@atlasauth/emulator-core 0.2.0 → 0.3.1

package/dist/tokens.d.ts

@@ -1,5 +1,6 @@
 import type { Engine } from './engine';
 import type { Obj } from './openapi';
+import { type OpDecryptAlg } from './jwe';
 /** The issuer used when none is given: a reserved `.invalid` host, so no production verifier can ever be configured with it. */
 export declare const DEFAULT_TEST_ISSUER = "https://emulator.atlas.invalid";
 export interface MintSessionInput {
@@ -9,17 +10,29 @@ export interface MintSessionInput {
     claims?: Obj;
     ttlSeconds?: number;
 }
+/** The algorithms an instance key may use (the same list the real provider publishes). */
+export declare const SIGNING_ALGS: readonly ["RS256", "ES256", "ES384", "PS256", "EdDSA"];
+export type SigningAlg = (typeof SIGNING_ALGS)[number];
+export declare const isSigningAlg: (v: unknown) => v is SigningAlg;
+/** How long the previous key stays published after a rotation unless the caller says otherwise. */
+export declare const DEFAULT_KEY_GRACE_S = 86400;
 /**
  * Real signed tokens. Keys are generated in memory on first use and never written anywhere, so a token
  * this engine signs can only verify against this engine's own JWKS. Every token also carries
  * `atlas_emulator: true`, and the issuer defaults to a reserved host.
+ *
+ * The key set follows the real provider: one current key signs, a staged key is published before it signs, a previous
+ * key stays published until its grace ends (the engine clock), an emergency rotation publishes only the new key.
  */
 export declare class TokenService {
     private readonly engine;
-    private issuers;
+    private keys;
     private initializing;
     private issuerUrl;
     private rotations;
+    private enc;
+    /** Keys for the algorithms the OP signs responses with that differ from the instance key (as the real provider's OP key table). */
+    private opKeys;
     constructor(engine: Engine);
     get issuer(): string;
     /** The HTTP server calls this once it knows its origin. Drops keys made for the old issuer. */
@@ -27,15 +40,59 @@ export declare class TokenService {
     reset(): void;
     private make;
     private ensure;
+    /** Start signing with a staged key that is due, and drop previous keys whose grace has ended. */
+    private settle;
+    /** The clock-driven transitions, when a key exists already (an engine that never signed is left alone). */
+    settleIfStarted(): Promise<void>;
+    /** Make sure the first key exists and the clock-driven transitions have run; every entry point calls this first. */
+    ready(): Promise<void>;
     private current;
+    private currentRec;
     jwks(): Promise<{
         keys: Obj[];
     }>;
-    /** Publish a new signing key and sign with it from now on. The old key stays in the JWKS, so tokens already out keep verifying. */
-    rotate(alg?: 'RS256' | 'ES256'): Promise<{
+    /** The published key set a relying party reads: the signing keys, plus the encryption key once a client registered for encrypted request objects. */
+    publishedJwks(): Promise<{
+        keys: Obj[];
+    }>;
+    /** Make the key clients encrypt request objects to (and publish it). Idempotent per algorithm. */
+    ensureEncryptionKey(alg: OpDecryptAlg): Promise<Obj>;
+    /** The plaintext of a JWE addressed to one of this engine's encryption keys (by `kid`, else by `alg`); null when it cannot be decrypted. */
+    decryptEncrypted(jwe: string): Promise<string | null>;
+    /**
+     * Publish a new signing key. Immediately it signs and the old key stays published for `graceSeconds` (default 24 h);
+     * `emergency` publishes only the new key; `staged` publishes it now and starts signing at `activatesAt`.
+     * The caller checks the real provider's one-key-at-a-time rules (`keyState`).
+     */
+    rotate(alg?: SigningAlg, opts?: {
+        graceSeconds?: number;
+        emergency?: boolean;
+        staged?: boolean;
+        activatesAt?: number;
+        trigger?: string;
+    }): Promise<{
         kid: string;
+        alg: SigningAlg;
         previous_kid: string;
+        previous_retires_at: number | null;
+        emergency: boolean;
+        staged?: true;
+        activates_at?: number;
     }>;
+    /** The staged key, unpublished; null when none is staged. */
+    cancelStaged(): Promise<string | null>;
+    /** The key set as the rotation rules see it. */
+    keyState(): Promise<{
+        currentKid: string;
+        alg: SigningAlg;
+        staged: {
+            kid: string;
+            alg: string;
+            activatesAt: number;
+        } | null;
+        previousRetiresAt: number | null;
+    }>;
+    /** The published keys, newest first, with their state. */
     signingKeys(): Promise<Obj[]>;
     mintSession(input: MintSessionInput): Promise<{
         jwt: string;
@@ -47,6 +104,12 @@ export declare class TokenService {
      * `idToken` uses the OIDC ID-token minting path (aud, nonce, auth_time stay as given).
      */
     signClaims(claims: Obj, ttlSeconds?: number): Promise<string>;
+    /**
+     * Sign claims in a chosen algorithm (an authorization response or ID token the client registered an algorithm for).
+     * The instance key signs when it already has that algorithm (or none is asked); otherwise a key of that algorithm is
+     * made once and published beside it.
+     */
+    signClaimsAs(alg: string | null | undefined, claims: Obj, ttlSeconds?: number): Promise<string>;
     /** Verify as a resource server would: against the engine JWKS, issuer and clock. */
     verify(token: string): Promise<{
         ok: true;
@@ -60,7 +123,9 @@ export declare class TokenService {
      * the JWKS, issuer, `exp` and `nbf`. `verify` is the session-only check a resource server would run; this one is
      * for the engine's own routes (machine verify, introspection, token exchange).
      */
-    verifyAny(token: string): Promise<{
+    verifyAny(token: string, opts?: {
+        ignoreExp?: boolean;
+    }): Promise<{
         ok: true;
         claims: Obj;
     } | {

package/dist/tokens.js

@@ -1,22 +1,37 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenService = exports.DEFAULT_TEST_ISSUER = void 0;
+exports.TokenService = exports.DEFAULT_KEY_GRACE_S = exports.isSigningAlg = exports.SIGNING_ALGS = exports.DEFAULT_TEST_ISSUER = void 0;
 /* eslint-disable @typescript-eslint/no-explicit-any */
 const backend_1 = require("@atlasauth/backend");
 const store_1 = require("./store");
+const jws_1 = require("./jws");
+const jwe_1 = require("./jwe");
+const emu4_oauth_audit_1 = require("./handlers/emu4-oauth-audit");
 /** The issuer used when none is given: a reserved `.invalid` host, so no production verifier can ever be configured with it. */
 exports.DEFAULT_TEST_ISSUER = 'https://emulator.atlas.invalid';
+/** The algorithms an instance key may use (the same list the real provider publishes). */
+exports.SIGNING_ALGS = ['RS256', 'ES256', 'ES384', 'PS256', 'EdDSA'];
+const isSigningAlg = (v) => exports.SIGNING_ALGS.includes(v);
+exports.isSigningAlg = isSigningAlg;
+/** How long the previous key stays published after a rotation unless the caller says otherwise. */
+exports.DEFAULT_KEY_GRACE_S = 86_400;
 /**
  * Real signed tokens. Keys are generated in memory on first use and never written anywhere, so a token
  * this engine signs can only verify against this engine's own JWKS. Every token also carries
  * `atlas_emulator: true`, and the issuer defaults to a reserved host.
+ *
+ * The key set follows the real provider: one current key signs, a staged key is published before it signs, a previous
+ * key stays published until its grace ends (the engine clock), an emergency rotation publishes only the new key.
  */
 class TokenService {
     engine;
-    issuers = [];
+    keys = [];
     initializing = null;
     issuerUrl;
     rotations = 0;
+    enc = new Map();
+    /** Keys for the algorithms the OP signs responses with that differ from the instance key (as the real provider's OP key table). */
+    opKeys = new Map();
     constructor(engine) {
         this.engine = engine;
         this.issuerUrl = engine.options.issuer ?? exports.DEFAULT_TEST_ISSUER;
@@ -29,48 +44,148 @@ class TokenService {
         if (issuer === this.issuerUrl)
             return;
         this.issuerUrl = issuer;
-        this.issuers = [];
-        this.initializing = null;
-        this.rotations = 0;
+        this.reset();
     }
     reset() {
-        this.issuers = [];
+        this.keys = [];
         this.initializing = null;
         this.rotations = 0;
+        this.enc.clear();
+        this.opKeys.clear();
     }
     async make(alg) {
         const kid = `emu-${this.engine.instanceId}-${++this.rotations}`;
-        return (0, backend_1.createTestIssuer)({ alg, issuer: this.issuerUrl, kid, now: this.engine.clock.now });
+        // The test issuer is typed for RS256 and ES256; its key generation and signing take every algorithm of the list.
+        return (0, backend_1.createTestIssuer)({ alg: alg, issuer: this.issuerUrl, kid, now: this.engine.clock.now });
     }
     async ensure() {
-        this.initializing ??= this.make('RS256').then((i) => void this.issuers.push(i));
+        this.initializing ??= this.make('RS256').then((i) => void this.keys.push({ issuer: i, alg: 'RS256', activatesAt: null, graceMs: exports.DEFAULT_KEY_GRACE_S * 1000, retiresAt: null, trigger: null }));
         await this.initializing;
     }
+    /** Start signing with a staged key that is due, and drop previous keys whose grace has ended. */
+    settle() {
+        const now = this.engine.clock.now();
+        for (const k of this.keys) {
+            if (k.activatesAt === null || k.activatesAt > now)
+                continue;
+            const prev = this.keys.filter((x) => x !== k && x.activatesAt === null).pop();
+            const at = k.activatesAt;
+            k.activatesAt = null;
+            if (prev && prev.retiresAt === null)
+                prev.retiresAt = at + k.graceMs;
+            const data = { object: 'signing_key', kid: k.issuer.kid, alg: k.alg, previous_kid: prev?.issuer.kid ?? null, previous_retires_at: prev?.retiresAt ?? null };
+            this.engine.webhooks.emit('signing_key.activated', data);
+            (0, emu4_oauth_audit_1.recordAudit)(this.engine, 'signing_key.activated', 'system', 'instance', this.engine.instanceId, data);
+        }
+        this.keys = this.keys.filter((k) => k.retiresAt === null || k.retiresAt > now);
+    }
+    /** The clock-driven transitions, when a key exists already (an engine that never signed is left alone). */
+    async settleIfStarted() {
+        if (this.initializing)
+            await this.ready();
+    }
+    /** Make sure the first key exists and the clock-driven transitions have run; every entry point calls this first. */
+    async ready() {
+        await this.ensure();
+        this.settle();
+    }
     current() {
-        const cur = this.issuers[this.issuers.length - 1];
+        const cur = this.keys.filter((k) => k.activatesAt === null).pop();
         if (!cur)
             throw new Error('token service not initialised');
-        return cur;
+        return cur.issuer;
+    }
+    currentRec() {
+        return this.keys.filter((k) => k.activatesAt === null).pop();
     }
     async jwks() {
-        await this.ensure();
-        return { keys: this.issuers.flatMap((i) => i.jwks.keys) };
+        await this.ready();
+        return { keys: [...this.keys.flatMap((k) => k.issuer.jwks.keys), ...[...this.opKeys.values()].flatMap((i) => i.jwks.keys)] };
     }
-    /** Publish a new signing key and sign with it from now on. The old key stays in the JWKS, so tokens already out keep verifying. */
-    async rotate(alg = 'RS256') {
-        await this.ensure();
-        const previous = this.current().kid;
-        const next = await this.make(alg);
-        this.issuers.push(next);
-        return { kid: next.kid, previous_kid: previous };
+    /** The published key set a relying party reads: the signing keys, plus the encryption key once a client registered for encrypted request objects. */
+    async publishedJwks() {
+        const sig = await this.jwks();
+        return { keys: [...sig.keys, ...[...this.enc.values()].map((k) => k.publicJwk)] };
+    }
+    /** Make the key clients encrypt request objects to (and publish it). Idempotent per algorithm. */
+    async ensureEncryptionKey(alg) {
+        let k = this.enc.get(alg);
+        if (!k)
+            this.enc.set(alg, (k = await (0, jwe_1.generateEncKey)(alg, `emu-enc-${this.engine.instanceId}-${alg.toLowerCase()}`)));
+        return k.publicJwk;
+    }
+    /** The plaintext of a JWE addressed to one of this engine's encryption keys (by `kid`, else by `alg`); null when it cannot be decrypted. */
+    async decryptEncrypted(jwe) {
+        try {
+            const header = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(jwe.split('.')[0].replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0))));
+            const key = [...this.enc.values()].find((k) => (header.kid ? k.kid === header.kid : k.alg === header.alg));
+            return key ? await (0, jwe_1.decryptJwe)(jwe, key) : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Publish a new signing key. Immediately it signs and the old key stays published for `graceSeconds` (default 24 h);
+     * `emergency` publishes only the new key; `staged` publishes it now and starts signing at `activatesAt`.
+     * The caller checks the real provider's one-key-at-a-time rules (`keyState`).
+     */
+    async rotate(alg, opts = {}) {
+        await this.ready();
+        const cur = this.currentRec();
+        const now = this.engine.clock.now();
+        const next = alg ?? cur.alg;
+        const issuer = await this.make(next);
+        const rec = { issuer, alg: next, activatesAt: null, graceMs: (opts.graceSeconds ?? exports.DEFAULT_KEY_GRACE_S) * 1000, retiresAt: null, trigger: opts.trigger ?? null };
+        if (opts.staged && !opts.emergency) {
+            rec.activatesAt = opts.activatesAt ?? now + 14 * 86_400_000;
+            rec.graceMs = (opts.graceSeconds ?? exports.DEFAULT_KEY_GRACE_S) * 1000;
+            this.keys.push(rec);
+            return { kid: issuer.kid, alg: next, previous_kid: cur.issuer.kid, previous_retires_at: rec.activatesAt + rec.graceMs, emergency: false, staged: true, activates_at: rec.activatesAt };
+        }
+        if (opts.emergency)
+            this.keys = [];
+        else
+            cur.retiresAt = now + rec.graceMs;
+        this.keys.push(rec);
+        this.settle();
+        return { kid: issuer.kid, alg: next, previous_kid: cur.issuer.kid, previous_retires_at: opts.emergency ? null : cur.retiresAt, emergency: opts.emergency === true };
+    }
+    /** The staged key, unpublished; null when none is staged. */
+    async cancelStaged() {
+        await this.ready();
+        const k = this.keys.find((x) => x.activatesAt !== null);
+        if (!k)
+            return null;
+        this.keys = this.keys.filter((x) => x !== k);
+        return k.issuer.kid;
     }
+    /** The key set as the rotation rules see it. */
+    async keyState() {
+        await this.ready();
+        const cur = this.currentRec();
+        const staged = this.keys.find((k) => k.activatesAt !== null);
+        const prev = this.keys.filter((k) => k.retiresAt !== null).map((k) => k.retiresAt);
+        return { currentKid: cur.issuer.kid, alg: cur.alg, staged: staged ? { kid: staged.issuer.kid, alg: staged.alg, activatesAt: staged.activatesAt } : null, previousRetiresAt: prev.length ? Math.max(...prev) : null };
+    }
+    /** The published keys, newest first, with their state. */
     async signingKeys() {
-        await this.ensure();
-        const cur = this.current().kid;
-        return [...this.issuers].reverse().map((i) => ({ object: 'signing_key', kid: i.kid, alg: i.jwks.keys[0].alg, current: i.kid === cur }));
+        await this.ready();
+        const cur = this.currentRec();
+        return [...this.keys].reverse().map((k) => ({
+            object: 'signing_key',
+            kid: k.issuer.kid,
+            alg: k.alg,
+            status: k === cur ? 'current' : k.activatesAt !== null ? 'next' : 'previous',
+            role: 'main',
+            retires_at: k.retiresAt,
+            ...(k.activatesAt !== null ? { activates_at: k.activatesAt } : {}),
+            provider: 'local',
+            current: k === cur,
+        }));
     }
     async mintSession(input) {
-        await this.ensure();
+        await this.ready();
         const ttl = input.ttlSeconds ?? 60;
         const nowS = Math.floor(this.engine.clock.now() / 1000);
         const claims = {
@@ -89,14 +204,29 @@ class TokenService {
      * `idToken` uses the OIDC ID-token minting path (aud, nonce, auth_time stay as given).
      */
     async signClaims(claims, ttlSeconds = 60) {
-        await this.ensure();
+        await this.ready();
         const nowS = Math.floor(this.engine.clock.now() / 1000);
         const body = { iss: this.issuerUrl, iat: nowS, exp: nowS + ttlSeconds, atlas_emulator: true, sid: undefined, azp: undefined, sv: undefined, mfa: undefined, ...claims };
         return this.current().mintSession(body);
     }
+    /**
+     * Sign claims in a chosen algorithm (an authorization response or ID token the client registered an algorithm for).
+     * The instance key signs when it already has that algorithm (or none is asked); otherwise a key of that algorithm is
+     * made once and published beside it.
+     */
+    async signClaimsAs(alg, claims, ttlSeconds = 60) {
+        await this.ready();
+        if (!alg || !(0, exports.isSigningAlg)(alg) || alg === this.currentRec().alg)
+            return this.signClaims(claims, ttlSeconds);
+        let issuer = this.opKeys.get(alg);
+        if (!issuer)
+            this.opKeys.set(alg, (issuer = await this.make(alg)));
+        const nowS = Math.floor(this.engine.clock.now() / 1000);
+        return issuer.mintSession({ iss: this.issuerUrl, iat: nowS, exp: nowS + ttlSeconds, atlas_emulator: true, sid: undefined, azp: undefined, sv: undefined, mfa: undefined, ...claims });
+    }
     /** Verify as a resource server would: against the engine JWKS, issuer and clock. */
     async verify(token) {
-        await this.ensure();
+        await this.ready();
         const backend = new backend_1.AtlasBackend({ jwks: await this.jwks(), issuer: this.issuerUrl, now: this.engine.clock.now });
         const r = await backend.verify(token);
         return r.ok ? { ok: true, claims: r.claims } : { ok: false, reason: r.reason };
@@ -106,28 +236,24 @@ class TokenService {
      * the JWKS, issuer, `exp` and `nbf`. `verify` is the session-only check a resource server would run; this one is
      * for the engine's own routes (machine verify, introspection, token exchange).
      */
-    async verifyAny(token) {
+    async verifyAny(token, opts = {}) {
         try {
-            const [h, p, sig] = token.split('.');
-            if (!h || !p || !sig)
+            const jwt = (0, jws_1.decodeJwt)(token);
+            if (!jwt)
                 return { ok: false, reason: 'malformed' };
-            const dec = (x) => Uint8Array.from(atob(x.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (x.length % 4)) % 4)), (c) => c.charCodeAt(0));
-            const header = JSON.parse(new TextDecoder().decode(dec(h)));
-            const jwk = (await this.jwks()).keys.find((k) => k.kid === header.kid);
+            const jwk = (await this.jwks()).keys.find((k) => k.kid === jwt.header.kid);
             if (!jwk)
                 return { ok: false, reason: 'unknown_key' };
-            const rsa = header.alg === 'RS256';
-            if (!rsa && header.alg !== 'ES256')
+            // The key fixes the algorithm: a token naming another one never verifies (no algorithm confusion).
+            if (!(0, exports.isSigningAlg)(jwt.header.alg) || jwk.alg !== jwt.header.alg)
                 return { ok: false, reason: 'unsupported_alg' };
-            const key = await crypto.subtle.importKey('jwk', jwk, rsa ? { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' } : { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
-            const ok = await crypto.subtle.verify(rsa ? { name: 'RSASSA-PKCS1-v1_5' } : { name: 'ECDSA', hash: 'SHA-256' }, key, dec(sig), new TextEncoder().encode(`${h}.${p}`));
-            if (!ok)
+            if (!(await (0, jws_1.verifyJws)(jwt, jwk)))
                 return { ok: false, reason: 'bad_signature' };
-            const claims = JSON.parse(new TextDecoder().decode(dec(p)));
+            const claims = jwt.payload;
             const nowS = this.engine.clock.now() / 1000;
             if (claims.iss !== this.issuerUrl)
                 return { ok: false, reason: 'wrong_issuer' };
-            if (typeof claims.exp === 'number' && claims.exp <= nowS)
+            if (!opts.ignoreExp && typeof claims.exp === 'number' && claims.exp <= nowS)
                 return { ok: false, reason: 'expired' };
             if (typeof claims.nbf === 'number' && claims.nbf > nowS + 60)
                 return { ok: false, reason: 'not_yet_valid' };

package/dist/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":";;;AAAA,uDAAuD;AACvD,gDAAqF;AAGrF,mCAAsC;AAEtC,gIAAgI;AACnH,QAAA,mBAAmB,GAAG,gCAAgC,CAAC;AAUpE;;;;GAIG;AACH,MAAa,YAAY;IAMM;IALrB,OAAO,GAAiB,EAAE,CAAC;IAC3B,YAAY,GAAyB,IAAI,CAAC;IAC1C,SAAS,CAAS;IAClB,SAAS,GAAG,CAAC,CAAC;IAEtB,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,2BAAmB,CAAC;IAChE,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,+FAA+F;IAC/F,SAAS,CAAC,MAAc;QACtB,IAAI,MAAM,KAAK,IAAI,CAAC,SAAS;YAAE,OAAO;QACtC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAsB;QACvC,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAChE,OAAO,IAAA,0BAAgB,EAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAEO,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC3D,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAa,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,mIAAmI;IACnI,KAAK,CAAC,MAAM,CAAC,MAAyB,OAAO;QAC3C,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAS,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;IACnJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxD,MAAM,MAAM,GAAQ;YAClB,GAAG,EAAE,KAAK,CAAC,MAAM;YACjB,GAAG,EAAE,KAAK,CAAC,SAAS;YACpB,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,IAAI,GAAG,GAAG;YACf,cAAc,EAAE,IAAI;YACpB,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;SACxB,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,MAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC1F,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,MAAW,EAAE,UAAU,GAAG,EAAE;QAC3C,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxD,MAAM,IAAI,GAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC;QAC7K,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,IAAW,CAAC,CAAC;IACjD,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAS,CAAC,CAAC;QACzH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACxF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAChE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACrK,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;YACvE,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACtD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC;YACnC,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YACpF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAiB,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtL,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAiB,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAiB,CAAC,CAAC;YACtM,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAQ,CAAC;YACnE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAChF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAClG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAC5G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,OAAO,GAAG,MAAM,IAAI,IAAA,mBAAW,EAAC,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;CACF;AApID,oCAoIC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":";;;AAAA,uDAAuD;AACvD,gDAAqF;AAGrF,mCAAsC;AACtC,+BAA6C;AAC7C,+BAAqF;AACrF,kEAA0D;AAE1D,gIAAgI;AACnH,QAAA,mBAAmB,GAAG,gCAAgC,CAAC;AAUpE,0FAA0F;AAC7E,QAAA,YAAY,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAE5E,MAAM,YAAY,GAAG,CAAC,CAAU,EAAmB,EAAE,CAAE,oBAAkC,CAAC,QAAQ,CAAC,CAAW,CAAC,CAAC;AAA1G,QAAA,YAAY,gBAA8F;AACvH,mGAAmG;AACtF,QAAA,mBAAmB,GAAG,MAAM,CAAC;AAe1C;;;;;;;GAOG;AACH,MAAa,YAAY;IASM;IARrB,IAAI,GAAa,EAAE,CAAC;IACpB,YAAY,GAAyB,IAAI,CAAC;IAC1C,SAAS,CAAS;IAClB,SAAS,GAAG,CAAC,CAAC;IACd,GAAG,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,mIAAmI;IAC3H,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE/C,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,2BAAmB,CAAC;IAChE,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,+FAA+F;IAC/F,SAAS,CAAC,MAAc;QACtB,IAAI,MAAM,KAAK,IAAI,CAAC,SAAS;YAAE,OAAO;QACtC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAe;QAChC,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAChE,iHAAiH;QACjH,OAAO,IAAA,0BAAgB,EAAC,EAAE,GAAG,EAAE,GAAc,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5G,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,2BAAmB,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/L,MAAM,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAED,iGAAiG;IACzF,MAAM;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,GAAG,GAAG;gBAAE,SAAS;YAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9E,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC;YACzB,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;YACrB,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;gBAAE,IAAI,CAAC,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;YACrE,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;YAC5J,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;YACzD,IAAA,8BAAW,EAAC,IAAI,CAAC,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,2GAA2G;IAC3G,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IAED,oHAAoH;IACpH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;IAEO,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QAClE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC3D,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAEO,UAAU;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,GAAG,EAAG,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAa,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAa,CAAC,CAAC,EAAE,CAAC;IACjJ,CAAC;IAED,qJAAqJ;IACrJ,KAAK,CAAC,aAAa;QACjB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAgB,CAAC,CAAC,EAAE,CAAC;IAC3F,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,mBAAmB,CAAC,GAAiB;QACzC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,IAAA,oBAAc,EAAC,GAAG,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACrH,OAAO,CAAC,CAAC,SAAgB,CAAC;IAC5B,CAAC;IAED,4IAA4I;IAC5I,KAAK,CAAC,gBAAgB,CAAC,GAAW;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7J,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3G,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,IAAA,gBAAU,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,OAAiH,EAAE;QAChJ,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAW,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,YAAY,IAAI,2BAAmB,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACzK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACnC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC;YAC5D,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,2BAAmB,CAAC,GAAG,IAAI,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;QACzL,CAAC;QACD,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;;YAC9B,GAAG,CAAC,SAAS,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;IACtK,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACtB,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAmB,CAAC,CAAC;QAC7F,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAY,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxN,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,aAAa;YACrB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG;YACjB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,MAAM,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU;YAC5E,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,CAAC,CAAC,SAAS;YACvB,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,CAAC,KAAK,GAAG;SACnB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxD,MAAM,MAAM,GAAQ;YAClB,GAAG,EAAE,KAAK,CAAC,MAAM;YACjB,GAAG,EAAE,KAAK,CAAC,SAAS;YACpB,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,IAAI,GAAG,GAAG;YACf,cAAc,EAAE,IAAI;YACpB,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;SACxB,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,MAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC1F,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,MAAW,EAAE,UAAU,GAAG,EAAE;QAC3C,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxD,MAAM,IAAI,GAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC;QAC7K,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,IAAW,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,GAA8B,EAAE,MAAW,EAAE,UAAU,GAAG,EAAE;QAC7E,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,IAAI,CAAC,IAAA,oBAAY,EAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC5G,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,EAAS,CAAC,CAAC;IAC/L,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,IAAI,sBAAY,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAS,CAAC,CAAC;QACzH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACxF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAgC,EAAE;QAC/D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAA,eAAS,EAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YACpD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3E,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACtD,mGAAmG;YACnG,IAAI,CAAC,IAAA,oBAAY,EAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YACjH,IAAI,CAAC,CAAC,MAAM,IAAA,eAAS,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAc,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAChF,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrH,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAC5G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,OAAO,GAAG,MAAM,IAAI,IAAA,mBAAW,EAAC,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;CACF;AAtPD,oCAsPC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/emulator-core",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "An in-memory Atlas engine driven by the OpenAPI document: stateful users, organizations, roles, API keys, machines and grants, real signed tokens, signed webhooks, the change feed and a message sink. Used by the emulator, the msw handlers and in-process tests.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -27,7 +27,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/backend": "0.52.0"
+    "@atlasauth/backend": "0.54.0"
   },
   "peerDependencies": {
     "msw": "^2"