IDLE_EXPIRED')
+                return { status: 'ended', reason: 'idle_expired' };
+            return { status: 'ended', reason: 'expired' };
+        }
+        // A key, scope or availability problem is not "signed out": say so loudly.
+        throw new error_1.AtlasApiError(res.status, errorsOf(body));
+    }
+    async function revokeSession(sid) {
+        const res = await sessionCall(sid, 'revoke');
+        if (res.ok)
+            return 'revoked';
+        if (res.status === 404)
+            return 'not_found';
+        throw new error_1.AtlasApiError(res.status, errorsOf(await res.json().catch(() => null)));
+    }
+    async function signOut(options = {}) {
+        if (options.sid && config.secretKey)
+            await revokeSession(options.sid);
+        const url = await (0, oidc_1.oidcLogoutUrl)({
+            ...base,
+            postLogoutRedirectUri: options.postLogoutRedirectUri ?? config.postLogoutRedirectUri,
+            idTokenHint: options.idToken,
+            state: options.state,
+        });
+        return redirect(url, []);
+    }
+    return { start, callback, requireRecentAuth, touchIfDue, revokeSession, signOut };
+}
+/** A 302 built with `new Response` (not `Response.redirect`), so its headers stay mutable. */
+function redirect(location, cookies) {
+    const headers = new Headers({ location, 'cache-control': 'no-store' });
+    for (const c of cookies)
+        headers.append('set-cookie', c);
+    return new Response(null, { status: 302, headers });
+}
+function errorsOf(body) {
+    const errors = body?.errors;
+    return Array.isArray(errors) ? errors : [];
+}
+//# sourceMappingURL=rp.js.map

package/dist/rp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rp.js","sourceRoot":"","sources":["../src/rp.ts"],"names":[],"mappings":";;;AAmOA,gDAmIC;AAtWD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,iCAUgB;AAChB,0CAAoE;AACpE,8CAAmD;AAEnD,+BAAoI;AAA3H,sGAAA,cAAc,OAAA;AAAE,sGAAA,cAAc,OAAA;AAAE,oGAAA,YAAY,OAAA;AAAE,qGAAA,aAAa,OAAA;AAAE,iGAAA,SAAS,OAAA;AAAE,yGAAA,iBAAiB,OAAA;AAAE,uGAAA,eAAe,OAAA;AAEnH,wCAA+C;AAAtC,sGAAA,aAAa,OAAA;AACtB,6GAA6G;AAC7G,+CAKwB;AAJtB,wHAAA,wBAAwB,OAAA;AACxB,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAGnB,+DAMgC;AAL9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AAGzB,sCAAsC;AACtC,mDAAyD;AAAhD,uHAAA,qBAAqB,OAAA;AAC9B,+CAA+E;AAAtE,kHAAA,kBAAkB,OAAA;AAAE,yHAAA,yBAAyB,OAAA;AAGtD,6CAAqE;AAA5D,kHAAA,mBAAmB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAsJ7C,MAAM,WAAW,GAAkD;IACjE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,WAAW,EAAE,UAAU,CAAC;CAC1B,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC7C,4EAA4E;AAC/D,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAE7C,6EAA6E;AAC7E,SAAgB,kBAAkB,CAAC,MAA0B;IAC3D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,+FAA+F,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,IAAI,GAAG,CAAC;IAClD,IAAI,CAAC,IAAA,qBAAc,EAAC,WAAW,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kFAAkF,CAAC,CAAC;IAC1I,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,uBAAgB;QACjD,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,IAAiB,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAErE,KAAK,UAAU,KAAK,CAAC,OAAgB,EAAE,YAA4B,EAAE;QACnE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;QAChD,MAAM,SAAS,GAAmB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,kEAAkE;YAClE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,IAAI,IAAA,qBAAc,EAAC,CAAC,CAAC,CAAC;gBAAG,SAA+C,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACtG,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAY,EAAC;YAClC,GAAG,IAAI;YACP,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY;YACxC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAqB;YAC7B,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,cAAc,EAAE,QAAQ,CAAC,aAAa;YACtC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5G,SAAS,EAAE,QAAQ,CAAC,QAAQ;SAC7B,CAAC;QACF,MAAM,MAAM,GAAuB;YACjC,QAAQ,EAAE,QAAQ,CAAC,OAAO;YAC1B,YAAY,EAAE,QAAQ,CAAC,WAAW;YAClC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,UAAU,EAAE,QAAQ,CAAC,SAAS;SAC/B,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;IAClH,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,aAAqB,EAAE,OAA0B;QAClG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,SAAS,CAAC,kFAAkF,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,OAAO,OAAO,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnH,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5B,8EAA8E;QAC9E,kFAAkF;QAClF,MAAM,OAAO,GAAG,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,kCAA0B,CAAC,CAAC,CAAC,aAAa,CAAC;QACjF,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,GAAG,IAAI,GAAG,EAAE,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC;QACjG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACtE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC;YACtC,GAAG,IAAI;YACP,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,OAAO,CAAC,GAAG;YACxB,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,IAAA,qBAAc,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAA0B;QAC1D,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,oCAAoC,CAAC,CAAC;QACvI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAC9F,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,yBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,kBAAkB,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QACzH,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,aAAwC;QAC7E,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,GAAG,GAAG,aAAa,GAAG,QAAQ,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;YAChG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC9C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACpF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3I,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACxE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YACrC,IAAI,IAAI,KAAK,iBAAiB;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9E,IAAI,IAAI,KAAK,sBAAsB;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACxF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QACD,2EAA2E;QAC3E,MAAM,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,GAAW;QACtC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,WAAW,CAAC;QAC3C,MAAM,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,UAA0B,EAAE;QACjD,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,IAAA,oBAAa,EAAC;YAC9B,GAAG,IAAI;YACP,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB;YACpF,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACpF,CAAC;AAED,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,QAAgB,EAAE,OAAiB;IACnD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,MAAM,MAAM,GAAI,IAAoC,EAAE,MAAM,CAAC;IAC7D,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC"}

package/dist/verify.d.ts

@@ -175,6 +175,14 @@ export interface AtlasBackendOptions {
     jwks?: Jwks;
     /** Expected `iss`. Required — an unchecked issuer accepts any Atlas instance. */
     issuer: string;
+    /**
+     * Earlier issuers of THIS instance, also accepted: its old sign-in host while
+     * the instance moves to a new one (a custom domain or a path mount going
+     * active). The keys are the instance's own, so nothing else changes. The
+     * instance's discovery document lists them in `atlas_previous_issuers` with
+     * an `accepted_until`; remove them after that.
+     */
+    previousIssuers?: readonly string[];
     /**
      * §7.3 optional azp allowlist. When set, a token minted for a different
      * origin is refused, which is what stops a token issued to one of the

package/dist/verify.js

@@ -181,7 +181,9 @@ class AtlasBackend {
                 // Pinned. Without this, a token whose header says `alg: none` — or any
                 // algorithm the key material can be coerced into — verifies.
                 algorithms: algs_1.ATLAS_SIGNING_ALGS,
-                issuer: this.options.issuer,
+                issuer: this.options.previousIssuers?.length
+                    ? [this.options.issuer, ...this.options.previousIssuers]
+                    : this.options.issuer,
                 // §S4 enforce `aud` ONLY when the caller configured an expected audience.
                 // Unset leaves `aud` unchecked, so a token carrying its default
                 // instance-id audience still verifies (backwards compatible).

package/dist/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";;;AAmmBA,sCAEC;AAED,0BAEC;AAMD,4CAEC;AAGD,gCAEC;AAOD,kBAEC;AAMD,0BAIC;AAzoBD,+BAAoD;AACpD,4CAK0B;AAC1B,6CAA6D;AAC7D,2CAA0E;AAC1E,iDAIwB;AACxB,iCAUgB;AAchB,6EAA6E;AAC7E,kFAAkF;AAClF,yEAAyE;AACzE,0CAW0B;AANxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAEjB,iCAA4C;AAC5C,qDAAuF;AAEvF;;;;;;;;;;;;;;;GAeG;AAEH,+EAA+E;AAClE,QAAA,kBAAkB,GAAG,CAAC,CAAC;AA8GpC,kFAAkF;AAClF,SAAS,UAAU,CAAC,MAAqB;IACvC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,wEAAwE;QACxE,oEAAoE;QACpE,KAAK,EACH,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG;YAChE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;YACzB,CAAC,CAAC,IAAI;QACV,GAAG,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,MAAM,EAAE,SAAS,CAAC;QACzD,OAAO,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,IAAA,gBAAQ,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,MAAM,IAAI,sBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAgED,MAAa,YAAY;IAWM;IAVZ,IAAI,CAAY;IAChB,MAAM,CAAwB;IAE/C;;;;OAIG;IACM,IAAI,CAAmB;IAEhC,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QACvD,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;QAC7C,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,6LAA6L,CAC9L,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,CAAC;QAED,IAAI,SAAoC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;gBAClB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,wCAA4B,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9F,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAC;YAC3H,CAAC;YACD,SAAS,GAAG,IAAI,yBAAa,CAAC;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,CAAgC,CAAI,EAAE,EAAE,CAAC,CAAC;YACrD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,CAAC;YACJ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG;YACV,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAS,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,mBAAY,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAa,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxC,aAAa,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,wBAAiB,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9D,WAAW,EAAE,sBAAe;SAC7B,CAAC;QAEF,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,IAAI,qCAAoB,CAAC;gBACrC,OAAO,EAAE,OAAO,CAAC,aAAa;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,qBAAqB,EAAE,0BAAkB;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAS,CAAC;YACxB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACzC,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CACf,KAAa,EACb,OAAwD;QAExD,OAAO,IAAA,+BAAgB,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;YACxC,GAAG,OAAO;YACV,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEvF,0EAA0E;QAC1E,uEAAuE;QACvE,iFAAiF;QACjF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,2BAAU,EAAC,KAAK,CAAC,CAAC,CAAC;YACnD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,CAAC,OAAO,CAAC,EAAE;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAkC,CAAC;gBAC1D,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;oBACvE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;wBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;gBAC/G,CAAC;gBACD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAgB,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS;gBACxB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBAC/D,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;gBAC3E,uEAAuE;gBACvE,6DAA6D;gBAC7D,UAAU,EAAE,yBAAkB;gBAC9B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,0EAA0E;gBAC1E,gEAAgE;gBAChE,8DAA8D;gBAC9D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAA6B,EAAE;oBAC1D,CAAC,CAAC,EAAE,CAAC;gBACP,cAAc,EAAE,0BAAkB;gBAClC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACzE,CAAC,CAAC;YACH,MAAM,GAAG,OAAmC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QAED;;;;;;;;WAQG;QACH,MAAM,QAAQ,GAAI,MAAkC,CAAC,SAAS,CAAC;QAC/D,MAAM,eAAe,GAAG,QAAQ,KAAK,SAAS,CAAC;QAC/C,2EAA2E;QAC3E,kEAAkE;QAClE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,kCAAkC;QAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACrD,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,4EAA4E;QAC5E,sCAAsC;QACtC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,mKAAmK,CACpK,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CACtD,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,mBAAmB,EAC9C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;oBACjD,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;aAChC,CACF,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;YAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAEzB;QACC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,MAAM,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEtD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,CACrB,QAAgB,EAChB,QAAkF;QAElF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,IAAI,sBAAsB,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACtE,CAAC;CACF;AAjSD,oCAiSC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,QAAkF;IAElF,IAAI,QAAQ,YAAY,eAAe;QAAE,OAAO,QAAQ,CAAC;IACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;oBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;iBAAM,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,yEAAyE;IACzE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CACjB,OAAkF,EAClF,IAAY;IAEZ,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7D,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,OAA6C,CAAC;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,IAAY;IAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,MAAqB,EAAE,UAAkB;IACrE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,OAAO,CAAC,MAAqB,EAAE,IAAY;IACzD,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,MAAqB,EAAE,UAAkB;IACxE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,2FAA2F;AAC3F,SAAgB,UAAU,CAAC,MAAqB,EAAE,IAAY;IAC5D,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAgB,GAAG,CAAC,MAAqB,EAAE,YAA8B,EAAE;IACzE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAgB,OAAO,CAAC,MAAqB,EAAE,YAA8B,EAAE;IAC7E,MAAM,OAAO,GAAG,IAAA,gBAAQ,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,sBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";;;AA6mBA,sCAEC;AAED,0BAEC;AAMD,4CAEC;AAGD,gCAEC;AAOD,kBAEC;AAMD,0BAIC;AAnpBD,+BAAoD;AACpD,4CAK0B;AAC1B,6CAA6D;AAC7D,2CAA0E;AAC1E,iDAIwB;AACxB,iCAUgB;AAchB,6EAA6E;AAC7E,kFAAkF;AAClF,yEAAyE;AACzE,0CAW0B;AANxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAEjB,iCAA4C;AAC5C,qDAAuF;AAEvF;;;;;;;;;;;;;;;GAeG;AAEH,+EAA+E;AAClE,QAAA,kBAAkB,GAAG,CAAC,CAAC;AA8GpC,kFAAkF;AAClF,SAAS,UAAU,CAAC,MAAqB;IACvC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,wEAAwE;QACxE,oEAAoE;QACpE,KAAK,EACH,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG;YAChE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;YACzB,CAAC,CAAC,IAAI;QACV,GAAG,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,MAAM,EAAE,SAAS,CAAC;QACzD,OAAO,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,IAAA,gBAAQ,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,MAAM,IAAI,sBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAwED,MAAa,YAAY;IAWM;IAVZ,IAAI,CAAY;IAChB,MAAM,CAAwB;IAE/C;;;;OAIG;IACM,IAAI,CAAmB;IAEhC,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QACvD,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;QAC7C,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,6LAA6L,CAC9L,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,CAAC;QAED,IAAI,SAAoC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;gBAClB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,wCAA4B,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9F,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAC;YAC3H,CAAC;YACD,SAAS,GAAG,IAAI,yBAAa,CAAC;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,CAAgC,CAAI,EAAE,EAAE,CAAC,CAAC;YACrD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,CAAC;YACJ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG;YACV,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAS,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,mBAAY,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAa,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxC,aAAa,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,wBAAiB,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9D,WAAW,EAAE,sBAAe;SAC7B,CAAC;QAEF,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,IAAI,qCAAoB,CAAC;gBACrC,OAAO,EAAE,OAAO,CAAC,aAAa;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,qBAAqB,EAAE,0BAAkB;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAS,CAAC;YACxB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACzC,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CACf,KAAa,EACb,OAAwD;QAExD,OAAO,IAAA,+BAAgB,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;YACxC,GAAG,OAAO;YACV,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEvF,0EAA0E;QAC1E,uEAAuE;QACvE,iFAAiF;QACjF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,2BAAU,EAAC,KAAK,CAAC,CAAC,CAAC;YACnD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,CAAC,OAAO,CAAC,EAAE;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAkC,CAAC;gBAC1D,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;oBACvE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;wBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;gBAC/G,CAAC;gBACD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAgB,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS;gBACxB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBAC/D,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;gBAC3E,uEAAuE;gBACvE,6DAA6D;gBAC7D,UAAU,EAAE,yBAAkB;gBAC9B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM;oBAC1C,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;oBACxD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;gBACvB,0EAA0E;gBAC1E,gEAAgE;gBAChE,8DAA8D;gBAC9D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAA6B,EAAE;oBAC1D,CAAC,CAAC,EAAE,CAAC;gBACP,cAAc,EAAE,0BAAkB;gBAClC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACzE,CAAC,CAAC;YACH,MAAM,GAAG,OAAmC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QAED;;;;;;;;WAQG;QACH,MAAM,QAAQ,GAAI,MAAkC,CAAC,SAAS,CAAC;QAC/D,MAAM,eAAe,GAAG,QAAQ,KAAK,SAAS,CAAC;QAC/C,2EAA2E;QAC3E,kEAAkE;QAClE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,kCAAkC;QAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACrD,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,4EAA4E;QAC5E,sCAAsC;QACtC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,mKAAmK,CACpK,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CACtD,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,mBAAmB,EAC9C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;oBACjD,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;aAChC,CACF,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;YAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAEzB;QACC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,MAAM,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEtD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,CACrB,QAAgB,EAChB,QAAkF;QAElF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,IAAI,sBAAsB,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACtE,CAAC;CACF;AAnSD,oCAmSC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,QAAkF;IAElF,IAAI,QAAQ,YAAY,eAAe;QAAE,OAAO,QAAQ,CAAC;IACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;oBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;iBAAM,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,yEAAyE;IACzE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CACjB,OAAkF,EAClF,IAAY;IAEZ,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7D,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,OAA6C,CAAC;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,IAAY;IAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,MAAqB,EAAE,UAAkB;IACrE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,OAAO,CAAC,MAAqB,EAAE,IAAY;IACzD,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,MAAqB,EAAE,UAAkB;IACxE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,2FAA2F;AAC3F,SAAgB,UAAU,CAAC,MAAqB,EAAE,IAAY;IAC5D,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAgB,GAAG,CAAC,MAAqB,EAAE,YAA8B,EAAE;IACzE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAgB,OAAO,CAAC,MAAqB,EAAE,YAA8B,EAAE;IAC7E,MAAM,OAAO,GAAG,IAAA,gBAAQ,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,sBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/webhook-common.d.ts

@@ -0,0 +1,53 @@
+/** What both Atlas webhook verifiers share: headers, constants, the result shape and the options. No Node APIs. */
+export declare const SIGNATURE_VERSION = "v1";
+export declare const REPLAY_TOLERANCE_MS: number;
+/** Header names Atlas sends on every delivery (lower-case; match case-insensitively). */
+export declare const ATLAS_WEBHOOK_HEADERS: {
+    readonly id: "atlas-id";
+    readonly timestamp: "atlas-timestamp";
+    readonly signature: "atlas-signature";
+};
+export type WebhookVerifyFailure = 'missing_headers' | 'malformed_signature' | 'stale_timestamp' | 'signature_mismatch';
+export interface WebhookVerifyResult<T = unknown> {
+    /** True only when the signature and timestamp both check out. */
+    verified: boolean;
+    /** Why verification failed, when it did. */
+    reason?: WebhookVerifyFailure;
+    /** The parsed event envelope `{ id, type, timestamp, instance_id, data }` — present only when `verified`. */
+    event?: T;
+    /**
+     * The signed `atlas-id` header — present only when `verified`. It is the same
+     * on every retry of one event, so it is the key to deduplicate deliveries on.
+     */
+    deliveryId?: string;
+    /** The signed `atlas-timestamp` header (epoch ms) of this attempt — present only when `verified`. */
+    timestamp?: number;
+}
+/** Read a header case-insensitively from a plain object or a Fetch `Headers`. */
+export declare function readHeader(headers: HeadersLike, name: string): string | undefined;
+/**
+ * The `v1` signatures in an `atlas-signature` header. The header carries one
+ * `v1,<base64>` entry, or several separated by spaces (while an endpoint
+ * secret rotates, Atlas signs with the old and the new secret). Entries of
+ * another version are skipped, so a future scheme never breaks this verifier.
+ */
+export declare function parseSignatures(header: string, version?: string): string[];
+export type HeadersLike = Headers | Record<string, string | string[] | undefined>;
+export interface WebhookVerifyOptions {
+    /** The request headers (a plain object, Node `req.headers`, or a Fetch `Headers`). */
+    headers: HeadersLike;
+    /** The endpoint's signing secret (shown once when the endpoint was created/rotated). */
+    secret: string;
+    /** Override "now" (tests); defaults to the current time. */
+    now?: Date;
+    /** Override the ±replay tolerance (defaults to 5 minutes). */
+    toleranceMs?: number;
+    /**
+     * The exact URL Atlas POSTed to (your endpoint's `url`). When given, `v2`
+     * signature entries — which also cover the URL, for endpoints with
+     * `signature_versions` including `v2` — are checked too.
+     */
+    url?: string;
+    /** Accept only a `v2` entry (needs `url`): a delivery replayed to another URL then fails. */
+    requireV2?: boolean;
+}

package/dist/webhook-common.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ATLAS_WEBHOOK_HEADERS = exports.REPLAY_TOLERANCE_MS = exports.SIGNATURE_VERSION = void 0;
+exports.readHeader = readHeader;
+exports.parseSignatures = parseSignatures;
+/** What both Atlas webhook verifiers share: headers, constants, the result shape and the options. No Node APIs. */
+exports.SIGNATURE_VERSION = 'v1';
+exports.REPLAY_TOLERANCE_MS = 5 * 60_000;
+/** Header names Atlas sends on every delivery (lower-case; match case-insensitively). */
+exports.ATLAS_WEBHOOK_HEADERS = {
+    id: 'atlas-id',
+    timestamp: 'atlas-timestamp',
+    signature: 'atlas-signature',
+};
+/** Read a header case-insensitively from a plain object or a Fetch `Headers`. */
+function readHeader(headers, name) {
+    if (typeof headers.get === 'function') {
+        return headers.get(name) ?? undefined;
+    }
+    const bag = headers;
+    const direct = bag[name] ?? bag[name.toLowerCase()];
+    const v = Array.isArray(direct) ? direct[0] : direct;
+    if (v !== undefined)
+        return v;
+    // Fall back to a case-insensitive scan (Node lower-cases, but be safe).
+    const hit = Object.keys(bag).find((k) => k.toLowerCase() === name);
+    const found = hit ? bag[hit] : undefined;
+    return Array.isArray(found) ? found[0] : found;
+}
+/**
+ * The `v1` signatures in an `atlas-signature` header. The header carries one
+ * `v1,<base64>` entry, or several separated by spaces (while an endpoint
+ * secret rotates, Atlas signs with the old and the new secret). Entries of
+ * another version are skipped, so a future scheme never breaks this verifier.
+ */
+function parseSignatures(header, version = exports.SIGNATURE_VERSION) {
+    const out = [];
+    for (const entry of header.trim().split(/\s+/)) {
+        const comma = entry.indexOf(',');
+        if (comma <= 0)
+            continue;
+        const value = entry.slice(comma + 1);
+        if (entry.slice(0, comma) === version && value)
+            out.push(value);
+    }
+    return out;
+}
+//# sourceMappingURL=webhook-common.js.map

package/dist/webhook-common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-common.js","sourceRoot":"","sources":["../src/webhook-common.ts"],"names":[],"mappings":";;;AAkCA,gCAYC;AAQD,0CASC;AA/DD,mHAAmH;AACtG,QAAA,iBAAiB,GAAG,IAAI,CAAC;AACzB,QAAA,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AAE9C,yFAAyF;AAC5E,QAAA,qBAAqB,GAAG;IACnC,EAAE,EAAE,UAAU;IACd,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;CACpB,CAAC;AAwBX,iFAAiF;AACjF,SAAgB,UAAU,CAAC,OAAoB,EAAE,IAAY;IAC3D,IAAI,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QACnD,OAAQ,OAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,OAAwD,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,wEAAwE;IACxE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,MAAc,EAAE,UAAkB,yBAAiB;IACjF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,IAAI,CAAC;YAAE,SAAS;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,OAAO,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}