@atlasauth/backend 0.23.0 → 0.25.0

package/dist/client/access-policies.d.ts

@@ -0,0 +1,100 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export type AccessPolicyStage = 'sign_in' | 'authorize' | 'token';
+export type AccessPolicyGrantType = 'allow' | 'block' | 'require_mfa' | 'require_acr' | 'require_policy_acceptance' | 'require_action';
+export interface AccessPolicyGrant {
+    type: AccessPolicyGrantType;
+    /** require_acr: the acr; require_policy_acceptance: the policy key; require_action: the action name. */
+    value?: string;
+}
+/** Every present condition must match; an absent one matches anything. */
+export interface AccessPolicyConditions {
+    applications?: string[];
+    userIds?: string[];
+    groups?: string[];
+    orgs?: string[];
+    roles?: string[];
+    networkZones?: {
+        include?: string[];
+        exclude?: string[];
+    };
+    countries?: string[];
+    riskLevels?: Array<'low' | 'medium' | 'high'>;
+    deviceTrust?: Array<'trusted' | 'untrusted' | 'unknown'>;
+    authMethods?: string[];
+    timeWindow?: {
+        days?: number[];
+        start: string;
+        end: string;
+        timezone?: string;
+    };
+}
+/** A conditional-access policy, evaluated at sign-in, /authorize and token issuance. */
+export interface AccessPolicy {
+    object: 'access_policy';
+    id: string;
+    name: string;
+    description: string | null;
+    enabled: boolean;
+    priority: number;
+    stages: AccessPolicyStage[];
+    conditions: AccessPolicyConditions;
+    grants: AccessPolicyGrant[];
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateAccessPolicyBody {
+    name: string;
+    description?: string | null;
+    enabled?: boolean;
+    priority?: number;
+    stages?: AccessPolicyStage[];
+    conditions?: AccessPolicyConditions;
+    grants: AccessPolicyGrant[];
+}
+export type UpdateAccessPolicyBody = Partial<CreateAccessPolicyBody>;
+export interface SimulateAccessBody {
+    policy_id?: string;
+    stage?: AccessPolicyStage;
+    ip?: string;
+    application_id?: string;
+    user_id?: string;
+    groups?: string[];
+    orgs?: string[];
+    roles?: string[];
+    country?: string;
+    risk_level?: 'low' | 'medium' | 'high';
+    device_trust?: 'trusted' | 'untrusted' | 'unknown';
+    auth_methods?: string[];
+    mfa_verified?: boolean;
+    acr?: string[];
+    /** Epoch ms; default now. */
+    now?: number;
+}
+export interface AccessPolicySimulation {
+    object: 'access_policy_simulation';
+    decision: 'allow' | 'block' | 'step_up';
+    matched: string[];
+    blocked_by: string | null;
+    requirements: {
+        mfa: boolean;
+        acr: string[];
+        policy_acceptance: string[];
+        actions: string[];
+    };
+    unmet: string[];
+}
+/** CRUD over conditional-access policies, plus a what-if `simulate`. */
+export declare function accessPoliciesResource(request: RequestFn): {
+    list(): Promise<ListPage<AccessPolicy>>;
+    get(id: string): Promise<AccessPolicy>;
+    create(body: CreateAccessPolicyBody, idempotencyKey?: string): Promise<AccessPolicy>;
+    update(id: string, body: UpdateAccessPolicyBody): Promise<AccessPolicy>;
+    delete(id: string): Promise<{
+        object: "access_policy";
+        id: string;
+        deleted: true;
+    }>;
+    /** What would the policies decide for this request? */
+    simulate(body: SimulateAccessBody): Promise<AccessPolicySimulation>;
+};

package/dist/client/access-policies.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.accessPoliciesResource = accessPoliciesResource;
+const request_1 = require("./request");
+/** CRUD over conditional-access policies, plus a what-if `simulate`. */
+function accessPoliciesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/access_policies' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/access_policies/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/access_policies', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/access_policies/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/access_policies/${(0, request_1.enc)(id)}` });
+        },
+        /** What would the policies decide for this request? */
+        simulate(body) {
+            return request({ method: 'POST', path: '/v1/access_policies/simulate', body });
+        },
+    };
+}
+//# sourceMappingURL=access-policies.js.map

package/dist/client/access-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-policies.js","sourceRoot":"","sources":["../../src/client/access-policies.ts"],"names":[],"mappings":";;AAmFA,wDAsBC;AAzGD,uCAAgD;AAkFhD,wEAAwE;AACxE,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA4B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,uDAAuD;QACvD,QAAQ,CAAC,IAAwB;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/action-gallery.d.ts

@@ -7,7 +7,7 @@ import type { ListPage } from './types';
  * actions up to date, and publish your own templates for review.
  */
 /** Every trigger a template can target (a superset of the classic three). */
-export type GalleryTrigger = ActionTrigger | 'pre_organization_create' | 'pre_member_add' | 'pre_invitation_create';
+export type GalleryTrigger = ActionTrigger;
 /** A secret a template reads, declared by NAME; values are never part of a template. */
 export interface ActionTemplateSecret {
     name: string;

package/dist/client/action-gallery.js.map

@@ -1 +1 @@
-{"version":3,"file":"action-gallery.js","sourceRoot":"","sources":["../../src/client/action-gallery.ts"],"names":[],"mappings":";;AA6LA,sDAuBC;AAED,0DAmCC;AAzPD,uCAAgD;AA6LhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,+BAA+B;QAC/B,IAAI,CAAC,SAA8B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,6DAA6D;QAC7D,GAAG,CAAC,IAAY;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,kFAAkF;QAClF,OAAO,CAAC,IAAY,EAAE,OAA4B,EAAE,EAAE,cAAuB;YAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,8DAA8D;QAC9D,QAAQ;YACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,iEAAiE;QACjE,MAAM,CAAC,QAAgB,EAAE,OAA6C,EAAE;YACtE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,IAA8B,EAAE,cAAuB;YAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,IAAwB;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,aAAa,CAAC,EAAU,EAAE,OAAe;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,aAAa,CAAC,EAAU,EAAE,OAAe;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,0DAA0D;QAC1D,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,gEAAgE;QAChE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"action-gallery.js","sourceRoot":"","sources":["../../src/client/action-gallery.ts"],"names":[],"mappings":";;AAyLA,sDAuBC;AAED,0DAmCC;AArPD,uCAAgD;AAyLhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,+BAA+B;QAC/B,IAAI,CAAC,SAA8B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,6DAA6D;QAC7D,GAAG,CAAC,IAAY;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,kFAAkF;QAClF,OAAO,CAAC,IAAY,EAAE,OAA4B,EAAE,EAAE,cAAuB;YAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,8DAA8D;QAC9D,QAAQ;YACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,iEAAiE;QACjE,MAAM,CAAC,QAAgB,EAAE,OAA6C,EAAE;YACtE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,IAA8B,EAAE,cAAuB;YAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,IAAwB;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,aAAa,CAAC,EAAU,EAAE,OAAe;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,aAAa,CAAC,EAAU,EAAE,OAAe;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,0DAA0D;QAC1D,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,gEAAgE;QAChE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/actions.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The fixed point in the auth pipeline an action runs at. */
-export type ActionTrigger = 'post_login' | 'pre_user_registration' | 'post_user_registration';
+export type ActionTrigger = 'post_login' | 'pre_user_registration' | 'post_user_registration' | 'pre_organization_create' | 'pre_member_add' | 'pre_invitation_create' | 'pre_authentication' | 'pre_token' | 'post_token_exchange' | 'pre_user_update' | 'mfa_verification_attempt' | 'password_verification_attempt' | 'account_link_decision' | 'billing_plan_selected' | 'post_change_password' | 'post_password_reset' | 'post_user_update' | 'post_email_verified' | 'post_mfa_enroll' | 'post_mfa_remove' | 'post_logout' | 'org_membership_changed' | 'custom_challenge_create' | 'custom_challenge_verify' | 'workflow_step';
 /**
  * Tenant code run in the hardened isolate at a trigger. Secret VALUES are
  * write-only and never returned — a read reports only `secret_names`. Timestamps
@@ -12,27 +12,96 @@ export interface Action {
     id: string;
     name: string;
     trigger: ActionTrigger;
+    /** The JavaScript of a `node` Action; empty for an `http` one. */
     code: string;
-    runtime: string;
+    /** `node` runs `code` in the sandbox; `http` calls `http_target.url`. */
+    runtime: 'node' | 'http' | (string & {});
+    /** An `http` Action's endpoint; null for a `node` one. */
+    http_target: ActionHttpTarget | null;
     enabled: boolean;
     secret_names: string[];
     created_at: number;
     updated_at: number;
 }
+/** Where an `http` Action sends the event. Timestamps are epoch milliseconds. */
+export interface ActionHttpTarget {
+    url: string;
+    /** 500 to 5000; default 3000. */
+    timeout_ms: number;
+    /** What a failed call does: `closed` (default) refuses a gate, `open` carries on. */
+    failure_mode: 'open' | 'closed';
+}
 export interface CreateActionBody {
     name: string;
     trigger: ActionTrigger;
-    code: string;
+    /** Required for a `node` Action; an `http` Action has none. */
+    code?: string;
+    /** `node` (default) or `http`: call your own HTTPS endpoint instead of running code. */
+    runtime?: 'node' | 'http';
+    /** Required when `runtime` is `http`. */
+    http_target?: {
+        url: string;
+        timeout_ms?: number;
+        failure_mode?: 'open' | 'closed';
+    };
+    /** `http` only: your own 16 to 512 character secret. Omit it and Atlas generates one, returned once. */
+    signing_secret?: string;
     enabled?: boolean;
     /** Write-only, encrypted at rest, never read back. */
     secrets?: Record<string, string>;
 }
+/** The create/update response of an `http` Action carries a generated signing secret once. */
+export type ActionWithSecret = Action & {
+    signing_secret?: string;
+};
 export interface UpdateActionBody {
     name?: string;
     code?: string;
+    /** `http` only; omitted settings keep their value. */
+    http_target?: {
+        url?: string;
+        timeout_ms?: number;
+        failure_mode?: 'open' | 'closed';
+    };
+    /** `http` only: replace the signing secret with your own. */
+    signing_secret?: string;
+    /** `http` only: generate a new signing secret, returned once on the response. */
+    rotate_signing_secret?: boolean;
     enabled?: boolean;
     secrets?: Record<string, string>;
 }
+/** One call to an `http` Action's endpoint. */
+export interface ActionHttpCall {
+    object: 'action_http_call';
+    id: string;
+    action_id: string;
+    trigger: ActionTrigger;
+    user_id: string | null;
+    /** A dry-run test call; kept out of the stats. */
+    test: boolean;
+    status: 'ok' | 'denied' | 'timeout' | 'error' | 'invalid_response';
+    http_status: number | null;
+    latency_ms: number | null;
+    error: string | null;
+    /** What the endpoint answered with, reduced to the names it set. */
+    answer: Record<string, unknown> | null;
+    created_at: number;
+}
+export interface ActionHttpCallList {
+    object: 'list';
+    data: ActionHttpCall[];
+    has_more: boolean;
+    next_cursor: string | null;
+    /** Real (non-test) calls in the last 24 hours. */
+    stats: {
+        calls_24h: number;
+        denied_24h: number;
+        failed_24h: number;
+        timeouts_24h: number;
+        p95_latency_ms: number | null;
+        last_failed_at: number | null;
+    };
+}
 /** The sample event a dry-run runs against; every field has a stand-in default. */
 export interface ActionTestEvent {
     user?: {
@@ -50,6 +119,7 @@ export interface ActionTestEvent {
     };
     connection?: {
         strategy?: string;
+        method?: string;
     };
     /** `country` is the ISO code `event.request.country` should carry. */
     request?: {
@@ -57,6 +127,16 @@ export interface ActionTestEvent {
         user_agent?: string;
         country?: string;
     };
+    /** The per-trigger `event.context` (token type, changed fields, MFA result, …). */
+    context?: Record<string, unknown>;
+    /** Registration triggers: the typed sign-up field values (`event.signUpFields`). */
+    sign_up_fields?: Record<string, string>;
+    /** Organization triggers: `event.organization`. */
+    organization?: {
+        id?: string | null;
+        name?: string;
+        slug?: string;
+    };
 }
 /** An outbound request the code queued with `api.http` (a dry run sends nothing). */
 export interface ActionTestHttpRequest {
@@ -68,6 +148,17 @@ export interface ActionTestHttpRequest {
     has_body: boolean;
     save_response_as: string | null;
 }
+/** Edits to the user an Action asked for. */
+export interface ActionUserEdits {
+    banned?: {
+        value: boolean;
+        reason: string | null;
+    };
+    emailVerified?: boolean;
+    firstName?: string | null;
+    lastName?: string | null;
+    imageUrl?: string | null;
+}
 /** What an action produced against a sample event — no real data is touched. */
 export interface ActionTestResult {
     object: 'action_test_result';
@@ -77,8 +168,33 @@ export interface ActionTestResult {
     access_token_claims: Record<string, unknown>;
     id_token_claims: Record<string, unknown>;
     app_metadata: Record<string, unknown>;
+    /** Set when the code called `api.access.lock()`; a real run locks the account for 15 minutes. */
+    lock_reason?: string | null;
+    challenge?: {
+        prompt: string;
+        hint: string | null;
+        state: unknown;
+    } | null;
+    challenge_accepted?: {
+        amr: string[];
+    } | null;
+    /** `pre_token`: the claims the code asked to remove. */
+    suppressed_access_claims?: string[];
+    suppressed_id_claims?: string[];
+    /** An `http` Action only: how the endpoint call went (the test really calls it, flagged `test`). */
+    http_call?: {
+        status: string;
+        http_status: number | null;
+        latency_ms: number | null;
+        error: string | null;
+    };
+    /** `api.user.setBanned/setEmailVerified/setName/setImage`, as a real run would apply them. */
+    user_edits?: ActionUserEdits;
+    /** Registration triggers: `api.signUp.prefill` and `modify`. */
+    sign_up_prefill?: Record<string, string>;
+    sign_up_modify?: Record<string, string>;
     logs: string[];
-    /** What the code queued with `api.http`; sent only on a real post_login / post_user_registration run. */
+    /** What the code queued with `api.http`; sent only on a real run of a post_login or side-effect trigger. */
     http_requests?: ActionTestHttpRequest[];
     error: string | null;
 }
@@ -90,9 +206,9 @@ export interface ActionBindingList {
 }
 export declare function actionsResource(request: RequestFn): {
     list(): Promise<ListPage<Action>>;
-    create(body: CreateActionBody, idempotencyKey?: string): Promise<Action>;
+    create(body: CreateActionBody, idempotencyKey?: string): Promise<ActionWithSecret>;
     get(id: string): Promise<Action>;
-    update(id: string, body: UpdateActionBody): Promise<Action>;
+    update(id: string, body: UpdateActionBody): Promise<ActionWithSecret>;
     delete(id: string): Promise<{
         object: "action";
         id: string;
@@ -100,6 +216,13 @@ export declare function actionsResource(request: RequestFn): {
     }>;
     /** Dry-run against a sample event in the sandbox; nothing is persisted. */
     test(id: string, event?: ActionTestEvent): Promise<ActionTestResult>;
+    /** The call log of an `http` Action, newest first, with 24 hour stats. */
+    calls(id: string, query?: {
+        limit?: number;
+        status?: "ok" | "denied" | "failed" | "timeout" | "error" | "invalid_response";
+        test?: boolean;
+        starting_after?: string;
+    }): Promise<ActionHttpCallList>;
     /** The actions bound to a trigger, in run order. */
     getBindings(trigger: ActionTrigger): Promise<ActionBindingList>;
     /** Replace a trigger's ordered binding set. */

package/dist/client/actions.js

@@ -23,6 +23,10 @@ function actionsResource(request) {
         test(id, event = {}) {
             return request({ method: 'POST', path: `/v1/actions/${(0, request_1.enc)(id)}/test`, body: { event } });
         },
+        /** The call log of an `http` Action, newest first, with 24 hour stats. */
+        calls(id, query = {}) {
+            return request({ method: 'GET', path: `/v1/actions/${(0, request_1.enc)(id)}/calls`, query });
+        },
         /** The actions bound to a trigger, in run order. */
         getBindings(trigger) {
             return request({ method: 'GET', path: `/v1/actions/bindings/${(0, request_1.enc)(trigger)}` });

package/dist/client/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AAwFA,0CAkCC;AA1HD,uCAAgD;AAwFhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AA8MA,0CAyCC;AAvPD,uCAAgD;AA8MhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,0EAA0E;QAC1E,KAAK,CACH,EAAU,EACV,QAAqJ,EAAE;YAEvJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/analytics-reports.d.ts

@@ -0,0 +1,215 @@
+import { type RequestFn } from './request';
+import type { DeletedObject } from './types';
+/** The window every analytics read takes: `from`/`to` (epoch ms or ISO 8601) or `days`, at most 180. */
+export interface AnalyticsParams {
+    from?: number | string;
+    to?: number | string;
+    days?: number;
+    granularity?: 'day' | 'week' | 'month';
+    /** Only members of this organization (not available for failures). */
+    organization_id?: string;
+}
+export interface AnalyticsReport<Row> {
+    object: string;
+    window: {
+        from: number;
+        to: number;
+        granularity: string;
+        organization_id: string | null;
+    };
+    data: Row[];
+    [meta: string]: unknown;
+}
+export interface FunnelRow {
+    method: string;
+    started: number;
+    completed: number;
+    abandoned: number;
+    in_progress: number;
+    needs_first_factor: number;
+    needs_second_factor: number;
+    needs_email_verification: number;
+    completion_rate: number;
+}
+export interface JourneyFunnelRow {
+    step: string;
+    held: number;
+    completed: number;
+    applied: number;
+    denied: number;
+    completion_rate: number;
+}
+export interface FailureRow {
+    phase: string;
+    reason: string;
+    method: string;
+    count: number;
+    share: number;
+}
+export interface BreakdownRow {
+    value: string;
+    count: number;
+    share: number;
+}
+export interface ActiveUsersRow {
+    bucket: string;
+    active_users: number;
+    new_users: number;
+    returning_users: number;
+    sign_ins: number;
+}
+export interface PasskeyAdoptionRow {
+    bucket: string;
+    passkey_sign_ins: number;
+    sign_ins: number;
+    passkey_share: number;
+}
+export interface InactiveUserRow {
+    user_id: string;
+    email: string | null;
+    last_sign_in_at: string | null;
+    created_at: string;
+}
+export interface MfaCoverageRow {
+    protection: string;
+    users: number;
+    share: number;
+}
+export interface AccessByAppRow {
+    client_id: string;
+    name: string;
+    users: number;
+    active_grants: number;
+    users_in_window: number;
+}
+export type AlertMetric = 'sign_in_success_rate' | 'failed_passkey_ratio' | 'failed_sign_ins' | 'sign_in_p95_seconds' | 'api_usage_spike';
+export type UsageSubjectType = 'api_key' | 'end_user_api_key' | 'organization';
+/** One key's or organization's API usage against its 7-day hourly baseline. */
+export interface ApiUsageSubject {
+    type: UsageSubjectType;
+    id: string;
+    current: number;
+    current_per_hour: number;
+    baseline_per_hour: number;
+    /** current_per_hour / baseline_per_hour (the baseline is floored at 1 request an hour). */
+    ratio: number;
+    error_rate: number;
+}
+export interface AnalyticsAlertRule {
+    object: 'analytics_alert_rule';
+    id: string;
+    name: string;
+    metric: AlertMetric;
+    comparator: 'lt' | 'gt';
+    threshold: number;
+    window_minutes: number;
+    min_sample: number;
+    cooldown_minutes: number;
+    email_contacts: string[];
+    webhook_url: string | null;
+    has_webhook_secret: boolean;
+    enabled: boolean;
+    subject_type: UsageSubjectType | null;
+    subject_id: string | null;
+    ssf: boolean;
+    state: 'ok' | 'firing';
+    last_value: number | null;
+    last_evaluated_at: number | null;
+    last_triggered_at: number | null;
+    last_error: string | null;
+    created_at: number;
+}
+export interface AnalyticsAlertRuleInput {
+    name: string;
+    metric: AlertMetric;
+    comparator: 'lt' | 'gt';
+    threshold: number;
+    /** 5 to 1440 (default 60). */
+    window_minutes?: number;
+    /** Ratios and latency are not evaluated on fewer observations (default 20). */
+    min_sample?: number;
+    /** Minutes between notifications while the rule stays firing (default 60). */
+    cooldown_minutes?: number;
+    email_contacts?: string[];
+    /** A public HTTPS endpoint; the body is signed like any Atlas webhook. */
+    webhook_url?: string | null;
+    enabled?: boolean;
+    /** api_usage_spike: which kind of subject to watch (null = all). */
+    subject_type?: UsageSubjectType | null;
+    /** api_usage_spike: one key or organization (needs subject_type). */
+    subject_id?: string | null;
+    /** Also raise a Shared Signals event when the rule fires. */
+    ssf?: boolean;
+}
+export declare function analyticsResource(request: RequestFn): {
+    /** Where sign-in (or sign-up) attempts end, per method. */
+    funnel: (params?: AnalyticsParams & {
+        kind?: "sign_in" | "sign_up";
+    }) => Promise<AnalyticsReport<FunnelRow>>;
+    /** What happened at each step of a sign-in journey. */
+    journeyFunnel: (params: Omit<AnalyticsParams, "organization_id"> & {
+        journey_id: string;
+    }) => Promise<AnalyticsReport<JourneyFunnelRow>>;
+    /** Failed attempts by reason and method. */
+    failures: (params?: Omit<AnalyticsParams, "organization_id">) => Promise<AnalyticsReport<FailureRow>>;
+    /** Sign-ins by method, device, browser, os or country. */
+    breakdown: (params?: AnalyticsParams & {
+        dimension?: "method" | "device" | "browser" | "os" | "country";
+    }) => Promise<AnalyticsReport<BreakdownRow>>;
+    /** DAU/WAU/MAU and a series, with new vs returning users. */
+    activeUsers: (params?: AnalyticsParams) => Promise<AnalyticsReport<ActiveUsersRow>>;
+    passkeyAdoption: (params?: AnalyticsParams) => Promise<AnalyticsReport<PasskeyAdoptionRow>>;
+    /** API usage per secret key, end-user API key or organization against its own baseline, highest ratio first. */
+    apiUsage: (params?: {
+        subject_type?: UsageSubjectType;
+        subject_id?: string;
+        window_minutes?: number;
+    }) => Promise<{
+        object: "api_usage";
+        window_minutes: number;
+        baseline_hours: number;
+        generated_at: number;
+        data: ApiUsageSubject[];
+    }>;
+    reports: {
+        inactiveUsers: (params?: AnalyticsParams & {
+            inactive_days?: number;
+            limit?: number;
+            starting_after?: string;
+        }) => Promise<AnalyticsReport<InactiveUserRow>>;
+        mfaCoverage: (params?: AnalyticsParams) => Promise<AnalyticsReport<MfaCoverageRow>>;
+        accessByApp: (params?: AnalyticsParams) => Promise<AnalyticsReport<AccessByAppRow>>;
+    };
+    /**
+     * Any analytics read as CSV text, e.g. `exportCsv('breakdown', { dimension: 'country' })`.
+     * For Parquet call the same path with `format=parquet` over HTTP (a binary body).
+     */
+    exportCsv: (report: "funnel" | "failures" | "breakdown" | "active_users" | "passkey_adoption" | "reports/inactive_users" | "reports/mfa_coverage" | "reports/access_by_app", params?: object) => Promise<string>;
+    alertRules: {
+        list(): Promise<{
+            object: "list";
+            data: AnalyticsAlertRule[];
+            has_more: boolean;
+        }>;
+        get(id: string): Promise<AnalyticsAlertRule>;
+        /** A webhook rule's `webhook_secret` is in this response only. */
+        create(body: AnalyticsAlertRuleInput, idempotencyKey?: string): Promise<AnalyticsAlertRule & {
+            webhook_secret?: string;
+        }>;
+        update(id: string, body: Partial<AnalyticsAlertRuleInput>): Promise<AnalyticsAlertRule & {
+            webhook_secret?: string;
+        }>;
+        delete(id: string): Promise<DeletedObject>;
+        /** Measure now; `notify: true` also sends the rule's email and webhook. */
+        test(id: string, body?: {
+            notify?: boolean;
+        }): Promise<{
+            object: "analytics_alert_test";
+            value: number | null;
+            sample: number;
+            subject: ApiUsageSubject | null;
+            notified: boolean;
+            error: string | null;
+        }>;
+    };
+};

package/dist/client/analytics-reports.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyticsResource = analyticsResource;
+const request_1 = require("./request");
+function analyticsResource(request) {
+    const read = (path, params) => request({ method: 'GET', path, query: { ...params } });
+    const csv = (path, params) => request({ method: 'GET', path, query: { ...params, format: 'csv' }, raw: true });
+    return {
+        /** Where sign-in (or sign-up) attempts end, per method. */
+        funnel: (params = {}) => read('/v1/analytics/funnel', params),
+        /** What happened at each step of a sign-in journey. */
+        journeyFunnel: (params) => read('/v1/analytics/journey_funnel', params),
+        /** Failed attempts by reason and method. */
+        failures: (params = {}) => read('/v1/analytics/failures', params),
+        /** Sign-ins by method, device, browser, os or country. */
+        breakdown: (params = {}) => read('/v1/analytics/breakdown', params),
+        /** DAU/WAU/MAU and a series, with new vs returning users. */
+        activeUsers: (params = {}) => read('/v1/analytics/active_users', params),
+        passkeyAdoption: (params = {}) => read('/v1/analytics/passkey_adoption', params),
+        /** API usage per secret key, end-user API key or organization against its own baseline, highest ratio first. */
+        apiUsage: (params = {}) => request({ method: 'GET', path: '/v1/analytics/api_usage', query: { ...params } }),
+        reports: {
+            inactiveUsers: (params = {}) => read('/v1/analytics/reports/inactive_users', params),
+            mfaCoverage: (params = {}) => read('/v1/analytics/reports/mfa_coverage', params),
+            accessByApp: (params = {}) => read('/v1/analytics/reports/access_by_app', params),
+        },
+        /**
+         * Any analytics read as CSV text, e.g. `exportCsv('breakdown', { dimension: 'country' })`.
+         * For Parquet call the same path with `format=parquet` over HTTP (a binary body).
+         */
+        exportCsv: (report, params = {}) => csv(`/v1/analytics/${report}`, params),
+        alertRules: {
+            list() {
+                return request({ method: 'GET', path: '/v1/analytics/alert_rules' });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/analytics/alert_rules/${(0, request_1.enc)(id)}` });
+            },
+            /** A webhook rule's `webhook_secret` is in this response only. */
+            create(body, idempotencyKey) {
+                return request({ method: 'POST', path: '/v1/analytics/alert_rules', body, idempotencyKey });
+            },
+            update(id, body) {
+                return request({ method: 'PATCH', path: `/v1/analytics/alert_rules/${(0, request_1.enc)(id)}`, body });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: `/v1/analytics/alert_rules/${(0, request_1.enc)(id)}` });
+            },
+            /** Measure now; `notify: true` also sends the rule's email and webhook. */
+            test(id, body = {}) {
+                return request({ method: 'POST', path: `/v1/analytics/alert_rules/${(0, request_1.enc)(id)}/test`, body });
+            },
+        },
+    };
+}
+//# sourceMappingURL=analytics-reports.js.map

package/dist/client/analytics-reports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics-reports.js","sourceRoot":"","sources":["../../src/client/analytics-reports.ts"],"names":[],"mappings":";;AAwGA,8CA6DC;AArKD,uCAAgD;AAwGhD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,MAAM,IAAI,GAAG,CAAM,IAAY,EAAE,MAAc,EAAiC,EAAE,CAChF,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,MAAc,EAAmB,EAAE,CAC5D,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,OAAO;QACL,2DAA2D;QAC3D,MAAM,EAAE,CAAC,SAA6D,EAAE,EAAE,EAAE,CAAC,IAAI,CAAY,sBAAsB,EAAE,MAAM,CAAC;QAC5H,uDAAuD;QACvD,aAAa,EAAE,CAAC,MAAyE,EAAE,EAAE,CAAC,IAAI,CAAmB,8BAA8B,EAAE,MAAM,CAAC;QAC5J,4CAA4C;QAC5C,QAAQ,EAAE,CAAC,SAAmD,EAAE,EAAE,EAAE,CAAC,IAAI,CAAa,wBAAwB,EAAE,MAAM,CAAC;QACvH,0DAA0D;QAC1D,SAAS,EAAE,CAAC,SAA+F,EAAE,EAAE,EAAE,CAC/G,IAAI,CAAe,yBAAyB,EAAE,MAAM,CAAC;QACvD,6DAA6D;QAC7D,WAAW,EAAE,CAAC,SAA0B,EAAE,EAAE,EAAE,CAAC,IAAI,CAAiB,4BAA4B,EAAE,MAAM,CAAC;QACzG,eAAe,EAAE,CAAC,SAA0B,EAAE,EAAE,EAAE,CAAC,IAAI,CAAqB,gCAAgC,EAAE,MAAM,CAAC;QACrH,gHAAgH;QAChH,QAAQ,EAAE,CAAC,SAA4F,EAAE,EAMtG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;QACvF,OAAO,EAAE;YACP,aAAa,EAAE,CAAC,SAAgG,EAAE,EAAE,EAAE,CACpH,IAAI,CAAkB,sCAAsC,EAAE,MAAM,CAAC;YACvE,WAAW,EAAE,CAAC,SAA0B,EAAE,EAAE,EAAE,CAAC,IAAI,CAAiB,oCAAoC,EAAE,MAAM,CAAC;YACjH,WAAW,EAAE,CAAC,SAA0B,EAAE,EAAE,EAAE,CAAC,IAAI,CAAiB,qCAAqC,EAAE,MAAM,CAAC;SACnH;QACD;;;WAGG;QACH,SAAS,EAAE,CAAC,MAA+J,EAAE,SAAiB,EAAE,EAAE,EAAE,CAClM,GAAG,CAAC,iBAAiB,MAAM,EAAE,EAAE,MAAM,CAAC;QACxC,UAAU,EAAE;YACV,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,kEAAkE;YAClE,MAAM,CAAC,IAA6B,EAAE,cAAuB;gBAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAsC;gBACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,2EAA2E;YAC3E,IAAI,CAAC,EAAU,EAAE,OAA6B,EAAE;gBAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}