@atlasauth/backend 0.25.0 → 0.26.0

package/dist/client/fga.js

@@ -4,6 +4,14 @@ exports.fgaResource = fgaResource;
 const request_1 = require("./request");
 function fgaResource(request) {
     const api = {
+        settings: {
+            get() {
+                return request({ method: 'GET', path: '/v1/fga/settings' });
+            },
+            update(body) {
+                return request({ method: 'PUT', path: '/v1/fga/settings', body });
+            },
+        },
         stores: {
             list() {
                 return request({ method: 'GET', path: '/v1/fga/stores' });
@@ -60,6 +68,35 @@ function fgaResource(request) {
         listObjects(storeId, body) {
             return request({ method: 'POST', path: `/v1/fga/stores/${(0, request_1.enc)(storeId)}/list-objects`, body });
         },
+        /**
+         * Who has a relation on an object: concrete users, usersets (give the filter
+         * a `relation`) and the `type:*` wildcard with `excluded_users`. One page.
+         */
+        listUsers(storeId, body) {
+            return request({ method: 'POST', path: `/v1/fga/stores/${(0, request_1.enc)(storeId)}/list-users`, body });
+        },
+        /** {@link listUsers} following `continuation_token` until every page is collected. */
+        async listAllUsers(storeId, body) {
+            let page = await api.listUsers(storeId, body);
+            const users = [...page.users];
+            while (page.continuation_token) {
+                page = await api.listUsers(storeId, { ...body, continuation_token: page.continuation_token });
+                users.push(...page.users);
+            }
+            return { ...page, users };
+        },
+        /**
+         * The store's tuple change log, in commit order. The returned
+         * `continuation_token` works even on the last page: persist it and call again
+         * to receive only what changed since.
+         */
+        readChanges(storeId, params = {}) {
+            return request({
+                method: 'GET',
+                path: `/v1/fga/stores/${(0, request_1.enc)(storeId)}/changes`,
+                query: { ...params },
+            });
+        },
         /** Expand the full userset tree for an object#relation. */
         expand(storeId, body) {
             return request({ method: 'POST', path: `/v1/fga/stores/${(0, request_1.enc)(storeId)}/expand`, body });
@@ -77,6 +114,9 @@ function fgaResource(request) {
                 check: (body) => api.check(storeId, body),
                 batchCheck: (body) => api.batchCheck(storeId, body),
                 listObjects: (body) => api.listObjects(storeId, body),
+                listUsers: (body) => api.listUsers(storeId, body),
+                listAllUsers: (body) => api.listAllUsers(storeId, body),
+                readChanges: (params) => api.readChanges(storeId, params),
                 expand: (body) => api.expand(storeId, body),
                 models: {
                     list: () => api.models.list(storeId),

package/dist/client/fga.js.map

@@ -1 +1 @@
-{"version":3,"file":"fga.js","sourceRoot":"","sources":["../../src/client/fga.ts"],"names":[],"mappings":";;AAwFA,kCAoHC;AA5MD,uCAAgD;AAwFhD,SAAgB,WAAW,CAAC,OAAkB;IAC5C,MAAM,GAAG,GAAG;QACV,MAAM,EAAE;YACN,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,OAAe;gBAClB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,uBAAuB;iBAC5D,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,OAAe,EACf,IAAgC,EAChC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,uBAAuB;oBAC3D,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,OAAe,EAAE,OAAe;gBAClC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,yBAAyB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAC5E,CAAC,CAAC;YACL,CAAC;SACF;QAED,qDAAqD;QACrD,KAAK,CACH,OAAe,EACf,IAAuD,EACvD,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,8DAA8D;QAC9D,IAAI,CACF,OAAe,EACf,IAA2D;YAE3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,0DAA0D;QAC1D,KAAK,CACH,OAAe,EACf,IAAkB;YAElB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,gFAAgF;QAChF,UAAU,CACR,OAAe,EACf,IAAsE;YAEtE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,2DAA2D;QAC3D,WAAW,CACT,OAAe,EACf,IAAwB;YAExB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,2DAA2D;QAC3D,MAAM,CACJ,OAAe,EACf,IAA2E;YAE3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,OAAe;YACnB,OAAO;gBACL,KAAK,EAAE,CAAC,IAAuD,EAAE,cAAuB,EAAE,EAAE,CAC1F,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC;gBAC1C,IAAI,EAAE,CAAC,IAA2D,EAAE,EAAE,CACpE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;gBACzB,KAAK,EAAE,CAAC,IAAkB,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;gBACvD,UAAU,EAAE,CAAC,IAAsE,EAAE,EAAE,CACrF,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC;gBAC/B,WAAW,EAAE,CAAC,IAAwB,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC;gBACzE,MAAM,EAAE,CAAC,IAA2E,EAAE,EAAE,CACtF,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;gBAC3B,MAAM,EAAE;oBACN,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;oBACpC,MAAM,EAAE,CAAC,IAAgC,EAAE,cAAuB,EAAE,EAAE,CACpE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC;oBAClD,GAAG,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC;iBAC3D;aACF,CAAC;QACJ,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"fga.js","sourceRoot":"","sources":["../../src/client/fga.ts"],"names":[],"mappings":";;AA0LA,kCA4JC;AAtVD,uCAAgD;AA0LhD,SAAgB,WAAW,CAAC,OAAkB;IAC5C,MAAM,GAAG,GAAG;QACV,QAAQ,EAAE;YACR,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,CAAC,IAA2B;gBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;SACF;QACD,MAAM,EAAE;YACN,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,OAAe;gBAClB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,uBAAuB;iBAC5D,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,OAAe,EACf,IAAgC,EAChC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,uBAAuB;oBAC3D,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,OAAe,EAAE,OAAe;gBAClC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,yBAAyB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAC5E,CAAC,CAAC;YACL,CAAC;SACF;QAED,qDAAqD;QACrD,KAAK,CACH,OAAe,EACf,IAAuD,EACvD,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,8DAA8D;QAC9D,IAAI,CACF,OAAe,EACf,IAA2D;YAE3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,0DAA0D;QAC1D,KAAK,CACH,OAAe,EACf,IAAkB;YAElB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,gFAAgF;QAChF,UAAU,CACR,OAAe,EACf,IAA8F;YAE9F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,2DAA2D;QAC3D,WAAW,CACT,OAAe,EACf,IAAwB;YAExB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,OAAe,EAAE,IAAsB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,sFAAsF;QACtF,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,IAAsB;YACxD,IAAI,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC/B,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;gBAC9F,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD;;;;WAIG;QACH,WAAW,CAAC,OAAe,EAAE,SAA+B,EAAE;YAC5D,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU;gBAC9C,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD,2DAA2D;QAC3D,MAAM,CACJ,OAAe,EACf,IAA2E;YAE3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,OAAe;YACnB,OAAO;gBACL,KAAK,EAAE,CAAC,IAAuD,EAAE,cAAuB,EAAE,EAAE,CAC1F,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC;gBAC1C,IAAI,EAAE,CAAC,IAA2D,EAAE,EAAE,CACpE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;gBACzB,KAAK,EAAE,CAAC,IAAkB,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;gBACvD,UAAU,EAAE,CAAC,IAA8F,EAAE,EAAE,CAC7G,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC;gBAC/B,WAAW,EAAE,CAAC,IAAwB,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC;gBACzE,SAAS,EAAE,CAAC,IAAsB,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;gBACnE,YAAY,EAAE,CAAC,IAAsB,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC;gBACzE,WAAW,EAAE,CAAC,MAA6B,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC;gBAChF,MAAM,EAAE,CAAC,IAA2E,EAAE,EAAE,CACtF,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;gBAC3B,MAAM,EAAE;oBACN,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;oBACpC,MAAM,EAAE,CAAC,IAAgC,EAAE,cAAuB,EAAE,EAAE,CACpE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC;oBAClD,GAAG,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC;iBAC3D;aACF,CAAC;QACJ,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/client/iga.d.ts

@@ -0,0 +1,436 @@
+import { type RequestFn } from './request';
+export type IgaKind = 'role' | 'org_membership' | 'group' | 'resource_role' | 'app_assignment' | 'custom';
+export type IgaRisk = 'low' | 'medium' | 'high' | 'critical';
+export type IgaApproverSelector = {
+    type: 'manager' | 'owner';
+} | {
+    type: 'group' | 'users';
+    ids: string[];
+};
+export interface IgaApprovalStep {
+    type: 'manager' | 'owner' | 'group' | 'users';
+    /** A group slug (`group`) or user ids (`users`). */
+    ids?: string[];
+    /** `any` approver decides the step; `all` must approve. Default `any`. */
+    mode?: 'any' | 'all';
+    /** After this long without a decision the step escalates. */
+    timeout_seconds?: number;
+    escalate_to?: IgaApproverSelector;
+}
+export interface IgaEntitlement {
+    object: 'iga_entitlement';
+    id: string;
+    key: string;
+    name: string;
+    description: string | null;
+    kind: IgaKind;
+    target: Record<string, unknown>;
+    owner_user_id: string | null;
+    risk_level: IgaRisk;
+    approval_rules: {
+        steps: IgaApprovalStep[];
+    };
+    max_duration_seconds: number | null;
+    requestable: boolean;
+    require_justification: boolean;
+    created_at: number;
+    updated_at: number;
+}
+export interface IgaEntitlementInput {
+    key: string;
+    name: string;
+    kind: IgaKind;
+    /** role `{role_key}`, org_membership `{organization_id, role}`, group `{group}`, resource_role `{resource_id, role}`, app_assignment `{app_id}`, custom (free-form). */
+    target: Record<string, unknown>;
+    description?: string | null;
+    owner_user_id?: string | null;
+    risk_level?: IgaRisk;
+    approval_rules?: {
+        steps: IgaApprovalStep[];
+    };
+    max_duration_seconds?: number | null;
+    requestable?: boolean;
+    require_justification?: boolean;
+}
+export type IgaRequestStatus = 'pending' | 'approved' | 'denied' | 'cancelled' | 'fulfilled' | 'failed';
+export interface IgaRequest {
+    object: 'iga_request';
+    id: string;
+    entitlement_id: string;
+    requester_user_id: string | null;
+    beneficiary_user_id: string;
+    source: 'self' | 'admin';
+    justification: string | null;
+    duration_seconds: number | null;
+    status: IgaRequestStatus;
+    current_step: number | null;
+    steps: Array<{
+        index: number;
+        type: string;
+        mode: 'any' | 'all';
+        approvers: string[];
+        status: 'pending' | 'approved' | 'denied';
+        escalated: boolean;
+        timeout_seconds: number | null;
+        sod_rule_id: string | null;
+    }>;
+    sod: Array<{
+        rule_id: string;
+        rule_name: string;
+        mode: 'block' | 'require_approval';
+        conflicting_entitlement_id: string;
+    }>;
+    approvals: Array<{
+        step: number;
+        approver_user_id: string;
+        acting_for_user_id: string | null;
+        decision: 'approve' | 'deny';
+        comment: string | null;
+        decided_at: number;
+    }>;
+    failure: string | null;
+    decided_at: number | null;
+    created_at: number;
+}
+export interface IgaGrant {
+    object: 'iga_grant';
+    id: string;
+    user_id: string;
+    entitlement_id: string;
+    request_id: string | null;
+    source: 'request' | 'admin' | 'birthright' | 'existing';
+    status: 'active' | 'revoked' | 'expired';
+    granted_at: number;
+    expires_at: number | null;
+    revoked_at: number | null;
+    revoked_reason: string | null;
+    revoked_by: string | null;
+    /** The access existed before governance took it over; an expiry leaves it in place. */
+    adopted: boolean;
+}
+export interface IgaDelegation {
+    object: 'iga_delegation';
+    id: string;
+    delegator_user_id: string;
+    delegate_user_id: string;
+    starts_at: number;
+    ends_at: number;
+    created_at: number;
+}
+export interface IgaSodRule {
+    object: 'iga_sod_rule';
+    id: string;
+    name: string;
+    description: string | null;
+    entitlement_a: string;
+    entitlement_b: string;
+    mode: 'block' | 'require_approval';
+    approver: IgaApprovalStep | null;
+    enabled: boolean;
+    created_at: number;
+    updated_at: number;
+}
+export interface IgaSodViolation {
+    object: 'iga_sod_violation';
+    id: string;
+    rule_id: string;
+    rule_name: string | null;
+    mode: string | null;
+    user_id: string;
+    status: 'open' | 'accepted' | 'resolved';
+    source: 'request' | 'assignment' | 'scan';
+    request_id: string | null;
+    note: string | null;
+    detected_at: number;
+    resolved_at: number | null;
+}
+export interface IgaBirthrightMatch {
+    group?: string;
+    organization_id?: string;
+    org_role?: string;
+    app_role?: string;
+    email_domain?: string;
+}
+export interface IgaBirthrightRule {
+    object: 'iga_birthright_rule';
+    id: string;
+    name: string;
+    match: IgaBirthrightMatch;
+    entitlement_ids: string[];
+    revoke_on_unmatch: boolean;
+    enabled: boolean;
+    created_at: number;
+}
+export interface IgaSettings {
+    object: 'iga_settings';
+    jml_enabled: boolean;
+    leaver_action: 'revoke' | 'revoke_and_close';
+    leaver_close_grace_seconds: number | null;
+}
+export interface IgaCampaign {
+    object: 'iga_campaign';
+    id: string;
+    name: string;
+    description: string | null;
+    scope_type: 'all' | 'entitlement' | 'app' | 'role' | 'group' | 'org';
+    scope_ids: string[];
+    reviewer_type: 'manager' | 'owner' | 'named';
+    reviewer_ids: string[];
+    status: 'draft' | 'active' | 'closed';
+    due_at: number | null;
+    reminder_days: number[];
+    auto_revoke: boolean;
+    launched_at: number | null;
+    closed_at: number | null;
+    created_at: number;
+}
+export interface IgaCampaignInput {
+    name: string;
+    description?: string;
+    scope_type?: IgaCampaign['scope_type'];
+    scope_ids?: string[];
+    reviewer_type?: IgaCampaign['reviewer_type'];
+    reviewer_ids?: string[];
+    due_at?: number;
+    reminder_days?: number[];
+    /** Remove access reviewers marked for revocation when the campaign closes. Default true. */
+    auto_revoke?: boolean;
+}
+export interface IgaCampaignItem {
+    object: 'iga_campaign_item';
+    id: string;
+    campaign_id: string;
+    grant_id: string;
+    user_id: string;
+    entitlement_id: string;
+    reviewer_user_id: string | null;
+    decision: 'pending' | 'certified' | 'revoked';
+    decided_by: string | null;
+    decided_at: number | null;
+    comment: string | null;
+    revoked_applied: boolean;
+}
+export interface IgaCampaignProgress {
+    object: 'iga_campaign_progress';
+    campaign_id: string;
+    status: IgaCampaign['status'];
+    total: number;
+    pending: number;
+    certified: number;
+    revoked: number;
+    percent_complete: number;
+    overdue: boolean;
+    reviewers: Array<{
+        reviewer_user_id: string | null;
+        total: number;
+        decided: number;
+    }>;
+}
+export interface IgaEvidence {
+    object: 'iga_campaign_evidence';
+    campaign: IgaCampaign;
+    progress: IgaCampaignProgress;
+    generated_at: string;
+    items: Array<{
+        item_id: string;
+        user_id: string;
+        user_erased: boolean;
+        user_email_masked?: string | null;
+        entitlement_key: string | null;
+        entitlement_name: string | null;
+        risk_level: string | null;
+        reviewer_user_id: string | null;
+        decision: string;
+        decided_by: string | null;
+        decided_at: string | null;
+        revoked_applied: boolean;
+    }>;
+}
+export interface IgaOffboarding {
+    object: 'iga_offboarding';
+    user_id: string;
+    revoked_grants: number;
+    cancelled_requests: number;
+    account_closure: {
+        effective_at: number;
+        request_id: string;
+    } | null;
+}
+type List<T> = {
+    object: 'list';
+    data: T[];
+    has_more: boolean;
+};
+type Deleted<O extends string> = {
+    object: O;
+    id: string;
+    deleted: true;
+};
+/**
+ * Identity governance: the entitlement catalog, access requests with multi-step
+ * approvals, time-bound grants, certification campaigns, separation of duties
+ * and joiner/mover/leaver automation. Needs the `iga:read` / `iga:write` scopes.
+ */
+export declare function igaResource(request: RequestFn): {
+    entitlements: {
+        list: (params?: {
+            kind?: IgaKind;
+        }) => Promise<List<IgaEntitlement>>;
+        get: (idOrKey: string) => Promise<IgaEntitlement>;
+        create: (body: IgaEntitlementInput) => Promise<IgaEntitlement>;
+        update: (idOrKey: string, body: Partial<Omit<IgaEntitlementInput, "key" | "kind">>) => Promise<IgaEntitlement>;
+        delete: (idOrKey: string) => Promise<Deleted<"iga_entitlement">>;
+    };
+    requests: {
+        list: (params?: {
+            status?: IgaRequestStatus;
+            user_id?: string;
+            requester_user_id?: string;
+            entitlement?: string;
+            limit?: number;
+        }) => Promise<List<IgaRequest>>;
+        get: (id: string) => Promise<IgaRequest>;
+        /** File a request for a user; it follows the entitlement's approval steps. */
+        create: (body: {
+            entitlement: string;
+            user_id: string;
+            requester_user_id?: string;
+            justification?: string;
+            duration_seconds?: number;
+        }) => Promise<IgaRequest>;
+        /** Decide the open step as `approver_user_id`, or as an administrator override when omitted. */
+        decide: (id: string, body: {
+            decision: "approve" | "deny";
+            comment?: string;
+            approver_user_id?: string;
+        }) => Promise<IgaRequest>;
+        cancel: (id: string) => Promise<IgaRequest>;
+        /** Requests waiting on one person (their own steps and delegated ones). */
+        inbox: (approverUserId: string) => Promise<List<IgaRequest>>;
+    };
+    grants: {
+        list: (params?: {
+            user_id?: string;
+            entitlement?: string;
+            status?: "active" | "revoked" | "expired";
+            limit?: number;
+        }) => Promise<List<IgaGrant>>;
+        create: (body: {
+            entitlement: string;
+            user_id: string;
+            expires_at?: number;
+            override_reason?: string;
+        }) => Promise<IgaGrant>;
+        revoke: (id: string, body?: {
+            reason?: string;
+        }) => Promise<IgaGrant>;
+    };
+    delegations: {
+        list: (params?: {
+            delegator_user_id?: string;
+        }) => Promise<List<IgaDelegation>>;
+        create: (body: {
+            delegator_user_id: string;
+            delegate_user_id: string;
+            ends_at: number;
+            starts_at?: number;
+        }) => Promise<IgaDelegation>;
+        delete: (id: string) => Promise<Deleted<"iga_delegation">>;
+    };
+    sod: {
+        listRules: () => Promise<List<IgaSodRule>>;
+        createRule: (body: {
+            name: string;
+            entitlement_a: string;
+            entitlement_b: string;
+            mode?: "block" | "require_approval";
+            approver?: IgaApprovalStep;
+            description?: string;
+            enabled?: boolean;
+        }) => Promise<IgaSodRule>;
+        updateRule: (id: string, body: {
+            name?: string;
+            description?: string;
+            mode?: "block" | "require_approval";
+            approver?: IgaApprovalStep;
+            enabled?: boolean;
+        }) => Promise<IgaSodRule>;
+        deleteRule: (id: string) => Promise<Deleted<"iga_sod_rule">>;
+        /** The violations report. */
+        violations: (params?: {
+            status?: "open" | "accepted" | "resolved";
+        }) => Promise<List<IgaSodViolation>>;
+        /** Re-check every rule against what people hold now. */
+        scan: () => Promise<{
+            object: "iga_sod_scan";
+            found: number;
+            resolved: number;
+        }>;
+    };
+    lifecycle: {
+        listBirthrightRules: () => Promise<List<IgaBirthrightRule>>;
+        createBirthrightRule: (body: {
+            name: string;
+            match: IgaBirthrightMatch;
+            entitlement_ids: string[];
+            revoke_on_unmatch?: boolean;
+            enabled?: boolean;
+        }) => Promise<IgaBirthrightRule>;
+        updateBirthrightRule: (id: string, body: Partial<{
+            name: string;
+            match: IgaBirthrightMatch;
+            entitlement_ids: string[];
+            revoke_on_unmatch: boolean;
+            enabled: boolean;
+        }>) => Promise<IgaBirthrightRule>;
+        deleteBirthrightRule: (id: string) => Promise<Deleted<"iga_birthright_rule">>;
+        /** Re-evaluate one user's birthright access now (joiner or mover). */
+        reconcile: (userId: string) => Promise<{
+            object: "iga_jml";
+            user_id: string;
+            granted: string[];
+            revoked: string[];
+        }>;
+        /** Offboard a leaver; with `close_account` the closure goes through the data-rights path. */
+        offboard: (userId: string, body?: {
+            close_account?: boolean;
+            grace_seconds?: number;
+            reason?: string;
+        }) => Promise<IgaOffboarding>;
+        settings: () => Promise<IgaSettings>;
+        updateSettings: (body: Partial<Omit<IgaSettings, "object">>) => Promise<IgaSettings>;
+    };
+    campaigns: {
+        list: (params?: {
+            status?: IgaCampaign["status"];
+        }) => Promise<List<IgaCampaign>>;
+        get: (id: string) => Promise<IgaCampaign & {
+            progress: IgaCampaignProgress;
+        }>;
+        create: (body: IgaCampaignInput) => Promise<IgaCampaign>;
+        delete: (id: string) => Promise<Deleted<"iga_campaign">>;
+        /** Freeze the review list (adopting access that was never granted through governance) and notify reviewers. */
+        launch: (id: string) => Promise<IgaCampaign>;
+        /** Close the campaign; with auto-revoke, access reviewers marked for revocation is removed. */
+        close: (id: string) => Promise<IgaCampaign>;
+        items: (id: string, params?: {
+            decision?: IgaCampaignItem["decision"];
+            reviewer_user_id?: string;
+        }) => Promise<List<IgaCampaignItem>>;
+        progress: (id: string) => Promise<IgaCampaignProgress>;
+        /** Audit evidence as JSON. People appear by id only; free-text comments are never included. */
+        evidence: (id: string, params?: {
+            masked_emails?: boolean;
+        }) => Promise<IgaEvidence>;
+        /** The same evidence as CSV text. */
+        evidenceCsv: (id: string, params?: {
+            masked_emails?: boolean;
+        }) => Promise<string>;
+        decide: (itemId: string, body: {
+            decision: "certify" | "revoke";
+            comment?: string;
+            reviewer_user_id?: string;
+        }) => Promise<IgaCampaignItem>;
+    };
+};
+export {};

package/dist/client/iga.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.igaResource = igaResource;
+const request_1 = require("./request");
+/**
+ * Identity governance: the entitlement catalog, access requests with multi-step
+ * approvals, time-bound grants, certification campaigns, separation of duties
+ * and joiner/mover/leaver automation. Needs the `iga:read` / `iga:write` scopes.
+ */
+function igaResource(request) {
+    const P = '/v1/iga';
+    return {
+        entitlements: {
+            list: (params = {}) => request({ method: 'GET', path: `${P}/entitlements`, query: params }),
+            get: (idOrKey) => request({ method: 'GET', path: `${P}/entitlements/${(0, request_1.enc)(idOrKey)}` }),
+            create: (body) => request({ method: 'POST', path: `${P}/entitlements`, body }),
+            update: (idOrKey, body) => request({ method: 'PATCH', path: `${P}/entitlements/${(0, request_1.enc)(idOrKey)}`, body }),
+            delete: (idOrKey) => request({ method: 'DELETE', path: `${P}/entitlements/${(0, request_1.enc)(idOrKey)}` }),
+        },
+        requests: {
+            list: (params = {}) => request({ method: 'GET', path: `${P}/requests`, query: params }),
+            get: (id) => request({ method: 'GET', path: `${P}/requests/${(0, request_1.enc)(id)}` }),
+            /** File a request for a user; it follows the entitlement's approval steps. */
+            create: (body) => request({ method: 'POST', path: `${P}/requests`, body }),
+            /** Decide the open step as `approver_user_id`, or as an administrator override when omitted. */
+            decide: (id, body) => request({ method: 'POST', path: `${P}/requests/${(0, request_1.enc)(id)}/decide`, body }),
+            cancel: (id) => request({ method: 'POST', path: `${P}/requests/${(0, request_1.enc)(id)}/cancel` }),
+            /** Requests waiting on one person (their own steps and delegated ones). */
+            inbox: (approverUserId) => request({ method: 'GET', path: `${P}/approvals`, query: { approver_user_id: approverUserId } }),
+        },
+        grants: {
+            list: (params = {}) => request({ method: 'GET', path: `${P}/grants`, query: params }),
+            create: (body) => request({ method: 'POST', path: `${P}/grants`, body }),
+            revoke: (id, body = {}) => request({ method: 'POST', path: `${P}/grants/${(0, request_1.enc)(id)}/revoke`, body }),
+        },
+        delegations: {
+            list: (params = {}) => request({ method: 'GET', path: `${P}/delegations`, query: params }),
+            create: (body) => request({ method: 'POST', path: `${P}/delegations`, body }),
+            delete: (id) => request({ method: 'DELETE', path: `${P}/delegations/${(0, request_1.enc)(id)}` }),
+        },
+        sod: {
+            listRules: () => request({ method: 'GET', path: `${P}/sod_rules` }),
+            createRule: (body) => request({ method: 'POST', path: `${P}/sod_rules`, body }),
+            updateRule: (id, body) => request({ method: 'PATCH', path: `${P}/sod_rules/${(0, request_1.enc)(id)}`, body }),
+            deleteRule: (id) => request({ method: 'DELETE', path: `${P}/sod_rules/${(0, request_1.enc)(id)}` }),
+            /** The violations report. */
+            violations: (params = {}) => request({ method: 'GET', path: `${P}/sod_violations`, query: params }),
+            /** Re-check every rule against what people hold now. */
+            scan: () => request({ method: 'POST', path: `${P}/sod_violations/scan` }),
+        },
+        lifecycle: {
+            listBirthrightRules: () => request({ method: 'GET', path: `${P}/birthright_rules` }),
+            createBirthrightRule: (body) => request({ method: 'POST', path: `${P}/birthright_rules`, body }),
+            updateBirthrightRule: (id, body) => request({ method: 'PATCH', path: `${P}/birthright_rules/${(0, request_1.enc)(id)}`, body }),
+            deleteBirthrightRule: (id) => request({ method: 'DELETE', path: `${P}/birthright_rules/${(0, request_1.enc)(id)}` }),
+            /** Re-evaluate one user's birthright access now (joiner or mover). */
+            reconcile: (userId) => request({ method: 'POST', path: `${P}/users/${(0, request_1.enc)(userId)}/reconcile` }),
+            /** Offboard a leaver; with `close_account` the closure goes through the data-rights path. */
+            offboard: (userId, body = {}) => request({ method: 'POST', path: `${P}/users/${(0, request_1.enc)(userId)}/offboard`, body }),
+            settings: () => request({ method: 'GET', path: `${P}/settings` }),
+            updateSettings: (body) => request({ method: 'PUT', path: `${P}/settings`, body }),
+        },
+        campaigns: {
+            list: (params = {}) => request({ method: 'GET', path: `${P}/campaigns`, query: params }),
+            get: (id) => request({ method: 'GET', path: `${P}/campaigns/${(0, request_1.enc)(id)}` }),
+            create: (body) => request({ method: 'POST', path: `${P}/campaigns`, body }),
+            delete: (id) => request({ method: 'DELETE', path: `${P}/campaigns/${(0, request_1.enc)(id)}` }),
+            /** Freeze the review list (adopting access that was never granted through governance) and notify reviewers. */
+            launch: (id) => request({ method: 'POST', path: `${P}/campaigns/${(0, request_1.enc)(id)}/launch` }),
+            /** Close the campaign; with auto-revoke, access reviewers marked for revocation is removed. */
+            close: (id) => request({ method: 'POST', path: `${P}/campaigns/${(0, request_1.enc)(id)}/close` }),
+            items: (id, params = {}) => request({ method: 'GET', path: `${P}/campaigns/${(0, request_1.enc)(id)}/items`, query: params }),
+            progress: (id) => request({ method: 'GET', path: `${P}/campaigns/${(0, request_1.enc)(id)}/progress` }),
+            /** Audit evidence as JSON. People appear by id only; free-text comments are never included. */
+            evidence: (id, params = {}) => request({ method: 'GET', path: `${P}/campaigns/${(0, request_1.enc)(id)}/evidence`, query: params }),
+            /** The same evidence as CSV text. */
+            evidenceCsv: (id, params = {}) => request({ method: 'GET', path: `${P}/campaigns/${(0, request_1.enc)(id)}/evidence`, query: { ...params, format: 'csv' }, raw: true }),
+            decide: (itemId, body) => request({ method: 'POST', path: `${P}/campaign_items/${(0, request_1.enc)(itemId)}/decide`, body }),
+        },
+    };
+}
+//# sourceMappingURL=iga.js.map

package/dist/client/iga.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iga.js","sourceRoot":"","sources":["../../src/client/iga.ts"],"names":[],"mappings":";;AAoJA,kCAuEC;AA3ND,uCAAgD;AA+IhD;;;;GAIG;AACH,SAAgB,WAAW,CAAC,OAAkB;IAC5C,MAAM,CAAC,GAAG,SAAS,CAAC;IACpB,OAAO;QACL,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,SAA6B,EAAE,EAAiC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC9I,GAAG,EAAE,CAAC,OAAe,EAA2B,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,iBAAiB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACxH,MAAM,EAAE,CAAC,IAAyB,EAA2B,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;YAC5H,MAAM,EAAE,CAAC,OAAe,EAAE,IAAwD,EAA2B,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,iBAAiB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;YAC7L,MAAM,EAAE,CAAC,OAAe,EAAuC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,iBAAiB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC;SAC3I;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,CAAC,SAA4H,EAAE,EAA6B,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACrO,GAAG,EAAE,CAAC,EAAU,EAAuB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACtG,8EAA8E;YAC9E,MAAM,EAAE,CAAC,IAA6H,EAAuB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;YACxN,gGAAgG;YAChG,MAAM,EAAE,CAAC,EAAU,EAAE,IAAmF,EAAuB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;YAC5M,MAAM,EAAE,CAAC,EAAU,EAAuB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC;YACjH,2EAA2E;YAC3E,KAAK,EAAE,CAAC,cAAsB,EAA6B,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,CAAC;SAC9J;QACD,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,SAAgH,EAAE,EAA2B,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACrN,MAAM,EAAE,CAAC,IAA6F,EAAqB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;YACpL,MAAM,EAAE,CAAC,EAAU,EAAE,OAA4B,EAAE,EAAqB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;SACpJ;QACD,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,SAAyC,EAAE,EAAgC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACxJ,MAAM,EAAE,CAAC,IAAkG,EAA0B,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;YACnM,MAAM,EAAE,CAAC,EAAU,EAAsC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC;SAC/H;QACD,GAAG,EAAE;YACH,SAAS,EAAE,GAA8B,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC;YAC9F,UAAU,EAAE,CAAC,IAA8K,EAAuB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;YAC9Q,UAAU,EAAE,CAAC,EAAU,EAAE,IAAiI,EAAuB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;YACzP,UAAU,EAAE,CAAC,EAAU,EAAoC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9H,6BAA6B;YAC7B,UAAU,EAAE,CAAC,SAAwD,EAAE,EAAkC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAClL,wDAAwD;YACxD,IAAI,EAAE,GAAyE,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,sBAAsB,EAAE,CAAC;SAChJ;QACD,SAAS,EAAE;YACT,mBAAmB,EAAE,GAAqC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC;YACtH,oBAAoB,EAAE,CAAC,IAA4H,EAA8B,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;YACpP,oBAAoB,EAAE,CAAC,EAAU,EAAE,IAAmI,EAA8B,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;YACnR,oBAAoB,EAAE,CAAC,EAAU,EAA2C,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACtJ,sEAAsE;YACtE,SAAS,EAAE,CAAC,MAAc,EAAyF,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,IAAA,aAAG,EAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9L,6FAA6F;YAC7F,QAAQ,EAAE,CAAC,MAAc,EAAE,OAA6E,EAAE,EAA2B,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,IAAA,aAAG,EAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;YACrN,QAAQ,EAAE,GAAyB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;YACvF,cAAc,EAAE,CAAC,IAA0C,EAAwB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;SAC9I;QACD,SAAS,EAAE;YACT,IAAI,EAAE,CAAC,SAA6C,EAAE,EAA8B,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACxJ,GAAG,EAAE,CAAC,EAAU,EAA4D,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5I,MAAM,EAAE,CAAC,IAAsB,EAAwB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;YACnH,MAAM,EAAE,CAAC,EAAU,EAAoC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1H,+GAA+G;YAC/G,MAAM,EAAE,CAAC,EAAU,EAAwB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC;YACnH,+FAA+F;YAC/F,KAAK,EAAE,CAAC,EAAU,EAAwB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;YACjH,KAAK,EAAE,CAAC,EAAU,EAAE,SAAgF,EAAE,EAAkC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7N,QAAQ,EAAE,CAAC,EAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC;YAC9H,+FAA+F;YAC/F,QAAQ,EAAE,CAAC,EAAU,EAAE,SAAsC,EAAE,EAAwB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC/K,qCAAqC;YACrC,WAAW,EAAE,CAAC,EAAU,EAAE,SAAsC,EAAE,EAAmB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;YAC9M,MAAM,EAAE,CAAC,MAAc,EAAE,IAAqF,EAA4B,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,mBAAmB,IAAA,aAAG,EAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;SAClO;KACF,CAAC;AACJ,CAAC"}