@atlasauth/backend 0.14.1 → 0.16.0

package/dist/client/actions.d.ts

@@ -40,15 +40,34 @@ export interface ActionTestEvent {
         email?: string;
         emailVerified?: boolean;
         metadata?: Record<string, unknown>;
+        /** The user's organization memberships, as `event.user.organizations`. */
+        organizations?: Array<{
+            id: string;
+            slug: string;
+            name: string;
+            role: string;
+        }>;
     };
     connection?: {
         strategy?: string;
     };
+    /** `country` is the ISO code `event.request.country` should carry. */
     request?: {
         ip?: string;
         user_agent?: string;
+        country?: string;
     };
 }
+/** An outbound request the code queued with `api.http` (a dry run sends nothing). */
+export interface ActionTestHttpRequest {
+    method: 'GET' | 'POST';
+    /** Query values are masked. */
+    url: string;
+    /** Header names only; values are never echoed. */
+    header_names: string[];
+    has_body: boolean;
+    save_response_as: string | null;
+}
 /** What an action produced against a sample event — no real data is touched. */
 export interface ActionTestResult {
     object: 'action_test_result';
@@ -59,6 +78,8 @@ export interface ActionTestResult {
     id_token_claims: Record<string, unknown>;
     app_metadata: Record<string, unknown>;
     logs: string[];
+    /** What the code queued with `api.http`; sent only on a real post_login / post_user_registration run. */
+    http_requests?: ActionTestHttpRequest[];
     error: string | null;
 }
 /** The ordered binding list for a trigger, replaced atomically as a set. */

package/dist/client/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AAwEA,0CAkCC;AA1GD,uCAAgD;AAwEhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AAwFA,0CAkCC;AA1HD,uCAAgD;AAwFhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/api-keys.d.ts

@@ -20,11 +20,31 @@ export interface ApiKey {
     limits?: ApiKeyLimit[] | null;
     /** Each cap with its current-window usage (empty when the key has no caps). */
     usage?: ApiKeyLimitState[];
+    /** A disabled key fails verify until re-enabled (it is not revoked). */
+    enabled?: boolean;
+    /** Per-key verify rate limit, or null. */
+    rate_limit?: ApiKeyRateLimit | null;
+    /** Uses left (each successful verify spends one); null = unlimited. */
+    remaining?: number | null;
     last_used_at: number | null;
     expires_at: number | null;
     revoked_at: number | null;
     created_at: number;
 }
+/** At most `max` successful verifies per `window_seconds`. */
+export interface ApiKeyRateLimit {
+    max: number;
+    window_seconds: number;
+}
+/** Controls shared by create and update. */
+export interface ApiKeyControls {
+    /** Default true. A disabled key fails verify and cannot mint tokens. */
+    enabled?: boolean;
+    /** Per-key verify rate limit; null removes it. */
+    rate_limit?: ApiKeyRateLimit | null;
+    /** Uses left; null = unlimited. */
+    remaining?: number | null;
+}
 /** The window a spend cap counts over. `request` caps a single debit; `day`/`month` are UTC calendar windows; `total` never resets. */
 export type ApiKeyLimitPeriod = 'request' | 'day' | 'month' | 'total';
 /** A per-key spend cap, metered with {@link apiKeysResource} `recordUsage`. */
@@ -103,17 +123,21 @@ export interface ApiKeyWithSecret extends ApiKey {
     secret: string;
     note: string;
 }
-export interface CreateApiKeyBody {
+export interface CreateApiKeyBody extends ApiKeyControls {
     subject_type: ApiKeySubjectType;
     subject_id: string;
     name?: string;
     claims?: Record<string, unknown>;
-    /** Epoch ms; null (or omitted) never expires. */
+    /** Epoch ms; null never expires (omitted: the instance default lifetime, if any). */
     expires_at?: number | null;
+    /** Relative expiry; mutually exclusive with `expires_at`. */
+    expires_in_seconds?: number;
+    /** Custom secret prefix (e.g. `acme` gives `acme_<id>_<secret>`). */
+    prefix?: string;
     /** Per-key spend caps, metered with `recordUsage`. */
     limits?: ApiKeyLimit[] | null;
 }
-export interface UpdateApiKeyBody {
+export interface UpdateApiKeyBody extends ApiKeyControls {
     name?: string | null;
     claims?: Record<string, unknown>;
     expires_at?: number | null;
@@ -128,6 +152,19 @@ export interface UpdateApiKeyBody {
 export type ApiKeyVerification = {
     object: 'api_key_verification';
     valid: false;
+} | {
+    /**
+     * A live key refused by its own policy: `insufficient_scope` (see
+     * `missing_scopes`), `rate_limited` (retry after `retry_after_ms`) or
+     * `usage_exhausted` (no uses left).
+     */
+    object: 'api_key_verification';
+    valid: false;
+    code: 'insufficient_scope' | 'rate_limited' | 'usage_exhausted';
+    id: string;
+    missing_scopes?: string[];
+    retry_after_ms?: number;
+    remaining?: number;
 } | {
     object: 'api_key_verification';
     valid: true;
@@ -144,6 +181,8 @@ export type ApiKeyVerification = {
     usage?: ApiKeyLimitState[];
     last_used_at: number | null;
     expires_at?: number | null;
+    /** Uses left after this verify (null = unlimited). */
+    remaining?: number | null;
 };
 /**
  * §P1-8 a short-lived, offline-verifiable access JWT minted from a long-lived
@@ -193,7 +232,13 @@ export declare function apiKeysResource(request: RequestFn): {
     /** Mint a key. The secret is returned once, here. */
     create(body: CreateApiKeyBody, idempotencyKey?: string): Promise<ApiKeyWithSecret>;
     /** Check a presented secret. Rate-limited — it is an online credential check. */
-    verify(secret: string): Promise<ApiKeyVerification>;
+    /**
+     * Verify a presented key. `required_scopes`: every one must be on the key,
+     * else `{ valid: false, code: 'insufficient_scope' }`.
+     */
+    verify(secret: string, options?: {
+        required_scopes?: string[];
+    }): Promise<ApiKeyVerification>;
     get(id: string): Promise<ApiKey>;
     update(id: string, body: UpdateApiKeyBody): Promise<ApiKey>;
     /** Revoke a key. It stays queryable but never authenticates again. */

package/dist/client/api-keys.js

@@ -13,8 +13,12 @@ function apiKeysResource(request) {
             return request({ method: 'POST', path: '/v1/api_keys', body, idempotencyKey });
         },
         /** Check a presented secret. Rate-limited — it is an online credential check. */
-        verify(secret) {
-            return request({ method: 'POST', path: '/v1/api_keys/verify', body: { secret } });
+        /**
+         * Verify a presented key. `required_scopes`: every one must be on the key,
+         * else `{ valid: false, code: 'insufficient_scope' }`.
+         */
+        verify(secret, options = {}) {
+            return request({ method: 'POST', path: '/v1/api_keys/verify', body: { secret, ...options } });
         },
         get(id) {
             return request({ method: 'GET', path: `/v1/api_keys/${(0, request_1.enc)(id)}` });

package/dist/client/api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/client/api-keys.ts"],"names":[],"mappings":";;AA2MA,0CAyDC;AApQD,uCAAgD;AA2MhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,KAGJ;YACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,qDAAqD;QACrD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,iFAAiF;QACjF,MAAM,CAAC,MAAc;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;;;;;WAOG;QACH,WAAW,CAAC,EAAU,EAAE,IAA2B;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,iFAAiF;QACjF,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,IAAyB;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD;;;WAGG;QACH,WAAW,CAAC,QAAiC,EAAE;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/client/api-keys.ts"],"names":[],"mappings":";;AAqPA,0CA6DC;AAlTD,uCAAgD;AAqPhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,KAGJ;YACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,qDAAqD;QACrD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,iFAAiF;QACjF;;;WAGG;QACH,MAAM,CAAC,MAAc,EAAE,UAA0C,EAAE;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;;;;;WAOG;QACH,WAAW,CAAC,EAAU,EAAE,IAA2B;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,iFAAiF;QACjF,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,IAAyB;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD;;;WAGG;QACH,WAAW,CAAC,QAAiC,EAAE;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/app-roles.d.ts

@@ -0,0 +1,76 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * App-level (instance-wide) user roles: roles that are not tied to an
+ * organization, each granting permission keys like `tickets:read`. A user's
+ * role keys and the union of their permissions travel on the session token as
+ * `app_roles` / `app_permissions`; check them offline with
+ * `has(claims, { appPermission: 'tickets:read' })` or `hasAppPermission`.
+ */
+export interface AppRole {
+    object: 'app_role';
+    id: string;
+    key: string;
+    name: string;
+    description: string | null;
+    permissions: string[];
+    /** On list and create only. */
+    users_count?: number;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateAppRoleBody {
+    /** 2-64 lowercase letters, digits, _ or -, starting with a letter. */
+    key: string;
+    name: string;
+    description?: string | null;
+    /** `resource:action` keys (the `org:` namespace is reserved for organizations). */
+    permissions?: string[];
+}
+export interface UpdateAppRoleBody {
+    name?: string;
+    description?: string | null;
+    permissions?: string[];
+}
+export interface UserAppRoles {
+    object: 'user_app_roles';
+    user_id: string;
+    roles: AppRole[];
+    role_keys: string[];
+    permissions: string[];
+}
+/**
+ * Change a user's app roles: `roles` replaces the set; `add`/`remove` change it
+ * (role keys or ids). Send one form, not both.
+ */
+export type SetUserAppRolesBody = {
+    roles: string[];
+} | {
+    add?: string[];
+    remove?: string[];
+};
+export declare function appRolesResource(request: RequestFn): {
+    list(): Promise<ListPage<AppRole>>;
+    create(body: CreateAppRoleBody): Promise<AppRole>;
+    /** By id or key. */
+    get(idOrKey: string): Promise<AppRole>;
+    update(idOrKey: string, body: UpdateAppRoleBody): Promise<AppRole>;
+    delete(idOrKey: string): Promise<{
+        object: "app_role";
+        id: string;
+        deleted: true;
+    }>;
+    /** The users holding a role. */
+    listUsers(idOrKey: string, query?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<ListPage<{
+        object: "user_app_role";
+        user_id: string;
+        role: string;
+    }>>;
+    /** A user's app roles and effective permissions. */
+    getForUser(userId: string): Promise<UserAppRoles>;
+    setForUser(userId: string, body: SetUserAppRolesBody): Promise<UserAppRoles>;
+    removeFromUser(userId: string, idOrKey: string): Promise<UserAppRoles>;
+};

package/dist/client/app-roles.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.appRolesResource = appRolesResource;
+const request_1 = require("./request");
+function appRolesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/app_roles' });
+        },
+        create(body) {
+            return request({ method: 'POST', path: '/v1/app_roles', body });
+        },
+        /** By id or key. */
+        get(idOrKey) {
+            return request({ method: 'GET', path: `/v1/app_roles/${(0, request_1.enc)(idOrKey)}` });
+        },
+        update(idOrKey, body) {
+            return request({ method: 'PATCH', path: `/v1/app_roles/${(0, request_1.enc)(idOrKey)}`, body });
+        },
+        delete(idOrKey) {
+            return request({ method: 'DELETE', path: `/v1/app_roles/${(0, request_1.enc)(idOrKey)}` });
+        },
+        /** The users holding a role. */
+        listUsers(idOrKey, query = {}) {
+            return request({ method: 'GET', path: `/v1/app_roles/${(0, request_1.enc)(idOrKey)}/users`, query });
+        },
+        /** A user's app roles and effective permissions. */
+        getForUser(userId) {
+            return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(userId)}/app_roles` });
+        },
+        setForUser(userId, body) {
+            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(userId)}/app_roles`, body });
+        },
+        removeFromUser(userId, idOrKey) {
+            return request({ method: 'DELETE', path: `/v1/users/${(0, request_1.enc)(userId)}/app_roles/${(0, request_1.enc)(idOrKey)}` });
+        },
+    };
+}
+//# sourceMappingURL=app-roles.js.map

package/dist/client/app-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-roles.js","sourceRoot":"","sources":["../../src/client/app-roles.ts"],"names":[],"mappings":";;AAoDA,4CAoCC;AAxFD,uCAAgD;AAoDhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,CAAC,IAAuB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,oBAAoB;QACpB,GAAG,CAAC,OAAe;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,OAAe,EAAE,IAAuB;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,CAAC,OAAe;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,gCAAgC;QAChC,SAAS,CACP,OAAe,EACf,QAA6C,EAAE;YAE/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,oDAAoD;QACpD,UAAU,CAAC,MAAc;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,UAAU,CAAC,MAAc,EAAE,IAAyB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,cAAc,CAAC,MAAc,EAAE,OAAe;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,cAAc,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/attack-protection.d.ts

@@ -25,8 +25,39 @@ export interface AttackProtection {
         secret_set: boolean;
         managed_by: 'auth_config_and_captcha_secret';
     };
+    /** Read-only reflections of auth_config.attackProtection. */
+    country_restrictions?: {
+        mode: 'off' | 'allow' | 'deny';
+        countries: string[];
+        sign_up: boolean;
+        sign_in: boolean;
+        block_unknown: boolean;
+        managed_by: 'auth_config';
+    };
+    device_accounts?: {
+        enabled: boolean;
+        max_accounts: number;
+        window_days: number;
+        managed_by: 'auth_config';
+    };
+    /** Dormant-account reactivation alerts (writable). */
+    dormant_accounts?: DormantAccountsSettings;
+}
+/**
+ * When an account idle for `threshold_days` signs in again: an audit entry, the
+ * `user.reactivated` webhook, an optional security notice to the user, and —
+ * with `require_mfa` — a second-factor step-up (`on_no_factor` decides for an
+ * account without one).
+ */
+export interface DormantAccountsSettings {
+    enabled: boolean;
+    /** 1–3650; default 90. */
+    threshold_days: number;
+    require_mfa: boolean;
+    on_no_factor: 'allow' | 'require_enroll' | 'block';
+    notify_user: boolean;
 }
-/** Only the two flags are writable; the rest of the object is read-only. */
+/** The writable parts; the rest of the object is read-only. */
 export interface UpdateAttackProtectionBody {
     brute_force?: {
         enabled?: boolean;
@@ -34,6 +65,7 @@ export interface UpdateAttackProtectionBody {
     breached_password?: {
         enabled?: boolean;
     };
+    dormant_accounts?: Partial<DormantAccountsSettings>;
 }
 export declare function attackProtectionResource(request: RequestFn): {
     get(): Promise<AttackProtection>;

package/dist/client/attack-protection.js.map

@@ -1 +1 @@
-{"version":3,"file":"attack-protection.js","sourceRoot":"","sources":["../../src/client/attack-protection.ts"],"names":[],"mappings":";;AAkCA,4DASC;AATD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"attack-protection.js","sourceRoot":"","sources":["../../src/client/attack-protection.ts"],"names":[],"mappings":";;AA8DA,4DASC;AATD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/billing-plans.d.ts

@@ -15,11 +15,22 @@ export interface BillingPlan {
     amount: string | null;
     currency: string;
     features: string[];
+    /** Numeric limits the plan grants (the `ent.limits` claim); `-1` = unlimited. */
+    limits?: Record<string, unknown>;
     audience: string;
     active: boolean;
+    /** stripe | polar | dodo | creem | chargebee | autumn | commet */
+    provider?: BillingProviderName;
+    /** The plan's price reference on its provider. */
+    provider_price_id?: string | null;
+    /** `base`: the subject's main plan. `addon`: bought alongside it; several may be live. */
+    kind?: 'base' | 'addon';
+    /** Autumn plans: the feature whose usage tracks the org's member count. */
+    seat_feature_id?: string | null;
     created_at: number;
     updated_at: number;
 }
+export type BillingProviderName = 'stripe' | 'polar' | 'dodo' | 'creem' | 'chargebee' | 'autumn' | 'commet';
 /**
  * A read view of who is subscribed. `status` is written ONLY by the verified
  * Stripe webhook, never through this SDK.
@@ -34,9 +45,55 @@ export interface BillingSubscription {
     stripe_subscription_id: string | null;
     stripe_customer_id: string | null;
     current_period_end: number | null;
+    provider?: BillingProviderName;
+    provider_subscription_id?: string | null;
+    provider_customer_id?: string | null;
+    quantity?: number;
+    cancel_at_period_end?: boolean;
+    /** What an entitlement provider (Autumn, Commet) reports this subscription grants. */
+    entitlements?: {
+        features: string[];
+        limits: Record<string, number>;
+    } | null;
     created_at: number;
     updated_at: number;
 }
+/** How numeric limits merge when a subject holds several entitling subscriptions. */
+export interface BillingSettings {
+    object: 'billing_settings';
+    default_limit_merge: 'max' | 'sum';
+    limit_merge: Record<string, 'max' | 'sum'>;
+}
+export interface UpdateBillingSettingsBody {
+    default_limit_merge?: 'max' | 'sum';
+    /** Limit key → `max` | `sum`; replaces the stored map. */
+    limit_merge?: Record<string, 'max' | 'sum'>;
+}
+/** May a subject use a feature? */
+export interface CheckBillingFeatureBody {
+    subject_type: 'user' | 'org';
+    subject_id: string;
+    feature: string;
+    /** Units about to be used (default 1). */
+    required?: number;
+}
+export interface BillingFeatureCheck {
+    object: 'billing_feature_check';
+    feature: string;
+    allowed: boolean;
+    /** `provider`: asked live of Autumn/Commet; `atlas`: from the resolved entitlement. */
+    source: 'provider' | 'atlas';
+    provider: string | null;
+    remaining: number | null;
+    granted: number | null;
+    usage: number | null;
+    unlimited: boolean;
+}
+export interface ChangeBillingSubscriptionBody {
+    plan_id: string;
+    interval?: 'month' | 'year';
+    schedule_at_period_end?: boolean;
+}
 export interface CreateBillingPlanBody {
     name: string;
     slug: string;
@@ -49,6 +106,13 @@ export interface CreateBillingPlanBody {
     /** One of `user`, `org`. Defaults to `user`. */
     audience?: string;
     active?: boolean;
+    limits?: Record<string, unknown>;
+    provider?: BillingProviderName;
+    provider_price_id?: string;
+    /** `base` (default) or `addon`. */
+    kind?: 'base' | 'addon';
+    /** Autumn: one of the plan's features; its usage follows the org's member count. */
+    seat_feature_id?: string | null;
 }
 export interface UpdateBillingPlanBody {
     name?: string;
@@ -60,6 +124,12 @@ export interface UpdateBillingPlanBody {
     features?: string[];
     audience?: string;
     active?: boolean;
+    limits?: Record<string, unknown>;
+    provider?: BillingProviderName;
+    provider_price_id?: string;
+    kind?: 'base' | 'addon';
+    /** `null` clears it. */
+    seat_feature_id?: string | null;
 }
 /** Filter the subscription read view to one subject. */
 export interface ListSubscriptionsParams {
@@ -83,6 +153,10 @@ export interface ReportBillingUsageBody {
     /** Non-negative. */
     quantity: number;
     idempotency_key: string;
+    /** Count against this provider feature (an Autumn feature id / Commet feature code). */
+    feature?: string;
+    /** Attribute to this subscription when the subject holds several. */
+    subscription_id?: string;
 }
 export interface BillingUsageReport {
     object: 'billing_usage';
@@ -109,6 +183,25 @@ export declare function billingResource(request: RequestFn): {
         deleted: true;
     }>;
     listSubscriptions(params?: ListSubscriptionsParams): Promise<ListPage<BillingSubscription>>;
+    /** One subscription by id (a subject may hold several: a base plan + add-ons). */
+    getSubscription(id: string): Promise<BillingSubscription>;
+    /** Move one subscription to another plan or interval (now, or at the period end). */
+    changeSubscription(id: string, body: ChangeBillingSubscriptionBody): Promise<BillingSubscription & {
+        scheduled: boolean;
+    }>;
+    /** Cancel one subscription at the period end (default) or now. */
+    cancelSubscription(id: string, body?: {
+        immediately?: boolean;
+    }): Promise<BillingSubscription>;
+    /** Undo a cancellation scheduled for the period end. */
+    restoreSubscription(id: string): Promise<BillingSubscription>;
+    /** Mirror a plan's features/limits from its provider (Autumn, Commet). */
+    syncPlanEntitlements(id: string): Promise<BillingPlan>;
+    /** How limits merge across a subject's several subscriptions. */
+    getSettings(): Promise<BillingSettings>;
+    updateSettings(body: UpdateBillingSettingsBody): Promise<BillingSettings>;
+    /** May a subject use a feature? Live from Autumn/Commet when the subject is on one. */
+    checkFeature(body: CheckBillingFeatureBody): Promise<BillingFeatureCheck>;
     /**
      * Adopt an EXISTING Stripe subscription onto a user/org + plan, for
      * migrating billing into Atlas without re-charging. Read-only on Stripe.

package/dist/client/billing-plans.js

@@ -22,6 +22,37 @@ function billingResource(request) {
         listSubscriptions(params) {
             return request({ method: 'GET', path: '/v1/billing/subscriptions', query: { ...params } });
         },
+        /** One subscription by id (a subject may hold several: a base plan + add-ons). */
+        getSubscription(id) {
+            return request({ method: 'GET', path: `/v1/billing/subscriptions/${(0, request_1.enc)(id)}` });
+        },
+        /** Move one subscription to another plan or interval (now, or at the period end). */
+        changeSubscription(id, body) {
+            return request({ method: 'POST', path: `/v1/billing/subscriptions/${(0, request_1.enc)(id)}/change`, body });
+        },
+        /** Cancel one subscription at the period end (default) or now. */
+        cancelSubscription(id, body = {}) {
+            return request({ method: 'POST', path: `/v1/billing/subscriptions/${(0, request_1.enc)(id)}/cancel`, body });
+        },
+        /** Undo a cancellation scheduled for the period end. */
+        restoreSubscription(id) {
+            return request({ method: 'POST', path: `/v1/billing/subscriptions/${(0, request_1.enc)(id)}/restore` });
+        },
+        /** Mirror a plan's features/limits from its provider (Autumn, Commet). */
+        syncPlanEntitlements(id) {
+            return request({ method: 'POST', path: `/v1/billing/plans/${(0, request_1.enc)(id)}/sync_entitlements` });
+        },
+        /** How limits merge across a subject's several subscriptions. */
+        getSettings() {
+            return request({ method: 'GET', path: '/v1/billing/settings' });
+        },
+        updateSettings(body) {
+            return request({ method: 'PUT', path: '/v1/billing/settings', body });
+        },
+        /** May a subject use a feature? Live from Autumn/Commet when the subject is on one. */
+        checkFeature(body) {
+            return request({ method: 'POST', path: '/v1/billing/check', body });
+        },
         /**
          * Adopt an EXISTING Stripe subscription onto a user/org + plan, for
          * migrating billing into Atlas without re-charging. Read-only on Stripe.

package/dist/client/billing-plans.js.map

@@ -1 +1 @@
-{"version":3,"file":"billing-plans.js","sourceRoot":"","sources":["../../src/client/billing-plans.ts"],"names":[],"mappings":";;AA8GA,0CAkDC;AAhKD,uCAAgD;AA8GhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,UAAU,CAAC,IAA2B,EAAE,cAAuB;YAC7D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,IAA2B;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,iBAAiB,CAAC,MAAgC;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD;;;WAGG;QACH,kBAAkB,CAChB,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,kCAAkC;gBACxC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,wFAAwF;QACxF,WAAW,CAAC,IAA4B;YACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,WAA2B,EAAE,SAAiB;YACtD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,WAAW,CAAC,IAAI,IAAA,aAAG,EAAC,SAAS,CAAC,aAAa;aAC9E,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"billing-plans.js","sourceRoot":"","sources":["../../src/client/billing-plans.ts"],"names":[],"mappings":";;AA2LA,0CAiFC;AA5QD,uCAAgD;AA2LhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,UAAU,CAAC,IAA2B,EAAE,cAAuB;YAC7D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,IAA2B;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,iBAAiB,CAAC,MAAgC;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,kFAAkF;QAClF,eAAe,CAAC,EAAU;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,qFAAqF;QACrF,kBAAkB,CAAC,EAAU,EAAE,IAAmC;YAChE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,kEAAkE;QAClE,kBAAkB,CAAC,EAAU,EAAE,OAAkC,EAAE;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,wDAAwD;QACxD,mBAAmB,CAAC,EAAU;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,0EAA0E;QAC1E,oBAAoB,CAAC,EAAU;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,iEAAiE;QACjE,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,cAAc,CAAC,IAA+B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,uFAAuF;QACvF,YAAY,CAAC,IAA6B;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,kBAAkB,CAChB,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,kCAAkC;gBACxC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,wFAAwF;QACxF,WAAW,CAAC,IAA4B;YACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,WAA2B,EAAE,SAAiB;YACtD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,WAAW,CAAC,IAAI,IAAA,aAAG,EAAC,SAAS,CAAC,aAAa;aAC9E,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}