@atlasauth/js 0.5.0 → 0.7.0

package/dist/redirect.js

@@ -15,12 +15,14 @@
  * the React provider and any custom integration read the exact same contract.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REDIRECT_PARAMS = void 0;
+exports.POPUP_SEVERED_TIMEOUT_MS = exports.POPUP_SEVERED_WINDOW_MS = exports.REDIRECT_PARAMS = void 0;
 exports.startOauthRedirect = startOauthRedirect;
 exports.parseOAuthPopupMessage = parseOAuthPopupMessage;
+exports.mapOAuthPopupPayload = mapOAuthPopupPayload;
 exports.startOauthPopup = startOauthPopup;
 exports.readRedirectResult = readRedirectResult;
 exports.stripRedirectParams = stripRedirectParams;
+const popup_channel_1 = require("./popup-channel");
 exports.REDIRECT_PARAMS = ['__atlas_attempt', '__atlas_ticket', '__atlas_status'];
 /**
  * Start a redirect-based OAuth sign-in for a provider that has no in-page native
@@ -48,6 +50,14 @@ async function startOauthRedirect(client, input) {
 function parseOAuthPopupMessage(eventOrigin, expectedOrigin, data) {
     if (eventOrigin !== expectedOrigin)
         return null;
+    return mapOAuthPopupPayload(data);
+}
+/**
+ * Pure: map one of the Frontend API's `atlas:oauth:*` result payloads (from a
+ * `postMessage`, or relayed from a severed popup's landing page) to an outcome,
+ * or null when it is not one.
+ */
+function mapOAuthPopupPayload(data) {
     if (!data || typeof data !== 'object')
         return null;
     const d = data;
@@ -67,6 +77,12 @@ function parseOAuthPopupMessage(eventOrigin, expectedOrigin, data) {
             return null;
     }
 }
+/** `popup.closed` this soon after opening means the opener link was severed, not a user close. */
+exports.POPUP_SEVERED_WINDOW_MS = 1_500;
+/** How long a severed popup is waited for before it counts as cancelled. */
+exports.POPUP_SEVERED_TIMEOUT_MS = 5 * 60_000;
+/** Back-off between session probes while a severed popup is pending. */
+const SEVERED_PROBE_DELAYS_MS = [2_000, 3_000, 5_000, 8_000, 13_000, 21_000, 30_000];
 function centeredPopupFeatures(w, h) {
     const dualLeft = (window.screenLeft ?? window.screenX ?? 0);
     const dualTop = (window.screenTop ?? window.screenY ?? 0);
@@ -76,18 +92,35 @@ function centeredPopupFeatures(w, h) {
     const top = Math.max(0, dualTop + (vh - h) / 2);
     return `popup,width=${w},height=${h},left=${Math.round(left)},top=${Math.round(top)}`;
 }
+/** The popup flow currently waiting in this page; a new one supersedes it. */
+let cancelActivePopup = null;
 /**
  * Start a POPUP OAuth sign-in (GSI-style). Opens the provider authorize URL in a
  * popup and resolves when the callback posts back the one-time ticket (complete),
  * an error, or a continuation. Falls back to a full redirect when the popup is
  * blocked — resolves `{ blocked:true, authorizationUrl }` and the caller
  * navigates there, so it is always safe to enable. Browser-only.
+ *
+ * The result arrives by `postMessage` from the Frontend API, or — when a
+ * Cross-Origin-Opener-Policy severed the popup from this page — relayed over
+ * `BroadcastChannel('atlas:oauth:<nonce>')` by the SDK on the page the popup
+ * lands on (see ./popup-channel). Cancel semantics:
+ *   - the popup closes after the first {@link POPUP_SEVERED_WINDOW_MS}: the user
+ *     closed it — one final session probe, then `popup_closed`;
+ *   - `popup.closed` reads true within that window: the link was severed (the
+ *     popup is very much open). Keep waiting for the relayed result, probing
+ *     the session with back-off, and settle as `popup_closed` only after
+ *     {@link POPUP_SEVERED_TIMEOUT_MS}, an explicit error/cancel result,
+ *     `input.signal` aborting, or a newer popup flow starting.
  */
 async function startOauthPopup(client, input, handlers = {}) {
+    const nonce = (0, popup_channel_1.createPopupNonce)();
     const res = await client.post('/v1/client/sign_ins/oauth', {
         provider: input.provider,
         redirect_url: input.redirectUrl,
         mode: 'popup',
+        popup_nonce: nonce,
+        opener_origin: window.location.origin,
     });
     const authorizationUrl = res.ok ? res.data?.authorization_url : undefined;
     if (!authorizationUrl)
@@ -95,7 +128,7 @@ async function startOauthPopup(client, input, handlers = {}) {
     const expectedOrigin = client.frontendApiOrigin || window.location.origin;
     let popup = null;
     try {
-        popup = window.open(authorizationUrl, 'atlas:oauth', centeredPopupFeatures(500, 650));
+        popup = window.open(authorizationUrl, popup_channel_1.OAUTH_POPUP_WINDOW_NAME, centeredPopupFeatures(500, 650));
     }
     catch {
         popup = null;
@@ -104,15 +137,28 @@ async function startOauthPopup(client, input, handlers = {}) {
         handlers.onBlockedFallback?.(authorizationUrl);
         return { blocked: true, authorizationUrl };
     }
+    const openedAt = Date.now();
     handlers.onOpen?.();
+    // Only one popup flow at a time: starting another cancels the one waiting.
+    cancelActivePopup?.();
     return await new Promise((resolve) => {
         let done = false;
+        let severed = false;
+        let probeTimer;
+        let deadline;
+        const cancel = () => settle({ error: 'popup_closed' });
         const settle = (r) => {
             if (done)
                 return;
             done = true;
             window.removeEventListener('message', onMessage);
             clearInterval(timer);
+            clearTimeout(probeTimer);
+            clearTimeout(deadline);
+            stopListening();
+            input.signal?.removeEventListener('abort', cancel);
+            if (cancelActivePopup === cancel)
+                cancelActivePopup = null;
             try {
                 if (popup && !popup.closed)
                     popup.close();
@@ -120,11 +166,10 @@ async function startOauthPopup(client, input, handlers = {}) {
             catch {
                 /* cross-origin close can throw; ignore */
             }
-            resolve(r);
+            resolve(severed ? { ...r, severed: true } : r);
         };
-        const onMessage = (ev) => {
-            const outcome = parseOAuthPopupMessage(ev.origin, expectedOrigin, ev.data);
-            if (!outcome)
+        const deliver = (outcome) => {
+            if (done)
                 return;
             if (outcome.ticket)
                 handlers.onComplete?.({ ticket: outcome.ticket, attemptId: outcome.attemptId });
@@ -132,14 +177,74 @@ async function startOauthPopup(client, input, handlers = {}) {
                 handlers.onError?.(outcome.error);
             settle(outcome);
         };
+        const onMessage = (ev) => {
+            const outcome = parseOAuthPopupMessage(ev.origin, expectedOrigin, ev.data);
+            if (outcome)
+                deliver(outcome);
+        };
+        // A probe that finds a session settles; otherwise `onMiss` decides.
+        const probe = (onMiss) => {
+            if (done)
+                return;
+            void probeSession(client).then((signedIn) => {
+                if (done)
+                    return;
+                if (signedIn)
+                    settle({ error: 'popup_closed', sessionDetected: true });
+                else
+                    onMiss();
+            });
+        };
+        const scheduleProbe = (attempt) => {
+            const delay = SEVERED_PROBE_DELAYS_MS[Math.min(attempt, SEVERED_PROBE_DELAYS_MS.length - 1)];
+            probeTimer = setTimeout(() => probe(() => scheduleProbe(attempt + 1)), delay);
+        };
+        const stopListening = (0, popup_channel_1.listenForPopupResult)(nonce, {
+            onResult: (payload) => {
+                const outcome = mapOAuthPopupPayload(payload);
+                if (outcome)
+                    deliver(outcome);
+            },
+            // A page in the popup finished the sign-in itself: check now.
+            onSignedIn: () => probe(() => undefined),
+        });
         // The user closing the popup without finishing is a cancellation, not a hang.
+        // But `popup.closed` turning true right after opening is not a close: the
+        // opener link was severed (Cross-Origin-Opener-Policy) and the popup is
+        // still on screen. Then wait for the relayed result instead.
         const timer = setInterval(() => {
-            if (popup && popup.closed)
-                settle({ error: 'popup_closed' });
-        }, 500);
+            if (!popup || !popup.closed || done)
+                return;
+            clearInterval(timer);
+            if (Date.now() - openedAt <= exports.POPUP_SEVERED_WINDOW_MS) {
+                severed = true;
+                handlers.onSevered?.();
+                deadline = setTimeout(cancel, exports.POPUP_SEVERED_TIMEOUT_MS);
+                scheduleProbe(0);
+                return;
+            }
+            // A real close. It can still follow a sign-in the popup finished on its
+            // own (an opener the browser severed later, mid-flow), so check the
+            // session once before calling it a cancel.
+            probe(cancel);
+        }, 250);
         window.addEventListener('message', onMessage);
+        input.signal?.addEventListener('abort', cancel);
+        if (input.signal?.aborted)
+            cancel();
+        cancelActivePopup = cancel;
     });
 }
+/** One `GET /v1/client`: is there a signed-in session on this browser now? */
+async function probeSession(client) {
+    try {
+        const res = await client.get('/v1/client');
+        return Boolean(res.ok && res.data?.session && res.data?.user);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Read Atlas's redirect params from a query string (`window.location.search`).
  *

package/dist/redirect.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../src/redirect.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAcH,gDAUC;AAiCD,wDAuBC;AAiCD,0CAsDC;AASD,gDAcC;AAQD,kDAIC;AAtMY,QAAA,eAAe,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAU,CAAC;AAEhG;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,KAAgD;IAEhD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiC,2BAA2B,EAAE;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AA0BD;;;;;;GAMG;AACH,SAAgB,sBAAsB,CACpC,WAAmB,EACnB,cAAsB,EACtB,IAAa;IAEb,IAAI,WAAW,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,sBAAsB;YACzB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,KAAK,mBAAmB;YACtB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;QACpF,KAAK,sBAAsB;YACzB,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;gBACrB,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3B,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;aACxC,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAgBD,SAAS,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAW,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAW,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,eAAe,CAAC,WAAW,IAAI,CAAC,CAAC;IAC1E,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe,CAAC,YAAY,IAAI,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,eAAe,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,KAAgD,EAChD,WAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiC,2BAA2B,EAAE;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,gBAAgB;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAExD,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAE1E,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,QAAQ,CAAC,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAC7C,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAEpB,OAAO,MAAM,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;QACrD,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAE,EAAE;YACrC,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACjD,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC;gBACH,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;YACD,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,EAAgB,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,IAAI,OAAO,CAAC,MAAM;gBAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACpG,IAAI,OAAO,CAAC,KAAK;gBAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,8EAA8E;QAC9E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;gBAAE,MAAM,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/D,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO;QACL,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,uBAAe;QAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../src/redirect.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAmBH,gDAUC;AAiCD,wDAOC;AAOD,oDAkBC;AAsFD,0CA+GC;AAmBD,gDAcC;AAQD,kDAIC;AA7UD,mDAIyB;AAEZ,QAAA,eAAe,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAU,CAAC;AAEhG;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,KAAgD;IAEhD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiC,2BAA2B,EAAE;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AA0BD;;;;;;GAMG;AACH,SAAgB,sBAAsB,CACpC,WAAmB,EACnB,cAAsB,EACtB,IAAa;IAEb,IAAI,WAAW,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,IAAa;IAChD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,sBAAsB;YACzB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,KAAK,mBAAmB;YACtB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;QACpF,KAAK,sBAAsB;YACzB,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;gBACrB,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3B,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;aACxC,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AA+CD,kGAAkG;AACrF,QAAA,uBAAuB,GAAG,KAAK,CAAC;AAC7C,4EAA4E;AAC/D,QAAA,wBAAwB,GAAG,CAAC,GAAG,MAAM,CAAC;AACnD,wEAAwE;AACxE,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAErF,SAAS,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAW,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAW,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,eAAe,CAAC,WAAW,IAAI,CAAC,CAAC;IAC1E,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe,CAAC,YAAY,IAAI,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,eAAe,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,8EAA8E;AAC9E,IAAI,iBAAiB,GAAwB,IAAI,CAAC;AAElD;;;;;;;;;;;;;;;;;;GAkBG;AACI,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,KAAsB,EACtB,WAA+B,EAAE;IAEjC,MAAM,KAAK,GAAG,IAAA,gCAAgB,GAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiC,2BAA2B,EAAE;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,KAAK;QAClB,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;KACtC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,gBAAgB;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAExD,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAE1E,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,uCAAuB,EAAE,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,QAAQ,CAAC,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB,2EAA2E;IAC3E,iBAAiB,EAAE,EAAE,CAAC;IAEtB,OAAO,MAAM,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;QACrD,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,UAAqD,CAAC;QAC1D,IAAI,QAAmD,CAAC;QACxD,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAE,EAAE;YACrC,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACjD,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,YAAY,CAAC,UAAU,CAAC,CAAC;YACzB,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,aAAa,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,iBAAiB,KAAK,MAAM;gBAAE,iBAAiB,GAAG,IAAI,CAAC;YAC3D,IAAI,CAAC;gBACH,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,OAAqB,EAAE,EAAE;YACxC,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,OAAO,CAAC,MAAM;gBAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACpG,IAAI,OAAO,CAAC,KAAK;gBAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,EAAgB,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,OAAO;gBAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC;QACF,oEAAoE;QACpE,MAAM,KAAK,GAAG,CAAC,MAAkB,EAAE,EAAE;YACnC,IAAI,IAAI;gBAAE,OAAO;YACjB,KAAK,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBAC1C,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,QAAQ;oBAAE,MAAM,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;;oBAClE,MAAM,EAAE,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAE,CAAC;YAC9F,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAChF,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,IAAA,oCAAoB,EAAC,KAAK,EAAE;YAChD,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;gBACpB,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC9C,IAAI,OAAO;oBAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;YACD,8DAA8D;YAC9D,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC;QACH,8EAA8E;QAC9E,0EAA0E;QAC1E,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI;gBAAE,OAAO;YAC5C,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,+BAAuB,EAAE,CAAC;gBACrD,OAAO,GAAG,IAAI,CAAC;gBACf,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;gBACvB,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,gCAAwB,CAAC,CAAC;gBACxD,aAAa,CAAC,CAAC,CAAC,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,wEAAwE;YACxE,oEAAoE;YACpE,2CAA2C;YAC3C,KAAK,CAAC,MAAM,CAAC,CAAC;QAChB,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,EAAE,CAAC;QACpC,iBAAiB,GAAG,MAAM,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,YAAY,CAAC,MAAkB;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAwC,YAAY,CAAC,CAAC;QAClF,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO;QACL,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,uBAAe;QAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}

package/dist/sign-out.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Sign-out that cannot be silently undone.
+ *
+ * A browser sign-out has two halves: revoke the session on the Frontend API
+ * (which also clears the HttpOnly session cookies), and drop the local state.
+ * If the first half fails — a network blip, a 5xx — the refresh cookie is still
+ * valid, and the very next `reload()` (a tab regaining focus, a sibling tab's
+ * broadcast, a failed token refresh) re-boots straight back into the session
+ * the user just signed out of.
+ *
+ * These helpers close that gap: {@link revokeSession} retries once and reports
+ * what the server did (including the parked session it promoted, if any), and
+ * {@link SessionTombstones} remembers the ids of sessions this browser signed
+ * out of so a reload — or a tab opened later — never re-adopts one, even when
+ * the revoke never reached the server.
+ */
+/** What `signOut()` resolves with. */
+export interface SignOutResult {
+    /**
+     * Whether the Frontend API confirmed the session was revoked. `false` means
+     * the local sign-out happened but the server could not be reached (or
+     * refused); the session id is remembered so this browser never re-adopts it.
+     */
+    revoked: boolean;
+    /**
+     * Set when another account signed in on this browser was promoted to active
+     * (multi-session). The SDK adopts it, so the user stays signed in as it.
+     */
+    activeSessionId?: string;
+}
+/** The error `signOut({ strict: true })` rejects with when the revoke fails. */
+export declare class SignOutError extends Error {
+    readonly code: "SIGN_OUT_REVOKE_FAILED";
+    /** The session that could not be revoked. */
+    readonly sessionId: string;
+    /** The last HTTP status from the Frontend API, or `0` for a network failure. */
+    readonly status: number;
+    constructor(sessionId: string, status: number);
+}
+/** The outcome of {@link revokeSession}. */
+export interface RevokeSessionOutcome {
+    revoked: boolean;
+    /** The last HTTP status (`0` when the request never got a response). */
+    status: number;
+    /** The successful response, for front-channel logout. */
+    response?: Response;
+    /** A parked session the server promoted to active, if any. */
+    activeSessionId?: string;
+}
+/**
+ * `POST /v1/client/sessions/:id/revoke`, retried once on a network failure or a
+ * 5xx/429. A 4xx other than 429 is not retried: the server understood and said
+ * no. A 404 counts as revoked — the session is already gone.
+ *
+ * `request` is the caller's credentialed FAPI fetch (cookies included), so the
+ * server can clear the session cookies on this browser.
+ */
+export declare function revokeSession(request: (path: string, init?: RequestInit) => Promise<Response>, sessionId: string, options?: {
+    retries?: number;
+}): Promise<RevokeSessionOutcome>;
+/** Options for {@link SessionTombstones}. */
+export interface SessionTombstonesOptions {
+    /**
+     * The Frontend API URL or origin the sessions belong to. Tombstones are kept
+     * per Frontend API origin, so two Atlas instances used on one site never
+     * share (or clear) each other's.
+     */
+    frontendApi?: string;
+    /** Override the storage key entirely (the Frontend API scope is then not appended). */
+    storageKey?: string;
+    /** Clock, for tests. */
+    now?: () => number;
+}
+/**
+ * The ids of sessions this browser signed out of, so a reload — or a tab opened
+ * later — never re-adopts one from a refresh cookie the revoke did not clear.
+ *
+ * Kept in `localStorage` (shared by every tab of the site and surviving a
+ * restart), at most 20 entries, each for 30 days, pruned whenever it is read,
+ * and keyed per Frontend API origin. Tabs see each other's changes on every
+ * read, and {@link SessionTombstones.subscribe} reports them as they happen
+ * (the `storage` event). `sessionStorage` is used only when `localStorage`
+ * throws (storage disabled, sandboxed frames); memory always backs both. A
+ * confirmed revoke may {@link SessionTombstones.remove} its tombstone. Never
+ * holds a token — a session id is not a credential.
+ */
+export declare class SessionTombstones {
+    private entries;
+    /** Ids no storage accepted: only memory remembers them, so a sync keeps them. */
+    private unsaved;
+    private readonly storageKey;
+    private readonly now;
+    constructor(options?: string | SessionTombstonesOptions);
+    has(sessionId: string | null | undefined): boolean;
+    add(...sessionIds: (string | null | undefined)[]): void;
+    /**
+     * Forget tombstones — called once a later revoke of the session is confirmed
+     * (the server has ended it, so there is nothing left to re-adopt).
+     */
+    remove(...sessionIds: (string | null | undefined)[]): void;
+    list(): string[];
+    /**
+     * Call `listener` when another tab adds or removes a tombstone (the `storage`
+     * event). Returns the unsubscribe function; a no-op outside a browser.
+     */
+    subscribe(listener: (ids: string[]) => void): () => void;
+    /**
+     * Re-read storage — the source of truth, so another tab's add or remove is
+     * seen here — keeping only what this tab could not store; then drop expired
+     * entries. With no readable storage, memory is all there is.
+     */
+    private sync;
+    private prune;
+    private persist;
+}

package/dist/sign-out.js

@@ -0,0 +1,297 @@
+"use strict";
+/**
+ * Sign-out that cannot be silently undone.
+ *
+ * A browser sign-out has two halves: revoke the session on the Frontend API
+ * (which also clears the HttpOnly session cookies), and drop the local state.
+ * If the first half fails — a network blip, a 5xx — the refresh cookie is still
+ * valid, and the very next `reload()` (a tab regaining focus, a sibling tab's
+ * broadcast, a failed token refresh) re-boots straight back into the session
+ * the user just signed out of.
+ *
+ * These helpers close that gap: {@link revokeSession} retries once and reports
+ * what the server did (including the parked session it promoted, if any), and
+ * {@link SessionTombstones} remembers the ids of sessions this browser signed
+ * out of so a reload — or a tab opened later — never re-adopts one, even when
+ * the revoke never reached the server.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionTombstones = exports.SignOutError = void 0;
+exports.revokeSession = revokeSession;
+/** The error `signOut({ strict: true })` rejects with when the revoke fails. */
+class SignOutError extends Error {
+    code = 'SIGN_OUT_REVOKE_FAILED';
+    /** The session that could not be revoked. */
+    sessionId;
+    /** The last HTTP status from the Frontend API, or `0` for a network failure. */
+    status;
+    constructor(sessionId, status) {
+        super(status === 0
+            ? 'Signed out locally, but the Atlas Frontend API could not be reached to end the session.'
+            : `Signed out locally, but the Atlas Frontend API refused to end the session (HTTP ${status}).`);
+        this.name = 'SignOutError';
+        this.sessionId = sessionId;
+        this.status = status;
+    }
+}
+exports.SignOutError = SignOutError;
+/**
+ * `POST /v1/client/sessions/:id/revoke`, retried once on a network failure or a
+ * 5xx/429. A 4xx other than 429 is not retried: the server understood and said
+ * no. A 404 counts as revoked — the session is already gone.
+ *
+ * `request` is the caller's credentialed FAPI fetch (cookies included), so the
+ * server can clear the session cookies on this browser.
+ */
+async function revokeSession(request, sessionId, options = {}) {
+    const retries = Math.max(0, options.retries ?? 1);
+    let status = 0;
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        let response;
+        try {
+            response = await request(`/v1/client/sessions/${encodeURIComponent(sessionId)}/revoke`, {
+                method: 'POST',
+            });
+        }
+        catch {
+            status = 0;
+            continue;
+        }
+        status = response.status;
+        if (response.ok) {
+            let activeSessionId;
+            try {
+                const body = (await response.clone().json());
+                if (typeof body?.active_session_id === 'string')
+                    activeSessionId = body.active_session_id;
+            }
+            catch {
+                // A body we cannot read still means the revoke succeeded.
+            }
+            return { revoked: true, status, response, ...(activeSessionId ? { activeSessionId } : {}) };
+        }
+        if (status === 404)
+            return { revoked: true, status };
+        if (status < 500 && status !== 429)
+            break;
+    }
+    return { revoked: false, status };
+}
+const TOMBSTONE_KEY = 'atlas:signed-out-sessions';
+const TOMBSTONE_LIMIT = 20;
+/** How long a tombstone is kept: longer than any refresh cookie it guards against. */
+const TOMBSTONE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * The ids of sessions this browser signed out of, so a reload — or a tab opened
+ * later — never re-adopts one from a refresh cookie the revoke did not clear.
+ *
+ * Kept in `localStorage` (shared by every tab of the site and surviving a
+ * restart), at most 20 entries, each for 30 days, pruned whenever it is read,
+ * and keyed per Frontend API origin. Tabs see each other's changes on every
+ * read, and {@link SessionTombstones.subscribe} reports them as they happen
+ * (the `storage` event). `sessionStorage` is used only when `localStorage`
+ * throws (storage disabled, sandboxed frames); memory always backs both. A
+ * confirmed revoke may {@link SessionTombstones.remove} its tombstone. Never
+ * holds a token — a session id is not a credential.
+ */
+class SessionTombstones {
+    entries;
+    /** Ids no storage accepted: only memory remembers them, so a sync keeps them. */
+    unsaved = new Set();
+    storageKey;
+    now;
+    constructor(options = {}) {
+        const opts = typeof options === 'string' ? { storageKey: options } : options;
+        this.storageKey = opts.storageKey ?? scopedKey(opts.frontendApi);
+        this.now = opts.now ?? Date.now;
+        const stored = readStored(this.storageKey) ?? [];
+        const legacy = readLegacy(this.storageKey, this.now()).filter((l) => !stored.some((e) => e.id === l.id));
+        this.entries = this.prune([...stored, ...legacy]);
+        // Carry an older SDK's per-tab tombstones over into the shared store, once.
+        if (legacy.length) {
+            this.persist();
+            try {
+                storage('session')?.removeItem(TOMBSTONE_KEY);
+            }
+            catch {
+                /* sessionStorage unavailable */
+            }
+        }
+    }
+    has(sessionId) {
+        if (typeof sessionId !== 'string' || !sessionId)
+            return false;
+        this.sync();
+        return this.entries.some((e) => e.id === sessionId);
+    }
+    add(...sessionIds) {
+        this.sync();
+        let changed = false;
+        for (const id of sessionIds) {
+            if (typeof id !== 'string' || !id || this.entries.some((e) => e.id === id))
+                continue;
+            this.entries.push({ id, at: this.now() });
+            changed = true;
+        }
+        if (changed)
+            this.persist();
+    }
+    /**
+     * Forget tombstones — called once a later revoke of the session is confirmed
+     * (the server has ended it, so there is nothing left to re-adopt).
+     */
+    remove(...sessionIds) {
+        this.sync();
+        const before = this.entries.length;
+        this.entries = this.entries.filter((e) => !sessionIds.includes(e.id));
+        if (this.entries.length !== before)
+            this.persist();
+    }
+    list() {
+        this.sync();
+        return this.entries.map((e) => e.id);
+    }
+    /**
+     * Call `listener` when another tab adds or removes a tombstone (the `storage`
+     * event). Returns the unsubscribe function; a no-op outside a browser.
+     */
+    subscribe(listener) {
+        const target = globalThis;
+        if (typeof target.addEventListener !== 'function')
+            return () => undefined;
+        const onStorage = (event) => {
+            if (event.key !== this.storageKey && event.key !== null)
+                return;
+            listener(this.list());
+        };
+        target.addEventListener('storage', onStorage);
+        return () => target.removeEventListener?.('storage', onStorage);
+    }
+    /**
+     * Re-read storage — the source of truth, so another tab's add or remove is
+     * seen here — keeping only what this tab could not store; then drop expired
+     * entries. With no readable storage, memory is all there is.
+     */
+    sync() {
+        const stored = readStored(this.storageKey);
+        if (!stored) {
+            this.entries = this.prune(this.entries);
+            return;
+        }
+        const known = new Set(stored.map((e) => e.id));
+        this.entries = this.prune([
+            ...stored,
+            ...this.entries.filter((e) => this.unsaved.has(e.id) && !known.has(e.id)),
+        ]);
+    }
+    prune(entries) {
+        const cutoff = this.now() - TOMBSTONE_TTL_MS;
+        const seen = new Set();
+        const fresh = entries
+            .filter((e) => e.at > cutoff && !seen.has(e.id) && seen.add(e.id))
+            .sort((a, b) => a.at - b.at);
+        return fresh.slice(-TOMBSTONE_LIMIT);
+    }
+    persist() {
+        this.entries = this.prune(this.entries);
+        const raw = JSON.stringify(this.entries);
+        if (write('local', this.storageKey, raw)) {
+            // Anything parked in sessionStorage by an earlier failed write is now in localStorage.
+            try {
+                storage('session')?.removeItem(this.storageKey);
+            }
+            catch {
+                /* nothing parked, or sessionStorage unavailable */
+            }
+            this.unsaved.clear();
+            return;
+        }
+        // localStorage threw (disabled, sandboxed, full): fall back to this tab's
+        // sessionStorage, and memory still protects this tab if that throws too.
+        this.unsaved = write('session', this.storageKey, raw) ? new Set() : new Set(this.entries.map((e) => e.id));
+    }
+}
+exports.SessionTombstones = SessionTombstones;
+/** `atlas:signed-out-sessions:<frontend api origin>`. */
+function scopedKey(frontendApi) {
+    if (!frontendApi)
+        return TOMBSTONE_KEY;
+    try {
+        return `${TOMBSTONE_KEY}:${new URL(frontendApi).origin}`;
+    }
+    catch {
+        return `${TOMBSTONE_KEY}:${frontendApi}`;
+    }
+}
+function storage(kind) {
+    // Reading `localStorage` itself throws in some sandboxed contexts.
+    return kind === 'local' ? globalThis.localStorage : globalThis.sessionStorage;
+}
+function write(kind, key, value) {
+    try {
+        const s = storage(kind);
+        if (!s)
+            return false;
+        s.setItem(key, value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function parseEntries(raw, now) {
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed))
+            return [];
+        const out = [];
+        for (const v of parsed) {
+            // Bare ids are the pre-TTL format: date them now.
+            if (typeof v === 'string' && v)
+                out.push({ id: v, at: now });
+            else if (v && typeof v === 'object') {
+                const { id, at } = v;
+                if (typeof id === 'string' && id && typeof at === 'number' && Number.isFinite(at))
+                    out.push({ id, at });
+            }
+        }
+        return out;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * localStorage (plus anything a failed write parked in sessionStorage), or
+ * sessionStorage alone when localStorage throws; null when neither is readable.
+ */
+function readStored(key) {
+    const now = Date.now();
+    try {
+        const s = storage('local');
+        if (s)
+            return [...parseEntries(s.getItem(key), now), ...(readSession(key, now) ?? [])];
+    }
+    catch {
+        /* fall through to sessionStorage */
+    }
+    return readSession(key, now);
+}
+function readSession(key, now) {
+    try {
+        const s = storage('session');
+        return s ? parseEntries(s.getItem(key), now) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Tombstones written by earlier SDK versions: per tab, unscoped, in sessionStorage. */
+function readLegacy(key, now) {
+    if (key === TOMBSTONE_KEY)
+        return [];
+    return readSession(TOMBSTONE_KEY, now) ?? [];
+}
+//# sourceMappingURL=sign-out.js.map

package/dist/sign-out.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-out.js","sourceRoot":"","sources":["../src/sign-out.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAwDH,sCAgCC;AAvED,gFAAgF;AAChF,MAAa,YAAa,SAAQ,KAAK;IAC5B,IAAI,GAAG,wBAAiC,CAAC;IAClD,6CAA6C;IACpC,SAAS,CAAS;IAC3B,gFAAgF;IACvE,MAAM,CAAS;IAExB,YAAY,SAAiB,EAAE,MAAc;QAC3C,KAAK,CACH,MAAM,KAAK,CAAC;YACV,CAAC,CAAC,yFAAyF;YAC3F,CAAC,CAAC,mFAAmF,MAAM,IAAI,CAClG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAjBD,oCAiBC;AAaD;;;;;;;GAOG;AACI,KAAK,UAAU,aAAa,CACjC,OAAgE,EAChE,SAAiB,EACjB,UAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;IAClD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,SAAS,EAAE;gBACtF,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACzB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,eAAmC,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAA2C,CAAC;gBACvF,IAAI,OAAO,IAAI,EAAE,iBAAiB,KAAK,QAAQ;oBAAE,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;YAC5D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9F,CAAC;QACD,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACrD,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;IAC5C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAClD,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,sFAAsF;AACtF,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAwBlD;;;;;;;;;;;;GAYG;AACH,MAAa,iBAAiB;IACpB,OAAO,CAAmB;IAClC,iFAAiF;IACzE,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IACnB,UAAU,CAAS;IACnB,GAAG,CAAe;IAEnC,YAAY,UAA6C,EAAE;QACzD,MAAM,IAAI,GAA6B,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACvG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;QAClD,4EAA4E;QAC5E,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,OAAO,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,GAAG,CAAC,SAAoC;QACtC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IACtD,CAAC;IAED,GAAG,CAAC,GAAG,UAAyC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;gBAAE,SAAS;YACrF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1C,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,OAAO;YAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,GAAG,UAAyC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,IAAI;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,QAAiC;QACzC,MAAM,MAAM,GAAG,UAAoH,CAAC;QACpI,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,UAAU;YAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;QAC1E,MAAM,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;YACxC,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI;gBAAE,OAAO;YAChE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACK,IAAI;QACV,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;YACxB,GAAG,MAAM;YACT,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC1E,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,OAAyB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO;aAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACjE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC;IACvC,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC;YACzC,uFAAuF;YACvF,IAAI,CAAC;gBACH,OAAO,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;CACF;AArHD,8CAqHC;AAED,yDAAyD;AACzD,SAAS,SAAS,CAAC,WAA+B;IAChD,IAAI,CAAC,WAAW;QAAE,OAAO,aAAa,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,GAAG,aAAa,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,aAAa,IAAI,WAAW,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAiB;IAChC,mEAAmE;IACnE,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;AAChF,CAAC;AAED,SAAS,KAAK,CAAC,IAAiB,EAAE,GAAW,EAAE,KAAa;IAC1D,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAA8B,EAAE,GAAW;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,GAAG,GAAqB,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,kDAAkD;YAClD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;iBACxD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAmC,CAAC;gBACvD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC;YAAE,OAAO,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,GAAW;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,UAAU,CAAC,GAAW,EAAE,GAAW;IAC1C,IAAI,GAAG,KAAK,aAAa;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,WAAW,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AAC/C,CAAC"}