@atlasauth/backend 0.34.0 → 0.36.0

package/dist/rp-sid-store.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.memorySidStore = memorySidStore;
+exports.sqlSidStore = sqlSidStore;
+const ms = (at) => (at instanceof Date ? at.getTime() : at);
+/** An in-process {@link SidStore}. Fine for one server; use a shared store (e.g. {@link sqlSidStore}) for several. */
+function memorySidStore(now = Date.now) {
+    const bySid = new Map();
+    const sweep = (t) => {
+        for (const [sid, apps] of bySid) {
+            for (const [id, exp] of apps)
+                if (exp <= t)
+                    apps.delete(id);
+            if (apps.size === 0)
+                bySid.delete(sid);
+        }
+    };
+    return {
+        bind(sid, appSessionId, expiresAt) {
+            sweep(now());
+            let apps = bySid.get(sid);
+            if (!apps)
+                bySid.set(sid, (apps = new Map()));
+            apps.set(appSessionId, ms(expiresAt));
+        },
+        take(sid) {
+            sweep(now());
+            const apps = bySid.get(sid);
+            bySid.delete(sid);
+            return apps ? [...apps.keys()] : [];
+        },
+    };
+}
+/**
+ * A {@link SidStore} on PostgreSQL. Create the table once:
+ *
+ *   create table atlas_rp_sessions (
+ *     sid text not null,
+ *     app_session_id text not null,
+ *     expires_at timestamptz not null,
+ *     primary key (sid, app_session_id)
+ *   );
+ *
+ * `take` deletes every row for the sid (expired ones too) and returns the unexpired ids.
+ */
+function sqlSidStore({ query }) {
+    return {
+        async bind(sid, appSessionId, expiresAt) {
+            await query('insert into atlas_rp_sessions (sid, app_session_id, expires_at) values ($1, $2, $3) ' +
+                'on conflict (sid, app_session_id) do update set expires_at = excluded.expires_at', [sid, appSessionId, new Date(ms(expiresAt))]);
+        },
+        async take(sid) {
+            const { rows } = await query('delete from atlas_rp_sessions where sid = $1 returning app_session_id, expires_at > now() as live', [sid]);
+            return rows.filter((r) => r.live).map((r) => String(r.app_session_id));
+        },
+    };
+}
+//# sourceMappingURL=rp-sid-store.js.map

package/dist/rp-sid-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rp-sid-store.js","sourceRoot":"","sources":["../src/rp-sid-store.ts"],"names":[],"mappings":";;AAmBA,wCAsBC;AAmBD,kCAiBC;AA7DD,MAAM,EAAE,GAAG,CAAC,EAAiB,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE3E,sHAAsH;AACtH,SAAgB,cAAc,CAAC,MAAoB,IAAI,CAAC,GAAG;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACrD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE;QAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI;gBAAE,IAAI,GAAG,IAAI,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;gBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS;YAC/B,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACb,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,GAAG;YACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC;AAOD;;;;;;;;;;;GAWG;AACH,SAAgB,WAAW,CAAC,EAAE,KAAK,EAAsB;IACvD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS;YACrC,MAAM,KAAK,CACT,sFAAsF;gBACpF,kFAAkF,EACpF,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAC7C,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAC1B,mGAAmG,EACnG,CAAC,GAAG,CAAC,CACN,CAAC;YACF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/rp-testing.d.ts

@@ -0,0 +1,38 @@
+export interface MockIssuerOptions {
+    /** The issuer URL (`https://...`), e.g. `https://atlasauth.net` for Sign in with Atlas. */
+    issuer: string;
+    clientId: string;
+    /** Signing algorithm. Default `RS256`. */
+    alg?: 'RS256' | 'ES256';
+    /** A clock in epoch milliseconds, for `iat` / `exp`. */
+    now?: () => number;
+}
+export interface MockIssuer {
+    issuer: string;
+    clientId: string;
+    /** A `fetch` serving discovery, the JWKS, the token endpoint and `/oauth2/session/touch` / `/end`; 404 otherwise. Pass it as `fetchImpl`. */
+    fetch: typeof fetch;
+    /** The public key set. */
+    jwks: {
+        keys: Record<string, unknown>[];
+    };
+    /** The discovery document `fetch` serves. */
+    discovery: Record<string, unknown>;
+    /** Claims merged into the ID token of the next code redeemed at the token endpoint (then cleared). */
+    nextClaims: Record<string, unknown>;
+    /**
+     * Play the user signing in: pass the authorize URL `rp.start` redirected to,
+     * get the callback URL (`code`, `state`, `iss`) to request with the sign-in cookie.
+     */
+    authorize(authorizeUrl: string): string;
+    /** A signed ID token: `iss`, `aud`, `sub`, `iat`, `exp`, `auth_time`, `sid`, `email`, `email_verified`, then `claims`. Its `sid` becomes live for touch/end. */
+    idToken(claims?: Record<string, unknown>): Promise<string>;
+    /** A signed back-channel logout token for `sid` (and `sub`), as Atlas POSTs it. */
+    logoutToken(options: {
+        sid: string;
+        sub?: string;
+    }): Promise<string>;
+    /** The sids `/oauth2/session/touch` and `/end` treat as live sign-ins. */
+    liveSids: Set<string>;
+}
+export declare function mockIssuer(options: MockIssuerOptions): Promise<MockIssuer>;

package/dist/rp-testing.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mockIssuer = mockIssuer;
+/**
+ * `@atlasauth/rp/testing`: an offline issuer for testing an app built on
+ * `createRelyingParty`, with no network and no Atlas account.
+ *
+ *   const issuer = await mockIssuer({ issuer: 'https://atlasauth.net', clientId: 'client_test' });
+ *   const rp = createRelyingParty({ ...settings, issuer: issuer.issuer, clientId: issuer.clientId, fetchImpl: issuer.fetch });
+ *   const started = await rp.start(new Request('https://app.test/auth/sign-in'));
+ *   const callbackUrl = issuer.authorize(started.headers.get('location')!); // the user signs in
+ *
+ * Web standards and `jose` only, like the relying party itself.
+ */
+const jose_1 = require("jose");
+const logout_token_1 = require("./logout-token");
+async function mockIssuer(options) {
+    const issuer = options.issuer.replace(/\/+$/, '');
+    const { clientId } = options;
+    const alg = options.alg ?? 'RS256';
+    const clock = options.now ?? Date.now;
+    const kid = 'mock-key-1';
+    const { privateKey, publicKey } = await (0, jose_1.generateKeyPair)(alg);
+    const jwks = { keys: [{ ...(await (0, jose_1.exportJWK)(publicKey)), kid, alg, use: 'sig' }] };
+    const discovery = {
+        issuer,
+        authorization_endpoint: `${issuer}/oauth2/authorize`,
+        token_endpoint: `${issuer}/oauth2/token`,
+        jwks_uri: `${issuer}/.well-known/jwks.json`,
+        end_session_endpoint: `${issuer}/oauth2/logout`,
+        response_types_supported: ['code'],
+        subject_types_supported: ['public'],
+        id_token_signing_alg_values_supported: [alg],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post'],
+    };
+    const liveSids = new Set();
+    const codes = new Map();
+    const sign = (payload, typ) => new jose_1.SignJWT(payload).setProtectedHeader({ alg, kid, typ }).sign(privateKey);
+    const mock = {
+        issuer,
+        clientId,
+        jwks,
+        discovery,
+        nextClaims: {},
+        liveSids,
+        fetch: undefined,
+        authorize(authorizeUrl) {
+            const p = new URL(authorizeUrl).searchParams;
+            const redirectUri = p.get('redirect_uri');
+            if (!redirectUri)
+                throw new Error('mockIssuer.authorize: the authorize URL has no redirect_uri.');
+            if (p.get('client_id') !== clientId)
+                throw new Error(`mockIssuer.authorize: client_id ${p.get('client_id')} is not ${clientId}.`);
+            const code = `code_${randomId()}`;
+            codes.set(code, { redirectUri, nonce: p.get('nonce'), challenge: p.get('code_challenge') });
+            const back = new URL(redirectUri);
+            back.searchParams.set('code', code);
+            if (p.get('state') !== null)
+                back.searchParams.set('state', p.get('state'));
+            back.searchParams.set('iss', issuer);
+            return back.toString();
+        },
+        async idToken(claims = {}) {
+            const iat = Math.floor(clock() / 1000);
+            const payload = {
+                iss: issuer,
+                aud: clientId,
+                sub: 'user_test',
+                iat,
+                exp: iat + 3600,
+                auth_time: iat,
+                sid: 'sid_test',
+                email: 'user@example.com',
+                email_verified: true,
+                ...claims,
+            };
+            if (typeof payload.sid === 'string')
+                liveSids.add(payload.sid);
+            return sign(payload, 'JWT');
+        },
+        async logoutToken({ sid, sub }) {
+            const iat = Math.floor(clock() / 1000);
+            return sign({ iss: issuer, aud: clientId, iat, exp: iat + 120, jti: randomId(), sid, ...(sub ? { sub } : {}), events: { [logout_token_1.BACKCHANNEL_LOGOUT_EVENT]: {} } }, 'logout+jwt');
+        },
+    };
+    const json = (status, body) => new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json', 'cache-control': 'no-store' } });
+    async function token(form) {
+        if (form.get('grant_type') !== 'authorization_code')
+            return json(400, { error: 'unsupported_grant_type' });
+        const code = form.get('code') ?? '';
+        const pending = codes.get(code);
+        codes.delete(code); // single use
+        if (!pending || pending.redirectUri !== form.get('redirect_uri'))
+            return json(400, { error: 'invalid_grant' });
+        if (pending.challenge && (await s256(form.get('code_verifier') ?? '')) !== pending.challenge) {
+            return json(400, { error: 'invalid_grant', error_description: 'PKCE verification failed' });
+        }
+        const claims = mock.nextClaims;
+        mock.nextClaims = {};
+        const idToken = await mock.idToken({ ...(pending.nonce ? { nonce: pending.nonce } : {}), ...claims });
+        return json(200, { access_token: `at_${randomId()}`, token_type: 'Bearer', expires_in: 3600, id_token: idToken });
+    }
+    function session(action, form) {
+        const sid = form.get('sid')?.trim() ?? '';
+        if (!sid)
+            return json(400, { error: 'invalid_request', error_description: 'Missing sid.' });
+        if (!liveSids.has(sid))
+            return json(404, { error: 'session_not_found', error_description: 'No live sign-in of this app has that sid.' });
+        if (action === 'touch') {
+            return json(200, { object: 'oauth_session', sid, active: true, grants_touched: 0, idle_expires_at: clock() + 30 * 86_400_000, expires_at: null });
+        }
+        liveSids.delete(sid);
+        return json(200, { object: 'oauth_session', sid, active: false, ended: true, grants_revoked: 0, backchannel_logouts: 1 });
+    }
+    mock.fetch = (async (input, init) => {
+        const request = new Request(input, init);
+        const url = new URL(request.url);
+        const target = `${url.origin}${url.pathname}`;
+        if (request.method === 'GET' && target === `${issuer}/.well-known/openid-configuration`)
+            return json(200, discovery);
+        if (request.method === 'GET' && target === discovery.jwks_uri)
+            return json(200, jwks);
+        if (request.method === 'POST' && target.startsWith(`${issuer}/oauth2/`)) {
+            const form = new URLSearchParams(await request.text());
+            // Confidential clients only, like the token endpoint: Basic or client_secret in the body.
+            const basic = request.headers.get('authorization')?.startsWith('Basic ');
+            const id = basic ? decodeURIComponent(atob(request.headers.get('authorization').slice(6)).split(':')[0]) : form.get('client_id');
+            if (id !== clientId || (!basic && !form.get('client_secret')))
+                return json(401, { error: 'invalid_client' });
+            const path = target.slice(issuer.length);
+            if (path === '/oauth2/token')
+                return token(form);
+            if (path === '/oauth2/session/touch')
+                return session('touch', form);
+            if (path === '/oauth2/session/end')
+                return session('end', form);
+        }
+        return json(404, { error: 'not_found' });
+    });
+    return mock;
+}
+function randomId() {
+    return Array.from(crypto.getRandomValues(new Uint8Array(16)), (b) => b.toString(16).padStart(2, '0')).join('');
+}
+async function s256(value) {
+    const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value)));
+    let bin = '';
+    for (const b of digest)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+//# sourceMappingURL=rp-testing.js.map

package/dist/rp-testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rp-testing.js","sourceRoot":"","sources":["../src/rp-testing.ts"],"names":[],"mappings":";;AAgDA,gCA2HC;AA3KD;;;;;;;;;;GAUG;AACH,+BAAyE;AACzE,iDAA0D;AAoCnD,KAAK,UAAU,UAAU,CAAC,OAA0B;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC;IACzB,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,sBAAe,EAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,IAAA,gBAAS,EAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACnF,MAAM,SAAS,GAAG;QAChB,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,mBAAmB;QACpD,cAAc,EAAE,GAAG,MAAM,eAAe;QACxC,QAAQ,EAAE,GAAG,MAAM,wBAAwB;QAC3C,oBAAoB,EAAE,GAAG,MAAM,gBAAgB;QAC/C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,uBAAuB,EAAE,CAAC,QAAQ,CAAC;QACnC,qCAAqC,EAAE,CAAC,GAAG,CAAC;QAC5C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;KACrF,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmF,CAAC;IAEzG,MAAM,IAAI,GAAG,CAAC,OAAgC,EAAE,GAAW,EAAE,EAAE,CAC7D,IAAI,cAAO,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,UAAqB,CAAC,CAAC;IAEzF,MAAM,IAAI,GAAe;QACvB,MAAM;QACN,QAAQ;QACR,IAAI;QACJ,SAAS;QACT,UAAU,EAAE,EAAE;QACd,QAAQ;QACR,KAAK,EAAE,SAAoC;QAC3C,SAAS,CAAC,YAAY;YACpB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC;YAC7C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC1C,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAClG,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,QAAQ,GAAG,CAAC,CAAC;YAClI,MAAM,IAAI,GAAG,QAAQ,QAAQ,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC5F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YAClC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC,CAAC;YAC7E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACrC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG;gBACd,GAAG,EAAE,MAAM;gBACX,GAAG,EAAE,QAAQ;gBACb,GAAG,EAAE,WAAW;gBAChB,GAAG;gBACH,GAAG,EAAE,GAAG,GAAG,IAAI;gBACf,SAAS,EAAE,GAAG;gBACd,GAAG,EAAE,UAAU;gBACf,KAAK,EAAE,kBAAkB;gBACzB,cAAc,EAAE,IAAI;gBACpB,GAAG,MAAM;aACV,CAAC;YACF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;YACvC,OAAO,IAAI,CACT,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,uCAAwB,CAAC,EAAE,EAAE,EAAE,EAAE,EAC9I,YAAY,CACb,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAa,EAAE,EAAE,CAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAE/H,KAAK,UAAU,KAAK,CAAC,IAAqB;QACxC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,oBAAoB;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAC3G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC/G,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7F,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACtG,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACpH,CAAC;IAED,SAAS,OAAO,CAAC,MAAuB,EAAE,IAAqB;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,2CAA2C,EAAE,CAAC,CAAC;QACzI,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACpJ,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAkC,EAAE,IAAkB,EAAE,EAAE;QAC7E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,GAAG,MAAM,mCAAmC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrH,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,SAAS,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,0FAA0F;YAC1F,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YACzE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACnI,IAAI,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7G,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,IAAI,KAAK,eAAe;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,IAAI,KAAK,uBAAuB;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACpE,IAAI,IAAI,KAAK,qBAAqB;gBAAE,OAAO,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAiB,CAAC;IAEnB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACjH,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,KAAa;IAC/B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtG,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/rp.d.ts

@@ -29,9 +29,16 @@
  * the Atlas session calls a relying party that keeps its own session needs:
  * keep-alive (`POST /v1/sessions/{id}/touch`) and server-side sign-out
  * (`POST /v1/sessions/{id}/revoke`, or with `serverSignOut` the one-call
- * `POST /v1/oauth_clients/{id}/logout`).
+ * `POST /v1/oauth_clients/{id}/logout`). An app with no instance secret key
+ * (Sign in with Atlas: issuer `https://atlasauth.net`) keeps its own sign-in
+ * alive and ends it with its client credentials instead
+ * (`POST {issuer}/oauth2/session/touch` and `/oauth2/session/end`).
  */
 import { AtlasOidcError, type OidcClientAuth, type OidcIdentity, type OidcStartOptions } from './oidc';
+import type { LogoutTokenClaims } from './logout-token';
+import type { SidStore } from './rp-sid-store';
+export { memorySidStore, sqlSidStore } from './rp-sid-store';
+export type { SidStore, SqlSidStoreOptions } from './rp-sid-store';
 export { AtlasOidcError, isSafeReturnTo, oidcCallback, oidcLogoutUrl, oidcStart, oidcVerifyIdToken, resetOidcCaches } from './oidc';
 export type { OidcIdentity, OidcStartOptions, OidcCallbackOptions, AtlasOidcErrorCode } from './oidc';
 export { AtlasApiError } from './client/error';
@@ -49,7 +56,10 @@ export interface RelyingPartyConfig {
     issuer: string;
     /** The OAuth client id. */
     clientId: string;
-    /** The client secret (a confidential client). */
+    /**
+     * The client secret (a confidential client). Without a `secretKey`, it also
+     * authenticates `touchIfDue` and `endAppSession` (the app's own sign-in).
+     */
     clientSecret?: string;
     /** Token-endpoint authentication. Default `client_secret_basic` with a secret. */
     clientAuth?: OidcClientAuth;
@@ -63,7 +73,11 @@ export interface RelyingPartyConfig {
     afterSignInPath?: string;
     /** Where Atlas sends the browser after sign-out. Must be registered on the client exactly. */
     postLogoutRedirectUri?: string;
-    /** The instance secret key (`sk_...`, scope `sessions:write`). Needed for `touchIfDue` and server-side revoke. */
+    /**
+     * The instance secret key (`sk_...`, scope `sessions:write`). Used by
+     * `touchIfDue` and needed for server-side revoke. A Sign in with Atlas app has
+     * none: leave it unset and `touchIfDue` uses the client credentials.
+     */
     secretKey?: string;
     /** The Backend API origin. Default `https://api.atlasauth.net`. */
     apiUrl?: string;
@@ -98,7 +112,20 @@ export interface RelyingPartyConfig {
         signIn?: string;
         callback?: string;
         signOut?: string;
+        backchannelLogout?: string;
     };
+    /**
+     * Where you record which of your app sessions each Atlas `sid` backs (see
+     * {@link RelyingParty.bindSession}), so a back-channel logout can end them.
+     */
+    sidStore?: SidStore;
+    /**
+     * Called by {@link RelyingParty.backchannelLogout} with the app sessions to
+     * end: those bound to the token's `sid` in `sidStore` (taken out of it), or
+     * `[]` when there is no store, no binding or no `sid` (then end by
+     * `claims.sub`). Throwing answers 503 and keeps the bindings, so Atlas retries.
+     */
+    onBackchannelLogout?: (appSessionIds: string[], claims: LogoutTokenClaims) => Promise<void> | void;
     /**
      * Called by {@link RelyingParty.handle} after a verified sign-in: create your
      * own session here. Return a `Response` to answer with it, or nothing to
@@ -220,6 +247,10 @@ export interface RelyingParty {
      * Keep the Atlas session alive while the user is active in your app, at
      * most once per `touchIntervalMs` per session. Call it on each authenticated
      * request with the `sid` and the time you last touched (0 or null at first).
+     * With a `secretKey` it touches the Atlas session (`/v1/sessions/{id}/touch`);
+     * without one but with a `clientSecret` it touches this app's own sign-in
+     * (`POST {issuer}/oauth2/session/touch`), where a sid with no live sign-in of
+     * this app is `{ status: 'ended', reason: 'not_found' }`. Neither: a TypeError.
      */
     touchIfDue(sid: string, lastTouchedAt: number | null | undefined): Promise<TouchResult>;
     /**
@@ -229,6 +260,30 @@ export interface RelyingParty {
      * session (check you use the same instance's secret key). Other failures throw.
      */
     revokeSession(sid: string): Promise<'revoked' | 'not_found'>;
+    /**
+     * End THIS app's sign-in under `sid` with the app's client credentials
+     * (`POST {issuer}/oauth2/session/end`): its refresh grants are revoked and
+     * Atlas sends the app a back-channel logout, so every server of yours hears
+     * it. The Atlas session and other apps are untouched. `not_found`: no live
+     * sign-in of this app has that sid. Needs `clientSecret`; other failures throw.
+     */
+    endAppSession(sid: string): Promise<'ended' | 'not_found'>;
+    /**
+     * Record that your app session `appSessionId` is backed by the Atlas `sid`
+     * (the user's `sid` from the callback), until `expiresAt` (epoch ms or Date).
+     * Call it when you create your app session, after MFA if you gate on it. A
+     * step-up callback carries the same `sid`: bind again only if you rotate
+     * your session id then. Needs `sidStore`.
+     */
+    bindSession(sid: string, appSessionId: string, expiresAt: number | Date): Promise<void>;
+    /**
+     * The back-channel logout receiver: verifies the `logout_token` (issuer and
+     * client id from the config), takes the app sessions bound to its `sid` from
+     * `sidStore` and passes them to `onBackchannelLogout`. Answers 200 when
+     * handled (or a replay), 400 for a bad token, 503 (with `Retry-After`) when
+     * the keys could not be loaded or `onBackchannelLogout` threw.
+     */
+    backchannelLogout(request: Request): Promise<Response>;
     /**
      * Sign-out: with a `sid` and a `secretKey`, revokes the Atlas session
      * server-side first, then 302s the browser to `/oauth2/logout`. With
@@ -240,7 +295,8 @@ export interface RelyingParty {
     /**
      * All three routes in one handler: `GET` on the sign-in path runs `start`,
      * `GET` on the callback path runs `callback` then `onSignedIn`, and `POST`
-     * or `GET` on the sign-out path runs `onSignOut` then `signOut`. Any other
+     * or `GET` on the sign-out path runs `onSignOut` then `signOut`, and with
+     * `routes.backchannelLogout` set, `POST` there runs `backchannelLogout`. Any other
      * request gets `null`, so your app answers it. Needs `onSignedIn`.
      *
      *   export default { fetch: async (req) => (await rp.handle(req)) ?? app(req) };

package/dist/rp.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIRM_NOW_WINDOW_SECONDS = exports.usedMultiFactor = exports.authenticatedWithin = exports.verifyAtlasWebhookRequest = exports.verifyAtlasWebhook = exports.ATLAS_WEBHOOK_HEADERS = exports.handleBackchannelLogout = exports.fetchBackchannelLogout = exports.fastifyBackchannelLogoutPlugin = exports.fastifyBackchannelLogout = exports.expressBackchannelLogout = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.BACKCHANNEL_LOGOUT_EVENT = exports.AtlasApiError = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcCallback = exports.isSafeReturnTo = exports.AtlasOidcError = void 0;
+exports.CONFIRM_NOW_WINDOW_SECONDS = exports.usedMultiFactor = exports.authenticatedWithin = exports.verifyAtlasWebhookRequest = exports.verifyAtlasWebhook = exports.ATLAS_WEBHOOK_HEADERS = exports.handleBackchannelLogout = exports.fetchBackchannelLogout = exports.fastifyBackchannelLogoutPlugin = exports.fastifyBackchannelLogout = exports.expressBackchannelLogout = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.BACKCHANNEL_LOGOUT_EVENT = exports.AtlasApiError = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcCallback = exports.isSafeReturnTo = exports.AtlasOidcError = exports.sqlSidStore = exports.memorySidStore = void 0;
 exports.createRelyingParty = createRelyingParty;
 /**
  * `@atlasauth/backend/rp` (also published alone as `@atlasauth/rp`, whose
@@ -33,11 +33,18 @@ exports.createRelyingParty = createRelyingParty;
  * the Atlas session calls a relying party that keeps its own session needs:
  * keep-alive (`POST /v1/sessions/{id}/touch`) and server-side sign-out
  * (`POST /v1/sessions/{id}/revoke`, or with `serverSignOut` the one-call
- * `POST /v1/oauth_clients/{id}/logout`).
+ * `POST /v1/oauth_clients/{id}/logout`). An app with no instance secret key
+ * (Sign in with Atlas: issuer `https://atlasauth.net`) keeps its own sign-in
+ * alive and ends it with its client credentials instead
+ * (`POST {issuer}/oauth2/session/touch` and `/oauth2/session/end`).
  */
 const oidc_1 = require("./oidc");
 const error_1 = require("./client/error");
 const request_1 = require("./client/request");
+const backchannel_handlers_1 = require("./backchannel-handlers");
+var rp_sid_store_1 = require("./rp-sid-store");
+Object.defineProperty(exports, "memorySidStore", { enumerable: true, get: function () { return rp_sid_store_1.memorySidStore; } });
+Object.defineProperty(exports, "sqlSidStore", { enumerable: true, get: function () { return rp_sid_store_1.sqlSidStore; } });
 var oidc_2 = require("./oidc");
 Object.defineProperty(exports, "AtlasOidcError", { enumerable: true, get: function () { return oidc_2.AtlasOidcError; } });
 Object.defineProperty(exports, "isSafeReturnTo", { enumerable: true, get: function () { return oidc_2.isSafeReturnTo; } });
@@ -54,12 +61,12 @@ Object.defineProperty(exports, "BACKCHANNEL_LOGOUT_EVENT", { enumerable: true, g
 Object.defineProperty(exports, "LogoutTokenVerifier", { enumerable: true, get: function () { return logout_token_1.LogoutTokenVerifier; } });
 Object.defineProperty(exports, "memoryLogoutReplayStore", { enumerable: true, get: function () { return logout_token_1.memoryLogoutReplayStore; } });
 Object.defineProperty(exports, "verifyLogoutToken", { enumerable: true, get: function () { return logout_token_1.verifyLogoutToken; } });
-var backchannel_handlers_1 = require("./backchannel-handlers");
-Object.defineProperty(exports, "expressBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.expressBackchannelLogout; } });
-Object.defineProperty(exports, "fastifyBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.fastifyBackchannelLogout; } });
-Object.defineProperty(exports, "fastifyBackchannelLogoutPlugin", { enumerable: true, get: function () { return backchannel_handlers_1.fastifyBackchannelLogoutPlugin; } });
-Object.defineProperty(exports, "fetchBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.fetchBackchannelLogout; } });
-Object.defineProperty(exports, "handleBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.handleBackchannelLogout; } });
+var backchannel_handlers_2 = require("./backchannel-handlers");
+Object.defineProperty(exports, "expressBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_2.expressBackchannelLogout; } });
+Object.defineProperty(exports, "fastifyBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_2.fastifyBackchannelLogout; } });
+Object.defineProperty(exports, "fastifyBackchannelLogoutPlugin", { enumerable: true, get: function () { return backchannel_handlers_2.fastifyBackchannelLogoutPlugin; } });
+Object.defineProperty(exports, "fetchBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_2.fetchBackchannelLogout; } });
+Object.defineProperty(exports, "handleBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_2.handleBackchannelLogout; } });
 // Webhooks, verified with Web Crypto.
 var webhook_common_1 = require("./webhook-common");
 Object.defineProperty(exports, "ATLAS_WEBHOOK_HEADERS", { enumerable: true, get: function () { return webhook_common_1.ATLAS_WEBHOOK_HEADERS; } });
@@ -202,11 +209,49 @@ function createRelyingParty(config) {
         const url = `${(config.apiUrl ?? request_1.DEFAULT_API_URL).replace(/\/+$/, '')}/v1/sessions/${encodeURIComponent(sid)}/${action}`;
         return doFetch(url, { method: 'POST', headers: { authorization: `Bearer ${config.secretKey}`, accept: 'application/json' } });
     }
+    /** The app's own sign-in, authenticated like the token endpoint (`/oauth2/session/touch` or `/end`). */
+    function appSessionCall(sid, action, caller) {
+        const method = config.clientAuth ?? (config.clientSecret ? 'client_secret_basic' : 'none');
+        if (method === 'none' || !config.clientSecret) {
+            throw new TypeError(`${caller}: configure \`clientSecret\` (the app's client credentials)${action === 'touch' ? ' or `secretKey`' : ''}; a public client cannot call it.`);
+        }
+        if (typeof sid !== 'string' || !sid)
+            throw new TypeError('A session id (`sid`) is required.');
+        const body = new URLSearchParams({ sid });
+        const headers = { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' };
+        if (method === 'client_secret_basic') {
+            // RFC 6749 §2.3.1: both halves are form-encoded before Basic encoding.
+            headers.authorization = `Basic ${btoa(`${encodeURIComponent(config.clientId)}:${encodeURIComponent(config.clientSecret)}`)}`;
+        }
+        else {
+            body.set('client_id', config.clientId);
+            body.set('client_secret', config.clientSecret);
+        }
+        return doFetch(`${config.issuer.replace(/\/+$/, '')}/oauth2/session/${action}`, { method: 'POST', headers, body });
+    }
+    /** The OAuth error body of `/oauth2/session/*` as an {@link AtlasApiError}. */
+    function oauthFailure(res, body) {
+        const code = typeof body?.error === 'string' ? body.error : 'request_failed';
+        const message = typeof body?.error_description === 'string' ? body.error_description : `The issuer answered ${res.status}.`;
+        return new error_1.AtlasApiError(res.status, [{ code, message }]);
+    }
     async function touchIfDue(sid, lastTouchedAt) {
         const now = clock();
         if (typeof lastTouchedAt === 'number' && now - lastTouchedAt < interval && now >= lastTouchedAt) {
             return { status: 'skipped', lastTouchedAt };
         }
+        if (!config.secretKey) {
+            const res = await appSessionCall(sid, 'touch', 'touchIfDue');
+            const body = (await res.json().catch(() => null));
+            if (res.ok) {
+                const idle = body?.idle_expires_at;
+                const idleExpiresAt = typeof idle === 'number' ? new Date(idle).toISOString() : typeof idle === 'string' ? idle : null;
+                return { status: 'touched', lastTouchedAt: now, idleExpiresAt };
+            }
+            if (res.status === 404 && body?.error === 'session_not_found')
+                return { status: 'ended', reason: 'not_found' };
+            throw oauthFailure(res, body);
+        }
         const res = await sessionCall(sid, 'touch');
         const body = (await res.json().catch(() => null));
         if (res.ok) {
@@ -233,6 +278,50 @@ function createRelyingParty(config) {
             return 'not_found';
         throw new error_1.AtlasApiError(res.status, errorsOf(await res.json().catch(() => null)));
     }
+    async function endAppSession(sid) {
+        const res = await appSessionCall(sid, 'end', 'endAppSession');
+        const body = (await res.json().catch(() => null));
+        if (res.ok)
+            return 'ended';
+        if (res.status === 404 && body?.error === 'session_not_found')
+            return 'not_found';
+        throw oauthFailure(res, body);
+    }
+    async function bindSession(sid, appSessionId, expiresAt) {
+        if (!config.sidStore)
+            throw new TypeError('bindSession: `sidStore` is not configured.');
+        if (typeof sid !== 'string' || !sid || typeof appSessionId !== 'string' || !appSessionId) {
+            throw new TypeError('bindSession: `sid` and `appSessionId` are required.');
+        }
+        await config.sidStore.bind(sid, appSessionId, expiresAt);
+    }
+    // Built on first use so its key cache lives as long as the relying party.
+    let backchannel;
+    async function backchannelLogout(request) {
+        const onLogout = config.onBackchannelLogout;
+        if (!onLogout)
+            throw new TypeError('backchannelLogout: `onBackchannelLogout` is not configured.');
+        backchannel ??= (0, backchannel_handlers_1.fetchBackchannelLogout)({
+            issuer: config.issuer,
+            clientId: config.clientId,
+            fetchImpl: config.fetchImpl,
+            now: config.now,
+            async onLogout(claims) {
+                const store = config.sidStore;
+                const ids = claims.sid && store ? await store.take(claims.sid) : [];
+                try {
+                    await onLogout(ids, claims);
+                }
+                catch (error) {
+                    // Put the bindings back so Atlas's retry finds them; the app sessions are ending anyway.
+                    for (const id of ids)
+                        await store.bind(claims.sid, id, clock() + 86_400_000);
+                    throw error;
+                }
+            },
+        });
+        return backchannel(request);
+    }
     async function signOut(options = {}) {
         if (config.serverSignOut && options.sid && config.secretKey) {
             const url = `${(config.apiUrl ?? request_1.DEFAULT_API_URL).replace(/\/+$/, '')}/v1/oauth_clients/${encodeURIComponent(config.clientId)}/logout`;
@@ -265,6 +354,8 @@ function createRelyingParty(config) {
         const { pathname } = new URL(request.url);
         const method = request.method.toUpperCase();
         const routes = config.routes ?? {};
+        if (method === 'POST' && routes.backchannelLogout && pathname === routes.backchannelLogout)
+            return backchannelLogout(request);
         if (method === 'GET' && pathname === (routes.signIn ?? '/auth/sign-in'))
             return start(request);
         if (method === 'GET' && pathname === (routes.callback ?? new URL(config.redirectUri).pathname)) {
@@ -288,7 +379,7 @@ function createRelyingParty(config) {
         }
         return null;
     }
-    return { start, callback, requireRecentAuth, touchIfDue, revokeSession, signOut, handle };
+    return { start, callback, requireRecentAuth, touchIfDue, revokeSession, endAppSession, bindSession, backchannelLogout, signOut, handle };
 }
 /** A copy of `response` with mutable headers and one more `Set-Cookie`. */
 function withCookie(response, cookie) {

package/dist/rp.js.map

@@ -1 +1 @@
-{"version":3,"file":"rp.js","sourceRoot":"","sources":["../src/rp.ts"],"names":[],"mappings":";;;AAqTA,gDAsLC;AA3eD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,iCAUgB;AAChB,0CAAoE;AACpE,8CAAmD;AAEnD,+BAAoI;AAA3H,sGAAA,cAAc,OAAA;AAAE,sGAAA,cAAc,OAAA;AAAE,oGAAA,YAAY,OAAA;AAAE,qGAAA,aAAa,OAAA;AAAE,iGAAA,SAAS,OAAA;AAAE,yGAAA,iBAAiB,OAAA;AAAE,uGAAA,eAAe,OAAA;AAEnH,wCAA+C;AAAtC,sGAAA,aAAa,OAAA;AACtB,6GAA6G;AAC7G,+CAKwB;AAJtB,wHAAA,wBAAwB,OAAA;AACxB,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAGnB,+DAMgC;AAL9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AAGzB,sCAAsC;AACtC,mDAAyD;AAAhD,uHAAA,qBAAqB,OAAA;AAC9B,+CAA+E;AAAtE,kHAAA,kBAAkB,OAAA;AAAE,yHAAA,yBAAyB,OAAA;AAGtD,6CAAqE;AAA5D,kHAAA,mBAAmB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAgN7C,MAAM,WAAW,GAAkD;IACjE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,WAAW,EAAE,UAAU,CAAC;CAC1B,CAAC;AAEF,uGAAuG;AACvG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,eAAe;IACf,WAAW;IACX,cAAc;IACd,OAAO;IACP,OAAO;IACP,gBAAgB;IAChB,uBAAuB;IACvB,OAAO;IACP,WAAW;IACX,eAAe;IACf,SAAS;IACT,aAAa;CACd,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC7C,4EAA4E;AAC/D,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAE7C,6EAA6E;AAC7E,SAAgB,kBAAkB,CAAC,MAA0B;IAC3D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,+FAA+F,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,IAAI,GAAG,CAAC;IAClD,IAAI,CAAC,IAAA,qBAAc,EAAC,WAAW,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kFAAkF,CAAC,CAAC;IAC1I,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,SAAS,CAAC,wDAAwD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;QAClK,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,uBAAgB;QACjD,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,IAAiB,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAErE,KAAK,UAAU,KAAK,CAAC,OAAgB,EAAE,YAA4B,EAAE;QACnE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;QAChD,MAAM,SAAS,GAAmB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,kEAAkE;YAClE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,IAAI,IAAA,qBAAc,EAAC,CAAC,CAAC,CAAC;gBAAG,SAA+C,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,mBAAmB;gBAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,WAAW,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QACnH,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAY,EAAC;YAClC,GAAG,IAAI;YACP,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY;YACxC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAqB;YAC7B,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,cAAc,EAAE,QAAQ,CAAC,aAAa;YACtC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5G,SAAS,EAAE,QAAQ,CAAC,QAAQ;SAC7B,CAAC;QACF,MAAM,MAAM,GAAuB;YACjC,QAAQ,EAAE,QAAQ,CAAC,OAAO;YAC1B,YAAY,EAAE,QAAQ,CAAC,WAAW;YAClC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,UAAU,EAAE,QAAQ,CAAC,SAAS;SAC/B,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;IAClH,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,aAAqB,EAAE,OAA0B;QAClG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,SAAS,CAAC,kFAAkF,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,OAAO,OAAO,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnH,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5B,8EAA8E;QAC9E,kFAAkF;QAClF,MAAM,OAAO,GAAG,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,kCAA0B,CAAC,CAAC,CAAC,aAAa,CAAC;QACjF,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,GAAG,IAAI,GAAG,EAAE,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC;QACjG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACtE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC;YACtC,GAAG,IAAI;YACP,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,OAAO,CAAC,GAAG;YACxB,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,IAAA,qBAAc,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAA0B;QAC1D,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,oCAAoC,CAAC,CAAC;QACvI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAC9F,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,yBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,kBAAkB,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QACzH,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,aAAwC;QAC7E,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,GAAG,GAAG,aAAa,GAAG,QAAQ,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;YAChG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC9C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACpF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3I,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACxE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YACrC,IAAI,IAAI,KAAK,iBAAiB;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9E,IAAI,IAAI,KAAK,sBAAsB;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACxF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QACD,2EAA2E;QAC3E,MAAM,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,GAAW;QACtC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,WAAW,CAAC;QAC3C,MAAM,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,UAA0B,EAAE;QACjD,IAAI,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,yBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvI,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACxH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;aAC3C,CAAC,CAAC;YACH,oFAAoF;YACpF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,IAAI,GAAG,EAAE,yBAAyB,CAAC,CAAC;YACxH,IAAI,OAAO,CAAC,KAAK;gBAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACnE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,yBAAyB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9H,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,IAAA,oBAAa,EAAC;YAC9B,GAAG,IAAI;YACP,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB;YACpF,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,mFAAmF,CAAC,CAAC;QACjI,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/F,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/F,IAAI,MAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAc,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACpD,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa;oBACjC,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;oBAC5C,CAAC,CAAC,IAAI,QAAQ,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;gBAC9J,OAAO,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACjF,OAAO,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,EAAE,CAAC;YACjG,OAAO,OAAO,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5F,CAAC;AAED,2EAA2E;AAC3E,SAAS,UAAU,CAAC,QAAkB,EAAE,MAA0B;IAChE,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,MAAM;QAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,QAAgB,EAAE,OAAiB;IACnD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,MAAM,MAAM,GAAI,IAAoC,EAAE,MAAM,CAAC;IAC7D,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC"}
+{"version":3,"file":"rp.js","sourceRoot":"","sources":["../src/rp.ts"],"names":[],"mappings":";;;AA8WA,gDAuQC;AArnBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,iCAUgB;AAChB,0CAAoE;AACpE,8CAAmD;AACnD,iEAAgE;AAIhE,+CAA6D;AAApD,8GAAA,cAAc,OAAA;AAAE,2GAAA,WAAW,OAAA;AAGpC,+BAAoI;AAA3H,sGAAA,cAAc,OAAA;AAAE,sGAAA,cAAc,OAAA;AAAE,oGAAA,YAAY,OAAA;AAAE,qGAAA,aAAa,OAAA;AAAE,iGAAA,SAAS,OAAA;AAAE,yGAAA,iBAAiB,OAAA;AAAE,uGAAA,eAAe,OAAA;AAEnH,wCAA+C;AAAtC,sGAAA,aAAa,OAAA;AACtB,6GAA6G;AAC7G,+CAKwB;AAJtB,wHAAA,wBAAwB,OAAA;AACxB,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAGnB,+DAMgC;AAL9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AAGzB,sCAAsC;AACtC,mDAAyD;AAAhD,uHAAA,qBAAqB,OAAA;AAC9B,+CAA+E;AAAtE,kHAAA,kBAAkB,OAAA;AAAE,yHAAA,yBAAyB,OAAA;AAGtD,6CAAqE;AAA5D,kHAAA,mBAAmB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAgQ7C,MAAM,WAAW,GAAkD;IACjE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,WAAW,EAAE,UAAU,CAAC;CAC1B,CAAC;AAEF,uGAAuG;AACvG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,eAAe;IACf,WAAW;IACX,cAAc;IACd,OAAO;IACP,OAAO;IACP,gBAAgB;IAChB,uBAAuB;IACvB,OAAO;IACP,WAAW;IACX,eAAe;IACf,SAAS;IACT,aAAa;CACd,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC7C,4EAA4E;AAC/D,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAE7C,6EAA6E;AAC7E,SAAgB,kBAAkB,CAAC,MAA0B;IAC3D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,+FAA+F,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,IAAI,GAAG,CAAC;IAClD,IAAI,CAAC,IAAA,qBAAc,EAAC,WAAW,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kFAAkF,CAAC,CAAC;IAC1I,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,SAAS,CAAC,wDAAwD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;QAClK,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,uBAAgB;QACjD,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,IAAiB,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAErE,KAAK,UAAU,KAAK,CAAC,OAAgB,EAAE,YAA4B,EAAE;QACnE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;QAChD,MAAM,SAAS,GAAmB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,kEAAkE;YAClE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,IAAI,IAAA,qBAAc,EAAC,CAAC,CAAC,CAAC;gBAAG,SAA+C,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,mBAAmB;gBAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,WAAW,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QACnH,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAY,EAAC;YAClC,GAAG,IAAI;YACP,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY;YACxC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAqB;YAC7B,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,cAAc,EAAE,QAAQ,CAAC,aAAa;YACtC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5G,SAAS,EAAE,QAAQ,CAAC,QAAQ;SAC7B,CAAC;QACF,MAAM,MAAM,GAAuB;YACjC,QAAQ,EAAE,QAAQ,CAAC,OAAO;YAC1B,YAAY,EAAE,QAAQ,CAAC,WAAW;YAClC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,UAAU,EAAE,QAAQ,CAAC,SAAS;SAC/B,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;IAClH,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,aAAqB,EAAE,OAA0B;QAClG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,SAAS,CAAC,kFAAkF,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,OAAO,OAAO,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnH,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5B,8EAA8E;QAC9E,kFAAkF;QAClF,MAAM,OAAO,GAAG,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,kCAA0B,CAAC,CAAC,CAAC,aAAa,CAAC;QACjF,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,GAAG,IAAI,GAAG,EAAE,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC;QACjG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACtE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC;YACtC,GAAG,IAAI;YACP,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,OAAO,CAAC,GAAG;YACxB,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,IAAA,qBAAc,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAA0B;QAC1D,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,oCAAoC,CAAC,CAAC;QACvI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAC9F,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,yBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,kBAAkB,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QACzH,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,wGAAwG;IACxG,SAAS,cAAc,CAAC,GAAW,EAAE,MAAuB,EAAE,MAAc;QAC1E,MAAM,MAAM,GAAmB,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3G,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9C,MAAM,IAAI,SAAS,CACjB,GAAG,MAAM,8DAA8D,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mCAAmC,CACtJ,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAC9F,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1C,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC5H,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;YACrC,uEAAuE;YACvE,OAAO,CAAC,aAAa,GAAG,SAAS,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/H,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrH,CAAC;IAED,+EAA+E;IAC/E,SAAS,YAAY,CAAC,GAAa,EAAE,IAAoC;QACvE,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC7E,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,uBAAuB,GAAG,CAAC,MAAM,GAAG,CAAC;QAC5H,OAAO,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,aAAwC;QAC7E,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,GAAG,GAAG,aAAa,GAAG,QAAQ,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;YAChG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;YACpF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,IAAI,EAAE,eAAe,CAAC;gBACnC,MAAM,aAAa,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBACvH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;YAClE,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,KAAK,KAAK,mBAAmB;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAC/G,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACpF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3I,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACxE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YACrC,IAAI,IAAI,KAAK,iBAAiB;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9E,IAAI,IAAI,KAAK,sBAAsB;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACxF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QACD,2EAA2E;QAC3E,MAAM,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,GAAW;QACtC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,WAAW,CAAC;QAC3C,MAAM,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,GAAW;QACtC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACpF,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC;QAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,KAAK,KAAK,mBAAmB;YAAE,OAAO,WAAW,CAAC;QAClF,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,YAAoB,EAAE,SAAwB;QACpF,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;QACxF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACzF,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IAED,0EAA0E;IAC1E,IAAI,WAAkE,CAAC;IACvE,KAAK,UAAU,iBAAiB,CAAC,OAAgB;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;QAClG,WAAW,KAAK,IAAA,6CAAsB,EAAC;YACrC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK,CAAC,QAAQ,CAAC,MAAM;gBACnB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC9B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,yFAAyF;oBACzF,KAAK,MAAM,EAAE,IAAI,GAAG;wBAAE,MAAM,KAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,CAAC;oBAC/E,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,UAA0B,EAAE;QACjD,IAAI,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,yBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvI,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACxH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;aAC3C,CAAC,CAAC;YACH,oFAAoF;YACpF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,IAAI,GAAG,EAAE,yBAAyB,CAAC,CAAC;YACxH,IAAI,OAAO,CAAC,KAAK;gBAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACnE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,yBAAyB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9H,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,IAAA,oBAAa,EAAC;YAC9B,GAAG,IAAI;YACP,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB;YACpF,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,mFAAmF,CAAC,CAAC;QACjI,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,iBAAiB,IAAI,QAAQ,KAAK,MAAM,CAAC,iBAAiB;YAAE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9H,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/F,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/F,IAAI,MAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAc,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACpD,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa;oBACjC,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;oBAC5C,CAAC,CAAC,IAAI,QAAQ,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;gBAC9J,OAAO,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACjF,OAAO,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,EAAE,CAAC;YACjG,OAAO,OAAO,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC3I,CAAC;AAED,2EAA2E;AAC3E,SAAS,UAAU,CAAC,QAAkB,EAAE,MAA0B;IAChE,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,MAAM;QAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,QAAgB,EAAE,OAAiB;IACnD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,MAAM,MAAM,GAAI,IAAoC,EAAE,MAAM,CAAC;IAC7D,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC"}