@atlasauth/js 0.16.0 → 0.18.0

package/dist/compat.d.ts

@@ -0,0 +1,149 @@
+export interface Auth0CompatClientOptions {
+    /** The instance publishable key. `clientId` is accepted as an alias. */
+    publishableKey?: string;
+    /** The instance's Frontend API origin (`https://auth.example.com`). `domain` is accepted as an alias. */
+    frontendApi?: string;
+    /** auth0-spa-js names, accepted so existing option objects keep working. */
+    clientId?: string;
+    domain?: string;
+    authorizationParams?: {
+        redirect_uri?: string;
+        [key: string]: unknown;
+    };
+    /** Where sign-in happens (default: the instance's hosted page, `<frontendApi>/hosted/sign-in`). */
+    signInUrl?: string;
+    /** Where sign-up happens (default `<frontendApi>/hosted/sign-up`), used for `screen_hint: 'signup'`. */
+    signUpUrl?: string;
+    fetchImpl?: typeof fetch;
+    [option: string]: unknown;
+}
+/** The OIDC-profile user auth0-spa-js's `getUser()` returns. */
+export interface Auth0CompatUser {
+    sub: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    nickname?: string;
+    picture?: string;
+    email?: string;
+    email_verified?: boolean;
+    [claim: string]: unknown;
+}
+export interface Auth0CompatRedirectOptions {
+    appState?: unknown;
+    authorizationParams?: {
+        /** A social provider to go straight to (`github`, `google-oauth2`, …). */
+        connection?: string;
+        redirect_uri?: string;
+        /** `signup` opens the sign-up page. */
+        screen_hint?: string;
+        [key: string]: unknown;
+    };
+    /** Called with the URL instead of navigating (auth0-spa-js `openUrl`). */
+    openUrl?: (url: string) => void | Promise<void>;
+}
+export interface Auth0CompatLogoutOptions {
+    logoutParams?: {
+        returnTo?: string;
+        [key: string]: unknown;
+    };
+    /** `false` signs out without navigating; a function receives the URL instead. */
+    openUrl?: false | ((url: string) => void | Promise<void>);
+}
+export interface Auth0CompatTokenOptions {
+    /** `'off'` always mints a fresh token. */
+    cacheMode?: 'on' | 'off' | 'cache-only';
+    /** Resolve `{ access_token, id_token, expires_in }` instead of the token string. */
+    detailedResponse?: boolean;
+    /** An Atlas JWT template name, for a named-template token. */
+    template?: string;
+    authorizationParams?: Record<string, unknown>;
+}
+/** auth0-spa-js-style errors: `error` carries the OAuth-ish code apps branch on. */
+export declare class Auth0CompatError extends Error {
+    readonly error: 'login_required' | 'popup_closed' | 'popup_blocked' | 'timeout' | 'missing_transaction' | 'start_failed';
+    constructor(error: 'login_required' | 'popup_closed' | 'popup_blocked' | 'timeout' | 'missing_transaction' | 'start_failed', message: string);
+}
+interface AtlasClientBody {
+    session: {
+        id: string;
+    } | null;
+    user: {
+        id: string;
+        first_name: string | null;
+        last_name: string | null;
+        username: string | null;
+        image_url: string | null;
+        email_addresses?: Array<{
+            email_address: string;
+            verified: boolean;
+            primary: boolean;
+        }>;
+    } | null;
+    jwt?: string;
+}
+/** Decode a JWT's payload (no verification: it came from our own FAPI). */
+export declare function decodeJwtPayload(jwt: string): Record<string, unknown> | null;
+/** Project the Frontend API user onto the OIDC profile shape. */
+export declare function auth0UserFromClient(user: AtlasClientBody['user']): Auth0CompatUser | undefined;
+/** The auth0-spa-js `Auth0Client`, on Atlas. */
+export declare class Auth0CompatClient {
+    readonly publishableKey: string;
+    readonly frontendApi: string;
+    private readonly fapi;
+    private readonly raw;
+    private readonly options;
+    private state;
+    private token;
+    constructor(options: Auth0CompatClientOptions);
+    private signInUrl;
+    /** Read the Frontend API client state (session, user, token). */
+    private load;
+    private keepToken;
+    /** `checkSession()`: refresh the local view of the session; never throws. */
+    checkSession(): Promise<void>;
+    isAuthenticated(): Promise<boolean>;
+    getUser<TUser extends Auth0CompatUser = Auth0CompatUser>(): Promise<TUser | undefined>;
+    getIdTokenClaims(): Promise<(Record<string, unknown> & {
+        __raw: string;
+    }) | undefined>;
+    /** The Atlas session token (or a named-template token), refreshed when close to expiry. */
+    getTokenSilently(options: Auth0CompatTokenOptions & {
+        detailedResponse: true;
+    }): Promise<{
+        access_token: string;
+        id_token: string;
+        expires_in: number;
+    }>;
+    getTokenSilently(options?: Auth0CompatTokenOptions): Promise<string>;
+    /** Sign in in a popup when needed, then return a token. */
+    getTokenWithPopup(options?: Auth0CompatTokenOptions & Auth0CompatRedirectOptions): Promise<string | undefined>;
+    /**
+     * Navigate to sign-in. With `authorizationParams.connection` the user goes
+     * straight to that social provider; otherwise to the instance's hosted page.
+     * `appState` comes back from {@link handleRedirectCallback}.
+     */
+    loginWithRedirect(options?: Auth0CompatRedirectOptions): Promise<void>;
+    /**
+     * Finish a redirect sign-in on the page you came back to: exchanges the
+     * one-time ticket in the URL (if any), removes it from the address bar, and
+     * returns the `appState` passed to `loginWithRedirect`.
+     */
+    handleRedirectCallback(url?: string): Promise<{
+        appState?: unknown;
+    }>;
+    /**
+     * Sign in in a popup: straight at a social provider with
+     * `authorizationParams.connection`, otherwise the hosted sign-in page (this
+     * waits until a session appears or the popup is closed, up to 5 minutes).
+     */
+    loginWithPopup(options?: Auth0CompatRedirectOptions & {
+        timeoutInSeconds?: number;
+    }): Promise<void>;
+    private isSignedInNow;
+    /** Sign out (revokes the Atlas session), then go to `logoutParams.returnTo` (default: this site). */
+    logout(options?: Auth0CompatLogoutOptions): Promise<void>;
+}
+/** `createAuth0Client(options)`: a client that has already checked the session. */
+export declare function createAuth0CompatClient(options: Auth0CompatClientOptions): Promise<Auth0CompatClient>;
+export {};

package/dist/compat.js

@@ -0,0 +1,363 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Auth0CompatClient = exports.Auth0CompatError = void 0;
+exports.decodeJwtPayload = decodeJwtPayload;
+exports.auth0UserFromClient = auth0UserFromClient;
+exports.createAuth0CompatClient = createAuth0CompatClient;
+/**
+ * `@atlasauth/js/compat` — a drop-in for `@auth0/auth0-spa-js` on Atlas, for
+ * framework-free browser apps (what `atlas migrate code --from auth0` rewrites
+ * `createAuth0Client` / `new Auth0Client` onto).
+ *
+ * The client keeps auth0-spa-js's method names and result shapes —
+ * `loginWithRedirect`, `handleRedirectCallback`, `isAuthenticated`, `getUser`,
+ * `getTokenSilently`, `logout`, … — on top of the Atlas Frontend API: the session
+ * lives in Atlas's own cookies, sign-in happens on your instance's hosted pages
+ * (or straight at a social provider when `authorizationParams.connection` is
+ * given), and tokens are Atlas session tokens. Move call sites to the native
+ * `@atlasauth/js` APIs at your own pace.
+ */
+const fapi_1 = require("./fapi");
+const redirect_1 = require("./redirect");
+const sign_out_1 = require("./sign-out");
+const dev_browser_1 = require("./dev-browser");
+/** auth0-spa-js-style errors: `error` carries the OAuth-ish code apps branch on. */
+class Auth0CompatError extends Error {
+    error;
+    constructor(error, message) {
+        super(message);
+        this.error = error;
+        this.name = 'Auth0CompatError';
+    }
+}
+exports.Auth0CompatError = Auth0CompatError;
+/** Auth0 connection names → Atlas provider keys (others pass through). */
+const CONNECTIONS = {
+    'google-oauth2': 'google',
+    windowslive: 'microsoft',
+    'microsoft-account': 'microsoft',
+    github: 'github',
+    apple: 'apple',
+    facebook: 'facebook',
+    linkedin: 'linkedin',
+    twitter: 'twitter',
+    discord: 'discord',
+    gitlab: 'gitlab',
+    bitbucket: 'bitbucket',
+};
+const APP_STATE_KEY = 'atlas:compat:appState';
+/** Decode a JWT's payload (no verification: it came from our own FAPI). */
+function decodeJwtPayload(jwt) {
+    const part = jwt.split('.')[1];
+    if (!part)
+        return null;
+    try {
+        const b64 = part.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(part.length / 4) * 4, '=');
+        const json = decodeURIComponent(Array.from(atob(b64), (c) => `%${c.charCodeAt(0).toString(16).padStart(2, '0')}`).join(''));
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+/** Project the Frontend API user onto the OIDC profile shape. */
+function auth0UserFromClient(user) {
+    if (!user)
+        return undefined;
+    const emails = user.email_addresses ?? [];
+    const email = emails.find((e) => e.primary) ?? emails.find((e) => e.verified) ?? emails[0];
+    const out = { sub: user.id };
+    const name = [user.first_name, user.last_name].filter(Boolean).join(' ') || user.username;
+    if (name)
+        out.name = name;
+    if (user.first_name)
+        out.given_name = user.first_name;
+    if (user.last_name)
+        out.family_name = user.last_name;
+    if (user.username)
+        out.nickname = user.username;
+    if (user.image_url)
+        out.picture = user.image_url;
+    if (email) {
+        out.email = email.email_address;
+        out.email_verified = email.verified;
+    }
+    return out;
+}
+function frontendApiFrom(options) {
+    const raw = options.frontendApi ?? options.domain ?? '';
+    if (!raw)
+        return '';
+    const withScheme = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
+    return withScheme.replace(/\/+$/, '');
+}
+function withRedirect(url, redirectUrl) {
+    if (!redirectUrl)
+        return url;
+    return `${url}${url.includes('?') ? '&' : '?'}redirect_url=${encodeURIComponent(redirectUrl)}`;
+}
+function currentHref() {
+    return typeof window === 'undefined' ? undefined : window.location.href;
+}
+function storage() {
+    try {
+        return typeof window === 'undefined' ? null : window.sessionStorage;
+    }
+    catch {
+        return null;
+    }
+}
+/** The auth0-spa-js `Auth0Client`, on Atlas. */
+class Auth0CompatClient {
+    publishableKey;
+    frontendApi;
+    fapi;
+    raw;
+    options;
+    state = null;
+    token = null;
+    constructor(options) {
+        const publishableKey = options.publishableKey ?? options.clientId;
+        if (!publishableKey)
+            throw new Error('Auth0CompatClient: publishableKey is required.');
+        this.publishableKey = publishableKey;
+        this.frontendApi = frontendApiFrom(options);
+        this.options = options;
+        const fetchImpl = options.fetchImpl ?? ((...args) => fetch(...args));
+        this.fapi = new fapi_1.FapiClient({ publishableKey, baseUrl: this.frontendApi, fetchImpl });
+        const doFetch = (0, dev_browser_1.withDevBrowser)(publishableKey, fetchImpl);
+        this.raw = (path, init = {}) => doFetch(`${this.frontendApi}${path}`, {
+            ...init,
+            credentials: 'include',
+            headers: {
+                'x-publishable-key': publishableKey,
+                ...(init.body ? { 'content-type': 'application/json' } : {}),
+                ...init.headers,
+            },
+        });
+    }
+    signInUrl(signUp = false) {
+        if (signUp)
+            return this.options.signUpUrl ?? `${this.frontendApi}/hosted/sign-up`;
+        return this.options.signInUrl ?? `${this.frontendApi}/hosted/sign-in`;
+    }
+    /** Read the Frontend API client state (session, user, token). */
+    async load(force = false) {
+        if (!force && this.state && Date.now() - this.state.at < 2_000)
+            return this.state.body;
+        const response = await this.raw('/v1/client');
+        if (!response.ok)
+            throw new Error(`Atlas: could not read the session (HTTP ${response.status}).`);
+        const body = (await response.json());
+        this.state = { body, at: Date.now() };
+        if (body.session && body.jwt)
+            this.keepToken(body.jwt, body.session.id);
+        if (!body.session)
+            this.token = null;
+        return body;
+    }
+    keepToken(jwt, sessionId) {
+        const exp = Number(decodeJwtPayload(jwt)?.exp ?? 0) * 1000;
+        this.token = { jwt, exp, sessionId };
+    }
+    /** `checkSession()`: refresh the local view of the session; never throws. */
+    async checkSession() {
+        try {
+            await this.load(true);
+        }
+        catch {
+            // auth0-spa-js swallows login_required here too.
+        }
+    }
+    async isAuthenticated() {
+        const body = await this.load();
+        return Boolean(body.session && body.user);
+    }
+    async getUser() {
+        const body = await this.load();
+        return body.session ? auth0UserFromClient(body.user) : undefined;
+    }
+    async getIdTokenClaims() {
+        const jwt = await this.getTokenSilently().catch(() => null);
+        if (typeof jwt !== 'string')
+            return undefined;
+        const claims = decodeJwtPayload(jwt);
+        return claims ? { ...claims, __raw: jwt } : undefined;
+    }
+    async getTokenSilently(options = {}) {
+        const body = await this.load(options.cacheMode === 'off');
+        if (!body.session)
+            throw new Auth0CompatError('login_required', 'Login required');
+        let jwt = null;
+        let expiresIn = 0;
+        if (options.template) {
+            const t = await (0, fapi_1.getTemplateToken)(this.fapi, body.session.id, options.template);
+            if (!t)
+                throw new Auth0CompatError('login_required', `No token for template ${options.template}`);
+            jwt = t.jwt;
+            expiresIn = t.expiresIn;
+        }
+        else {
+            const usable = this.token && this.token.sessionId === body.session.id && this.token.exp - Date.now() > 10_000;
+            if (!usable || options.cacheMode === 'off') {
+                if (options.cacheMode === 'cache-only')
+                    throw new Auth0CompatError('login_required', 'No cached token');
+                const response = await this.raw(`/v1/client/sessions/${encodeURIComponent(body.session.id)}/tokens`, { method: 'POST' });
+                if (!response.ok)
+                    throw new Auth0CompatError('login_required', 'Login required');
+                const minted = (await response.json());
+                this.keepToken(minted.jwt, minted.session_id);
+            }
+            jwt = this.token.jwt;
+            expiresIn = Math.max(0, Math.floor((this.token.exp - Date.now()) / 1000));
+        }
+        return options.detailedResponse ? { access_token: jwt, id_token: jwt, expires_in: expiresIn } : jwt;
+    }
+    /** Sign in in a popup when needed, then return a token. */
+    async getTokenWithPopup(options = {}) {
+        if (!(await this.isAuthenticated()))
+            await this.loginWithPopup(options);
+        return this.getTokenSilently({ ...options, detailedResponse: false });
+    }
+    /**
+     * Navigate to sign-in. With `authorizationParams.connection` the user goes
+     * straight to that social provider; otherwise to the instance's hosted page.
+     * `appState` comes back from {@link handleRedirectCallback}.
+     */
+    async loginWithRedirect(options = {}) {
+        const params = options.authorizationParams ?? {};
+        const returnTo = params.redirect_uri ?? this.options.authorizationParams?.redirect_uri ?? currentHref();
+        if (options.appState !== undefined)
+            storage()?.setItem(APP_STATE_KEY, JSON.stringify(options.appState));
+        let url;
+        if (params.connection) {
+            const started = await (0, redirect_1.startOauthRedirect)(this.fapi, {
+                provider: CONNECTIONS[params.connection] ?? params.connection,
+                redirectUrl: returnTo ?? '/',
+            });
+            if (!started)
+                throw new Auth0CompatError('start_failed', `Could not start sign-in with ${params.connection}.`);
+            url = started.authorizationUrl;
+        }
+        else {
+            url = withRedirect(this.signInUrl(params.screen_hint === 'signup'), returnTo);
+        }
+        if (options.openUrl)
+            await options.openUrl(url);
+        else if (typeof window !== 'undefined')
+            window.location.assign(url);
+    }
+    /**
+     * Finish a redirect sign-in on the page you came back to: exchanges the
+     * one-time ticket in the URL (if any), removes it from the address bar, and
+     * returns the `appState` passed to `loginWithRedirect`.
+     */
+    async handleRedirectCallback(url) {
+        const href = url ?? currentHref() ?? '';
+        const search = href.includes('?') ? href.slice(href.indexOf('?')) : '';
+        const result = (0, redirect_1.readRedirectResult)(search.split('#')[0] ?? '');
+        if (result?.ticket) {
+            const response = await this.raw('/v1/client/tickets/exchange', {
+                method: 'POST',
+                body: JSON.stringify({ attempt_id: result.attemptId, ticket: result.ticket }),
+            });
+            if (!response.ok)
+                throw new Auth0CompatError('login_required', 'The sign-in could not be completed.');
+        }
+        else if (result?.status && result.status !== 'complete') {
+            throw new Auth0CompatError('login_required', `Sign-in needs another step (${result.status}).`);
+        }
+        if (!url && typeof window !== 'undefined' && result) {
+            window.history.replaceState({}, document.title, (0, redirect_1.stripRedirectParams)(window.location.href));
+        }
+        await this.load(true);
+        const raw = storage()?.getItem(APP_STATE_KEY);
+        storage()?.removeItem(APP_STATE_KEY);
+        let appState;
+        try {
+            appState = raw ? JSON.parse(raw) : undefined;
+        }
+        catch {
+            appState = undefined;
+        }
+        return appState === undefined ? {} : { appState };
+    }
+    /**
+     * Sign in in a popup: straight at a social provider with
+     * `authorizationParams.connection`, otherwise the hosted sign-in page (this
+     * waits until a session appears or the popup is closed, up to 5 minutes).
+     */
+    async loginWithPopup(options = {}) {
+        const params = options.authorizationParams ?? {};
+        if (params.connection) {
+            const outcome = await (0, redirect_1.startOauthPopup)(this.fapi, {
+                provider: CONNECTIONS[params.connection] ?? params.connection,
+                redirectUrl: currentHref() ?? '/',
+            });
+            if (outcome.blocked)
+                throw new Auth0CompatError('popup_blocked', 'The sign-in popup was blocked.');
+            if (outcome.ticket && outcome.attemptId) {
+                await this.raw('/v1/client/tickets/exchange', {
+                    method: 'POST',
+                    body: JSON.stringify({ attempt_id: outcome.attemptId, ticket: outcome.ticket }),
+                });
+            }
+            else if (!outcome.sessionDetected) {
+                throw new Auth0CompatError(outcome.error === 'popup_closed' ? 'popup_closed' : 'start_failed', outcome.error ?? 'Sign-in did not complete.');
+            }
+            await this.load(true);
+            return;
+        }
+        const popup = typeof window !== 'undefined' ? window.open(this.signInUrl(params.screen_hint === 'signup'), 'atlas-sign-in', 'width=500,height=650') : null;
+        if (!popup)
+            throw new Auth0CompatError('popup_blocked', 'The sign-in popup was blocked.');
+        const deadline = Date.now() + (options.timeoutInSeconds ?? 300) * 1000;
+        for (;;) {
+            await new Promise((r) => setTimeout(r, 1_000));
+            if (await this.isSignedInNow()) {
+                try {
+                    popup.close();
+                }
+                catch {
+                    /* cross-origin close */
+                }
+                return;
+            }
+            if (popup.closed)
+                throw new Auth0CompatError('popup_closed', 'The sign-in popup was closed.');
+            if (Date.now() > deadline)
+                throw new Auth0CompatError('timeout', 'Timed out waiting for sign-in.');
+        }
+    }
+    async isSignedInNow() {
+        try {
+            return Boolean((await this.load(true)).session);
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Sign out (revokes the Atlas session), then go to `logoutParams.returnTo` (default: this site). */
+    async logout(options = {}) {
+        const body = this.state?.body ?? (await this.load().catch(() => null));
+        if (body?.session)
+            await (0, sign_out_1.revokeSession)(this.raw, body.session.id);
+        this.state = null;
+        this.token = null;
+        const url = options.logoutParams?.returnTo ?? (typeof window !== 'undefined' ? window.location.origin : '/');
+        if (options.openUrl === false)
+            return;
+        if (typeof options.openUrl === 'function')
+            await options.openUrl(url);
+        else if (typeof window !== 'undefined')
+            window.location.assign(url);
+    }
+}
+exports.Auth0CompatClient = Auth0CompatClient;
+/** `createAuth0Client(options)`: a client that has already checked the session. */
+async function createAuth0CompatClient(options) {
+    const client = new Auth0CompatClient(options);
+    await client.checkSession();
+    return client;
+}
+//# sourceMappingURL=compat.js.map

package/dist/compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat.js","sourceRoot":"","sources":["../src/compat.ts"],"names":[],"mappings":";;;AAwHA,4CAYC;AAGD,kDAgBC;AAoQD,0DAIC;AA/ZD;;;;;;;;;;;;GAYG;AACH,iCAAsD;AACtD,yCAA0G;AAC1G,yCAA2C;AAC3C,+CAA+C;AA8D/C,oFAAoF;AACpF,MAAa,gBAAiB,SAAQ,KAAK;IAE9B;IADX,YACW,KAA+G,EACxH,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,UAAK,GAAL,KAAK,CAA0G;QAIxH,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AARD,4CAQC;AAeD,0EAA0E;AAC1E,MAAM,WAAW,GAA2B;IAC1C,eAAe,EAAE,QAAQ;IACzB,WAAW,EAAE,WAAW;IACxB,mBAAmB,EAAE,WAAW;IAChC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;CACvB,CAAC;AAEF,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C,2EAA2E;AAC3E,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,kBAAkB,CAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAC3F,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,SAAgB,mBAAmB,CAAC,IAA6B;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAoB,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC;IAC1F,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1B,IAAI,IAAI,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACtD,IAAI,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;IACrD,IAAI,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAChD,IAAI,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;IACjD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC;QAChC,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,OAAiC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC;IACtE,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,WAA+B;IAChE,IAAI,CAAC,WAAW;QAAE,OAAO,GAAG,CAAC;IAC7B,OAAO,GAAG,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,gBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,OAAO;IACd,IAAI,CAAC;QACH,OAAO,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gDAAgD;AAChD,MAAa,iBAAiB;IACnB,cAAc,CAAS;IACvB,WAAW,CAAS;IACZ,IAAI,CAAa;IACjB,GAAG,CAA0D;IAC7D,OAAO,CAA2B;IAC3C,KAAK,GAAiD,IAAI,CAAC;IAC3D,KAAK,GAA2D,IAAI,CAAC;IAE7E,YAAY,OAAiC;QAC3C,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC;QAClE,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACvF,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAA8B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,IAAI,GAAG,IAAI,iBAAU,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,IAAA,4BAAc,EAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CAC7B,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,EAAE,EAAE;YACpC,GAAG,IAAI;YACP,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE;gBACP,mBAAmB,EAAE,cAAc;gBACnC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAI,IAAI,CAAC,OAA8C;aACxD;SACF,CAAC,CAAC;IACP,CAAC;IAEO,SAAS,CAAC,MAAM,GAAG,KAAK;QAC9B,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,IAAI,CAAC,WAAW,iBAAiB,CAAC;QAClF,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,IAAI,CAAC,WAAW,iBAAiB,CAAC;IACxE,CAAC;IAED,iEAAiE;IACzD,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK;QAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAClG,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,SAAS,CAAC,GAAW,EAAE,SAAiB;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3D,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAKD,KAAK,CAAC,gBAAgB,CAAC,UAAmC,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAClF,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,MAAM,IAAA,uBAAgB,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC/E,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,yBAAyB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClG,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;YACZ,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;YAC9G,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;gBAC3C,IAAI,OAAO,CAAC,SAAS,KAAK,YAAY;oBAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;gBACxG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,uBAAuB,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzH,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;gBACjF,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwC,CAAC;gBAC9E,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAChD,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,KAAM,CAAC,GAAG,CAAC;YACtB,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACtG,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,iBAAiB,CAAC,UAAgE,EAAE;QACxF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAAE,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAC,UAAsC,EAAE;QAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAI,MAAM,CAAC,YAAmC,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,YAAY,IAAI,WAAW,EAAE,CAAC;QAChI,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxG,IAAI,GAAW,CAAC;QAChB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,IAAA,6BAAkB,EAAC,IAAI,CAAC,IAAI,EAAE;gBAClD,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU;gBAC7D,WAAW,EAAE,QAAQ,IAAI,GAAG;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,gCAAgC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;YAC/G,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;aAC3C,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,sBAAsB,CAAC,GAAY;QACvC,MAAM,IAAI,GAAG,GAAG,IAAI,WAAW,EAAE,IAAI,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,IAAA,6BAAkB,EAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,6BAA6B,EAAE;gBAC7D,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAC9E,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;QACxG,CAAC;aAAM,IAAI,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1D,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,+BAA+B,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,GAAG,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,EAAE,CAAC;YACpD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAA,8BAAmB,EAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,OAAO,EAAE,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9C,OAAO,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QACrC,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QACD,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,UAAsE,EAAE;QAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,IAAA,0BAAe,EAAC,IAAI,CAAC,IAAI,EAAE;gBAC/C,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU;gBAC7D,WAAW,EAAE,WAAW,EAAE,IAAI,GAAG;aAClC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;YACnG,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACxC,MAAM,IAAI,CAAC,GAAG,CAAC,6BAA6B,EAAE;oBAC5C,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;iBAChF,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;gBACpC,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,IAAI,2BAA2B,CAAC,CAAC;YAC/I,CAAC;YACD,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,EAAE,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3J,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;QAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;QACvE,SAAS,CAAC;YACR,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/C,IAAI,MAAM,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC;YAC9F,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;gBAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,MAAM,CAAC,UAAoC,EAAE;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,IAAI,IAAI,EAAE,OAAO;YAAE,MAAM,IAAA,wBAAa,EAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7G,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO;QACtC,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU;YAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;aACjE,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;CACF;AAtOD,8CAsOC;AAED,mFAAmF;AAC5E,KAAK,UAAU,uBAAuB,CAAC,OAAiC;IAC7E,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/device-authorization.d.ts

@@ -0,0 +1,70 @@
+import type { FapiClient } from './fapi';
+/**
+ * Device sign-in (OAuth 2.0 Device Authorization Grant, RFC 8628) from YOUR app:
+ * the signed-in user types — or scans — the code their TV, console or CLI shows,
+ * and your own page approves it. The alternative to sending them to Atlas's
+ * hosted `/oauth2/device` page.
+ *
+ *   const auth = await lookupDeviceAuthorization(client, typedCode);
+ *   // show auth.client.name and auth.scopes, then:
+ *   await approveDeviceAuthorization(client, auth);   // or denyDeviceAuthorization
+ *
+ * The calls use the signed-in session (the cookie, or a native app's session
+ * token). When the application requires a recent re-authentication to approve a
+ * device (`requiresStepUp`), a stale session gets a
+ * {@link DeviceAuthorizationError} with `needsReverification` — re-authenticate
+ * (`reauthenticate()`), then approve again.
+ */
+export interface DeviceAuthorizationScope {
+    scope: string;
+    /** A human description for the consent text. */
+    description: string;
+}
+export interface DeviceAuthorization {
+    object: 'device_authorization';
+    id: string;
+    /** The code as the device shows it, e.g. `WDJB-MJHT`. */
+    userCode: string;
+    status: 'pending' | 'approved' | 'denied';
+    client: {
+        clientId: string;
+        name: string;
+        logoUrl: string | null;
+        homepageUrl: string | null;
+        firstParty: boolean;
+    };
+    scopes: DeviceAuthorizationScope[];
+    /** The API the device asked for a token for, if any. */
+    audience: string | null;
+    /** Approving needs a recent re-authentication. */
+    requiresStepUp: boolean;
+    createdAt: number;
+    expiresAt: number;
+}
+/** A refused request. `code` is the server's stable error code (`NOT_FOUND`, `RATE_LIMITED`, `STEP_UP_REQUIRED`, …). */
+export declare class DeviceAuthorizationError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly param?: string;
+    readonly reason?: string;
+    readonly meta?: Record<string, unknown>;
+    constructor(status: number, code: string, message: string, param?: string, reason?: string, meta?: Record<string, unknown>);
+    /** True when approving needs a fresh re-authentication first. */
+    get needsReverification(): boolean;
+    /** True when the code is unknown, expired or already used. */
+    get isInvalidCode(): boolean;
+}
+/**
+ * Normalise what a person typed into the `XXXX-XXXX` form devices show:
+ * uppercase, spaces and dashes ignored. Returns the input unchanged when it is
+ * not 8 letters or digits, so the server answers "not valid".
+ */
+export declare function formatUserCode(input: string): string;
+/** Read a `user_code` from a verification URL the device displayed (`?user_code=`), if any. */
+export declare function userCodeFromUrl(url: string | URL): string | null;
+/** Look up a pending device sign-in by the code the device shows. */
+export declare function lookupDeviceAuthorization(client: FapiClient, userCode: string): Promise<DeviceAuthorization>;
+/** Approve the device sign-in for the signed-in user. The device's next poll receives its tokens. */
+export declare function approveDeviceAuthorization(client: FapiClient, authorization: Pick<DeviceAuthorization, 'id' | 'userCode'>): Promise<DeviceAuthorization>;
+/** Deny the device sign-in. The device's next poll is told `access_denied`. */
+export declare function denyDeviceAuthorization(client: FapiClient, authorization: Pick<DeviceAuthorization, 'id' | 'userCode'>): Promise<DeviceAuthorization>;