@atlasauth/emulator-core 0.1.0 → 0.3.0

package/dist/adopt.d.ts

@@ -0,0 +1,50 @@
+import type { Engine } from './engine';
+import type { Obj } from './openapi';
+/**
+ * Put a record that already exists elsewhere (another store sharing this engine's state, such as the Frontend API mock)
+ * into the engine under its own id, with the same change-feed and webhook entries a create would make. Idempotent: an id
+ * already present is returned untouched. This is how `@atlasauth/emulator` keeps one state across its two surfaces.
+ */
+export interface AdoptUser {
+    id: string;
+    emails: Array<{
+        id: string;
+        email_address: string;
+        verified: boolean;
+    }>;
+    primary_email_address_id: string | null;
+    first_name?: string | null;
+    last_name?: string | null;
+    username?: string | null;
+    external_id?: string | null;
+    image_url?: string | null;
+    password?: string | null;
+    public_metadata?: Obj;
+    private_metadata?: Obj;
+    unsafe_metadata?: Obj;
+    banned?: boolean;
+    created_at: number;
+    updated_at: number;
+}
+export declare function adoptUser(e: Engine, u: AdoptUser): Obj;
+export declare function adoptOrganization(e: Engine, o: {
+    id: string;
+    name: string;
+    slug: string | null;
+    created_by?: string | null;
+    public_metadata?: Obj;
+    created_at: number;
+    updated_at: number;
+}): Obj;
+export declare function adoptMembership(e: Engine, orgId: string, userId: string, role: string): Obj;
+/** A session minted elsewhere: it gets a row under its id, and `refreshToken` becomes a live refresh credential on the real route. */
+export declare function adoptSession(e: Engine, s: {
+    id: string;
+    userId: string;
+    organizationId?: string | null;
+    refreshToken: string;
+    createdAt: number;
+    expiresAt: number;
+    lastActiveAt: number;
+    status: 'active' | 'revoked' | 'ended';
+}): Obj;

package/dist/adopt.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.adoptUser = adoptUser;
+exports.adoptOrganization = adoptOrganization;
+exports.adoptMembership = adoptMembership;
+exports.adoptSession = adoptSession;
+const orgs_1 = require("./handlers/orgs");
+const sessions_1 = require("./handlers/sessions");
+const users_1 = require("./handlers/users");
+function adoptUser(e, u) {
+    const have = e.db.users.get(u.id);
+    if (have)
+        return have;
+    const row = e.db.users.insert({
+        id: u.id,
+        username: u.username ?? null,
+        first_name: u.first_name ?? null,
+        last_name: u.last_name ?? null,
+        image_url: u.image_url ?? null,
+        external_id: u.external_id ?? null,
+        emails: u.emails,
+        primary_email_address_id: u.primary_email_address_id,
+        has_password: typeof u.password === 'string',
+        password_plain: u.password ?? null,
+        public_metadata: u.public_metadata ?? {},
+        unsafe_metadata: u.unsafe_metadata ?? {},
+        private_metadata: u.private_metadata ?? {},
+        banned: u.banned === true,
+        locked: false,
+        created_at: u.created_at,
+        updated_at: u.updated_at,
+        version: 1,
+    });
+    e.changed({ type: 'user.created', data: (0, users_1.presentUser)(e, row), resource: 'user', id: row.id, op: 'create' });
+    return row;
+}
+function adoptOrganization(e, o) {
+    const have = e.db.organizations.get(o.id);
+    if (have)
+        return have;
+    const row = e.db.organizations.insert({ id: o.id, name: o.name, slug: o.slug ?? o.id, image_url: null, public_metadata: o.public_metadata ?? {}, private_metadata: {}, created_by: o.created_by ?? null, created_at: o.created_at, updated_at: o.updated_at, version: 1 });
+    e.changed({ type: 'organization.created', data: (0, orgs_1.presentOrg)(e, row), resource: 'organization', id: row.id, op: 'create' });
+    return row;
+}
+function adoptMembership(e, orgId, userId, role) {
+    return e.db.memberships.find((m) => m.organization_id === orgId && m.user_id === userId) ?? (0, orgs_1.addMember)(e, orgId, userId, role);
+}
+/** A session minted elsewhere: it gets a row under its id, and `refreshToken` becomes a live refresh credential on the real route. */
+function adoptSession(e, s) {
+    const have = e.db.sessions.get(s.id);
+    if (have)
+        return have;
+    const row = e.db.sessions.insert({ id: s.id, user_id: s.userId, organization_id: s.organizationId ?? null, status: s.status === 'active' ? 'active' : 'revoked', created_at: s.createdAt, expires_at: s.expiresAt, last_active_at: s.lastActiveAt });
+    (0, sessions_1.issueRefreshToken)(e, s.id, s.refreshToken);
+    return row;
+}
+//# sourceMappingURL=adopt.js.map

package/dist/adopt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../src/adopt.ts"],"names":[],"mappings":";;AA8BA,8BAyBC;AAED,8CAMC;AAED,0CAEC;AAGD,oCAMC;AAzED,0CAAwD;AACxD,kDAAwD;AACxD,4CAA+C;AAyB/C,SAAgB,SAAS,CAAC,CAAS,EAAE,CAAY;IAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5B,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QAChC,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;QAClC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,wBAAwB,EAAE,CAAC,CAAC,wBAAwB;QACpD,YAAY,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC5C,cAAc,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAClC,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,EAAE;QACxC,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,EAAE;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,EAAE;QAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI;QACzB,MAAM,EAAE,KAAK;QACb,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,OAAO,EAAE,CAAC;KACX,CAAC,CAAC;IACH,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAA,mBAAW,EAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3G,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,iBAAiB,CAAC,CAAS,EAAE,CAA+I;IAC1L,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3Q,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,IAAA,iBAAU,EAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1H,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,eAAe,CAAC,CAAS,EAAE,KAAa,EAAE,MAAc,EAAE,IAAY;IACpF,OAAO,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,IAAI,IAAA,gBAAS,EAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAChI,CAAC;AAED,sIAAsI;AACtI,SAAgB,YAAY,CAAC,CAAS,EAAE,CAA2L;IACjO,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACrP,IAAA,4BAAiB,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/coverage.d.ts

@@ -0,0 +1,15 @@
+import type { Engine } from './engine';
+import type { Obj } from './openapi';
+export type Coverage = 'handler' | 'generic';
+/**
+ * What the emulator does for each operation of the OpenAPI document, for the surface-completeness matrix:
+ * `handler` = hand-written behaviour (state, side effects, events), `generic` = document-driven CRUD only (a valid answer,
+ * no side effects). Routes the engine serves that the document does not list (`/oauth2/*`, `/scim/v2/*`, the well-known
+ * documents) come back under `extra`.
+ */
+export declare function coverageList(engine: Engine): {
+    operations: Record<string, Coverage>;
+    extra: string[];
+};
+/** Copy of the document with `x-atlas-emulator-coverage` set on every operation. */
+export declare function annotateCoverage(doc: Obj, engine: Engine): Obj;

package/dist/coverage.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coverageList = coverageList;
+exports.annotateCoverage = annotateCoverage;
+/**
+ * What the emulator does for each operation of the OpenAPI document, for the surface-completeness matrix:
+ * `handler` = hand-written behaviour (state, side effects, events), `generic` = document-driven CRUD only (a valid answer,
+ * no side effects). Routes the engine serves that the document does not list (`/oauth2/*`, `/scim/v2/*`, the well-known
+ * documents) come back under `extra`.
+ */
+function coverageList(engine) {
+    const documented = new Set(engine.index.ops.map((o) => `${o.method} ${o.path}`));
+    return {
+        operations: engine.coverage(),
+        extra: engine.handwritten().filter((r) => !r.op && !r.pattern.startsWith('/__emulator')).map((r) => `${r.method} ${r.pattern}`).filter((k) => !documented.has(k)),
+    };
+}
+/** Copy of the document with `x-atlas-emulator-coverage` set on every operation. */
+function annotateCoverage(doc, engine) {
+    const cov = engine.coverage();
+    const out = structuredClone(doc);
+    for (const [path, item] of Object.entries(out.paths ?? {})) {
+        for (const method of Object.keys(item)) {
+            const level = cov[`${method.toUpperCase()} ${path}`];
+            if (level)
+                item[method]['x-atlas-emulator-coverage'] = level;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=coverage.js.map

package/dist/coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.js","sourceRoot":"","sources":["../src/coverage.ts"],"names":[],"mappings":";;AAWA,oCAMC;AAGD,4CAUC;AAzBD;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,MAAc;IACzC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE;QAC7B,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;KAClK,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAgB,gBAAgB,CAAC,GAAQ,EAAE,MAAc;IACvD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YACrD,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,GAAG,KAAK,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/crypto-util.d.ts

@@ -0,0 +1,10 @@
+export declare const bytesToB64url: (bytes: Uint8Array) => string;
+export declare const sha256: (data: string | Uint8Array) => Promise<Uint8Array>;
+/** Whether `pem` is a public key of a type a device may enrol with (Ed25519, ECDSA P-256, RSA). */
+export declare const isDeviceKey: (pem: string) => Promise<boolean>;
+/** RFC 7638 thumbprint of an SPKI PEM, base64url, or null for a key this engine cannot read. */
+export declare function jwkThumbprint(pem: string): Promise<string | null>;
+/** Verify a device's signature over the raw challenge string, the way the real route does (EC signatures are r||s). Never throws. */
+export declare function verifyDeviceSignature(pem: string, challenge: string, signatureB64url: string): Promise<boolean>;
+/** PKCE S256 challenge for a verifier. */
+export declare const pkceChallenge: (verifier: string) => Promise<string>;

package/dist/crypto-util.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pkceChallenge = exports.isDeviceKey = exports.sha256 = exports.bytesToB64url = void 0;
+exports.jwkThumbprint = jwkThumbprint;
+exports.verifyDeviceSignature = verifyDeviceSignature;
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/** Web Crypto helpers (portable: no node:crypto, so the engine still runs in a browser worker). */
+const b64urlToBytes = (s) => {
+    const pad = s.replace(/-/g, '+').replace(/_/g, '/');
+    return Uint8Array.from(atob(pad + '='.repeat((4 - (pad.length % 4)) % 4)), (c) => c.charCodeAt(0));
+};
+const bytesToB64url = (bytes) => {
+    let s = '';
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+exports.bytesToB64url = bytesToB64url;
+const enc = new TextEncoder();
+const sha256 = async (data) => new Uint8Array(await crypto.subtle.digest('SHA-256', (typeof data === 'string' ? enc.encode(data) : data)));
+exports.sha256 = sha256;
+const pemToDer = (pem) => {
+    const body = pem.replace(/-----[A-Z ]+-----/g, '').replace(/\s+/g, '');
+    return Uint8Array.from(atob(body), (c) => c.charCodeAt(0));
+};
+const KINDS = [
+    { import: { name: 'Ed25519' }, verify: { name: 'Ed25519' }, jwkKeys: ['crv', 'kty', 'x'] },
+    { import: { name: 'ECDSA', namedCurve: 'P-256' }, verify: { name: 'ECDSA', hash: 'SHA-256' }, jwkKeys: ['crv', 'kty', 'x', 'y'] },
+    { import: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, verify: { name: 'RSASSA-PKCS1-v1_5' }, jwkKeys: ['e', 'kty', 'n'] },
+];
+async function importPublic(pem) {
+    let der;
+    try {
+        der = pemToDer(pem);
+    }
+    catch {
+        return null;
+    }
+    for (const kind of KINDS) {
+        try {
+            return { key: await crypto.subtle.importKey('spki', der, kind.import, true, ['verify']), kind };
+        }
+        catch {
+            /* try the next key type */
+        }
+    }
+    return null;
+}
+/** Whether `pem` is a public key of a type a device may enrol with (Ed25519, ECDSA P-256, RSA). */
+const isDeviceKey = async (pem) => (await importPublic(pem)) !== null;
+exports.isDeviceKey = isDeviceKey;
+/** RFC 7638 thumbprint of an SPKI PEM, base64url, or null for a key this engine cannot read. */
+async function jwkThumbprint(pem) {
+    const k = await importPublic(pem);
+    if (!k)
+        return null;
+    const jwk = (await crypto.subtle.exportKey('jwk', k.key));
+    const canonical = JSON.stringify(Object.fromEntries(k.kind.jwkKeys.map((n) => [n, jwk[n]])));
+    return (0, exports.bytesToB64url)(await (0, exports.sha256)(canonical));
+}
+/** Verify a device's signature over the raw challenge string, the way the real route does (EC signatures are r||s). Never throws. */
+async function verifyDeviceSignature(pem, challenge, signatureB64url) {
+    try {
+        const k = await importPublic(pem);
+        if (!k)
+            return false;
+        return await crypto.subtle.verify(k.kind.verify, k.key, b64urlToBytes(signatureB64url), enc.encode(challenge));
+    }
+    catch {
+        return false;
+    }
+}
+/** PKCE S256 challenge for a verifier. */
+const pkceChallenge = async (verifier) => (0, exports.bytesToB64url)(await (0, exports.sha256)(verifier));
+exports.pkceChallenge = pkceChallenge;
+//# sourceMappingURL=crypto-util.js.map

package/dist/crypto-util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-util.js","sourceRoot":"","sources":["../src/crypto-util.ts"],"names":[],"mappings":";;;AAiDA,sCAMC;AAGD,sDAQC;AAlED,uDAAuD;AACvD,mGAAmG;AACnG,MAAM,aAAa,GAAG,CAAC,CAAS,EAAc,EAAE;IAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACrG,CAAC,CAAC;AACK,MAAM,aAAa,GAAG,CAAC,KAAiB,EAAU,EAAE;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC;AAJW,QAAA,aAAa,iBAIxB;AACF,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAEvB,MAAM,MAAM,GAAG,KAAK,EAAE,IAAyB,EAAuB,EAAE,CAC7E,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAiB,CAAC,CAAC,CAAC;AADjH,QAAA,MAAM,UAC2G;AAE9H,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAc,EAAE;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC;AAGF,MAAM,KAAK,GAAc;IACvB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE;IAC1F,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE;IACjI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE;CAC9H,CAAC;AAEF,KAAK,UAAU,YAAY,CAAC,GAAW;IACrC,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAmB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAClH,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mGAAmG;AAC5F,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAoB,EAAE,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;AAA1F,QAAA,WAAW,eAA+E;AAEvG,gGAAgG;AACzF,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAA2B,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,OAAO,IAAA,qBAAa,EAAC,MAAM,IAAA,cAAM,EAAC,SAAS,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,qIAAqI;AAC9H,KAAK,UAAU,qBAAqB,CAAC,GAAW,EAAE,SAAiB,EAAE,eAAuB;IACjG,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,eAAe,CAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAiB,CAAC,CAAC;IACjJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0CAA0C;AACnC,MAAM,aAAa,GAAG,KAAK,EAAE,QAAgB,EAAmB,EAAE,CAAC,IAAA,qBAAa,EAAC,MAAM,IAAA,cAAM,EAAC,QAAQ,CAAC,CAAC,CAAC;AAAnG,QAAA,aAAa,iBAAsF"}

package/dist/custom-html.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Custom hosted HTML and CSS for a page template region (the `custom` component).
+ *
+ * The author's markup is never trusted, and never placed in the sign-in page itself. Three layers, each enough on its own:
+ *
+ *  1. Allowlist sanitizer (this file). Only the tags, attributes and CSS properties below survive; there is no script, no style
+ *     attribute, no event handler, no form control, no iframe, no object, no SVG, no `url()`, no import and no custom property.
+ *     Links and images are https (links also mailto) only. A write that contains anything else is refused with the reason;
+ *     the same function runs again, leniently (dropping what it does not allow), every time the template is rendered, so a
+ *     row that was edited in the database is just as safe.
+ *  2. Server-side render into a sandboxed iframe (`srcdoc`): `sandbox` without `allow-scripts` or `allow-same-origin`, so the
+ *     frame has an opaque origin and cannot touch the sign-in form, read its fields, restyle it, or draw over it.
+ *  3. A content-security-policy inside the frame that allows no script, no connection, no form post and no base element, and
+ *     images from https only.
+ *
+ * Template variables are a fixed list substituted into text (never into attributes), HTML-escaped.
+ *
+ * This is the same allowlist, tokenizer and CSS rules the Atlas API applies (copied, not imported: the emulator has no dependency on the
+ * server packages), so a block that is refused here is refused in production for the same reason.
+ */
+export declare const MAX_CUSTOM_HTML_BYTES: number;
+export declare const MAX_CUSTOM_CSS_BYTES: number;
+export declare const MAX_CUSTOM_TAGS = 300;
+export declare const CUSTOM_MIN_HEIGHT = 40;
+export declare const CUSTOM_MAX_HEIGHT = 1200;
+/** The variables a custom block may use as `{{name}}` in text. */
+export declare const CUSTOM_VARIABLES: readonly ["year", "locale"];
+export type CustomVariables = Partial<Record<(typeof CUSTOM_VARIABLES)[number], string>>;
+export interface Sanitized {
+    out: string;
+    /** What was not allowed. Empty means the input was already clean. */
+    problems: string[];
+}
+/**
+ * Reduce markup to the allowlist. Returns the clean markup and every problem found (a tag, attribute or value that was
+ * dropped). `vars` substitutes `{{year}}` / `{{locale}}` in text (escaped); an unknown `{{name}}` is a problem.
+ */
+export declare function sanitizeCustomHtml(input: string, opts?: {
+    vars?: CustomVariables;
+}): Sanitized;
+/** Reduce CSS to the allowlist: class/tag selectors, a fixed property list, no url(), no imports, no custom properties. */
+export declare function sanitizeCustomCss(input: string): Sanitized;
+/** The policy inside the frame: nothing runs, nothing connects, nothing posts; images from https only; no base element. */
+export declare const CUSTOM_FRAME_CSP = "default-src 'none'; img-src https:; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'";
+/** The `sandbox` attribute value: popups only (for links), and never scripts, forms or the page's origin. */
+export declare const CUSTOM_FRAME_SANDBOX = "allow-popups allow-popups-to-escape-sandbox";
+/** The complete document placed in the iframe. `html` and `css` must already be sanitized. */
+export declare function customFrameDocument(html: string, css: string, lang: string): string;
+/** The iframe element for a custom block (sanitizes again: the stored value is not trusted at render time). */
+export declare function renderCustomBlock(n: {
+    html: string;
+    css?: string;
+    height: number;
+    title?: string;
+}, vars?: CustomVariables): string;
+/** The `custom` component of a page template, validated like the API does: the same refusals, the same messages, the stored value is the sanitized form. */
+export declare function parseCustomComponent(n: Record<string, unknown>, path: string, depth: number): Record<string, unknown>;