@atlasauth/backend 0.7.3 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @atlasauth/backend changelog
 
+## 0.9.0
+- **OIDC relying party.** New `oidc` namespace and standalone functions for the hosted-redirect sign-in: `oidcStart` (`oidc.start`), `oidcCallback` (`oidc.callback`), `oidcLogoutUrl` (`oidc.logoutUrl`), `oidcVerifyIdToken` (`oidc.verifyIdToken`), `oidcClearCookie` (`oidc.clearCookie`). `start({ issuer, clientId, redirectUri, scope?, prompt?, loginHint?, audienceHint?, extraParams?, cookieName?, secret? })` returns `{ url, cookie, state, nonce }`: a PKCE (S256) authorize URL from discovery and a `Set-Cookie` for a 10-minute, httpOnly, `SameSite=Lax`, callback-path flow cookie, AES-GCM sealed when `secret` is set. `callback({ …, clientSecret?, clientAuth?: 'client_secret_basic' | 'client_secret_post' | 'none', query, cookie, secret?, clockToleranceSec? })` returns `OidcIdentity` (`sub`, `namespacedSub` = `${issuer}#${sub}`, `email`, `emailVerified`, `name`, `idToken`, `accessToken`, `refreshToken?`, `expiresAt` in epoch ms, `claims`, `clearCookie`). The ID token is verified with RS256 pinned, exact `iss`, `aud` containing the client id (and `azp` when present or when there are several audiences), `nonce`, `exp`/`iat` with tolerance, and `at_hash`. Discovery is cached per issuer for an hour.
+- **Errors.** `AtlasOidcError` with `code` (`AtlasOidcErrorCode`: `state_mismatch`, `issuer_mismatch`, `invalid_request`, `invalid_token`, `token_exchange_failed`, `access_denied`, `discovery_failed`), `oauthError`, `description`, `status`, `clearCookie` and `cause`.
+- **`AtlasBackend#oidc`.** The same helpers with the backend's `issuer`, `fetchImpl` and `now` filled in (`AtlasBackendOidc`).
+- **Test issuer.** `createTestIssuer` accepts `clientId`, `clientSecret` and `idTokenTtlSeconds`, and the returned `TestIssuer` gains `clientId`, `mintIdToken(claims?, { aud?, nonce?, accessToken?, ttlSeconds?, tamper? })`, `authorize(authorizeUrl, { sub?, claims?, tamper?, error? })`, `fetch` (an offline discovery, JWKS and token endpoint) and `endpoints`. `mintSession(claims?, { tamper? })` accepts a tamper too. `TestTokenTamper` is `wrong_aud`, `wrong_iss`, `foreign_key`, `expired`, `wrong_nonce` or `alg_none`; `TEST_TOKEN_TAMPERS` lists all six. New types: `MintIdTokenOptions`, `TestAuthorizeOptions`, `TestAuthorizeResult`.
+- **OAuth client secret rotation with overlap.** `oauthClients.rotateSecret(id, { overlap_seconds? }, idempotencyKey?)` takes how long the previous secret keeps working: default 86400 (24 hours), `0` revokes it now, at most 604800 (7 days). It returns `OAuthClientSecretRotation` (`client_secret`, `overlap_seconds`, `previous_secret_expires_at`: epoch ms, or null when the old secret already stopped working). New type `RotateOAuthClientSecretBody`. `OAuthClient` gains optional `previous_secret_expires_at`.
+- **Issuer and verification endpoints.** `Instance` (`instance.get()`) and the platform client's `PlatformApp` gain `issuer`, `discovery_url` and `jwks_uri`; `PlatformApp` also gains `frontend_api_host`. They change when a custom domain goes active, so read them rather than hard-coding them.
+- **Email verification.** `EmailAddress` gains optional `verification` (`{ status: 'verified' | 'unverified', strategy?: string | null }`). `verified` and `email_verified` are now true only for a proven address: one that signed up while `requireEmailVerification` was false reads `verified: false`, with `verification.strategy: 'skipped'`. Do not grant access on an unverified address.
+- **Email templates.** `EmailTemplateName` adds `account_secured` (variable `when`): sent when the owner of an address proves it and the account is secured from whoever had set it up without proof.
+- **Managed email uses your own provider account.** `messaging.managedEmail.create` now sets the domain up on YOUR Resend or Brevo account: `CreateManagedEmailBody` gains `transport` (`resend` | `brevo`) + `config.api_key`, or `provider_id`. `ManagedEmail` gains `backend`, `provider_id` and `feedback_webhook`; `limits` is now always `null` and `reputation` is `your_provider_account`. `DeletedManagedEmail` gains `provider_removed`. `ManagedEmailRecord.purpose` adds `ownership` and `dmarc`.
+- **Development email sender.** New `messaging.developmentEmail.get / enable / disable` (`DevelopmentEmail`, `EnableDevelopmentEmailBody`): your own email provider in development mode, for a development instance without a verified domain. `MessagingProviders` gains `development_email`.
+- **Provider mode.** Email provider bodies accept `mode` (`standard` | `development`); provider responses gain optional `id` and `mode` (`standard` | `development` | `managed_domain`).
+- **Compatible** except `ManagedEmail.limits` (was `{ hourly, daily }`, now `null`) and `ManagedEmail.reputation` (new constant). Everything else is new exports, optional parameters and fields; `rotateSecret(id)` behaves as before.
+
+## 0.8.0
+- **Back-channel logout, retryable failures.** A failed `LogoutTokenResult` gains `retryable: boolean`. It is `true` for `no_keys` (the issuer's keys could not be fetched: a network error, a JWKS outage, or a just-rotated key whose refetch failed) and `false` for `malformed`, `invalid` and `replayed`. Answer `503` with `Retry-After` when it is true, so Atlas retries the delivery, and `400` otherwise. The README example does this.
+- **Back-channel delivery log and test.** `oauthClients.listBackchannelDeliveries(id, { limit?, starting_after? })` returns `BackchannelLogoutDeliveryPage` (`BackchannelLogoutDelivery`: `status`, `http_status`, `latency_ms`, `attempt_number`, `error`, `location`, `test`, timestamps). `oauthClients.testBackchannelLogout(id)` returns `BackchannelLogoutTest` (`ok`, `status`, `latency_ms`, `error`, `location`, `blocked_reason`, `body_excerpt`, `sid`, `delivery_id`). The platform client's `atlasIdApps` gains the same two methods plus `preflight(id)` (`AtlasIdAppPreflight`).
+- **Webhooks.** `verifyWebhook` returns `deliveryId` (the signed `atlas-id` header, the same on every retry of one event: deduplicate on it) and `timestamp` (the signed `atlas-timestamp`, epoch ms) on a verified delivery. `WebhookVerifyResult` gains both, optional.
+- **Users.** `User` gains optional `version`: it strictly increases with every change to the user, and user webhook payloads carry the same value. Apply an update only if its version is newer.
+- **Branding.** `ResolvedBranding` (`resolved` on `branding.get` / `branding.update`) gains every writable field under its input name (`theme`, `layout`, `fontFamily`, `legal`, `copy`, `providers`, `card`, `interaction`, `socialButtons`, …) plus the derived `fontStack`, `providerOrder`, `providerHidden`, `eyebrow`, `headline`, `subheadline`, `footer`. `Branding.copy` accepts `eyebrow`.
+- **Domain moves.** `instance.moveOrigin({ from, to, dry_run? })` rewrites every URL on one origin to another across the instance, its OAuth clients, webhooks, redirect URLs and Sign in with Atlas apps, and returns `OriginMove` (`changes` before → after, `problems`, `applied`); the platform client's `atlasIdApps.moveOrigin(id, body)` does the same for one app.
+- **Connections and integrations.** `instance.connections()` returns `InstanceConnections` (one `InstanceConnection` row per link to another platform, with `ok`, `severity`, `fix_hint`). `instance.integrations.chatly` and `instance.integrations.forumulate` get, set and delete the built-in connections (`ChatlyIntegration`, `ForumulateIntegration`).
+- **Logout fan-out.** New `logoutNotifyEndpoints` namespace: `list`, `create`, `get`, `update`, `delete` and `listDeliveries` for services that receive the same `logout_token` as your OIDC apps (`LogoutNotifyEndpoint`, `LogoutNotifyDelivery`).
+- **Managed email.** `messaging.managedEmail.get / create / verify / delete({ force? })` sends from your own domain through Atlas's email account (`ManagedEmail`, `ManagedEmailRecord`, `CreateManagedEmailBody` with optional write-only `dns`). `MessagingProviders` gains `managed_email`.
+- **Sign in with Atlas apps.** `atlasIdApps.findUsers(id, email)` (privacy-request lookup, `AtlasIdAppUser`), `revokeGrant(id, grantId)` (`AtlasIdGrantRevocation`) and `rotateWebhookSecret(id)`. `AtlasIdApp` gains `webhook_url`, `webhook_events` and `webhook_active`; `AtlasIdAppWithSecret` gains `webhook_secret`; `UpdateAtlasIdAppBody` accepts `webhook_url`.
+- **Publisher.** New platform namespace `atlasIdPublisher`: `get`, `set`, `update({ skip_consent })`, `delete`, `verify` (`AtlasIdPublisher`). The platform client's `configChangelog.list(params)` reads the account's config history.
+- **More fields.** `CookieConsent` gains `culture` and `declared_cookies` (`DeclaredCookie`); `SetCookieConsentBody` accepts `culture`. `PreflightReport` gains `sdk_versions_seen` (`SdkVersionSeen`, `SdkAdvisory`). `WebhookDelivery` gains `error` and `location`; `WebhookEndpointList` gains `event_catalog` (`WebhookEventCatalogEntry`) and `event_audiences`. `CustomDomain` gains `dns`, and `domains.create` accepts `dns` (`CustomDomainDnsInput`). `ConfigChangelogEntry` gains `target`. `users.revokeSessions(id, { revoke_grants })` also revokes OAuth grants and returns `grants_revoked`.
+- **Compatible.** New methods, types and optional fields only (`retryable` is a new field on the failure branch); no signatures changed.
+
 ## 0.7.3
 - **Added** error code constants `CAPTCHA_KEYS_REQUIRED` (422: captcha can only be turned on once its own site key and secret are stored) and `CAPTCHA_IN_USE` (409: removing a key a live captcha flow uses; `meta.flows`).
 

package/README.md

@@ -3,6 +3,7 @@
 Server-side Atlas for Node, Deno, Bun and edge runtimes. It does three things:
 
 - verifies Atlas session tokens, webhooks and back-channel logout tokens
+- runs the server side of a hosted-redirect (OpenID Connect) sign-in
 - gives you a typed client for the Backend API, using your secret key (`sk_...`)
 - gives you a typed client for the Platform API, using your platform key (`psk_...`)
 
@@ -24,6 +25,150 @@ if (result.ok) console.log(result.claims.sub);
 
 The JWKS is found from the issuer and cached. Instances on the shared host also pass `instanceId` (or `publishableKey`).
 
+## Sign in with a redirect (OpenID Connect)
+
+`oidc` runs the relying-party side of the hosted-redirect integration: state, nonce and PKCE, the flow cookie, the code exchange and the ID-token checks (RS256 only, `iss`, `aud` = your client id, `nonce`, `exp`).
+
+```ts
+import { oidc, AtlasOidcError } from '@atlasauth/backend';
+
+const config = {
+  issuer: 'https://bright-fox-42-fapi.atlasauth.net', // https:// + frontend_api_host
+  clientId: process.env.ATLAS_CLIENT_ID!,
+  redirectUri: 'https://app.example.com/auth/callback',
+  secret: process.env.OIDC_COOKIE_SECRET!, // 32+ random characters; seals the flow cookie
+};
+
+// Start: set the flow cookie, redirect.
+const { url, cookie } = await oidc.start({ ...config, scope: 'openid profile email' });
+
+// Callback: one call does every check.
+const identity = await oidc.callback({
+  ...config,
+  clientSecret: process.env.ATLAS_CLIENT_SECRET!,
+  query: request.url, // or URLSearchParams, or req.query
+  cookie: request.headers.get('cookie'),
+});
+// identity: { sub, namespacedSub, email, emailVerified, name, idToken, accessToken, refreshToken?, expiresAt, claims, clearCookie }
+
+// Sign out: end your session, then end the Atlas one.
+const logout = await oidc.logoutUrl({ ...config, postLogoutRedirectUri: 'https://app.example.com/', idTokenHint });
+```
+
+- The flow cookie is `httpOnly`, `SameSite=Lax`, `Secure` (except on a `http://localhost` callback), scoped to the callback path, and lasts 10 minutes. With `secret` it is encrypted (AES-GCM), so it can't be read or forged. Without `secret` it is only encoded. Always pass one in production.
+- `namespacedSub` is `${issuer}#${sub}`. Key users on it if you accept more than one instance, so two instances' users never collide.
+- `clientAuth` is `client_secret_basic` (default with a secret), `client_secret_post`, or `none` (public client, PKCE only).
+- `new AtlasBackend({ issuer }).oidc` has the same methods with `issuer` filled in.
+- Did your own code exchange? `oidc.verifyIdToken(idToken, { issuer, clientId, nonce })` runs just the token checks.
+
+Failures throw `AtlasOidcError` with a stable `code`:
+
+| `code` | Meaning |
+|---|---|
+| `state_mismatch` | No flow cookie, a different `state`, a cookie from another sign-in or secret, or a flow older than 10 minutes. Start again. |
+| `access_denied` | Atlas redirected back with an OAuth `error`. The exact value is in `oauthError` (`access_denied`, `login_required`, …). |
+| `issuer_mismatch` | The callback's `iss` parameter names a different server. |
+| `invalid_request` | The callback has no `code`. |
+| `token_exchange_failed` | The token endpoint refused the code or client (`oauthError`, `status`). |
+| `invalid_token` | The ID token failed a check: algorithm, signature, `iss`, `aud`/`azp`, `nonce`, `exp`/`iat` or `at_hash`. |
+| `discovery_failed` | The discovery document or the signing keys could not be fetched or don't match the issuer. |
+
+Every error from `callback` carries `clearCookie`: send it with your error page too.
+
+### Next.js (App Router)
+
+```ts
+// app/auth/login/route.ts
+import { oidc } from '@atlasauth/backend';
+import { config } from '@/lib/atlas';
+
+export async function GET() {
+  const { url, cookie } = await oidc.start(config);
+  return new Response(null, { status: 302, headers: { location: url, 'set-cookie': cookie } });
+}
+
+// app/auth/callback/route.ts
+import { oidc, AtlasOidcError } from '@atlasauth/backend';
+import { config } from '@/lib/atlas';
+
+export async function GET(request: Request) {
+  try {
+    const user = await oidc.callback({
+      ...config,
+      clientSecret: process.env.ATLAS_CLIENT_SECRET!,
+      query: request.url,
+      cookie: request.headers.get('cookie'),
+    });
+    const headers = new Headers({ location: '/' });
+    headers.append('set-cookie', user.clearCookie);
+    headers.append('set-cookie', await createAppSession(user)); // your own session cookie
+    return new Response(null, { status: 302, headers });
+  } catch (error) {
+    if (!(error instanceof AtlasOidcError)) throw error;
+    return new Response(`Sign-in failed (${error.code})`, {
+      status: 400,
+      headers: error.clearCookie ? { 'set-cookie': error.clearCookie } : {},
+    });
+  }
+}
+```
+
+### Express
+
+```ts
+import express from 'express';
+import { oidc, AtlasOidcError } from '@atlasauth/backend';
+
+const app = express();
+
+app.get('/auth/login', async (req, res) => {
+  const { url, cookie } = await oidc.start(config);
+  res.append('Set-Cookie', cookie).redirect(url);
+});
+
+app.get('/auth/callback', async (req, res) => {
+  try {
+    const user = await oidc.callback({
+      ...config,
+      clientSecret: process.env.ATLAS_CLIENT_SECRET!,
+      query: req.originalUrl,
+      cookie: req.headers.cookie,
+    });
+    res.append('Set-Cookie', user.clearCookie);
+    await startYourSession(req, res, user.namespacedSub);
+    res.redirect('/');
+  } catch (error) {
+    if (!(error instanceof AtlasOidcError)) throw error;
+    if (error.clearCookie) res.append('Set-Cookie', error.clearCookie);
+    res.status(400).send(`Sign-in failed (${error.code})`);
+  }
+});
+```
+
+## Test offline
+
+`createTestIssuer()` mints session tokens and ID tokens with a throwaway key, and its `fetch` serves discovery, the JWKS and a token endpoint, so a full redirect sign-in runs in a unit test with no network.
+
+```ts
+import { createTestIssuer, oidc, TEST_TOKEN_TAMPERS } from '@atlasauth/backend';
+
+const fx = await createTestIssuer({ clientSecret: 'test-secret' });
+const config = { issuer: fx.issuer, clientId: fx.clientId, redirectUri: 'https://app.example.com/auth/callback', secret: '…32+ chars…', fetchImpl: fx.fetch };
+
+const { url, cookie } = await oidc.start(config);
+const { callbackUrl } = await fx.authorize(url, { sub: 'user_1', claims: { email: 'a@example.com', email_verified: true } });
+const user = await oidc.callback({ ...config, clientSecret: 'test-secret', query: callbackUrl, cookie });
+
+// Negative cases: wrong_aud, wrong_iss, foreign_key, expired, wrong_nonce, alg_none.
+for (const tamper of TEST_TOKEN_TAMPERS) {
+  const { url, cookie } = await oidc.start(config);
+  const { callbackUrl } = await fx.authorize(url, { tamper });
+  await expect(oidc.callback({ ...config, clientSecret: 'test-secret', query: callbackUrl, cookie })).rejects.toMatchObject({ code: 'invalid_token' });
+}
+```
+
+`fx.mintIdToken(claims, { aud, nonce, tamper })` and `fx.mintSession(claims, { tamper })` mint single tokens. `@atlasauth/testing` re-exports `createTestIssuer`.
+
 ## Management client (secret key)
 
 ```ts
@@ -178,6 +323,25 @@ The platform client has these namespaces:
 
 It accepts the same `strict`, `onUnknownFields` and `withOptions` settings.
 
+### Domain moves, logout fan-out and managed email
+
+```ts
+// Move every URL from the old origin to the new one. dry_run first shows the diff.
+const preview = await atlas.instance.moveOrigin({ from: 'https://old.example.com', to: 'https://example.com', dry_run: true });
+for (const c of preview.changes) console.log(c.object, c.field, c.before, '->', c.after);
+
+// Send the same logout_token your OIDC apps get to another service.
+await atlas.logoutNotifyEndpoints.create({ url: 'https://api.example.com/atlas/logout' });
+
+// Send email from your own domain through Atlas, then publish the returned DNS records.
+const managed = await atlas.messaging.managedEmail.create({ from_address: 'Acme <no-reply@example.com>' });
+console.log(managed.records);
+```
+
+On the platform client, `atlasIdApps.findUsers(id, email)` answers a privacy request for one app,
+`atlasIdApps.revokeGrant(id, grantId)` revokes one person's approval, and `atlasIdPublisher` claims and verifies
+the publisher name shown on consent screens.
+
 ## Back-channel logout
 
 When a user signs out of Atlas, Atlas POSTs a `logout_token` to your `backchannel_logout_uri`. Verify it before you end the matching local sessions:
@@ -198,7 +362,13 @@ export async function handleBackchannelLogout(form: URLSearchParams) {
   if (!token) return { status: 400, headers };
 
   const result = await logoutTokens.verify(token);
-  if (!result.ok) return { status: 400, headers };
+  if (!result.ok) {
+    // retryable: our side failed for now (the issuer's keys could not be fetched).
+    // 503 + Retry-After makes Atlas send it again; 400 is final and never retried.
+    return result.retryable
+      ? { status: 503, headers: { ...headers, 'Retry-After': '30' } }
+      : { status: 400, headers };
+  }
 
   const { sid, sub } = result.claims;
   if (sid) await sessions.deleteByAtlasSid(sid); // your session store
@@ -222,6 +392,10 @@ For tokens signed by your own instance, `new AtlasBackend({ issuer }).verifyLogo
 
 To refuse replays across several servers, implement `LogoutReplayStore.remember(jti, expiresAtMs)` on a shared store, for example Redis `SET NX PX`.
 
+Atlas retries a delivery that gets a `5xx`, `408`, `429` or no answer, after 5 seconds, 5 minutes, 30 minutes, 2 hours, 5 hours and 10 hours. Any other `4xx` is final. Atlas never follows a redirect: a `3xx` answer is recorded as `backchannel_redirect_not_followed`, so after a domain move update `backchannel_logout_uri` to the final URL. Answer your own transient failures (a database that is down) with `503` too.
+
+To check the route end to end, `oauthClients.testBackchannelLogout(id)` sends a signed test token (`sid` starting `sid_test_`, extra claim `atlas_test: true`) and returns what your route answered; `oauthClients.listBackchannelDeliveries(id)` lists every attempt.
+
 ## Webhooks
 
 `verifyWebhook` checks the signature on events Atlas sends to your webhook endpoints. You manage endpoints with `atlas.webhooks.endpoints`: create, update, reveal or rotate a secret, send a test event, and redeliver a past delivery.

package/dist/client/activity.d.ts

@@ -70,6 +70,11 @@ export interface ConfigChangelogEntry {
     };
     action: string;
     ip?: string | null;
+    /** The object that changed, e.g. `{ type: 'oauth_client', id }`. */
+    target?: {
+        type: string;
+        id: string | null;
+    } | null;
     changes?: Array<{
         section: string;
         before: unknown;

package/dist/client/activity.js.map

@@ -1 +1 @@
-{"version":3,"file":"activity.js","sourceRoot":"","sources":["../../src/client/activity.ts"],"names":[],"mappings":";;AA4EA,wCAOC;AAED,sCAOC;AAED,0DAaC;AA/BD,SAAgB,cAAc,CAAC,OAAkB;IAC/C,OAAO;QACL,2EAA2E;QAC3E,IAAI,CAAC,SAAmC,EAAE;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,0FAA0F;QAC1F,GAAG,CAAC,SAA4B,EAAE;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI,CACF,SAAoC,EAAE;YAOtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"activity.js","sourceRoot":"","sources":["../../src/client/activity.ts"],"names":[],"mappings":";;AA8EA,wCAOC;AAED,sCAOC;AAED,0DAaC;AA/BD,SAAgB,cAAc,CAAC,OAAkB;IAC/C,OAAO;QACL,2EAA2E;QAC3E,IAAI,CAAC,SAAmC,EAAE;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,0FAA0F;QAC1F,GAAG,CAAC,SAA4B,EAAE;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI,CACF,SAAoC,EAAE;YAOtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/branding.d.ts

@@ -32,6 +32,7 @@ export interface Branding {
         hidden?: string[];
     };
     copy?: {
+        eyebrow?: string;
         headline?: string;
         subheadline?: string;
         footer?: string;
@@ -116,6 +117,63 @@ export interface ResolvedBranding {
     colorBackground: string;
     colorText: string;
     supportEmail: string | null;
+    colorAccent?: string;
+    colorCard?: string;
+    colorBorder?: string;
+    borderRadius?: string;
+    theme?: 'light' | 'dark' | 'auto';
+    /** The font stack name in force (`system` when unset or unknown). */
+    fontFamily?: string;
+    /** The CSS font-family list `fontFamily` resolves to. */
+    fontStack?: string;
+    fontUrl?: string | null;
+    layout?: 'centered' | 'split' | 'wall';
+    background?: Record<string, unknown>;
+    providers?: {
+        order: string[];
+        hidden: string[];
+    };
+    providerOrder?: string[];
+    providerHidden?: string[];
+    socialButtons?: Record<string, unknown>;
+    codeInput?: 'boxes' | 'single';
+    card?: {
+        width: string;
+        align: string;
+        logoSize: string;
+    };
+    typography?: {
+        headingSize: string;
+        headingWeight: string;
+    };
+    buttonShape?: string;
+    cardBorder?: string;
+    inputSize?: string;
+    interaction?: Record<string, unknown>;
+    backgroundPattern?: string;
+    cardStyle?: string;
+    textScale?: string;
+    socialPlacement?: 'top' | 'bottom';
+    sectionOrder?: string[];
+    legal?: {
+        termsUrl: string | null;
+        privacyUrl: string | null;
+        required: boolean;
+    };
+    signUpFields?: Array<Record<string, unknown>>;
+    copy?: {
+        eyebrow: string | null;
+        headline: string | null;
+        subheadline: string | null;
+        footer: string | null;
+    };
+    eyebrow?: string | null;
+    headline?: string | null;
+    subheadline?: string | null;
+    footer?: string | null;
+    customCss?: string;
+    customHtmlHeader?: string;
+    customHtmlFooter?: string;
 }
 /**
  * A read/update echoes the stored branding plus `resolved` — the sanitized shape

package/dist/client/branding.js.map

@@ -1 +1 @@
-{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/client/branding.ts"],"names":[],"mappings":";;AAyIA,4CAcC;AAdD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,kEAAkE;QAClE,MAAM,CAAC,IAAuB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,0EAA0E;QAC1E,OAAO,CAAC,IAAuB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/client/branding.ts"],"names":[],"mappings":";;AAkLA,4CAcC;AAdD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,kEAAkE;QAClE,MAAM,CAAC,IAAuB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,0EAA0E;QAC1E,OAAO,CAAC,IAAuB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/domains.d.ts

@@ -13,6 +13,18 @@ export interface CustomDomain {
     failure_reason: string | null;
     certificate_expires_at: number | null;
     cookie_domain: string | null;
+    /** DNS automation: the provider Atlas writes this host's record with (the token is never returned). */
+    dns?: {
+        provider: 'cloudflare';
+        token_set: boolean;
+    } | null;
+}
+/** Let Atlas write the domain's DNS record. The token is write-only. */
+export interface CustomDomainDnsInput {
+    provider: 'cloudflare';
+    api_token: string;
+    /** Replace a conflicting existing record. */
+    overwrite?: boolean;
 }
 export interface ListDomainsResponse {
     object: 'list';
@@ -31,6 +43,7 @@ export declare function domainsResource(request: RequestFn): {
     create(body: {
         host: string;
         role?: "fapi" | "accounts";
+        dns?: CustomDomainDnsInput;
     }, idempotencyKey?: string): Promise<CustomDomain & {
         instructions: Record<string, unknown>;
     }>;

package/dist/client/domains.js.map

@@ -1 +1 @@
-{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../src/client/domains.ts"],"names":[],"mappings":";;AA4BA,0CAkBC;AA9CD,uCAAgD;AA4BhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CACJ,IAAkD,EAClD,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../src/client/domains.ts"],"names":[],"mappings":";;AAsCA,0CAkBC;AAxDD,uCAAgD;AAsChD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CACJ,IAA8E,EAC9E,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/email-templates.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The transactional email a template drives. */
-export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'team_member_added' | 'team_role_changed';
+export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed';
 /** The customizable body of a template: a subject line and a text body. */
 export interface EmailTemplateBody {
     subject?: string;

package/dist/client/email-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AAwDA,wDAkBC;AA1ED,uCAAgD;AAwDhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AAyDA,wDAkBC;AA3ED,uCAAgD;AAyDhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/index.d.ts

@@ -35,10 +35,13 @@ declare function buildNamespaces(request: RequestFn): {
             deleted: true;
         }>;
         listSessions(id: string): Promise<import("./types").ListPage<import("./users").UserSession>>;
-        revokeSessions(id: string): Promise<{
+        revokeSessions(id: string, options?: {
+            revoke_grants?: boolean;
+        }): Promise<{
             object: "user";
             id: string;
             sessions_revoked: number;
+            grants_revoked?: number;
         }>;
         addEmail(id: string, body: {
             email_address: string;
@@ -338,13 +341,15 @@ declare function buildNamespaces(request: RequestFn): {
         get(id: string): Promise<import("./oauth-clients").OAuthClient>;
         create(body: import("./oauth-clients").CreateOAuthClientBody, idempotencyKey?: string): Promise<import("./oauth-clients").OAuthClientWithSecret>;
         update(id: string, body: import("./oauth-clients").UpdateOAuthClientBody): Promise<import("./oauth-clients").OAuthClient>;
-        rotateSecret(id: string): Promise<import("./oauth-clients").OAuthClientWithSecret>;
+        rotateSecret(id: string, body?: import("./oauth-clients").RotateOAuthClientSecretBody, idempotencyKey?: string): Promise<import("./oauth-clients").OAuthClientSecretRotation>;
         delete(id: string): Promise<{
             object: "oauth_client";
             id: string;
             deleted: true;
             note: string;
         }>;
+        listBackchannelDeliveries(id: string, query?: import("./oauth-clients").BackchannelDeliveriesQuery): Promise<import("./oauth-clients").BackchannelLogoutDeliveryPage>;
+        testBackchannelLogout(id: string): Promise<import("./oauth-clients").BackchannelLogoutTest>;
         grants: {
             list(clientId: string): Promise<import("./types").ListPage<import("./oauth-clients").ClientGrant>>;
             create(clientId: string, body: {
@@ -396,6 +401,7 @@ declare function buildNamespaces(request: RequestFn): {
         create(body: {
             host: string;
             role?: "fapi" | "accounts";
+            dns?: import("./domains").CustomDomainDnsInput;
         }, idempotencyKey?: string): Promise<import("./domains").CustomDomain & {
             instructions: Record<string, unknown>;
         }>;
@@ -835,6 +841,24 @@ declare function buildNamespaces(request: RequestFn): {
         deleteChannel(channel: "email" | "sms", options?: {
             force?: boolean;
         }): Promise<import("./messaging").DeletedMessagingProvider>;
+        developmentEmail: {
+            get(): Promise<import("./messaging").DevelopmentEmail>;
+            enable(body: import("./messaging").EnableDevelopmentEmailBody): Promise<import("./messaging").DevelopmentEmail>;
+            disable(): Promise<{
+                object: "development_email";
+                deleted: true;
+                provider_id: string;
+                mode: "standard";
+            }>;
+        };
+        managedEmail: {
+            get(): Promise<import("./messaging").ManagedEmail>;
+            create(body: import("./messaging").CreateManagedEmailBody): Promise<import("./messaging").ManagedEmail>;
+            verify(): Promise<import("./messaging").ManagedEmail>;
+            delete(options?: {
+                force?: boolean;
+            }): Promise<import("./messaging").DeletedManagedEmail>;
+        };
         test(channel: "email" | "sms", body: {
             to: string;
         }): Promise<import("./messaging").MessagingTestResult>;
@@ -882,6 +906,20 @@ declare function buildNamespaces(request: RequestFn): {
         get(): Promise<import("./instance").Instance>;
         update(body: import("./instance").UpdateInstanceBody): Promise<import("./instance").InstanceUpdateResult>;
         preflight(): Promise<import("./instance").PreflightReport>;
+        moveOrigin(body: import("./instance").OriginMoveRequest): Promise<import("./instance").OriginMove>;
+        connections(): Promise<import("./instance").InstanceConnections>;
+        integrations: {
+            chatly: {
+                get(): Promise<import("./instance").ChatlyIntegration>;
+                set(body: import("./instance").SetChatlyIntegrationBody): Promise<import("./instance").ChatlyIntegration>;
+                delete(): Promise<import("./instance").ChatlyIntegration>;
+            };
+            forumulate: {
+                get(): Promise<import("./instance").ForumulateIntegration>;
+                set(body: import("./instance").SetForumulateIntegrationBody): Promise<import("./instance").ForumulateIntegration>;
+                delete(): Promise<import("./instance").ForumulateIntegration>;
+            };
+        };
         cookieConsent: {
             get(): Promise<import("./instance").CookieConsent>;
             set(body: import("./instance").SetCookieConsentBody): Promise<import("./instance").CookieConsent>;
@@ -1200,6 +1238,20 @@ declare function buildNamespaces(request: RequestFn): {
         loginReadiness(params: import("./diagnostics").LoginReadinessParams): Promise<import("./diagnostics").LoginReadiness>;
         requestInspector(params: import("./diagnostics").RequestInspectorParams): Promise<import("./diagnostics").RequestInspection>;
     };
+    logoutNotifyEndpoints: {
+        list(): Promise<import("./logout-notify-endpoints").LogoutNotifyList<import("./logout-notify-endpoints").LogoutNotifyEndpoint>>;
+        create(body: import("./logout-notify-endpoints").CreateLogoutNotifyEndpointBody, idempotencyKey?: string): Promise<import("./logout-notify-endpoints").LogoutNotifyEndpoint>;
+        get(id: string): Promise<import("./logout-notify-endpoints").LogoutNotifyEndpoint>;
+        update(id: string, body: import("./logout-notify-endpoints").UpdateLogoutNotifyEndpointBody, idempotencyKey?: string): Promise<import("./logout-notify-endpoints").LogoutNotifyEndpoint>;
+        delete(id: string, idempotencyKey?: string): Promise<{
+            object: "logout_notify_endpoint";
+            id: string;
+            deleted: true;
+        }>;
+        listDeliveries(id: string, params?: {
+            limit?: number;
+        }): Promise<import("./logout-notify-endpoints").LogoutNotifyList<import("./logout-notify-endpoints").LogoutNotifyDelivery>>;
+    };
 };
 /** Every resource namespace of the management client. */
 export type AtlasClientNamespaces = ReturnType<typeof buildNamespaces>;
@@ -1282,4 +1334,5 @@ export * from './session-exchange-apps';
 export * from './tickets';
 export * from './test-mode';
 export * from './diagnostics';
+export * from './logout-notify-endpoints';
 export * from './platform';

package/dist/client/index.js

@@ -72,6 +72,7 @@ const connectors_1 = require("./connectors");
 const notifications_1 = require("./notifications");
 const audit_events_1 = require("./audit-events");
 const activity_1 = require("./activity");
+const logout_notify_endpoints_1 = require("./logout-notify-endpoints");
 const pca_1 = require("./pca");
 const mcp_1 = require("./mcp");
 const legacy_auth_1 = require("./legacy-auth");
@@ -175,6 +176,8 @@ function buildNamespaces(request) {
         // Development-instance helpers: the paired test instance, test users, testing tokens.
         testMode: (0, test_mode_1.testModeResource)(request),
         diagnostics: (0, diagnostics_1.diagnosticsResource)(request),
+        // Downstream services that get the same logout_token as your OIDC apps.
+        logoutNotifyEndpoints: (0, logout_notify_endpoints_1.logoutNotifyEndpointsResource)(request),
     };
 }
 var request_2 = require("./request");
@@ -253,5 +256,6 @@ __exportStar(require("./session-exchange-apps"), exports);
 __exportStar(require("./tickets"), exports);
 __exportStar(require("./test-mode"), exports);
 __exportStar(require("./diagnostics"), exports);
+__exportStar(require("./logout-notify-endpoints"), exports);
 __exportStar(require("./platform"), exports);
 //# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA2EA,8CAQC;AAnFD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;KAC1C,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA4EA,8CAQC;AApFD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}