@atlasauth/nextjs 0.8.1 → 0.10.0

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## Unreleased
 
+## 0.10.0 — 2026-11-04
+
+### Security
+
+- `createMountHandler` no longer trusts a browser-supplied client IP. It used the leftmost `X-Forwarded-For` entry (or `X-Real-IP`) as `X-Atlas-Client-IP`, which Atlas uses for rate limits, lockouts, risk checks and audit logs, so a visitor could pick their own IP. It now takes the `X-Forwarded-For` entry `trustedProxyHops` places from the right (default `1`: the one your nearest proxy appended), never reads `X-Real-IP`, and drops values that are not IP addresses.
+
+### Added
+
+- `createMountHandler({ clientIp?, trustedProxyHops? })`: `clientIp(request)` supplies the client IP yourself (takes precedence); `trustedProxyHops` sets how many proxies append to `X-Forwarded-For` (`0` forwards no client IP).
+
+### Changed
+
+- `createMountHandler` without `ATLAS_UPSTREAM` or `ATLAS_PROXY_SECRET` answers 503 (`text/plain`) and logs the missing variable once, instead of throwing (a bare 500).
+
+## 0.9.0 — 2026-11-03
+
+### Added
+
+- `createMountHandler({ upstream?, proxySecret?, basePath?, fetchImpl? })`: App Router handlers (`GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `HEAD`) that serve the Atlas Frontend API under a path of your app (a path mount). Reads `ATLAS_UPSTREAM` and `ATLAS_PROXY_SECRET` by default. Also exported from `@atlasauth/nextjs/server`.
+- `createVerifyHandler({ verifyToken? })`: the `/.well-known/atlas-verify/[token]` file for claiming the mount (`ATLAS_VERIFY_TOKEN`).
+- `atlasProxy({ csrf: true | { secret?, mountBasePath? } })`: session-bound CSRF tokens for signed-in browsers; unsafe methods without a valid token get 403 `CSRF_TOKEN_INVALID`. `proxyCsrfToken(request)`, the `x-atlas-csrf-token` forwarded header and `ForwardedAuth.csrfToken`.
+
 ## 0.8.1 — 2026-10-28
 
 ### Fixed

package/README.md

@@ -104,6 +104,43 @@ const initialState = await getAtlasInitialState();
 
 `getAtlasInitialState()` fetches the instance's public sign-in data (`/v1/appearance` and `/v1/client/environment`) on the server, cached for 60 seconds (`revalidate`). With it, `<SignIn />` renders styled and with its social buttons in the server HTML. It reads `ATLAS_PUBLISHABLE_KEY` and `ATLAS_FRONTEND_API` (or their `NEXT_PUBLIC_` forms) and never throws: anything it can't fetch within `timeoutMs` (1500 ms) is left for the browser.
 
+## CSRF protection
+
+```ts
+const atlas = atlasProxy({ ...config, csrf: true });
+export async function proxy(req: NextRequest) {
+  return (await atlas(req)) ?? withAtlasHeaders(req, NextResponse.next());
+}
+```
+
+For a signed-in browser the proxy keeps a token bound to the session in the `__atlas_csrf` cookie, and refuses a `POST`, `PUT`, `PATCH` or `DELETE` without it with `403` (`CSRF_TOKEN_INVALID`). Send the token in the `x-atlas-csrf` header (read it from the cookie) or as an `atlas_csrf` form field. In a server component, `readAtlasHeaders(await headers()).csrfToken` gives it for rendering a form.
+
+- Requests with `Authorization: Bearer`, signed-out requests and your path mount (`mountBasePath`, default `ATLAS_BASE_PATH` or `/atlas`) are exempt.
+- The secret is `ATLAS_CSRF_SECRET`, or derived from `ATLAS_SECRET_KEY`. Use the same one with `verifyCsrf` from `@atlasauth/backend` in your own handlers.
+- `withAtlasHeaders` sets the cookie, so call it on the response your proxy returns.
+
+## Frontend API on your own domain (path mount)
+
+Serve Atlas under a path of your app, with no DNS record and no reverse proxy of your own. Claim the host with `method: "path"` and a `base_path` such as `/atlas`, then add two route handlers:
+
+```ts
+// app/atlas/[[...path]]/route.ts
+import { createMountHandler } from '@atlasauth/nextjs/server';
+export const { GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD } = createMountHandler({ basePath: '/atlas' });
+```
+
+```ts
+// app/.well-known/atlas-verify/[token]/route.ts
+import { createVerifyHandler } from '@atlasauth/nextjs/server';
+export const { GET } = createVerifyHandler();
+```
+
+Set `ATLAS_UPSTREAM` (your instance's Frontend API host, from the domain's `instructions.upstream`), `ATLAS_PROXY_SECRET` (from `POST /v1/instance/proxy_secret`) and `ATLAS_VERIFY_TOKEN` (the domain's `verification.token`).
+
+Use a base path without a leading underscore, such as `/atlas`. The App Router treats folders starting with `_` as private and never routes them, so the default `/__atlas` doesn't work in Next.js.
+
+The handler forwards the method, path, query and body, drops any incoming `X-Atlas-*`, `X-Forwarded-*`, `Forwarded` and `X-Real-IP` headers, sets `X-Atlas-Forwarded-Host` and `X-Atlas-Proxy-Secret` itself, and returns every `Set-Cookie` and redirect unchanged. The client IP (`X-Atlas-Client-IP` and `X-Forwarded-For`) is the incoming `X-Forwarded-For` entry `trustedProxyHops` places from the right (default `1`: the entry your nearest proxy appended; entries further left are browser-controlled and ignored; `0` forwards none), or whatever `clientIp(request)` returns when you pass it; values that are not IP addresses are dropped. Without `ATLAS_UPSTREAM` or `ATLAS_PROXY_SECRET` the mount answers 503 and logs the missing variable once. Both handlers are also exported from `@atlasauth/nextjs`.
+
 ## Routing rules
 
 - Routes are protected unless they match `publicRoutes`. `protectedRoutes` wins over `publicRoutes`.

package/dist/index.d.ts

@@ -2,3 +2,4 @@ export * from './matcher';
 export * from './middleware';
 export * from './proxy';
 export * from './access-token';
+export * from './mount';

package/dist/index.js

@@ -18,4 +18,5 @@ __exportStar(require("./matcher"), exports);
 __exportStar(require("./middleware"), exports);
 __exportStar(require("./proxy"), exports);
 __exportStar(require("./access-token"), exports);
+__exportStar(require("./mount"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,+CAA6B;AAC7B,0CAAwB;AACxB,iDAA+B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,+CAA6B;AAC7B,0CAAwB;AACxB,iDAA+B;AAC/B,0CAAwB"}

package/dist/mount.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Serve the Atlas Frontend API under a path of your Next.js app (a path mount),
+ * with no reverse proxy of your own: a catch-all App Router route forwards
+ * `/<base>/…` to your instance's Frontend API host with the headers Atlas needs.
+ *
+ * ```ts
+ * // app/atlas/[[...path]]/route.ts
+ * import { createMountHandler } from '@atlasauth/nextjs';
+ * export const { GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD } = createMountHandler({ basePath: '/atlas' });
+ *
+ * // app/.well-known/atlas-verify/[token]/route.ts
+ * import { createVerifyHandler } from '@atlasauth/nextjs';
+ * export const { GET } = createVerifyHandler();
+ * ```
+ *
+ * Use a base path without a leading underscore (`/atlas`, not `/__atlas`): the
+ * App Router treats `_folder` as private and never routes it.
+ *
+ * Web-standard only (`fetch`, `Headers`, `Response`), so it runs on the Node.js
+ * and Edge runtimes.
+ */
+export interface AtlasMountOptions {
+    /** Your instance's Frontend API host (`instructions.upstream` of the domain). Default `ATLAS_UPSTREAM`. */
+    upstream?: string;
+    /** The instance proxy secret. Default `ATLAS_PROXY_SECRET`. */
+    proxySecret?: string;
+    /** The domain verification token (for {@link createVerifyHandler}). Default `ATLAS_VERIFY_TOKEN`. */
+    verifyToken?: string;
+    /** The mount's `base_path`, as registered with Atlas. Default `/atlas`. */
+    basePath?: string;
+    /**
+     * Derive the client IP forwarded to Atlas as `X-Atlas-Client-IP` yourself
+     * (for example from your platform's verified request IP). Takes precedence
+     * over `trustedProxyHops`. A value that is not an IP address is dropped.
+     */
+    clientIp?: (request: Request) => string | undefined;
+    /**
+     * How many proxies in front of this app append to `X-Forwarded-For`. The
+     * client IP is the entry that many places from the right (default 1: the
+     * rightmost, appended by the nearest proxy). Entries further left are
+     * browser-controlled and never used. `0` forwards no client IP.
+     */
+    trustedProxyHops?: number;
+    fetchImpl?: typeof fetch;
+}
+type Handler = (request: Request) => Promise<Response>;
+export interface AtlasMountHandlers {
+    GET: Handler;
+    POST: Handler;
+    PUT: Handler;
+    PATCH: Handler;
+    DELETE: Handler;
+    OPTIONS: Handler;
+    HEAD: Handler;
+}
+/**
+ * App Router handlers that forward the mount to Atlas: method, path (base
+ * included: Atlas reads the prefix from it), query and streamed body unchanged;
+ * hop-by-hop headers dropped. Every incoming `X-Atlas-*`, `X-Forwarded-*`,
+ * `Forwarded` and `X-Real-IP` header is dropped, then set as: `X-Atlas-Forwarded-Host`
+ * from `Host`; `X-Atlas-Proxy-Secret` from config; `X-Atlas-Client-IP` and
+ * `X-Forwarded-For` from `options.clientIp`, else the incoming `X-Forwarded-For`
+ * entry `trustedProxyHops` (default 1) from the right, omitted when absent or not
+ * an IP; `X-Forwarded-Proto` from the last incoming `X-Forwarded-Proto` entry (http or https only),
+ * else the request URL's scheme. The response keeps its status, headers and EVERY
+ * `Set-Cookie`; redirects are returned, not followed. Without an upstream or
+ * proxy secret it answers 503 (logged once).
+ */
+export declare function createMountHandler(options?: AtlasMountOptions): AtlasMountHandlers;
+type VerifyContext = {
+    params: {
+        token?: string | string[];
+    } | Promise<{
+        token?: string | string[];
+    }>;
+};
+/**
+ * The domain-verification file for `app/.well-known/atlas-verify/[token]/route.ts`:
+ * 200 `text/plain` with the token when it equals `ATLAS_VERIFY_TOKEN`
+ * (or `verifyToken`), else 404.
+ */
+export declare function createVerifyHandler(options?: Pick<AtlasMountOptions, 'verifyToken'>): {
+    GET: (request: Request, context?: VerifyContext) => Promise<Response>;
+};
+export {};

package/dist/mount.js

@@ -0,0 +1,174 @@
+"use strict";
+/**
+ * Serve the Atlas Frontend API under a path of your Next.js app (a path mount),
+ * with no reverse proxy of your own: a catch-all App Router route forwards
+ * `/<base>/…` to your instance's Frontend API host with the headers Atlas needs.
+ *
+ * ```ts
+ * // app/atlas/[[...path]]/route.ts
+ * import { createMountHandler } from '@atlasauth/nextjs';
+ * export const { GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD } = createMountHandler({ basePath: '/atlas' });
+ *
+ * // app/.well-known/atlas-verify/[token]/route.ts
+ * import { createVerifyHandler } from '@atlasauth/nextjs';
+ * export const { GET } = createVerifyHandler();
+ * ```
+ *
+ * Use a base path without a leading underscore (`/atlas`, not `/__atlas`): the
+ * App Router treats `_folder` as private and never routes it.
+ *
+ * Web-standard only (`fetch`, `Headers`, `Response`), so it runs on the Node.js
+ * and Edge runtimes.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMountHandler = createMountHandler;
+exports.createVerifyHandler = createVerifyHandler;
+function readEnv() {
+    return globalThis.process?.env ?? {};
+}
+const HOP_BY_HOP = new Set(['connection', 'keep-alive', 'transfer-encoding', 'upgrade', 'te', 'trailer', 'host', 'content-length']);
+const dropRequestHeader = (name) => HOP_BY_HOP.has(name) || name.startsWith('proxy-') || name.startsWith('x-atlas-') || name.startsWith('x-forwarded-') || name === 'forwarded' || name === 'x-real-ip';
+const DROP_RESPONSE = new Set(['connection', 'keep-alive', 'transfer-encoding', 'upgrade', 'te', 'trailer', 'content-encoding', 'content-length', 'set-cookie']);
+const NULL_BODY_STATUS = new Set([101, 204, 205, 304]);
+function setCookies(headers) {
+    const h = headers;
+    if (typeof h.getSetCookie === 'function')
+        return h.getSetCookie();
+    const single = headers.get('set-cookie');
+    return single ? [single] : [];
+}
+/** An IPv4/IPv6 address with any port or brackets stripped, or undefined when `raw` is not one. */
+function normaliseIp(raw) {
+    let v = raw?.trim() ?? '';
+    const bracketed = /^\[([^\]]+)\](?::\d+)?$/.exec(v);
+    if (bracketed)
+        v = bracketed[1];
+    else if (/^[\d.]+:\d+$/.test(v))
+        v = v.slice(0, v.lastIndexOf(':'));
+    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(v))
+        return v.split('.').every((o) => Number(o) <= 255) ? v : undefined;
+    if (!v.includes(':') || !/^[0-9a-fA-F:.]+$/.test(v))
+        return undefined;
+    try {
+        new URL(`http://[${v}]/`); // the WHATWG URL parser validates IPv6 on every runtime
+        return v;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The client IP: `options.clientIp(request)` when given, else the
+ * `X-Forwarded-For` entry `trustedProxyHops` from the right. The browser can
+ * set any `X-Forwarded-For` / `X-Real-IP`, so leftmost entries are never trusted.
+ */
+function clientIp(request, options) {
+    if (options.clientIp)
+        return normaliseIp(options.clientIp(request));
+    const hops = options.trustedProxyHops ?? 1;
+    if (hops <= 0)
+        return undefined;
+    const entries = request.headers.get('x-forwarded-for')?.split(',') ?? [];
+    return entries.length < hops ? undefined : normaliseIp(entries[entries.length - hops]);
+}
+let loggedMisconfig = false;
+/** `/atlas`, normalised: one leading slash, no trailing slash. */
+function normaliseBase(raw) {
+    const base = `/${raw.trim().replace(/^\/+|\/+$/g, '')}`;
+    if (base === '/')
+        throw new Error('@atlasauth/nextjs createMountHandler: basePath must not be "/"');
+    return base;
+}
+/**
+ * App Router handlers that forward the mount to Atlas: method, path (base
+ * included: Atlas reads the prefix from it), query and streamed body unchanged;
+ * hop-by-hop headers dropped. Every incoming `X-Atlas-*`, `X-Forwarded-*`,
+ * `Forwarded` and `X-Real-IP` header is dropped, then set as: `X-Atlas-Forwarded-Host`
+ * from `Host`; `X-Atlas-Proxy-Secret` from config; `X-Atlas-Client-IP` and
+ * `X-Forwarded-For` from `options.clientIp`, else the incoming `X-Forwarded-For`
+ * entry `trustedProxyHops` (default 1) from the right, omitted when absent or not
+ * an IP; `X-Forwarded-Proto` from the last incoming `X-Forwarded-Proto` entry (http or https only),
+ * else the request URL's scheme. The response keeps its status, headers and EVERY
+ * `Set-Cookie`; redirects are returned, not followed. Without an upstream or
+ * proxy secret it answers 503 (logged once).
+ */
+function createMountHandler(options = {}) {
+    const handle = async (request) => {
+        const env = readEnv();
+        const upstream = options.upstream ?? env.ATLAS_UPSTREAM;
+        const proxySecret = options.proxySecret ?? env.ATLAS_PROXY_SECRET;
+        if (!upstream || !proxySecret) {
+            if (!loggedMisconfig) {
+                loggedMisconfig = true;
+                console.error(!upstream
+                    ? '@atlasauth/nextjs createMountHandler: set ATLAS_UPSTREAM (your Frontend API host).'
+                    : '@atlasauth/nextjs createMountHandler: set ATLAS_PROXY_SECRET (POST /v1/instance/proxy_secret).');
+            }
+            return new Response('Atlas is not configured', {
+                status: 503,
+                headers: { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' },
+            });
+        }
+        const base = normaliseBase(options.basePath ?? '/atlas');
+        const url = new URL(request.url);
+        if (url.pathname !== base && !url.pathname.startsWith(`${base}/`)) {
+            return new Response('Not found', { status: 404 });
+        }
+        const origin = new URL(/^https?:\/\//i.test(upstream) ? upstream : `https://${upstream}`).origin;
+        const target = `${origin}${url.pathname}${url.search}`;
+        const headers = new Headers();
+        request.headers.forEach((value, key) => {
+            if (!dropRequestHeader(key.toLowerCase()))
+                headers.set(key, value);
+        });
+        headers.set('x-atlas-forwarded-host', request.headers.get('host') ?? url.host);
+        headers.set('x-atlas-proxy-secret', proxySecret);
+        const ip = clientIp(request, options);
+        if (ip) {
+            headers.set('x-atlas-client-ip', ip);
+            headers.set('x-forwarded-for', ip);
+        }
+        // Rightmost entry (the nearest proxy's), http or https only: a browser-sent value cannot downgrade the scheme.
+        const proto = request.headers.get('x-forwarded-proto')?.split(',').pop()?.trim().toLowerCase();
+        headers.set('x-forwarded-proto', proto === 'http' || proto === 'https' ? proto : url.protocol.replace(':', ''));
+        const method = request.method.toUpperCase();
+        const hasBody = method !== 'GET' && method !== 'HEAD' && request.body !== null;
+        const res = await (options.fetchImpl ?? fetch)(target, {
+            method,
+            headers,
+            body: hasBody ? request.body : undefined,
+            redirect: 'manual',
+            // Required by fetch to stream a request body.
+            ...(hasBody ? { duplex: 'half' } : {}),
+        });
+        const out = new Headers();
+        res.headers.forEach((value, key) => {
+            if (!DROP_RESPONSE.has(key.toLowerCase()))
+                out.append(key, value);
+        });
+        for (const cookie of setCookies(res.headers))
+            out.append('set-cookie', cookie);
+        const body = method === 'HEAD' || NULL_BODY_STATUS.has(res.status) ? null : res.body;
+        return new Response(body, { status: res.status, statusText: res.statusText, headers: out });
+    };
+    return { GET: handle, POST: handle, PUT: handle, PATCH: handle, DELETE: handle, OPTIONS: handle, HEAD: handle };
+}
+/**
+ * The domain-verification file for `app/.well-known/atlas-verify/[token]/route.ts`:
+ * 200 `text/plain` with the token when it equals `ATLAS_VERIFY_TOKEN`
+ * (or `verifyToken`), else 404.
+ */
+function createVerifyHandler(options = {}) {
+    return {
+        async GET(request, context) {
+            const expected = options.verifyToken ?? readEnv().ATLAS_VERIFY_TOKEN;
+            const fromParams = context ? (await context.params).token : undefined;
+            const token = (Array.isArray(fromParams) ? fromParams[0] : fromParams) ??
+                decodeURIComponent(new URL(request.url).pathname.split('/').filter(Boolean).pop() ?? '');
+            if (!expected || token !== expected)
+                return new Response('Not found', { status: 404 });
+            return new Response(token, { status: 200, headers: { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' } });
+        },
+    };
+}
+//# sourceMappingURL=mount.js.map

package/dist/mount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.js","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;AA6GH,gDA+DC;AASD,kDAcC;AA/LD,SAAS,OAAO;IACd,OAAQ,UAA0C,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACxE,CAAC;AAuCD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACpI,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,EAAE,CACzC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,CAAC;AACtK,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC;AACjK,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAEvD,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,CAAC,GAAG,OAAsD,CAAC;IACjE,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChC,CAAC;AAED,mGAAmG;AACnG,SAAS,WAAW,CAAC,GAAuB;IAC1C,IAAI,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,SAAS;QAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;SAC5B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,wDAAwD;QACnF,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,OAAgB,EAAE,OAA0B;IAC5D,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC;IAC3C,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACzE,OAAO,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,kEAAkE;AAClE,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;IACxD,IAAI,IAAI,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,kBAAkB,CAAC,UAA6B,EAAE;IAChE,MAAM,MAAM,GAAY,KAAK,EAAE,OAAO,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,cAAc,CAAC;QACxD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,kBAAkB,CAAC;QAClE,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,eAAe,GAAG,IAAI,CAAC;gBACvB,OAAO,CAAC,KAAK,CACX,CAAC,QAAQ;oBACP,CAAC,CAAC,oFAAoF;oBACtF,CAAC,CAAC,gGAAgG,CACrG,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE;gBAC7C,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE;aACtF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC;QAEzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjG,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAEvD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,EAAE,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,+GAA+G;QAC/G,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/F,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAEhH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE;YACrD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACxC,QAAQ,EAAE,QAAQ;YAClB,8CAA8C;YAC9C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxB,CAAC,CAAC;QAElB,MAAM,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,KAAK,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACrF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9F,CAAC,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClH,CAAC;AAID;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,UAAkD,EAAE;IAGtF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO;YACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC,kBAAkB,CAAC;YACrE,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,MAAM,KAAK,GACT,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;gBACxD,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACvF,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACrI,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/proxy.d.ts

@@ -31,6 +31,8 @@ export declare const ATLAS_AUTH_HEADERS: {
     readonly sessionId: "x-atlas-session-id";
     readonly orgId: "x-atlas-org-id";
     readonly orgRole: "x-atlas-org-role";
+    /** With `csrf`: the CSRF token valid for this session, to render into forms (`atlas_csrf`). */
+    readonly csrfToken: "x-atlas-csrf-token";
 };
 /** What `atlasProxy` needs from a request: a `NextRequest` satisfies it. */
 export interface ProxyRequest extends EdgeRequest {
@@ -46,18 +48,43 @@ export interface HeaderCarryingResponse {
     headers: Headers;
 }
 export type AtlasProxy = (request: ProxyRequest) => Promise<Response | null>;
+/** Options for {@link AtlasProxyOptions.csrf}. */
+export interface AtlasProxyCsrfOptions {
+    /**
+     * The HMAC secret (16+ characters). Default `ATLAS_CSRF_SECRET`, else derived
+     * from `ATLAS_SECRET_KEY` (HKDF), so `verifyCsrf` in your own handlers can use
+     * the same one.
+     */
+    secret?: string;
+    /** Your Frontend API path mount, which Atlas protects itself. Default `ATLAS_BASE_PATH` or `/atlas`. */
+    mountBasePath?: string;
+}
+export interface AtlasProxyOptions extends AtlasMiddlewareOptions {
+    /**
+     * CSRF protection for signed-in browsers. The proxy keeps a session-bound
+     * token in the `__atlas_csrf` cookie (readable by your JS) and refuses a
+     * POST / PUT / PATCH / DELETE with 403 unless it carries the same token in
+     * the `x-atlas-csrf` header or an `atlas_csrf` form field. Requests with
+     * `Authorization: Bearer`, signed-out requests and the mount base path are
+     * exempt. The cookie is set by {@link withAtlasHeaders}; server components
+     * read the token from the `x-atlas-csrf-token` request header.
+     */
+    csrf?: boolean | AtlasProxyCsrfOptions;
+}
 /**
  * The Next.js 16 `proxy.ts` entry for Atlas. Same options, same decisions as
  * `atlasMiddleware` (they share one engine) — only the calling convention
  * differs: it takes just the request and resolves to `Response | null`.
  */
-export declare function atlasProxy(options: AtlasMiddlewareOptions): AtlasProxy;
+export declare function atlasProxy(options: AtlasProxyOptions): AtlasProxy;
 /**
  * The auth state the proxy resolved for this request (signed-out if the proxy
  * hasn't run on it). For extra checks inside `proxy.ts` itself — a role gate on
  * `/admin`, say — without verifying the token again.
  */
 export declare function proxyAuth(request: object): AuthState;
+/** The CSRF token `atlasProxy({ csrf })` holds for this request (null without `csrf` or when signed out). */
+export declare function proxyCsrfToken(request: object): string | null;
 /**
  * Forward the verified session to the app as `x-atlas-*` REQUEST headers on a
  * response produced by any later step of the chain (`NextResponse.next()`, a
@@ -84,6 +111,8 @@ export interface ForwardedAuth {
     sessionId: string | null;
     orgId: string | null;
     orgRole: string | null;
+    /** With `atlasProxy({ csrf })`: the token to render as the `atlas_csrf` form field. */
+    csrfToken: string | null;
 }
 /**
  * Read the `x-atlas-*` headers the proxy forwarded (e.g. from `await headers()`

package/dist/proxy.js

@@ -3,8 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ATLAS_AUTH_HEADERS = void 0;
 exports.atlasProxy = atlasProxy;
 exports.proxyAuth = proxyAuth;
+exports.proxyCsrfToken = proxyCsrfToken;
 exports.withAtlasHeaders = withAtlasHeaders;
 exports.readAtlasHeaders = readAtlasHeaders;
+const backend_1 = require("@atlasauth/backend");
 const middleware_1 = require("./middleware");
 /**
  * Next.js 16 renamed `middleware.ts` to `proxy.ts` (exporting `proxy` or a
@@ -38,6 +40,8 @@ exports.ATLAS_AUTH_HEADERS = {
     sessionId: 'x-atlas-session-id',
     orgId: 'x-atlas-org-id',
     orgRole: 'x-atlas-org-role',
+    /** With `csrf`: the CSRF token valid for this session, to render into forms (`atlas_csrf`). */
+    csrfToken: 'x-atlas-csrf-token',
 };
 const ATLAS_HEADER_PREFIX = 'x-atlas-';
 const OVERRIDE_LIST = 'x-middleware-override-headers';
@@ -45,6 +49,53 @@ const OVERRIDE_PREFIX = 'x-middleware-request-';
 /** Auth state per request, recorded by the proxy for `withAtlasHeaders` /
  *  `proxyAuth`. Weak, so a finished request's state is collected with it. */
 const resolved = new WeakMap();
+/** The CSRF token per request, and whether the cookie must be (re)set. */
+const csrfState = new WeakMap();
+const UNSAFE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+function readEnv() {
+    return globalThis.process?.env ?? {};
+}
+function csrfCookie(token, secure) {
+    return `${backend_1.CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax${secure ? '; Secure' : ''}`;
+}
+function underBase(pathname, base) {
+    return pathname === base || pathname.startsWith(`${base}/`);
+}
+/** The CSRF gate: a 403 to return, or null after recording the request's token. */
+function createCsrfGate(option) {
+    const config = option === true ? {} : option;
+    let secret;
+    return async function gate(request, auth) {
+        if (!auth.sessionId)
+            return null;
+        if (request.headers.get('authorization')?.startsWith('Bearer '))
+            return null;
+        const env = readEnv();
+        const base = `/${(config.mountBasePath ?? env.ATLAS_BASE_PATH ?? '/atlas').replace(/^\/+|\/+$/g, '')}`;
+        if (underBase(request.nextUrl.pathname, base))
+            return null;
+        if (!secret) {
+            secret = config.secret ?? env.ATLAS_CSRF_SECRET ?? (env.ATLAS_SECRET_KEY ? (0, backend_1.deriveCsrfSecret)(env.ATLAS_SECRET_KEY) : undefined);
+            if (!secret)
+                throw new Error('@atlasauth/nextjs atlasProxy({ csrf }): set ATLAS_CSRF_SECRET or ATLAS_SECRET_KEY.');
+        }
+        const opts = { sid: auth.sessionId, secret };
+        const secure = !(request.url ?? '').startsWith('http:');
+        const existing = (0, backend_1.readCookieValue)(request.headers.get('cookie'), backend_1.CSRF_COOKIE);
+        const state = existing && (0, backend_1.checkCsrfToken)(existing, opts)
+            ? { token: existing, setCookie: false, secure }
+            : { token: (0, backend_1.csrfToken)(opts), setCookie: true, secure };
+        csrfState.set(request, state);
+        if (!UNSAFE_METHODS.has((request.method ?? 'GET').toUpperCase()))
+            return null;
+        if (await (0, backend_1.verifyCsrf)(request, opts))
+            return null;
+        const headers = new Headers({ 'content-type': 'application/json' });
+        if (state.setCookie)
+            headers.append('set-cookie', csrfCookie(state.token, secure));
+        return new Response(JSON.stringify({ errors: [{ code: 'CSRF_TOKEN_INVALID' }] }), { status: 403, headers });
+    };
+}
 function serializeCookie({ name, value, options }) {
     // Same encoding Next's `response.cookies.set` applies, so readers agree.
     const parts = [`${name}=${encodeURIComponent(value)}`];
@@ -70,12 +121,13 @@ function serializeCookie({ name, value, options }) {
  */
 function atlasProxy(options) {
     const decide = (0, middleware_1.createAtlasDecider)(options);
+    const csrfGate = options.csrf ? createCsrfGate(options.csrf) : null;
     return async function proxy(request) {
         const decision = await decide(request);
         resolved.set(request, decision.auth);
         switch (decision.kind) {
             case 'continue':
-                return null;
+                return csrfGate ? csrfGate(request, decision.auth) : null;
             case 'unauthorized':
                 return new Response(JSON.stringify(middleware_1.UNAUTHENTICATED_BODY), {
                     status: 401,
@@ -100,7 +152,11 @@ function atlasProxy(options) {
 function proxyAuth(request) {
     return resolved.get(request) ?? middleware_1.SIGNED_OUT;
 }
-function authHeaderValues(auth) {
+/** The CSRF token `atlasProxy({ csrf })` holds for this request (null without `csrf` or when signed out). */
+function proxyCsrfToken(request) {
+    return csrfState.get(request)?.token ?? null;
+}
+function authHeaderValues(auth, csrf) {
     const values = [
         [exports.ATLAS_AUTH_HEADERS.status, auth.userId ? 'signed-in' : 'signed-out'],
     ];
@@ -112,6 +168,8 @@ function authHeaderValues(auth) {
         values.push([exports.ATLAS_AUTH_HEADERS.orgId, auth.orgId]);
     if (auth.orgRole)
         values.push([exports.ATLAS_AUTH_HEADERS.orgRole, auth.orgRole]);
+    if (csrf)
+        values.push([exports.ATLAS_AUTH_HEADERS.csrfToken, csrf]);
     return values;
 }
 /**
@@ -133,6 +191,15 @@ function authHeaderValues(auth) {
  * signed-out if it didn't run.
  */
 function withAtlasHeaders(request, response, auth = proxyAuth(request)) {
+    const csrf = csrfState.get(request);
+    if (csrf?.setCookie) {
+        try {
+            response.headers.append('set-cookie', csrfCookie(csrf.token, csrf.secure));
+        }
+        catch {
+            // Immutable headers (a bare `Response.redirect`): the next response sets it.
+        }
+    }
     const continues = response.headers.has('x-middleware-next') || response.headers.has('x-middleware-rewrite');
     if (!continues)
         return response;
@@ -164,7 +231,7 @@ function withAtlasHeaders(request, response, auth = proxyAuth(request)) {
             response.headers.set(`${OVERRIDE_PREFIX}${name}`, value);
         });
     }
-    for (const [name, value] of authHeaderValues(auth)) {
+    for (const [name, value] of authHeaderValues(auth, csrf?.token)) {
         names.add(name);
         response.headers.set(`${OVERRIDE_PREFIX}${name}`, value);
     }
@@ -186,6 +253,7 @@ function readAtlasHeaders(headers) {
         sessionId: signedIn ? headers.get(exports.ATLAS_AUTH_HEADERS.sessionId) : null,
         orgId: signedIn ? headers.get(exports.ATLAS_AUTH_HEADERS.orgId) : null,
         orgRole: signedIn ? headers.get(exports.ATLAS_AUTH_HEADERS.orgRole) : null,
+        csrfToken: signedIn ? headers.get(exports.ATLAS_AUTH_HEADERS.csrfToken) : null,
     };
 }
 //# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":";;;AAyFA,gCA0BC;AAOD,8BAEC;AA+BD,4CAyCC;AAiBD,4CAUC;AA/ND,6CAQsB;AAEtB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;iDACiD;AACpC,QAAA,kBAAkB,GAAG;IAChC,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,iBAAiB;IACzB,SAAS,EAAE,oBAAoB;IAC/B,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE,kBAAkB;CACnB,CAAC;AAEX,MAAM,mBAAmB,GAAG,UAAU,CAAC;AACvC,MAAM,aAAa,GAAG,+BAA+B,CAAC;AACtD,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAmBhD;6EAC6E;AAC7E,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAqB,CAAC;AAElD,SAAS,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAe;IAC5D,yEAAyE;IACzE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,OAA+B;IACxD,MAAM,MAAM,GAAG,IAAA,+BAAkB,EAAC,OAAO,CAAC,CAAC;IAE3C,OAAO,KAAK,UAAU,KAAK,CAAC,OAAO;QACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAErC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC;YAEd,KAAK,cAAc;gBACjB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,iCAAoB,CAAC,EAAE;oBACxD,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CAAC,CAAC;YAEL,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,mEAAmE;gBACnE,oEAAoE;gBACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7D,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO;oBAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,OAAe;IACvC,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,uBAAU,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAe;IACvC,MAAM,MAAM,GAA4B;QACtC,CAAC,0BAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;KACtE,CAAC;IACF,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,IAAI,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,gBAAgB,CAC9B,OAAqB,EACrB,QAAW,EACX,OAAkB,SAAS,CAAC,OAAO,CAAC;IAEpC,MAAM,SAAS,GACb,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC5F,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEhC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,yEAAyE;QACzE,wDAAwD;QACxD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACzC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,8DAA8D;QAC9D,gFAAgF;QAChF,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBAAE,OAAO;YACjD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAWD;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,OAA6C;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,MAAM,CAAC,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3F,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAChC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QACtE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9D,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;KACnE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":";;;AA2KA,gCA2BC;AAOD,8BAEC;AAGD,wCAEC;AAgCD,4CAiDC;AAmBD,4CAWC;AAnUD,gDAO4B;AAC5B,6CAQsB;AAEtB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;iDACiD;AACpC,QAAA,kBAAkB,GAAG;IAChC,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,iBAAiB;IACzB,SAAS,EAAE,oBAAoB;IAC/B,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE,kBAAkB;IAC3B,+FAA+F;IAC/F,SAAS,EAAE,oBAAoB;CACvB,CAAC;AAEX,MAAM,mBAAmB,GAAG,UAAU,CAAC;AACvC,MAAM,aAAa,GAAG,+BAA+B,CAAC;AACtD,MAAM,eAAe,GAAG,uBAAuB,CAAC;AA4ChD;6EAC6E;AAC7E,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAqB,CAAC;AAClD,0EAA0E;AAC1E,MAAM,SAAS,GAAG,IAAI,OAAO,EAAkE,CAAC;AAEhG,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEnE,SAAS,OAAO;IACd,OAAQ,UAAyE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACvG,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,MAAe;IAChD,OAAO,GAAG,qBAAW,IAAI,kBAAkB,CAAC,KAAK,CAAC,yBAAyB,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACxG,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,IAAY;IAC/C,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,mFAAmF;AACnF,SAAS,cAAc,CAAC,MAAoC;IAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,MAA0B,CAAC;IAC/B,OAAO,KAAK,UAAU,IAAI,CAAC,OAAqB,EAAE,IAAe;QAC/D,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7E,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;QACvG,IAAI,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAA,0BAAgB,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC/H,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;QACrH,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,IAAA,yBAAe,EAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,qBAAW,CAAC,CAAC;QAC7E,MAAM,KAAK,GACT,QAAQ,IAAI,IAAA,wBAAc,EAAC,QAAQ,EAAE,IAAI,CAAC;YACxC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;YAC/C,CAAC,CAAC,EAAE,KAAK,EAAE,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1D,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAE9B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9E,IAAI,MAAM,IAAA,oBAAU,EAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,SAAS;YAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACnF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9G,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAe;IAC5D,yEAAyE;IACzE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,OAA0B;IACnD,MAAM,MAAM,GAAG,IAAA,+BAAkB,EAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEpE,OAAO,KAAK,UAAU,KAAK,CAAC,OAAO;QACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAErC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,UAAU;gBACb,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAE5D,KAAK,cAAc;gBACjB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,iCAAoB,CAAC,EAAE;oBACxD,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CAAC,CAAC;YAEL,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,mEAAmE;gBACnE,oEAAoE;gBACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7D,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO;oBAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,OAAe;IACvC,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,uBAAU,CAAC;AAC7C,CAAC;AAED,6GAA6G;AAC7G,SAAgB,cAAc,CAAC,OAAe;IAC5C,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAe,EAAE,IAAa;IACtD,MAAM,MAAM,GAA4B;QACtC,CAAC,0BAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;KACtE,CAAC;IACF,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,IAAI,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,IAAI,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,gBAAgB,CAC9B,OAAqB,EACrB,QAAW,EACX,OAAkB,SAAS,CAAC,OAAO,CAAC;IAEpC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GACb,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC5F,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEhC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,yEAAyE;QACzE,wDAAwD;QACxD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACzC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,8DAA8D;QAC9D,gFAAgF;QAChF,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBAAE,OAAO;YACjD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAChE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAaD;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,OAA6C;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,MAAM,CAAC,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3F,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAChC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QACtE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9D,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;QAClE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACvE,CAAC;AACJ,CAAC"}

package/dist/server.d.ts

@@ -105,3 +105,5 @@ export declare function getAtlasInitialState(options?: {
 }, env?: Env): Promise<AtlasInitialState>;
 export type { AtlasClient, AtlasClientConfig } from '@atlasauth/backend';
 export type { AuthState, CurrentUser, EdgeRequest } from './middleware';
+export { createMountHandler, createVerifyHandler } from './mount';
+export type { AtlasMountHandlers, AtlasMountOptions } from './mount';

package/dist/server.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.createVerifyHandler = exports.createMountHandler = void 0;
 exports.configFromEnv = configFromEnv;
 exports.backendConfigFromEnv = backendConfigFromEnv;
 exports.atlasClient = atlasClient;
@@ -249,4 +250,8 @@ async function getAtlasInitialState(options = {}, env = readEnv()) {
         state.environment = environment;
     return state;
 }
+// The Frontend API path mount and its domain-verification file, for route handlers.
+var mount_1 = require("./mount");
+Object.defineProperty(exports, "createMountHandler", { enumerable: true, get: function () { return mount_1.createMountHandler; } });
+Object.defineProperty(exports, "createVerifyHandler", { enumerable: true, get: function () { return mount_1.createVerifyHandler; } });
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,sCA6BC;AAOD,oDAOC;AAOD,kCAUC;AAsBD,4CAsBC;AA2DD,oBAGC;AAMD,kCAGC;AAsBD,oDA0CC;AAlSD;;;;;;;;;;;;;;GAcG;AACH,gDAI4B;AAC5B,6CAMsB;AAItB,mFAAmF;AACnF,SAAS,OAAO;IACd,OAAQ,UAA0C,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,6CAA6C;AAC7C,SAAS,IAAI,CAAC,GAAQ,EAAE,GAAG,KAAwB;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,MAAW,OAAO,EAAE;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,0BAA0B,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAG,IAAI,CAC/B,GAAG,EACH,0BAA0B,EAC1B,sCAAsC,CACvC,CAAC;IACF,MAAM,iBAAiB,GAAG,oBAAoB;QAC5C,CAAC,CAAC,oBAAoB;aACjB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IAE/F,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,MAAW,OAAO,EAAE;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACzF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,YAAwC,EAAE;IACpE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,4EAA4E;IAC5E,+EAA+E;IAC/E,sBAAsB;IACtB,OAAO,IAAA,2BAAiB,EAAC;QACvB,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,EAAE;QACrE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,eAAe,EAAE,2BAA2B,CAAC;QACrG,KAAK,EAAE,SAAS,CAAC,KAAK;KACvB,CAAC,CAAC;AACL,CAAC;AAaD;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAC9B,WAA4B,EAC5B,WAA4B;IAE5B,MAAM,aAAa,GAAG,WAAW;SAC9B,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;IACpG,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC;IAE/D,OAAO;QACL,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACzB,OAAO,EAAE;YACP,GAAG,CAAC,IAAY;gBACd,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/B,IAAI,GAAG,KAAK,QAAQ;oBAAE,OAAO,YAAY,CAAC;gBAC1C,IAAI,GAAG,KAAK,eAAe;oBAAE,OAAO,aAAa,CAAC;gBAClD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;YACvC,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,wDAAa,cAAc,GAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;IACpC,OAAO,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,OAA+B;IAC/C,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnG,CAAC;AAED,IAAI,eAAqF,CAAC;AAC1F,SAAS,aAAa;IACpB,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACpD,eAAe,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,IAAA,6BAAgB,EAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,eAAe,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,IAAI,sBAES,CAAC;AACd,SAAS,oBAAoB;IAC3B,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,sBAAsB,IAAI,sBAAsB,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QAClE,sBAAsB,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,sBAAsB,CAAC,EAAE,CAAC;AACnC,CAAC;AAMD;;;;;;GAMG;AACI,KAAK,UAAU,IAAI;IACxB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;AAChD,CAAC;AAsBM,KAAK,UAAU,oBAAoB,CACxC,UAOI,EAAE,EACN,MAAW,OAAO,EAAE;IAEpB,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,gCAAgC,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvF,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAE5C,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE;QACnD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;gBAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE;gBAC5E,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC;aACvE,CAAC,CAAC;YAClB,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;IAC5G,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;IAChF,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,KAAK,CAAC,WAAW,GAAG,WAAW,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,sCA6BC;AAOD,oDAOC;AAOD,kCAUC;AAsBD,4CAsBC;AA2DD,oBAGC;AAMD,kCAGC;AAsBD,oDA0CC;AAlSD;;;;;;;;;;;;;;GAcG;AACH,gDAI4B;AAC5B,6CAMsB;AAItB,mFAAmF;AACnF,SAAS,OAAO;IACd,OAAQ,UAA0C,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,6CAA6C;AAC7C,SAAS,IAAI,CAAC,GAAQ,EAAE,GAAG,KAAwB;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,MAAW,OAAO,EAAE;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,0BAA0B,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAG,IAAI,CAC/B,GAAG,EACH,0BAA0B,EAC1B,sCAAsC,CACvC,CAAC;IACF,MAAM,iBAAiB,GAAG,oBAAoB;QAC5C,CAAC,CAAC,oBAAoB;aACjB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IAE/F,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,MAAW,OAAO,EAAE;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACzF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,YAAwC,EAAE;IACpE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,4EAA4E;IAC5E,+EAA+E;IAC/E,sBAAsB;IACtB,OAAO,IAAA,2BAAiB,EAAC;QACvB,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,EAAE;QACrE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,eAAe,EAAE,2BAA2B,CAAC;QACrG,KAAK,EAAE,SAAS,CAAC,KAAK;KACvB,CAAC,CAAC;AACL,CAAC;AAaD;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAC9B,WAA4B,EAC5B,WAA4B;IAE5B,MAAM,aAAa,GAAG,WAAW;SAC9B,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;IACpG,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC;IAE/D,OAAO;QACL,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACzB,OAAO,EAAE;YACP,GAAG,CAAC,IAAY;gBACd,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/B,IAAI,GAAG,KAAK,QAAQ;oBAAE,OAAO,YAAY,CAAC;gBAC1C,IAAI,GAAG,KAAK,eAAe;oBAAE,OAAO,aAAa,CAAC;gBAClD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;YACvC,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,wDAAa,cAAc,GAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;IACpC,OAAO,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,OAA+B;IAC/C,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnG,CAAC;AAED,IAAI,eAAqF,CAAC;AAC1F,SAAS,aAAa;IACpB,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACpD,eAAe,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,IAAA,6BAAgB,EAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,eAAe,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,IAAI,sBAES,CAAC;AACd,SAAS,oBAAoB;IAC3B,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,sBAAsB,IAAI,sBAAsB,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QAClE,sBAAsB,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,sBAAsB,CAAC,EAAE,CAAC;AACnC,CAAC;AAMD;;;;;;GAMG;AACI,KAAK,UAAU,IAAI;IACxB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;AAChD,CAAC;AAsBM,KAAK,UAAU,oBAAoB,CACxC,UAOI,EAAE,EACN,MAAW,OAAO,EAAE;IAEpB,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,gCAAgC,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvF,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAE5C,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE;QACnD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;gBAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE;gBAC5E,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC;aACvE,CAAC,CAAC;YAClB,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;IAC5G,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;IAChF,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,KAAK,CAAC,WAAW,GAAG,WAAW,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC;AAKD,oFAAoF;AACpF,iCAAkE;AAAzD,2GAAA,kBAAkB,OAAA;AAAE,4GAAA,mBAAmB,OAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/nextjs",
-  "version": "0.8.1",
+  "version": "0.10.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -19,7 +19,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/backend": "0.27.1"
+    "@atlasauth/backend": "0.37.0"
   },
   "peerDependencies": {
     "next": ">=13.4"