@atlasauth/emulator-core 0.1.0 → 0.3.0

package/dist/handlers/emu4-shared.d.ts

@@ -0,0 +1,44 @@
+import type { Engine, RouteContext } from '../engine';
+import { EmulatorError } from '../errors';
+import type { Obj } from '../openapi';
+/**
+ * Shared by the round-four compliance and federation modules: the instance configuration the emulator keeps for the
+ * compliance settings (the part a config snapshot captures), the audit trail those routes write, and small helpers.
+ */
+export declare const bad: (message: string, param?: string) => EmulatorError;
+export declare const conflict: (message: string) => EmulatorError;
+export declare const isObj: (v: unknown) => v is Obj;
+export declare const hex: (data: string) => Promise<string>;
+export declare const DAY = 86400000;
+export declare const listOf: (data: Obj[], extra?: Obj) => Obj;
+export declare const needObj: (v: unknown, param: string) => Obj;
+/** Canonical JSON (sorted keys), the form digests and diffs compare. */
+export declare function canonical(v: unknown): string;
+export declare const MINOR_DEFAULTS: Obj;
+export declare const COOKIE_DEFAULTS: Obj;
+export declare const DATA_POLICY_DEFAULTS: Obj;
+export declare const INACTIVE_DEFAULTS: Obj;
+export declare const instanceConfig: (e: Engine) => Obj;
+export declare const resetInstanceConfig: (e: Engine) => void;
+export declare const minorsCfg: (e: Engine) => Obj;
+export declare const cookieCfg: (e: Engine) => Obj;
+export interface AuditRow {
+    id: string;
+    action: string;
+    actor_type: string;
+    actor_id: string | null;
+    target_type: string;
+    target_id: string;
+    metadata: Obj;
+    created_at: number;
+}
+export declare const auditLog: (e: Engine) => AuditRow[];
+export declare const actorOf: (c: RouteContext | null) => {
+    type: string;
+    id: string | null;
+};
+export declare function audit(e: Engine, c: RouteContext | null, action: string, targetType: string, targetId: string, metadata?: Obj): void;
+export declare const liveUser: (e: Engine, id: string | undefined) => Obj;
+export declare const iso: (ms: number) => string;
+/** Pagination over a newest-first array with the real `limit` / `starting_after` query. */
+export declare function pageReply(c: RouteContext, items: Obj[]): Obj;

package/dist/handlers/emu4-shared.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.iso = exports.liveUser = exports.actorOf = exports.auditLog = exports.cookieCfg = exports.minorsCfg = exports.resetInstanceConfig = exports.instanceConfig = exports.INACTIVE_DEFAULTS = exports.DATA_POLICY_DEFAULTS = exports.COOKIE_DEFAULTS = exports.MINOR_DEFAULTS = exports.needObj = exports.listOf = exports.DAY = exports.hex = exports.isObj = exports.conflict = exports.bad = void 0;
+exports.canonical = canonical;
+exports.audit = audit;
+exports.pageReply = pageReply;
+const errors_1 = require("../errors");
+const crypto_util_1 = require("../crypto-util");
+const support_1 = require("./support");
+/**
+ * Shared by the round-four compliance and federation modules: the instance configuration the emulator keeps for the
+ * compliance settings (the part a config snapshot captures), the audit trail those routes write, and small helpers.
+ */
+const bad = (message, param) => new errors_1.EmulatorError('VALIDATION_FAILED', message, param);
+exports.bad = bad;
+const conflict = (message) => new errors_1.EmulatorError('CONFLICT', message);
+exports.conflict = conflict;
+const isObj = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+exports.isObj = isObj;
+const hex = async (data) => [...(await (0, crypto_util_1.sha256)(data))].map((b) => b.toString(16).padStart(2, '0')).join('');
+exports.hex = hex;
+exports.DAY = 86_400_000;
+const listOf = (data, extra = {}) => ({ object: 'list', data, has_more: false, next_cursor: null, ...extra });
+exports.listOf = listOf;
+const needObj = (v, param) => {
+    if (!(0, exports.isObj)(v))
+        throw (0, exports.bad)(`${param} must be an object.`, param);
+    return v;
+};
+exports.needObj = needObj;
+/** Canonical JSON (sorted keys), the form digests and diffs compare. */
+function canonical(v) {
+    if (Array.isArray(v))
+        return `[${v.map(canonical).join(',')}]`;
+    if ((0, exports.isObj)(v))
+        return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`).join(',')}}`;
+    return JSON.stringify(v) ?? 'null';
+}
+// ── instance configuration the compliance settings live in ──
+exports.MINOR_DEFAULTS = { enabled: false, birthdateTrait: 'birthdate', countryTrait: null, defaultConsentAge: 13, consentAges: {}, minimumAge: null, restriction: 'hold', consentTtlHours: 72, consentMethods: ['email_link', 'admin'], minAssuranceLevel: 'low', trustedAgeMethods: [] };
+exports.COOKIE_DEFAULTS = { enabled: false, categories: ['necessary', 'functional', 'analytics', 'marketing'], policyVersion: null, honorGpc: true, honorDnt: false, repromptDays: 365, retentionDays: 0 };
+exports.DATA_POLICY_DEFAULTS = { controller: { name: null, contactEmail: null, dpoEmail: null }, activities: [] };
+exports.INACTIVE_DEFAULTS = { enabled: false, afterDays: 730, warnDays: 30, action: 'notify' };
+const defaults = () => ({
+    compliance: { minors: structuredClone(exports.MINOR_DEFAULTS), cookieConsent: structuredClone(exports.COOKIE_DEFAULTS), dataPolicy: structuredClone(exports.DATA_POLICY_DEFAULTS), inactiveUsers: structuredClone(exports.INACTIVE_DEFAULTS), dataRegion: null, consents: [], retention: { dsrDueDays: 30, erasureGraceDays: 7, deletedUserGraceDays: 30, anonymousRetentionDays: 30, ownershipTransfer: 'off' } },
+    localization: { requireReview: false, requireFourEyes: false },
+    approvals: {},
+});
+exports.instanceConfig = (0, support_1.engineState)(() => defaults());
+const resetInstanceConfig = (e) => {
+    const cfg = (0, exports.instanceConfig)(e);
+    for (const k of Object.keys(cfg))
+        delete cfg[k];
+    Object.assign(cfg, defaults());
+};
+exports.resetInstanceConfig = resetInstanceConfig;
+const minorsCfg = (e) => (0, exports.instanceConfig)(e).compliance.minors;
+exports.minorsCfg = minorsCfg;
+const cookieCfg = (e) => (0, exports.instanceConfig)(e).compliance.cookieConsent;
+exports.cookieCfg = cookieCfg;
+exports.auditLog = (0, support_1.engineState)(() => []);
+const actorOf = (c) => (c?.key ? { type: 'api_key', id: `apikey_${c.key.key.slice(-8)}` } : { type: 'system', id: null });
+exports.actorOf = actorOf;
+function audit(e, c, action, targetType, targetId, metadata = {}) {
+    const a = (0, exports.actorOf)(c);
+    (0, exports.auditLog)(e).push({ id: e.db.newId('audit'), action, actor_type: a.type, actor_id: a.id, target_type: targetType, target_id: targetId, metadata, created_at: e.clock.now() });
+}
+const liveUser = (e, id) => {
+    const u = e.db.users.get(id);
+    if (!u || u.deleted)
+        throw (0, errors_1.notFound)('User');
+    return u;
+};
+exports.liveUser = liveUser;
+const iso = (ms) => new Date(ms).toISOString();
+exports.iso = iso;
+/** Pagination over a newest-first array with the real `limit` / `starting_after` query. */
+function pageReply(c, items) {
+    const limit = Math.min(Math.max(Number(c.query.get('limit') ?? 20) || 20, 1), 100);
+    const after = c.query.get('starting_after');
+    let start = 0;
+    if (after) {
+        const at = items.findIndex((i) => i.id === after);
+        start = at < 0 ? items.length : at + 1;
+    }
+    const data = items.slice(start, start + limit);
+    const more = start + limit < items.length;
+    return { object: 'list', data, has_more: more, next_cursor: more ? (data[data.length - 1]?.id ?? null) : null };
+}
+//# sourceMappingURL=emu4-shared.js.map

package/dist/handlers/emu4-shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emu4-shared.js","sourceRoot":"","sources":["../../src/handlers/emu4-shared.ts"],"names":[],"mappings":";;;AAuBA,8BAIC;AAqCD,sBAGC;AAWD,8BAWC;AAvFD,sCAAoD;AAEpD,gDAAwC;AACxC,uCAAwC;AAExC;;;GAGG;AACI,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,KAAc,EAAE,EAAE,CAAC,IAAI,sBAAa,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAAlG,QAAA,GAAG,OAA+F;AACxG,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,sBAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAAvE,QAAA,QAAQ,YAA+D;AAC7E,MAAM,KAAK,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAApF,QAAA,KAAK,SAA+E;AAC1F,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,IAAA,oBAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAA9H,QAAA,GAAG,OAA2H;AAC9H,QAAA,GAAG,GAAG,UAAU,CAAC;AACvB,MAAM,MAAM,GAAG,CAAC,IAAW,EAAE,QAAa,EAAE,EAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AAAzH,QAAA,MAAM,UAAmH;AAC/H,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,KAAa,EAAO,EAAE;IACxD,IAAI,CAAC,IAAA,aAAK,EAAC,CAAC,CAAC;QAAE,MAAM,IAAA,WAAG,EAAC,GAAG,KAAK,qBAAqB,EAAE,KAAK,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAHW,QAAA,OAAO,WAGlB;AAEF,wEAAwE;AACxE,SAAgB,SAAS,CAAC,CAAU;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC/D,IAAI,IAAA,aAAK,EAAC,CAAC,CAAC;QAAE,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClH,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;AACrC,CAAC;AAED,+DAA+D;AAElD,QAAA,cAAc,GAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;AACxR,QAAA,eAAe,GAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;AACxM,QAAA,oBAAoB,GAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC/G,QAAA,iBAAiB,GAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAEzG,MAAM,QAAQ,GAAG,GAAQ,EAAE,CAAC,CAAC;IAC3B,UAAU,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,sBAAc,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,uBAAe,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,4BAAoB,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,yBAAiB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE;IAClX,YAAY,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;IAC9D,SAAS,EAAE,EAAE;CACd,CAAC,CAAC;AACU,QAAA,cAAc,GAAG,IAAA,qBAAW,EAAC,GAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,CAAC,CAAS,EAAQ,EAAE;IACrD,MAAM,GAAG,GAAG,IAAA,sBAAc,EAAC,CAAC,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;AACjC,CAAC,CAAC;AAJW,QAAA,mBAAmB,uBAI9B;AACK,MAAM,SAAS,GAAG,CAAC,CAAS,EAAO,EAAE,CAAC,IAAA,sBAAc,EAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;AAApE,QAAA,SAAS,aAA2D;AAC1E,MAAM,SAAS,GAAG,CAAC,CAAS,EAAO,EAAE,CAAC,IAAA,sBAAc,EAAC,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC;AAA3E,QAAA,SAAS,aAAkE;AAc3E,QAAA,QAAQ,GAAG,IAAA,qBAAW,EAAC,GAAe,EAAE,CAAC,EAAE,CAAC,CAAC;AACnD,MAAM,OAAO,GAAG,CAAC,CAAsB,EAAuC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAA9K,QAAA,OAAO,WAAuK;AAC3L,SAAgB,KAAK,CAAC,CAAS,EAAE,CAAsB,EAAE,MAAc,EAAE,UAAkB,EAAE,QAAgB,EAAE,WAAgB,EAAE;IAC/H,MAAM,CAAC,GAAG,IAAA,eAAO,EAAC,CAAC,CAAC,CAAC;IACrB,IAAA,gBAAQ,EAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC/K,CAAC;AAEM,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAsB,EAAO,EAAE;IACjE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;QAAE,MAAM,IAAA,iBAAQ,EAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAJW,QAAA,QAAQ,YAInB;AAEK,MAAM,GAAG,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAAzD,QAAA,GAAG,OAAsD;AAEtE,2FAA2F;AAC3F,SAAgB,SAAS,CAAC,CAAe,EAAE,KAAY;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;QAClD,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClH,CAAC"}

package/dist/handlers/emu4-snapshots.d.ts

@@ -0,0 +1,38 @@
+import type { Engine, RouteDef } from '../engine';
+import type { Obj } from '../openapi';
+/**
+ * Config time travel. A snapshot is the instance's configuration at one moment with every secret removed: the last-written
+ * singleton settings (`PATCH`/`PUT` of instance-wide settings) plus the compliance configuration. You can list snapshots, diff any
+ * two (or one against now) and restore one: a restore puts the configuration back as it was, keeps the secrets the instance holds
+ * today, and first saves the state it replaces so a restore can be undone the same way.
+ * shortcut: the document-driven settings routes cannot be hooked, so the write-time `auto` snapshot is taken by the compliance
+ * configuration route and by `POST /__emulator/config_snapshots/capture` (what the real worker pass does).
+ */
+declare const SOURCES: readonly ["manual", "auto", "pre_restore", "cli", "clone"];
+export declare function redact(value: unknown, path?: string, out?: string[]): {
+    value: unknown;
+    redacted: string[];
+};
+/** The configuration as the emulator holds it: instance-wide settings by route, the compliance configuration, the allowed origins. */
+export declare function currentConfig(e: Engine): {
+    auth_config: Obj;
+    allowed_origins: string[];
+};
+/** Take a snapshot of the instance as it is now. `skipIfUnchanged` (the automatic path) writes nothing when the newest snapshot is identical. */
+export declare function captureSnapshot(e: Engine, input: {
+    label?: string | null;
+    source: (typeof SOURCES)[number];
+    actor?: string | null;
+    skipIfUnchanged?: boolean;
+    current?: {
+        auth_config: Obj;
+        allowed_origins: string[];
+    };
+}): Promise<{
+    snapshot: Obj;
+    created: boolean;
+}>;
+/** Called by the routes that change configuration: the write-time snapshot, deduplicated by digest. */
+export declare const captureAutoSnapshot: (e: Engine) => Promise<unknown>;
+export declare function snapshotHandlers(): RouteDef[];
+export {};

package/dist/handlers/emu4-snapshots.js

@@ -0,0 +1,231 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.captureAutoSnapshot = void 0;
+exports.redact = redact;
+exports.currentConfig = currentConfig;
+exports.captureSnapshot = captureSnapshot;
+exports.snapshotHandlers = snapshotHandlers;
+const errors_1 = require("../errors");
+const store_1 = require("../store");
+const support_1 = require("./support");
+const emu4_shared_1 = require("./emu4-shared");
+const emu4_config_1 = require("./emu4-config");
+/**
+ * Config time travel. A snapshot is the instance's configuration at one moment with every secret removed: the last-written
+ * singleton settings (`PATCH`/`PUT` of instance-wide settings) plus the compliance configuration. You can list snapshots, diff any
+ * two (or one against now) and restore one: a restore puts the configuration back as it was, keeps the secrets the instance holds
+ * today, and first saves the state it replaces so a restore can be undone the same way.
+ * shortcut: the document-driven settings routes cannot be hooked, so the write-time `auto` snapshot is taken by the compliance
+ * configuration route and by `POST /__emulator/config_snapshots/capture` (what the real worker pass does).
+ */
+const SOURCES = ['manual', 'auto', 'pre_restore', 'cli', 'clone'];
+const LABEL_MAX = 120;
+const AUTO_KEEP = 200;
+/** Key names whose string value is a credential, and the at-rest envelope of an encrypted field. */
+const SECRET_KEY = /(secret|password|passwd|passphrase|private[_-]?key|api[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|signing|credential|salt|hmac|cipher|(^|[_-])token$|(^|[_-])pass$|(^|[_-])pwd$)/i;
+const ENVELOPE = /^v\d+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+const ATLAS_SECRET = /\b(sk|rk|whsec|ak|pk_live)_[A-Za-z0-9_-]{8,}/;
+const secretLike = (key, value) => typeof value === 'string' && value !== '' && (SECRET_KEY.test(key) || ENVELOPE.test(value) || ATLAS_SECRET.test(value));
+function redact(value, path = '', out = []) {
+    if (Array.isArray(value))
+        return { value: value.map((v, i) => redact(v, `${path}[${i}]`, out).value), redacted: out };
+    if ((0, emu4_shared_1.isObj)(value)) {
+        const next = {};
+        for (const [k, v] of Object.entries(value)) {
+            const here = path ? `${path}.${k}` : k;
+            if (secretLike(k, v)) {
+                out.push(here);
+                continue;
+            }
+            next[k] = redact(v, here, out).value;
+        }
+        return { value: next, redacted: out };
+    }
+    return { value, redacted: out };
+}
+/** Put the secrets the live config holds back into a restored copy (only where the snapshot has the surrounding object). */
+function carrySecrets(target, current) {
+    if (Array.isArray(target) && Array.isArray(current))
+        return target.map((t, i) => (i < current.length ? carrySecrets(t, current[i]) : t));
+    if ((0, emu4_shared_1.isObj)(target) && (0, emu4_shared_1.isObj)(current)) {
+        const next = { ...target };
+        for (const [k, v] of Object.entries(current)) {
+            if (secretLike(k, v)) {
+                if (!(k in next))
+                    next[k] = v;
+            }
+            else if (k in next)
+                next[k] = carrySecrets(next[k], v);
+        }
+        return next;
+    }
+    return target;
+}
+function diffConfig(a, b, path = '', out = []) {
+    if ((0, emu4_shared_1.isObj)(a) && (0, emu4_shared_1.isObj)(b)) {
+        for (const k of [...new Set([...Object.keys(a), ...Object.keys(b)])].sort())
+            diffConfig(a[k], b[k], path ? `${path}.${k}` : k, out);
+        return out;
+    }
+    if ((0, emu4_shared_1.canonical)(a ?? null) !== (0, emu4_shared_1.canonical)(b ?? null))
+        out.push({ path, before: a ?? null, after: b ?? null });
+    return out;
+}
+/** The configuration as the emulator holds it: instance-wide settings by route, the compliance configuration, the allowed origins. */
+function currentConfig(e) {
+    const settings = {};
+    for (const [path, body] of e.singletons)
+        if (path !== '/v1/instance/config_snapshots')
+            settings[path] = structuredClone(body);
+    const cfg = (0, emu4_shared_1.instanceConfig)(e);
+    const origins = e.singletons.get('/v1/instance')?.allowed_origins;
+    return { auth_config: { settings, compliance: structuredClone(cfg.compliance), localization: structuredClone(cfg.localization) }, allowed_origins: Array.isArray(origins) ? [...origins] : [] };
+}
+const snapshots = (0, support_1.engineState)((e) => new store_1.Table('instance_config_snapshots', e.clock.now, 'cfgs'));
+const digestOf = (authConfig, origins) => (0, emu4_shared_1.hex)((0, emu4_shared_1.canonical)({ auth_config: authConfig, allowed_origins: origins }));
+const present = (s, withConfig = false) => ({
+    object: 'config_snapshot', id: s.id, version: s.version, label: s.label ?? null, source: s.source, sha256: s.sha256, redacted_paths: s.redacted_paths, created_by: s.created_by ?? null, created_at: s.created_at,
+    ...(withConfig ? { auth_config: s.auth_config, allowed_origins: s.allowed_origins } : {}),
+});
+/** Take a snapshot of the instance as it is now. `skipIfUnchanged` (the automatic path) writes nothing when the newest snapshot is identical. */
+async function captureSnapshot(e, input) {
+    const cur = input.current ?? currentConfig(e);
+    const red = redact(cur.auth_config);
+    const sha = await digestOf(red.value, cur.allowed_origins);
+    const t = snapshots(e);
+    if (input.skipIfUnchanged) {
+        const last = t.all()[0];
+        if (last && last.sha256 === sha)
+            return { snapshot: last, created: false };
+    }
+    const version = (t.all().reduce((m, s) => Math.max(m, s.version), 0)) + 1;
+    const snapshot = t.insert({ version, label: input.label ?? null, source: input.source, auth_config: red.value, allowed_origins: cur.allowed_origins, redacted_paths: red.redacted, sha256: sha, created_by: input.actor ?? null, created_at: e.clock.now() });
+    if (input.source === 'auto' || input.source === 'pre_restore') {
+        const autos = t.all().filter((s) => s.source === 'auto' || s.source === 'pre_restore');
+        for (const old of autos.slice(AUTO_KEEP))
+            t.delete(old.id);
+    }
+    return { snapshot, created: true };
+}
+/** Called by the routes that change configuration: the write-time snapshot, deduplicated by digest. */
+const captureAutoSnapshot = (e) => captureSnapshot(e, { source: 'auto', skipIfUnchanged: true });
+exports.captureAutoSnapshot = captureAutoSnapshot;
+const parseLabel = (raw) => {
+    if (raw === undefined || raw === null)
+        return null;
+    if (typeof raw !== 'string' || raw.trim() === '' || raw.length > LABEL_MAX)
+        throw (0, emu4_shared_1.bad)(`label is text of 1 to ${LABEL_MAX} characters.`, 'label');
+    return raw.trim();
+};
+async function side(e, ref) {
+    if (ref === 'current') {
+        const cur = currentConfig(e);
+        return { label: 'current', auth_config: redact(cur.auth_config).value, allowed_origins: cur.allowed_origins };
+    }
+    const s = snapshots(e).get(ref);
+    if (!s)
+        throw (0, errors_1.notFound)('Unknown snapshot');
+    return { label: s.id, auth_config: s.auth_config, allowed_origins: s.allowed_origins };
+}
+function snapshotHandlers() {
+    const READ = 'instance:read';
+    const WRITE = 'instance:write';
+    const knownFields = (b, allowed) => {
+        const k = Object.keys(b).find((x) => !allowed.includes(x));
+        if (k)
+            throw (0, emu4_shared_1.bad)(`Unrecognised field ${k}. Expected any of ${allowed.join(', ')}.`, k);
+    };
+    return [
+        { method: 'POST', pattern: '/v1/instance/config_snapshots', scope: WRITE, handler: async (c) => {
+                knownFields(c.body, ['label']);
+                const label = parseLabel(c.body.label);
+                const { snapshot } = await captureSnapshot(c.engine, { label, source: 'manual', actor: (0, emu4_shared_1.actorOf)(c).id });
+                (0, emu4_shared_1.audit)(c.engine, c, 'config_snapshot.created', 'config_snapshot', snapshot.id, { version: snapshot.version, source: 'manual' });
+                return { status: 201, body: present(snapshot) };
+            } },
+        { method: 'GET', pattern: '/v1/instance/config_snapshots', scope: READ, handler: (c) => {
+                const source = c.query.get('source');
+                if (source !== null && !SOURCES.includes(source))
+                    throw (0, emu4_shared_1.bad)(`source is one of: ${SOURCES.join(', ')}.`, 'source');
+                return { body: (0, emu4_shared_1.pageReply)(c, snapshots(c.engine).all().filter((s) => !source || s.source === source).map((s) => present(s))) };
+            } },
+        { method: 'GET', pattern: '/v1/instance/config_snapshots/diff', scope: READ, handler: async (c) => {
+                const from = c.query.get('from');
+                if (!from)
+                    throw (0, emu4_shared_1.bad)('from is a snapshot id or "current".', 'from');
+                const a = await side(c.engine, from);
+                const b = await side(c.engine, c.query.get('to') || 'current');
+                const changes = diffConfig(a.auth_config, b.auth_config);
+                const originsChanged = (0, emu4_shared_1.canonical)(a.allowed_origins) !== (0, emu4_shared_1.canonical)(b.allowed_origins);
+                return { body: { object: 'config_snapshot_diff', from: a.label, to: b.label, changes, allowed_origins: originsChanged ? { before: a.allowed_origins, after: b.allowed_origins } : null, unchanged: changes.length === 0 && !originsChanged } };
+            } },
+        { method: 'GET', pattern: '/v1/instance/config_snapshots/:id', scope: READ, handler: (c) => {
+                const s = snapshots(c.engine).get(c.params.id);
+                if (!s)
+                    throw (0, errors_1.notFound)('Unknown snapshot');
+                return { body: present(s, true) };
+            } },
+        { method: 'POST', pattern: '/v1/instance/config_snapshots/:id/restore', scope: WRITE, handler: async (c) => {
+                const e = c.engine;
+                knownFields(c.body, ['dry_run', 'include_allowed_origins', 'expected_sha256']);
+                const snap = snapshots(e).get(c.params.id);
+                if (!snap)
+                    throw (0, errors_1.notFound)('Unknown snapshot');
+                for (const k of ['dry_run', 'include_allowed_origins'])
+                    if (c.body[k] !== undefined && typeof c.body[k] !== 'boolean')
+                        throw (0, emu4_shared_1.bad)(`${k} must be true or false.`, k);
+                if (c.body.expected_sha256 !== undefined && typeof c.body.expected_sha256 !== 'string')
+                    throw (0, emu4_shared_1.bad)('expected_sha256 must be a string.', 'expected_sha256');
+                const includeOrigins = c.body.include_allowed_origins === true;
+                const cur = currentConfig(e);
+                const currentRedacted = redact(cur.auth_config).value;
+                const currentSha = await digestOf(currentRedacted, cur.allowed_origins);
+                const next = carrySecrets(snap.auth_config, cur.auth_config);
+                const changes = diffConfig(currentRedacted, snap.auth_config);
+                const origins = includeOrigins ? snap.allowed_origins : null;
+                const originsChange = !!origins && (0, emu4_shared_1.canonical)(origins) !== (0, emu4_shared_1.canonical)(cur.allowed_origins);
+                const view = (applied) => ({ object: 'config_snapshot_restore', snapshot_id: snap.id, version: snap.version, dry_run: !applied, applied, current_sha256: currentSha, changes, allowed_origins_changed: originsChange });
+                if (c.body.dry_run === true)
+                    return { body: view(false) };
+                if (typeof c.body.expected_sha256 === 'string' && c.body.expected_sha256 !== currentSha)
+                    throw (0, emu4_shared_1.conflict)('The configuration changed since this restore was previewed. Preview it again.');
+                const problems = (0, emu4_config_1.configProblems)({ compliance: next.compliance, localization: next.localization });
+                if (problems.length > 0)
+                    throw (0, emu4_shared_1.bad)(`This snapshot no longer passes configuration checks: ${problems.slice(0, 5).map((p) => `${p.param}: ${p.message}`).join('; ')}`, 'snapshot');
+                if (changes.length === 0 && !originsChange)
+                    return { body: view(true) };
+                await captureSnapshot(e, { label: `Before restoring version ${snap.version}`, source: 'pre_restore', actor: (0, emu4_shared_1.actorOf)(c).id, current: cur });
+                // settings the snapshot does not hold are removed; the rest are put back (with today's secrets kept)
+                const settings = (next.settings ?? {});
+                for (const path of [...e.singletons.keys()])
+                    if (path !== '/v1/instance/config_snapshots' && !(path in settings))
+                        e.singletons.delete(path);
+                for (const [path, body] of Object.entries(settings))
+                    e.singletons.set(path, structuredClone(body));
+                const cfg = (0, emu4_shared_1.instanceConfig)(e);
+                cfg.compliance = structuredClone(next.compliance);
+                cfg.localization = structuredClone(next.localization);
+                if (originsChange)
+                    e.singletons.set('/v1/instance', { ...(e.singletons.get('/v1/instance') ?? {}), allowed_origins: origins });
+                const paths = changes.slice(0, 100).map((x) => x.path);
+                (0, emu4_shared_1.audit)(e, c, 'config_snapshot.restored', 'config_snapshot', snap.id, { version: snap.version, changed_paths: paths, allowed_origins_changed: originsChange });
+                e.webhooks.emit('config_snapshot.restored', { id: snap.id, version: snap.version, label: snap.label ?? null, changed_paths: paths, restored_at: e.clock.now() });
+                return { body: view(true) };
+            } },
+        { method: 'DELETE', pattern: '/v1/instance/config_snapshots/:id', scope: WRITE, handler: (c) => {
+                const e = c.engine;
+                const s = snapshots(e).get(c.params.id);
+                if (!s)
+                    throw (0, errors_1.notFound)('Unknown snapshot');
+                snapshots(e).delete(s.id);
+                (0, emu4_shared_1.audit)(e, c, 'config_snapshot.deleted', 'config_snapshot', s.id, { version: s.version });
+                return { status: 204 };
+            } },
+        // POST /__emulator/config_snapshots/capture: what the worker pass (and the write-time hook) does: an automatic snapshot, skipped when nothing changed.
+        { method: 'POST', pattern: '/__emulator/config_snapshots/capture', public: true, handler: async (c) => {
+                const { snapshot, created } = await captureSnapshot(c.engine, { source: 'auto', skipIfUnchanged: true });
+                return { body: { object: 'config_snapshot_capture', created, snapshot: present(snapshot) } };
+            } },
+    ];
+}
+//# sourceMappingURL=emu4-snapshots.js.map

package/dist/handlers/emu4-snapshots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emu4-snapshots.js","sourceRoot":"","sources":["../../src/handlers/emu4-snapshots.ts"],"names":[],"mappings":";;;AA0BA,wBAeC;AA4BD,sCAMC;AAWD,0CAgBC;AAoBD,4CAmFC;AA3MD,sCAAqC;AAErC,oCAAiC;AACjC,uCAAwC;AACxC,+CAAgH;AAChH,+CAA+C;AAE/C;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAU,CAAC;AAC3E,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,oGAAoG;AACpG,MAAM,UAAU,GAAG,kMAAkM,CAAC;AACtN,MAAM,QAAQ,GAAG,wEAAwE,CAAC;AAC1F,MAAM,YAAY,GAAG,8CAA8C,CAAC;AACpE,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,KAAc,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAErL,SAAgB,MAAM,CAAC,KAAc,EAAE,IAAI,GAAG,EAAE,EAAE,MAAgB,EAAE;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACtH,IAAI,IAAA,mBAAK,EAAC,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,GAAQ,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AAClC,CAAC;AAED,4HAA4H;AAC5H,SAAS,YAAY,CAAC,MAAe,EAAE,OAAgB;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzI,IAAI,IAAA,mBAAK,EAAC,MAAM,CAAC,IAAI,IAAA,mBAAK,EAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAQ,EAAE,GAAG,MAAM,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;oBAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,CAAC,IAAI,IAAI;gBAAE,IAAI,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAGD,SAAS,UAAU,CAAC,CAAU,EAAE,CAAU,EAAE,IAAI,GAAG,EAAE,EAAE,MAAgB,EAAE;IACvE,IAAI,IAAA,mBAAK,EAAC,CAAC,CAAC,IAAI,IAAA,mBAAK,EAAC,CAAC,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpI,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,IAAA,uBAAS,EAAC,CAAC,IAAI,IAAI,CAAC,KAAK,IAAA,uBAAS,EAAC,CAAC,IAAI,IAAI,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3G,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sIAAsI;AACtI,SAAgB,aAAa,CAAC,CAAS;IACrC,MAAM,QAAQ,GAAQ,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU;QAAE,IAAI,IAAI,KAAK,+BAA+B;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9H,MAAM,GAAG,GAAG,IAAA,4BAAc,EAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;IAClE,OAAO,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAClM,CAAC;AAED,MAAM,SAAS,GAAG,IAAA,qBAAW,EAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,aAAK,CAAC,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1G,MAAM,QAAQ,GAAG,CAAC,UAAmB,EAAE,OAAgB,EAAmB,EAAE,CAAC,IAAA,iBAAG,EAAC,IAAA,uBAAS,EAAC,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAEnJ,MAAM,OAAO,GAAG,CAAC,CAAM,EAAE,UAAU,GAAG,KAAK,EAAO,EAAE,CAAC,CAAC;IACpD,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;IACjN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC1F,CAAC,CAAC;AAEH,iJAAiJ;AAC1I,KAAK,UAAU,eAAe,CAAC,CAAS,EAAE,KAA+K;IAC9N,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,cAAc,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAS,CAAC,CAAC;IACrQ,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;QACvF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AACD,uGAAuG;AAChG,MAAM,mBAAmB,GAAG,CAAC,CAAS,EAAoB,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;AAArH,QAAA,mBAAmB,uBAAkG;AAElI,MAAM,UAAU,GAAG,CAAC,GAAY,EAAiB,EAAE;IACjD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS;QAAE,MAAM,IAAA,iBAAG,EAAC,yBAAyB,SAAS,cAAc,EAAE,OAAO,CAAC,CAAC;IACjJ,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF,KAAK,UAAU,IAAI,CAAC,CAAS,EAAE,GAAW;IACxC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC;IAChH,CAAC;IACD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAA,iBAAQ,EAAC,kBAAkB,CAAC,CAAC;IAC3C,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC;AACzF,CAAC;AAED,SAAgB,gBAAgB;IAC9B,MAAM,IAAI,GAAG,eAAe,CAAC;IAC7B,MAAM,KAAK,GAAG,gBAAgB,CAAC;IAC/B,MAAM,WAAW,GAAG,CAAC,CAAM,EAAE,OAAiB,EAAE,EAAE;QAChD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC;YAAE,MAAM,IAAA,iBAAG,EAAC,sBAAsB,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC,CAAC;IACF,OAAO;QACL,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,+BAA+B,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC7F,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAA,qBAAO,EAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxG,IAAA,mBAAK,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC/H,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,CAAC,EAAE;QACH,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACrF,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACrC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAA,iBAAG,EAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACzI,OAAO,EAAE,IAAI,EAAE,IAAA,uBAAS,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChI,CAAC,EAAE;QACH,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAChG,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAA,iBAAG,EAAC,qCAAqC,EAAE,MAAM,CAAC,CAAC;gBACpE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;gBAC/D,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;gBACzD,MAAM,cAAc,GAAG,IAAA,uBAAS,EAAC,CAAC,CAAC,eAAe,CAAC,KAAK,IAAA,uBAAS,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBACrF,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACjP,CAAC,EAAE;QACH,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACzF,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC/C,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,kBAAkB,CAAC,CAAC;gBAC3C,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YACpC,CAAC,EAAE;QACH,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,2CAA2C,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACzG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,yBAAyB,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBAC/E,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAA,iBAAQ,EAAC,kBAAkB,CAAC,CAAC;gBAC9C,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAU;oBAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;wBAAE,MAAM,IAAA,iBAAG,EAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;gBAC5K,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,KAAK,QAAQ;oBAAE,MAAM,IAAA,iBAAG,EAAC,mCAAmC,EAAE,iBAAiB,CAAC,CAAC;gBAC1J,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,KAAK,IAAI,CAAC;gBAC/D,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;gBAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC;gBACtD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;gBACxE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAQ,CAAC;gBACpE,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAE,IAAI,CAAC,eAA4B,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC3E,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,IAAI,IAAA,uBAAS,EAAC,OAAO,CAAC,KAAK,IAAA,uBAAS,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBACzF,MAAM,IAAI,GAAG,CAAC,OAAgB,EAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,CAAC,CAAC;gBACtO,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI;oBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1D,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,KAAK,UAAU;oBAAE,MAAM,IAAA,sBAAQ,EAAC,+EAA+E,CAAC,CAAC;gBACzL,MAAM,QAAQ,GAAG,IAAA,4BAAc,EAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;gBAClG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,IAAA,iBAAG,EAAC,wDAAwD,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;gBACjL,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa;oBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxE,MAAM,eAAe,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,4BAA4B,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,IAAA,qBAAO,EAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC3I,qGAAqG;gBACrG,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAQ,CAAC;gBAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;oBAAE,IAAI,IAAI,KAAK,+BAA+B,IAAI,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC;wBAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC5I,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;oBAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAQ,CAAC,CAAC;gBAC1G,MAAM,GAAG,GAAG,IAAA,4BAAc,EAAC,CAAC,CAAC,CAAC;gBAC9B,GAAG,CAAC,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAClD,GAAG,CAAC,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACtD,IAAI,aAAa;oBAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC/H,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACvD,IAAA,mBAAK,EAAC,CAAC,EAAE,CAAC,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC7J,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACjK,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,CAAC,EAAE;QACH,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAC7F,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxC,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,kBAAkB,CAAC,CAAC;gBAC3C,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC1B,IAAA,mBAAK,EAAC,CAAC,EAAE,CAAC,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACzB,CAAC,EAAE;QACH,uJAAuJ;QACvJ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sCAAsC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACpG,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzG,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC/F,CAAC,EAAE;KACJ,CAAC;AACJ,CAAC"}

package/dist/handlers/emu4-sns.d.ts

@@ -0,0 +1,9 @@
+import type { Engine } from '../engine';
+import type { Obj } from '../openapi';
+/** What the emulator knows about Amazon SNS: extra certificates a test registered, and subscription confirmations "visited". */
+export declare const snsState: (e: Engine) => {
+    certs: Map<string, string>;
+    confirmations: Obj[];
+};
+/** What fetching a SigningCertURL returns: a registered certificate for that exact URL, the built-in one at its own path, else nothing. */
+export declare function snsCertificateFor(e: Engine, url: string, builtIn: string): string | null;

package/dist/handlers/emu4-sns.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.snsState = void 0;
+exports.snsCertificateFor = snsCertificateFor;
+const sns_cert_1 = require("../sns-cert");
+const support_1 = require("./support");
+/** What the emulator knows about Amazon SNS: extra certificates a test registered, and subscription confirmations "visited". */
+exports.snsState = (0, support_1.engineState)((_e) => ({ certs: new Map(), confirmations: [] }));
+/** What fetching a SigningCertURL returns: a registered certificate for that exact URL, the built-in one at its own path, else nothing. */
+function snsCertificateFor(e, url, builtIn) {
+    const registered = (0, exports.snsState)(e).certs.get(url);
+    if (registered)
+        return registered;
+    try {
+        return new URL(url).pathname === sns_cert_1.SNS_CERT_PATH ? builtIn : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=emu4-sns.js.map

package/dist/handlers/emu4-sns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emu4-sns.js","sourceRoot":"","sources":["../../src/handlers/emu4-sns.ts"],"names":[],"mappings":";;;AASA,8CAQC;AAhBD,0CAA4C;AAE5C,uCAAwC;AAExC,gIAAgI;AACnH,QAAA,QAAQ,GAAG,IAAA,qBAAW,EAAC,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,EAAkB,EAAE,aAAa,EAAE,EAAW,EAAE,CAAC,CAAC,CAAC;AAExH,2IAA2I;AAC3I,SAAgB,iBAAiB,CAAC,CAAS,EAAE,GAAW,EAAE,OAAe;IACvE,MAAM,UAAU,GAAG,IAAA,gBAAQ,EAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,wBAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/handlers/emu4-trust-binding.d.ts

@@ -0,0 +1,27 @@
+import type { Engine, RouteContext, RouteDef } from '../engine';
+import type { Obj } from '../openapi';
+/**
+ * Sender-constrained sessions (a DPoP key per session) and device-bound sessions (the browser DBSC protocol).
+ * Both are opt-in through the trust config (`/__emulator/trust/config`); an engine left alone behaves as before.
+ */
+export interface TrustConfig {
+    session_binding: {
+        mode: 'off' | 'optional' | 'required';
+        require_attestation: boolean;
+    };
+    device_bound_sessions: boolean;
+    /** Whether native app attestation is on for the instance (the real instance verifies Apple and Google evidence). */
+    app_attestation: boolean;
+}
+export declare const trustConfig: (e: Engine) => TrustConfig;
+/** `cnf.jkt` for the session JWT of a bound session; nothing for an unbound one. */
+export declare const sessionBindingClaims: (e: Engine, sessionId: string) => Obj;
+/**
+ * The gate on the refresh route: a session bound to a key refreshes only with a fresh single-use proof from that key
+ * (401 `dpop_binding_required`); with mode `required` an unbound session cannot refresh (401 `session_binding_required`);
+ * a session bound to a device needs that device's bound cookie (401 `device_binding_required`).
+ */
+export declare function enforceSessionBinding(c: RouteContext, sessionId: string): Promise<void>;
+/** `Secure-Session-Registration` for a session handed out with a refresh cookie that is not bound to a device yet. */
+export declare function dbscRegistrationHeaders(e: Engine, sessionId: string): Promise<Record<string, string>>;
+export declare function emu4TrustBindingHandlers(): RouteDef[];