@cboxdk/id-js 0.17.0 → 0.19.0

package/dist/management.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/management/errors.ts","../src/management/transport.ts","../src/management/generated/environment.ts","../src/management/generated/workspace.ts","../src/management/generated/platform.ts","../src/management/generated/account.ts","../src/management/dpop.ts","../src/management/audit-logs.ts","../src/management/fga.ts"],"names":["uuid","sleep","encoder"],"mappings":";;;AAIO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAC;;;ACC9C,IAAM,cAAA,GAAN,cAA6B,WAAA,CAAY;AAAA;AAAA,EAErC,MAAA;AAAA;AAAA,EAEA,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,UAAA;AAAA,EAET,YAAY,IAAA,EAOT;AACD,IAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAClB,IAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACnB,IAAA,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,MAAA,IAAU,EAAC;AAC9B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAK,SAAA,IAAa,IAAA;AACnC,IAAA,IAAA,CAAK,aAAa,IAAA,CAAK,UAAA;AAAA,EACzB;AAAA;AAAA,EAGA,IAAI,iBAAA,GAA6B;AAC/B,IAAA,OAAO,KAAK,KAAA,KAAU,mBAAA;AAAA,EACxB;AACF;AAOO,IAAM,sBAAA,GAAN,cAAqC,WAAA,CAAY;AAAA,EACtD,WAAA,CACE,OAAA,EAES,cAAA,EACT,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAHJ,IAAA,IAAA,CAAA,cAAA,GAAA,cAAA;AAIT,IAAA,IAAI,OAAA,IAAW,WAAW,OAAA,EAAS;AACjC,MAAC,IAAA,CAA6B,QAAQ,OAAA,CAAQ,KAAA;AAAA,IAChD;AAAA,EACF;AAAA,EAPW,cAAA;AAQb;AAOO,IAAM,aAAA,GAAN,cAA4B,WAAA,CAAY;AAAA,EAC7C,WAAA,CACE,OAAA,EACS,MAAA,EACA,QAAA,EACT;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAHJ,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAGX;AAAA,EAJW,MAAA;AAAA,EACA,QAAA;AAIb;AAGO,IAAM,mBAAA,GAAN,cAAkC,aAAA,CAAc;AAAA,EACrD,YAAY,QAAA,EAA2B;AACrC,IAAA,KAAA,CAAM,CAAA,SAAA,EAAY,QAAA,CAAS,EAAE,CAAA,YAAA,CAAA,EAAgB,UAAU,QAAQ,CAAA;AAAA,EACjE;AACF;AAGO,IAAM,oBAAA,GAAN,cAAmC,aAAA,CAAc;AAAA,EACtD,YAAY,QAAA,EAA2B;AACrC,IAAA,KAAA,CAAM,CAAA,SAAA,EAAY,QAAA,CAAS,EAAE,CAAA,gCAAA,CAAA,EAAoC,WAAW,QAAQ,CAAA;AAAA,EACtF;AACF;;;ACnBA,IAAM,UAAA,GAA2C;AAAA,EAC/C,WAAA,EAAa,WAAA;AAAA,EACb,SAAA,EAAW,UAAA;AAAA,EACX,QAAA,EAAU,IAAA;AAAA,EACV,OAAA,EAAS;AACX,CAAA;AAGA,IAAM,cAAA,GAAwC;AAAA,EAC5C,WAAA,EAAa,EAAA;AAAA,EACb,SAAA,EAAW,YAAA;AAAA,EACX,QAAA,EAAU,WAAA;AAAA,EACV,OAAA,EAAS;AACX,CAAA;AAEA,IAAM,aAAA,uBAAoB,GAAA,CAAI,CAAC,QAAQ,KAAA,EAAO,OAAA,EAAS,QAAQ,CAAC,CAAA;AAGhE,IAAM,mBAAA,GAAsB,CAAA;AAS5B,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,IAAA,GAAe;AACtB,EAAA,IAAI,OAAO,MAAA,CAAO,UAAA,KAAe,UAAA,EAAY;AAC3C,IAAA,OAAO,OAAO,UAAA,EAAW;AAAA,EAC3B;AAEA,EAAA,MAAM,QAAQ,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AACvD,EAAA,KAAA,CAAM,CAAC,CAAA,GAAK,KAAA,CAAM,CAAC,IAAK,EAAA,GAAQ,EAAA;AAChC,EAAA,KAAA,CAAM,CAAC,CAAA,GAAK,KAAA,CAAM,CAAC,IAAK,EAAA,GAAQ,GAAA;AAChC,EAAA,MAAM,MAAM,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAE7E,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAC1G;AAGO,SAAS,aAAa,OAAA,EAAsC;AACjE,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,aAAa,GAAG,IAAA,EAAK;AAE7C,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,KAAQ,EAAA,EAAI;AACnC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,EAAG;AACrB,IAAA,OAAO,MAAA,CAAO,GAAG,CAAA,GAAI,GAAA;AAAA,EACvB;AAEA,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAE3B,EAAA,OAAO,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA,GAAY,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,GAAO,IAAA,CAAK,GAAA,EAAK,CAAA;AACvE;AAEA,SAAS,KAAA,CAAM,IAAY,MAAA,EAAqC;AAC9D,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,OAAO,MAAA,EAAQ,UAAU,OAAA,CAAQ,MAAA,CAAO,OAAO,MAAM,CAAA,GAAI,QAAQ,OAAA,EAAQ;AAAA,EAC3E;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,MAAA,CAAO,OAAO,MAAM,CAAA;AACpB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,EAAQ,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAC5C,MAAA,OAAA,EAAQ;AAAA,IACV,GAAG,EAAE,CAAA;AACL,IAAA,MAAM,UAAU,MAAY;AAC1B,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,IACvB,CAAA;AACA,IAAA,MAAA,EAAQ,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC3D,CAAC,CAAA;AACH;AAEA,SAAS,iBAAiB,GAAA,EAAqB;AAC7C,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,GAAG,CAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,mBAAmB,iDAAiD,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,QAAA,GAAW,CAAC,WAAA,EAAa,WAAA,EAAa,SAAS,KAAK,CAAA,CAAE,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAEjF,EAAA,IAAI,IAAI,QAAA,KAAa,QAAA,IAAY,EAAE,GAAA,CAAI,QAAA,KAAa,WAAW,QAAA,CAAA,EAAW;AAExE,IAAA,MAAM,IAAI,mBAAmB,CAAA,iDAAA,EAAoD,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,QAAQ,CAAA,EAAA,CAAI,CAAA;AAAA,EACpH;AAEA,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE5C,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAA,CAAK,QAAA,CAAS,SAAS,CAAA,GAAI,IAAA,GAAO,CAAA,EAAG,IAAI,CAAA,OAAA,CAAS,CAAA,CAAA;AAC3E;AAEA,SAAS,WAAA,CAAY,MAAA,EAAyB,GAAA,EAAa,KAAA,EAAsB;AAC/E,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,IAAA;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,WAAA,CAAY,MAAA,EAAQ,CAAA,EAAG,GAAG,CAAA,EAAA,CAAA,EAAM,IAAI,CAAA;AAAA,IACtC;AACA,IAAA;AAAA,EACF;AAEA,EAAA,IAAI,OAAO,UAAU,SAAA,EAAW;AAE9B,IAAA,MAAA,CAAO,MAAA,CAAO,GAAA,EAAK,KAAA,GAAQ,GAAA,GAAM,GAAG,CAAA;AACpC,IAAA;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,MAAA,CAAO,GAAA,EAAK,OAAO,KAAA,KAAU,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAC,CAAA;AACtF;AAEA,eAAe,SAAS,QAAA,EAAsC;AAC5D,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,EAAA,IAAI,SAAS,EAAA,EAAI;AACf,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAOO,IAAM,sBAAN,MAA0B;AAAA,EACtB,KAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACT,UAAA;AAAA,EAEA,WAAA,CAAY,KAAA,EAAc,OAAA,EAAkC,cAAA,EAAyB;AACnF,IAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,cAAA;AAEnC,IAAA,IAAI,OAAA,KAAY,MAAA,IAAa,OAAA,KAAY,EAAA,EAAI;AAC3C,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,IAAA,EAAO,KAAK,CAAA,oEAAA,CAAsE,CAAA;AAAA,IACjH;AAEA,IAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,KAAW,MAAA;AAClC,IAAA,MAAM,QAAA,GAAW,QAAQ,WAAA,KAAgB,MAAA;AAEzC,IAAA,IAAI,WAAW,QAAA,EAAU;AACvB,MAAA,MAAM,IAAI,mBAAmB,wEAAwE,CAAA;AAAA,IACvG;AAEA,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAM,GAAA,GAAM,QAAQ,MAAA,IAAU,EAAA;AAC9B,MAAA,MAAM,QAAA,GAAW,WAAW,KAAK,CAAA;AAEjC,MAAA,IAAI,QAAQ,EAAA,EAAI;AACd,QAAA,MAAM,IAAI,mBAAmB,sCAAsC,CAAA;AAAA,MACrE;AAEA,MAAA,IAAI,aAAa,IAAA,EAAM;AACrB,QAAA,MAAM,IAAI,kBAAA;AAAA,UACR,OAAO,KAAK,CAAA,kGAAA;AAAA,SACd;AAAA,MACF;AAEA,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,UAAU,EAAE,IAAA,CAAK,CAAC,MAAA,KAAW,MAAA,KAAW,QAAQ,MAAA,KAAW,QAAA,IAAY,GAAA,CAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AAEzH,MAAA,IAAI,UAAU,MAAA,EAAW;AAEvB,QAAA,MAAM,IAAI,mBAAmB,CAAA,IAAA,EAAO,KAAK,gCAA2B,KAAK,CAAA,mBAAA,EAAsB,QAAQ,CAAA,cAAA,CAAW,CAAA;AAAA,MACpH;AAEA,MAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAW;AAC9B,QAAA,MAAM,IAAI,mBAAmB,2DAA2D,CAAA;AAAA,MAC1F;AAAA,IACF;AAEA,IAAA,IAAI,OAAA,CAAQ,gBAAgB,MAAA,EAAW;AACrC,MAAA,IAAI,UAAU,aAAA,EAAe;AAC3B,QAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,0DAAA,EAA6D,KAAK,CAAA,OAAA,CAAS,CAAA;AAAA,MAC1G;AAEA,MAAA,IAAI,OAAA,CAAQ,gBAAgB,EAAA,EAAI;AAC9B,QAAA,MAAM,IAAI,mBAAmB,2CAA2C,CAAA;AAAA,MAC1E;AAEA,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAM,IAAI,kBAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,OAAA,GAAU,iBAAiB,OAAO,CAAA;AACvC,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAChB,IAAA,IAAA,CAAK,MAAA,GAAS,QAAQ,KAAA,KAAU,CAAC,OAAO,IAAA,KAAS,KAAA,CAAM,OAAO,IAAI,CAAA,CAAA;AAClE,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,KAAA,EAAO,cAAc,CAAC,CAAA;AAC7D,IAAA,IAAA,CAAK,eAAe,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,KAAA,EAAO,eAAe,GAAG,CAAA;AACjE,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,KAAA,EAAO,cAAc,GAAM,CAAA;AAAA,EACpE;AAAA;AAAA,EAGA,MAAM,IAAA,CACJ,EAAA,EACA,QAAA,EACA,OACA,OAAA,EAC4B;AAC5B,IAAA,MAAM,GAAA,GAAM,KAAK,IAAA,CAAK,EAAA,EAAI,UAAU,EAAA,CAAG,IAAA,GAAO,SAAY,KAAK,CAAA;AAC/D,IAAA,MAAM,OAAA,GAAU,EAAA,CAAG,IAAA,GAAO,KAAA,GAAQ,MAAA;AAClC,IAAA,MAAM,cAAA,GAAiB,cAAc,GAAA,CAAI,EAAA,CAAG,MAAM,CAAA,GAAI,OAAA,EAAS,cAAA,IAAkB,IAAA,EAAK,GAAI,MAAA;AAC1F,IAAA,MAAM,IAAA,GAAoB;AAAA,MACxB,cAAA;AAAA,MACA,YAAY,OAAA,EAAS,UAAA;AAAA,MACrB,QAAQ,OAAA,EAAS,MAAA;AAAA,MACjB,SAAS,OAAA,EAAS;AAAA,KACpB;AACA,IAAA,MAAM,OAAA,GAA2B,EAAE,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,IAAA,EAAM,GAAG,IAAA,EAAK;AAE1G,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,GAAG,MAAA,EAAQ,GAAA,EAAK,SAAS,IAAI,CAAA;AAC/D,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,CAAA;AAE9C,IAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,OAAA,EAAS,QAAA,KAAa,QAAA,EAAU;AACnD,MAAA,MAAM,MAAA,GAAuC;AAAA,QAC3C,OAAA,EAAS,IAAA;AAAA,QACT,MAAA,EAAQ,GAAA;AAAA,QACR,UAAU,IAAA,CAAK,QAAA;AAAA,QACf,cAAA;AAAA,QACA,QAAQ,EAAA,CAAG,MAAA;AAAA,QACX,MAAA,EAAQ,CAAC,aAAA,KACP,IAAA,CAAK,kBAAyB,EAAA,CAAG,MAAA,EAAQ,KAAK,OAAA,EAAS,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,eAAe,MAAA,IAAU,IAAA,CAAK,QAAO,EAAG,IAAA,EAAM,SAAS,KAAK;AAAA,OAC1I;AAEA,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,OAAQ,MAAM,IAAA,CAAK,iBAAA,CAAyB,EAAA,CAAG,MAAA,EAAQ,KAAK,OAAA,EAAS,IAAA,EAAM,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA;AAAA,IAChG;AAEA,IAAA,OAAQ,MAAM,IAAA,CAAK,OAAA,CAAe,QAAA,EAAU,cAAc,CAAA;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,QAAA,CACL,EAAA,EACA,QAAA,EACA,OACA,OAAA,EACwC;AACxC,IAAA,IAAI,KAAA,GAAiC,EAAE,GAAI,KAAA,IAAS,EAAC,EAAG;AAExD,IAAA,WAAS;AACP,MAAA,MAAM,OAAO,MAAM,IAAA,CAAK,IAAA,CAAmE,EAAA,EAAI,UAAU,KAAA,EAAO;AAAA,QAC9G,GAAG,OAAA;AAAA,QACH,QAAA,EAAU;AAAA,OACX,CAAA;AACD,MAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA,CAAK,OAAO,EAAC;AAEtD,MAAA,OAAO,KAAA;AAEP,MAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAElB,MAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,IAAA,EAAM,aAAa,IAAA,EAAM;AACjD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,EAAA,CAAG,eAAe,MAAA,EAAQ;AAC5B,QAAA,MAAM,OAAA,GAAU,OAAO,KAAA,CAAM,IAAA,KAAS,QAAA,GAAW,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,IAAA,IAAQ,CAAC,CAAA;AACpF,QAAA,KAAA,GAAQ,EAAE,GAAG,KAAA,EAAO,MAAM,IAAA,CAAK,SAAA,IAAa,UAAU,CAAA,EAAE;AAAA,MAC1D,CAAA,MAAO;AACL,QAAA,IAAI,OAAO,IAAA,CAAK,WAAA,KAAgB,QAAA,IAAY,IAAA,CAAK,gBAAgB,EAAA,EAAI;AACnE,UAAA;AAAA,QACF;AACA,QAAA,KAAA,GAAQ,EAAE,GAAG,KAAA,EAAO,KAAA,EAAO,KAAK,WAAA,EAAY;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,CACE,MAAA,EACA,IAAA,EACA,KAAA,EACA,OAAA,EAC4B;AAC5B,IAAA,MAAM,EAAA,GAAoB;AAAA,MACxB,MAAA,EAAQ,IAAA;AAAA,MACR,WAAA,EAAa,IAAA;AAAA,MACb,MAAA;AAAA,MACA,IAAA;AAAA,MACA,YAAY,EAAC;AAAA,MACb,KAAA,EAAO,IAAA;AAAA,MACP,MAAA,EAAQ,IAAA;AAAA,MACR,QAAA,EAAU,IAAA;AAAA,MACV,IAAA,EAAM,OAAO,IAAA,KAAS,MAAA;AAAA,MACtB,UAAA,EAAY;AAAA,KACd;AAEA,IAAA,OAAO,IAAA,CAAK,KAAe,EAAA,EAAI,IAAI,KAAA,EAAO,IAAA,IAAQ,KAAA,EAAO,KAAA,EAAO,OAAO,CAAA;AAAA,EACzE;AAAA,EAEA,IAAA,CAAK,EAAA,EAAmB,QAAA,EAA6B,KAAA,EAAwB;AAC3E,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,MAAM,OAAO,EAAA,CAAG,IAAA,CAAK,QAAQ,cAAA,EAAgB,CAAC,GAAG,IAAA,KAAiB;AAChE,MAAA,MAAM,KAAA,GAAQ,SAAS,KAAA,EAAO,CAAA;AAE9B,MAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,EAAA,EAAI;AACvC,QAAA,MAAM,IAAI,UAAU,CAAA,EAAG,EAAA,CAAG,UAAU,EAAA,CAAG,IAAI,CAAA,2BAAA,EAA8B,IAAI,CAAA,GAAA,CAAK,CAAA;AAAA,MACpF;AAEA,MAAA,OAAO,mBAAmB,KAAK,CAAA;AAAA,IACjC,CAAC,CAAA;AAED,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAE,CAAA;AAE5C,IAAA,IAAI,QAAA,CAAS,KAAK,CAAA,EAAG;AACnB,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAChD,QAAA,WAAA,CAAY,GAAA,CAAI,YAAA,EAAc,GAAA,EAAK,KAAK,CAAA;AAAA,MAC1C;AAAA,IACF;AAEA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAAA,EAEA,MAAM,QAAA,CAAS,MAAA,EAAgB,GAAA,EAAa,MAAmB,OAAA,EAAoC;AACjG,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,EAAE,GAAG,IAAA,CAAK,QAAA,CAAS,OAAA,EAAS,GAAG,IAAA,CAAK,OAAA,EAAS,CAAA;AACzE,IAAA,OAAA,CAAQ,GAAA,CAAI,UAAU,kBAAkB,CAAA;AAExC,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,kBAAkB,CAAA;AAAA,IAChD;AAEA,IAAA,IAAI,IAAA,CAAK,mBAAmB,MAAA,EAAW;AACrC,MAAA,OAAA,CAAQ,GAAA,CAAI,iBAAA,EAAmB,IAAA,CAAK,cAAc,CAAA;AAAA,IACpD;AAEA,IAAA,IAAI,IAAA,CAAK,eAAe,MAAA,EAAW;AACjC,MAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,IAAA,CAAK,UAAU,CAAA;AAAA,IAC9C;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,WAAA,KAAgB,MAAA,EAAW;AAC3C,MAAA,OAAA,CAAQ,GAAA,CAAI,kBAAA,EAAoB,IAAA,CAAK,QAAA,CAAS,WAAW,CAAA;AAAA,IAC3D;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,MAAA,KAAW,MAAA,EAAW;AACtC,MAAA,OAAA,CAAQ,IAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAC7D,MAAA,OAAO,OAAA;AAAA,IACT;AAEA,IAAA,MAAM,MAAA,GAAS,KAAK,QAAA,CAAS,WAAA;AAC7B,IAAA,MAAM,QAAQ,OAAO,MAAA,KAAW,UAAA,GAAa,MAAM,QAAO,GAAI,MAAA;AAE9D,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA,EAAI;AAC7C,MAAA,MAAM,IAAI,mBAAmB,iEAAiE,CAAA;AAAA,IAChG;AAEA,IAAA,MAAM,IAAA,GAAO,KAAK,QAAA,CAAS,IAAA;AAE3B,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAC9C,MAAA,OAAO,OAAA;AAAA,IACT;AAEA,IAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,KAAA,EAAQ,KAAK,CAAA,CAAE,CAAA;AAC5C,IAAA,OAAA,CAAQ,GAAA;AAAA,MACN,MAAA;AAAA,MACA,MAAM,KAAK,KAAA,CAAM;AAAA,QACf,MAAA;AAAA,QACA,GAAA;AAAA,QACA,WAAA,EAAa,KAAA;AAAA,QACb,GAAI,KAAK,UAAA,KAAe,MAAA,GAAY,EAAE,KAAA,EAAO,IAAA,CAAK,UAAA,EAAW,GAAI;AAAC,OACnE;AAAA,KACH;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,SAAA,CAAU,MAAA,EAAgB,GAAA,EAAa,SAAkB,IAAA,EAAsC;AACnG,IAAA,KAAA,IAAS,UAAA,GAAa,KAAK,UAAA,EAAA,EAAc;AACvC,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,QAAA,CAAS,QAAQ,GAAA,EAAK,IAAA,EAAM,YAAY,MAAS,CAAA;AAC5E,MAAA,MAAM,UAAU,WAAA,CAAY,OAAA,CAAQ,IAAA,CAAK,QAAA,CAAS,aAAa,GAAM,CAAA;AACrE,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,GAAS,WAAA,CAAY,GAAA,CAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,CAAC,CAAA,GAAI,OAAA;AACvE,MAAA,MAAM,IAAA,GAAoB,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAO;AAEpD,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AAAA,MACpC;AAEA,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AAC5C,MAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AAE/C,MAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,IAAA,CAAK,QAAA,CAAS,SAAS,MAAA,EAAW;AACtD,QAAA,MAAM,aAAa,QAAA,CAAS,MAAA,KAAW,OAAO,KAAA,KAAU,IAAA,CAAK,cAAc,UAAA,KAAe,CAAA;AAC1F,QAAA,IAAA,CAAK,UAAA,GAAa,KAAA;AAElB,QAAA,IAAI,UAAA,EAAY;AACd,UAAA,MAAM,QAAA,CAAS,MAAM,MAAA,EAAO;AAC5B,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,OAAO,QAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,QAAA,EAAsC;AACvD,IAAA,IAAI,QAAA,CAAS,MAAA,IAAU,GAAA,IAAO,QAAA,CAAS,WAAW,GAAA,EAAK;AACrD,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAE3B,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,QAAA,CAAS,OAAO,CAAA;AAC5C,MAAA,OAAO,QAAA,CAAS,IAAI,CAAA,IAAK,IAAA,CAAK,KAAA,KAAU,yBAAA;AAAA,IAC1C;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,SAAS,OAAA,EAAyB;AAChC,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,YAAA,GAAe,CAAA,IAAK,OAAA;AAC7C,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,WAAA,EAAa,WAAA,GAAc,IAAI,IAAA,CAAK,MAAA,EAAO,IAAK,WAAA,GAAc,CAAA,CAAE,CAAA;AAAA,EACvF;AAAA;AAAA,EAGA,MAAM,KAAA,CAAM,MAAA,EAAgB,GAAA,EAAa,SAAkB,IAAA,EAAsC;AAC/F,IAAA,KAAA,IAAS,OAAA,GAAU,KAAK,OAAA,EAAA,EAAW;AACjC,MAAA,IAAI,QAAA;AAEJ,MAAA,IAAI;AACF,QAAA,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,GAAA,EAAK,SAAS,IAAI,CAAA;AAAA,MAC5D,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,IAAA,CAAK,QAAQ,OAAA,EAAS;AACxB,UAAA,MAAM,IAAA,CAAK,OAAO,MAAA,IAAU,KAAA;AAAA,QAC9B;AAEA,QAAA,IAAI,KAAA,YAAiB,WAAA,IAAe,OAAA,IAAW,IAAA,CAAK,WAAA,EAAa;AAC/D,UAAA,IAAI,iBAAiB,WAAA,EAAa;AAChC,YAAA,MAAM,KAAA;AAAA,UACR;AAEA,UAAA,MAAM,IAAI,sBAAA;AAAA,YACR,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,IAAI,IAAI,GAAG,CAAA,CAAE,QAAQ,CAAA,SAAA,EAAY,iBAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA,CAAA;AAAA,YACpG,IAAA,CAAK,cAAA;AAAA,YACL,EAAE,OAAO,KAAA;AAAM,WACjB;AAAA,QACF;AAEA,QAAA,MAAM,MAAM,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA,EAAG,KAAK,MAAM,CAAA;AAC/C,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,OAAA,IAAW,KAAK,WAAA,IAAe,CAAE,MAAM,IAAA,CAAK,YAAA,CAAa,QAAQ,CAAA,EAAI;AACvE,QAAA,OAAO,QAAA;AAAA,MACT;AAEA,MAAA,MAAM,QAAQ,YAAA,CAAa,QAAA,CAAS,OAAO,CAAA,IAAK,IAAA,CAAK,SAAS,OAAO,CAAA;AAErE,MAAA,IAAI,KAAA,GAAQ,KAAK,WAAA,EAAa;AAC5B,QAAA,OAAO,QAAA;AAAA,MACT;AAEA,MAAA,MAAM,QAAA,CAAS,MAAM,MAAA,EAAO;AAC5B,MAAA,MAAM,KAAA,CAAM,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA;AAAA,IAChC;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,QAAA,EAAmG;AACrH,IAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,QAAA,CAAS,OAAO,CAAA;AAE5C,IAAA,IAAI,CAAC,QAAA,CAAS,IAAI,CAAA,IAAK,IAAA,CAAK,KAAA,KAAU,mBAAA,IAAuB,CAAC,QAAA,CAAS,IAAA,CAAK,QAAQ,CAAA,EAAG;AACrF,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,WAAW,IAAA,CAAK,QAAA;AAEtB,IAAA,IAAI,OAAO,QAAA,CAAS,EAAA,KAAO,QAAA,IAAY,QAAA,CAAS,OAAO,EAAA,EAAI;AACzD,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,OAAO;AAAA,MACL,QAAA,EAAU;AAAA,QACR,IAAI,QAAA,CAAS,EAAA;AAAA,QACb,QAAQ,OAAO,QAAA,CAAS,MAAA,KAAW,QAAA,GAAW,SAAS,MAAA,GAAS,SAAA;AAAA,QAChE,cAAc,OAAO,QAAA,CAAS,YAAA,KAAiB,QAAA,GAAW,SAAS,YAAA,GAAe,EAAA;AAAA,QAClF,YAAY,OAAO,QAAA,CAAS,UAAA,KAAe,QAAA,GAAW,SAAS,UAAA,GAAa,EAAA;AAAA,QAC5E,UACE,OAAO,QAAA,CAAS,aAAa,QAAA,GACzB,QAAA,CAAS,WACT,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,EAAG,cAAA,CAAe,KAAK,KAAK,CAAC,qBAAqB,kBAAA,CAAmB,QAAA,CAAS,EAAE,CAAC,CAAA;AAAA,OACxG;AAAA,MACA,UAAA,EAAY,YAAA,CAAa,QAAA,CAAS,OAAO;AAAA,KAC3C;AAAA,EACF;AAAA,EAEA,MAAM,kBACJ,MAAA,EACA,GAAA,EACA,SACA,IAAA,EACA,KAAA,EACA,SACA,MAAA,EAC6B;AAC7B,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,KAAA,IAAS,KAAA,GAAQ,KAAK,KAAA,EAAA,EAAS;AAC7B,MAAA,IAAI,MAAA,IAAU,QAAQ,CAAA,EAAG;AACvB,QAAA,MAAM,IAAA,CAAK,QAAA,CAAS,kBAAA,GAAqB,IAAA,CAAK,UAAU,OAAO,CAAA;AAAA,MACjE;AAEA,MAAA,MAAM,KAAK,cAAA,CAAe,IAAA,CAAK,UAAU,IAAA,CAAK,UAAA,EAAY,KAAK,MAAM,CAAA;AAErE,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,QAAQ,GAAA,EAAK,OAAA,EAAS,EAAE,GAAG,IAAA,EAAM,UAAA,EAAY,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA;AACjG,MAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,CAAA;AAE/C,MAAA,IAAI,UAAU,IAAA,EAAM;AAClB,QAAA,OAAO,IAAA,CAAK,OAAA,CAAe,QAAA,EAAU,IAAA,CAAK,cAAc,CAAA;AAAA,MAC1D;AAEA,MAAA,IAAI,SAAS,mBAAA,EAAqB;AAChC,QAAA,MAAM,IAAI,aAAA;AAAA,UACR,qCAAqC,KAAK,CAAA,kBAAA,CAAA;AAAA,UAC1C,UAAA;AAAA,UACA,KAAA,CAAM;AAAA,SACR;AAAA,MACF;AAEA,MAAA,IAAA,GAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,cAAA,CAAe,QAAA,EAA2B,YAAA,EAAkC,MAAA,EAAgD;AAChI,IAAA,MAAM,UAAU,IAAI,GAAA,CAAI,QAAA,CAAS,QAAA,EAAU,KAAK,OAAO,CAAA;AAEvD,IAAA,IAAI,QAAQ,MAAA,KAAW,IAAI,IAAI,IAAA,CAAK,OAAO,EAAE,MAAA,EAAQ;AAEnD,MAAA,MAAM,IAAI,YAAY,CAAA,0BAAA,EAA6B,QAAA,CAAS,EAAE,CAAA,oBAAA,EAAuB,OAAA,CAAQ,MAAM,CAAA,EAAA,CAAI,CAAA;AAAA,IACzG;AAEA,IAAA,MAAM,WAAW,IAAA,CAAK,GAAA,CAAI,GAAG,IAAA,CAAK,QAAA,CAAS,0BAA0B,GAAK,CAAA;AAC1E,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,QAAA,CAAS,UAAU,CAAA;AAChD,IAAA,IAAI,QAAQ,YAAA,IAAgB,QAAA;AAE5B,IAAA,WAAS;AACP,MAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,GAAM,GAAG,MAAM,CAAA;AAE3C,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,QAAA,EAAS,EAAG,MAAA,EAAW,EAAE,MAAA,EAAQ,CAAA;AAElF,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,MAAM,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA;AAAA,MAClC;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,QAAQ,CAAA;AACpC,MAAA,MAAM,IAAA,GAAO,QAAA,CAAS,IAAI,CAAA,IAAK,QAAA,CAAS,KAAK,IAAI,CAAA,GAAI,IAAA,CAAK,IAAA,GAAO,EAAC;AAClE,MAAA,MAAM,SAAS,OAAO,IAAA,CAAK,MAAA,KAAW,QAAA,GAAW,KAAK,MAAA,GAAS,SAAA;AAE/D,MAAA,QAAQ,MAAA;AAAQ,QACd,KAAK,UAAA;AACH,UAAA;AAAA,QACF,KAAK,QAAA;AACH,UAAA,MAAM,IAAI,oBAAoB,QAAQ,CAAA;AAAA,QACxC,KAAK,SAAA;AACH,UAAA,MAAM,IAAI,qBAAqB,QAAQ,CAAA;AAAA,QACzC,KAAK,UAAA;AACH,UAAA,MAAM,IAAI,aAAA,CAAc,CAAA,SAAA,EAAY,SAAS,EAAE,CAAA,qCAAA,CAAA,EAAyC,YAAY,QAAQ,CAAA;AAE5G;AAGJ,MAAA,IAAI,CAAC,OAAO,KAAA,CAAM,SAAS,KAAK,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA,EAAQ;AAC/D,QAAA,MAAM,IAAI,qBAAqB,QAAQ,CAAA;AAAA,MACzC;AAEA,MAAA,KAAA,GAAQ,YAAA,CAAa,QAAA,CAAS,OAAO,CAAA,IAAK,QAAA;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,MAAM,OAAA,CAAe,QAAA,EAAoB,cAAA,EAAiE;AACxG,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,MAAM,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA;AAAA,IAClC;AAEA,IAAA,MAAM,OAAO,QAAA,CAAS,MAAA,KAAW,MAAM,MAAA,GAAY,MAAM,SAAS,QAAQ,CAAA;AAC1E,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,IAAI,CAAA,IAAK,MAAA,IAAU,IAAA;AAE7C,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,IAAA,EAAO,QAAA,GAAW,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,MAC9B,IAAA,EAAO,QAAA,GAAW,IAAA,CAAK,IAAA,GAAO,MAAA;AAAA,MAC9B,IAAA;AAAA,MACA,UAAU,QAAA,CAAS,OAAA,CAAQ,IAAI,qBAAqB,CAAA,EAAG,aAAY,KAAM,MAAA;AAAA,MACzE,cAAA;AAAA,MACA,SAAA,EAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAAA,MAC9C,SAAS,QAAA,CAAS;AAAA,KACpB;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,QAAA,EAA6C;AACxD,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,QAAQ,CAAA;AACpC,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAI,CAAA,GAAI,OAAO,EAAC;AACxC,IAAA,MAAM,IAAA,GAAO,OAAO,MAAA,CAAO,KAAA,KAAU,WAAW,MAAA,CAAO,KAAA,GAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAEtF,IAAA,MAAM,OAAA,GACJ,OAAO,MAAA,CAAO,OAAA,KAAY,WACtB,MAAA,CAAO,OAAA,GACP,OAAO,MAAA,CAAO,sBAAsB,QAAA,GAClC,MAAA,CAAO,iBAAA,GACP,CAAA,KAAA,EAAQ,SAAS,MAAM,CAAA,CAAA;AAC/B,IAAA,MAAM,SAAmC,EAAC;AAE1C,IAAA,IAAI,QAAA,CAAS,MAAA,CAAO,MAAM,CAAA,EAAG;AAC3B,MAAA,KAAA,MAAW,CAAC,OAAO,QAAQ,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA,EAAG;AAC7D,QAAA,MAAA,CAAO,KAAK,CAAA,GAAI,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,GAAI,CAAC,MAAA,CAAO,QAAQ,CAAC,CAAA;AAAA,MACpF;AAAA,IACF;AAEA,IAAA,MAAM,UAAA,GAAa,YAAA,CAAa,QAAA,CAAS,OAAO,CAAA;AAGhD,IAAA,MAAM,SAAA,GAAY,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,IAAY,MAAA,CAAO,UAAA,KAAe,EAAA,GAAK,MAAA,CAAO,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,IAAI,cAAc,CAAA;AAE7I,IAAA,OAAO,IAAI,cAAA,CAAe;AAAA,MACxB,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,KAAA,EAAO,IAAA;AAAA,MACP,OAAA;AAAA,MACA,MAAA;AAAA,MACA,SAAA;AAAA,MACA,YAAY,UAAA,KAAe,MAAA,GAAY,SAAY,IAAA,CAAK,IAAA,CAAK,aAAa,GAAI;AAAA,KAC/E,CAAA;AAAA,EACH;AACF;;;ACw5HO,IAAM,qBAAA,GAAwB;AAAA,EACnC,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,kBAAA,EAAoB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACtQ,uBAAA,EAAyB,EAAE,MAAA,EAAQ,uBAAA,EAAyB,aAAa,uBAAA,EAAyB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,oBAAoB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACpP,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,iBAAA,EAAmB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAClP,6BAAA,EAA+B,EAAE,MAAA,EAAQ,6BAAA,EAA+B,WAAA,EAAa,+BAA+B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,sCAAA,EAAwC,UAAA,EAAY,CAAC,MAAM,SAAS,CAAA,EAAG,KAAA,EAAO,kBAAA,EAAoB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1S,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,aAAa,2BAAA,EAA6B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,iBAAA,EAAmB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACjR,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,mBAAmB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAChP,sBAAA,EAAwB,EAAE,MAAA,EAAQ,IAAA,EAAM,aAAa,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,wBAAA,EAA0B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,UAAU,KAAA,EAAO,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACxM,eAAA,EAAiB,EAAE,MAAA,EAAQ,eAAA,EAAiB,aAAa,eAAA,EAAiB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,2CAAA,EAA6C,UAAA,EAAY,CAAC,iBAAiB,CAAA,EAAG,KAAA,EAAO,eAAA,EAAiB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACvQ,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,gBAAA,EAAkB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,gBAAA,EAAkB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5O,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7L,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,YAAA,EAAc,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC/M,UAAA,EAAY,EAAE,MAAA,EAAQ,UAAA,EAAY,aAAa,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,YAAA,EAAc,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9L,WAAA,EAAa,EAAE,MAAA,EAAQ,WAAA,EAAa,aAAa,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,aAAa,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC3L,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,WAAA,EAAa,sBAAsB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,yBAAA,EAA2B,UAAA,EAAY,CAAC,MAAM,KAAK,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACvP,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,WAAA,EAAa,sBAAsB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,yBAAA,EAA2B,UAAA,EAAY,CAAC,MAAM,KAAK,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACjQ,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,YAAA,EAAc,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACvM,gBAAA,EAAkB,EAAE,MAAA,EAAQ,gBAAA,EAAkB,aAAa,gBAAA,EAAkB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,mCAAA,EAAqC,UAAA,EAAY,CAAC,YAAY,CAAA,EAAG,KAAA,EAAO,iBAAA,EAAmB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACnQ,gBAAA,EAAkB,EAAE,MAAA,EAAQ,gBAAA,EAAkB,aAAa,gBAAA,EAAkB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,kBAAkB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAChO,gBAAA,EAAkB,EAAE,MAAA,EAAQ,gBAAA,EAAkB,aAAa,gBAAA,EAAkB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAChO,WAAA,EAAa,EAAE,MAAA,EAAQ,WAAA,EAAa,aAAa,WAAA,EAAa,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACjN,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,aAAA,EAAe,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzM,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,aAAA,EAAe,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,YAAA,EAAc,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACrN,UAAA,EAAY,EAAE,MAAA,EAAQ,UAAA,EAAY,aAAa,UAAA,EAAY,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,YAAA,EAAc,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACpM,WAAA,EAAa,EAAE,MAAA,EAAQ,WAAA,EAAa,aAAa,WAAA,EAAa,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,aAAa,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAClM,mBAAA,EAAqB,EAAE,MAAA,EAAQ,mBAAA,EAAqB,aAAa,mBAAA,EAAqB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzO,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,0BAAA,EAA4B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACnP,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACjO,mBAAA,EAAqB,EAAE,MAAA,EAAQ,mBAAA,EAAqB,aAAa,mBAAA,EAAqB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACvO,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,WAAA,EAAa,uBAAuB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,gCAAA,EAAkC,UAAA,EAAY,CAAC,MAAM,WAAW,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9Q,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAClP,8BAAA,EAAgC,EAAE,MAAA,EAAQ,8BAAA,EAAgC,aAAa,8BAAA,EAAgC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,oCAAA,EAAsC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzR,kCAAA,EAAoC,EAAE,MAAA,EAAQ,kCAAA,EAAoC,aAAa,kCAAA,EAAoC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,wCAAA,EAA0C,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzS,8BAAA,EAAgC,EAAE,MAAA,EAAQ,8BAAA,EAAgC,aAAa,8BAAA,EAAgC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,oCAAA,EAAsC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzR,8BAAA,EAAgC,EAAE,MAAA,EAAQ,8BAAA,EAAgC,aAAa,8BAAA,EAAgC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,oCAAA,EAAsC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzR,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,aAAA,EAAe,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,YAAA,EAAc,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAChN,0BAAA,EAA4B,EAAE,MAAA,EAAQ,0BAAA,EAA4B,aAAa,0BAAA,EAA4B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,oBAAoB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAChQ,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,mBAAmB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC5P,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,aAAa,2BAAA,EAA6B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,qBAAqB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACrQ,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,0BAAA,EAA4B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,iBAAA,EAAmB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAClQ,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,aAAa,2BAAA,EAA6B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,qBAAqB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACrQ,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,aAAa,2BAAA,EAA6B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,8BAAA,EAAgC,UAAA,EAAY,CAAC,QAAQ,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC/R,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,8BAAA,EAAgC,UAAA,EAAY,CAAC,QAAQ,CAAA,EAAG,KAAA,EAAO,iBAAA,EAAmB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1Q,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,mBAAmB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAChQ,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,aAAa,2BAAA,EAA6B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,8BAAA,EAAgC,UAAA,EAAY,CAAC,QAAQ,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACrR,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,mBAAmB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7P,4BAAA,EAA8B,EAAE,MAAA,EAAQ,4BAAA,EAA8B,aAAa,4BAAA,EAA8B,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,qBAAqB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAChR,mBAAA,EAAqB,EAAE,MAAA,EAAQ,mBAAA,EAAqB,aAAa,mBAAA,EAAqB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,mBAAmB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACzO,YAAA,EAAc,EAAE,MAAA,EAAQ,YAAA,EAAc,aAAa,YAAA,EAAc,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,YAAA,EAAc,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC3M,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,iBAAiB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3P,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,kBAAkB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5P,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,iBAAiB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3P,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,kBAAkB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5P,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,wBAAwB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1P,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,wBAAwB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC/O,iCAAA,EAAmC,EAAE,MAAA,EAAQ,iCAAA,EAAmC,aAAa,iCAAA,EAAmC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,sBAAA,EAAwB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1S,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,sBAAA,EAAwB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7P,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1O,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,0BAAA,EAA4B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC7Q,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,sBAAA,EAAwB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7Q,0BAAA,EAA4B,EAAE,MAAA,EAAQ,0BAAA,EAA4B,aAAa,0BAAA,EAA4B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,wBAAwB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACtQ,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,uBAAuB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACxO,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,0BAAA,EAA4B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,sBAAA,EAAwB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACxQ,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,wBAAA,EAA0B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,sBAAA,EAAwB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACpP,kCAAA,EAAoC,EAAE,MAAA,EAAQ,kCAAA,EAAoC,aAAa,kCAAA,EAAoC,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,iCAAA,EAAmC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,sBAAA,EAAwB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9S,0BAAA,EAA4B,EAAE,MAAA,EAAQ,0BAAA,EAA4B,aAAa,0BAAA,EAA4B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,0BAAA,EAA4B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,sBAAA,EAAwB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACjR,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,sBAAA,EAAwB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACtP,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,aAAA,EAAe,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,UAAA,EAAY,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,iBAAiB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5M,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,aAAA,EAAe,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,UAAA,EAAY,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,gBAAgB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1M,gBAAA,EAAkB,EAAE,MAAA,EAAQ,gBAAA,EAAkB,aAAa,gBAAA,EAAkB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,UAAA,EAAY,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,iBAAiB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9N,gBAAA,EAAkB,EAAE,MAAA,EAAQ,gBAAA,EAAkB,aAAa,gBAAA,EAAkB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,iBAAiB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7N,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,aAAA,EAAe,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,eAAe,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC5M,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,gBAAA,EAAkB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,uBAAuB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACnP,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACrQ,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,yBAAA,EAA2B,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,sBAAsB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAChQ,mBAAA,EAAqB,EAAE,MAAA,EAAQ,mBAAA,EAAqB,aAAa,mBAAA,EAAqB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,oBAAA,EAAsB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACjP,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,gBAAA,EAAkB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,sBAAsB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC/O,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7P,WAAA,EAAa,EAAE,MAAA,EAAQ,WAAA,EAAa,aAAa,WAAA,EAAa,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,YAAA,EAAc,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,YAAY,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAClM,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,kBAAA,EAAoB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,YAAY,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1N,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,gBAAA,EAAkB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,YAAY,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACrO,gBAAA,EAAkB,EAAE,MAAA,EAAQ,gBAAA,EAAkB,aAAa,gBAAA,EAAkB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,YAAY,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAClN,mBAAA,EAAqB,EAAE,MAAA,EAAQ,mBAAA,EAAqB,aAAa,mBAAA,EAAqB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAChO,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,YAAY,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1O,mBAAA,EAAqB,EAAE,MAAA,EAAQ,mBAAA,EAAqB,aAAa,mBAAA,EAAqB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,eAAA,EAAiB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,YAAY,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACjO,mBAAA,EAAqB,EAAE,MAAA,EAAQ,mBAAA,EAAqB,aAAa,mBAAA,EAAqB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,aAAa,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1O,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,YAAY,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACzN,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,aAAa,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1N,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,gBAAA,EAAkB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,uBAAuB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACnP,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,gBAAA,EAAkB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,sBAAsB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC/O,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACrQ,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,aAAa,2BAAA,EAA6B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,6BAAA,EAA+B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAClR,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,eAAe,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9M,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7N,WAAA,EAAa,EAAE,MAAA,EAAQ,WAAA,EAAa,aAAa,WAAA,EAAa,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACzM,YAAA,EAAc,EAAE,MAAA,EAAQ,YAAA,EAAc,aAAa,YAAA,EAAc,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACvM,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACxN,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,8CAAA,EAAgD,UAAA,EAAY,CAAC,iBAAiB,CAAA,EAAG,KAAA,EAAO,kBAAA,EAAoB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACtR,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,WAAA,EAAa,sBAAsB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,qEAAA,EAAuE,UAAA,EAAY,CAAC,mBAAmB,eAAe,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACnU,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,WAAA,EAAa,sBAAsB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,8DAAA,EAAgE,UAAA,EAAY,CAAC,mBAAmB,eAAe,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACpU,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,8CAAA,EAAgD,UAAA,EAAY,CAAC,iBAAiB,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACpR,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,aAAA,EAAe,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzM,WAAA,EAAa,EAAE,MAAA,EAAQ,WAAA,EAAa,aAAa,WAAA,EAAa,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,aAAa,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAClM,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,aAAA,EAAe,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,YAAA,EAAc,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACxN,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,aAAA,EAAe,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzN,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,uBAAA,EAAyB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,gBAAgB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACvP,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,eAAA,EAAiB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,eAAe,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7N,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,gBAAgB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3O,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,gBAAgB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACnP,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,qBAAqB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5O,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3P,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,kBAAA,EAAoB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACvO,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,oBAAoB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACrO,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,wBAAA,EAA0B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAClP,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACtP,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,aAAA,EAAe,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,0CAAA,EAA4C,UAAA,EAAY,CAAC,iBAAiB,CAAA,EAAG,KAAA,EAAO,eAAA,EAAiB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7P,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,0CAAA,EAA4C,UAAA,EAAY,CAAC,iBAAiB,CAAA,EAAG,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAClQ,gBAAA,EAAkB,EAAE,MAAA,EAAQ,gBAAA,EAAkB,WAAA,EAAa,kBAAkB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,oDAAA,EAAsD,UAAA,EAAY,CAAC,mBAAmB,SAAS,CAAA,EAAG,KAAA,EAAO,eAAA,EAAiB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACpS,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,WAAA,EAAa,uBAAuB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,oEAAA,EAAsE,UAAA,EAAY,CAAC,mBAAmB,SAAA,EAAW,SAAS,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACnU,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,WAAA,EAAa,sBAAsB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,0DAAA,EAA4D,UAAA,EAAY,CAAC,mBAAmB,SAAS,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACzS,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,WAAA,EAAa,wBAAwB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,oEAAA,EAAsE,UAAA,EAAY,CAAC,mBAAmB,SAAA,EAAW,SAAS,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,aAAA,EAAe,QAAA,EAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC/U,gBAAA,EAAkB,EAAE,MAAA,EAAQ,gBAAA,EAAkB,WAAA,EAAa,kBAAkB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,oDAAA,EAAsD,UAAA,EAAY,CAAC,mBAAmB,SAAS,CAAA,EAAG,KAAA,EAAO,eAAA,EAAiB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5R,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,gBAAA,EAAkB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,uBAAuB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACnP,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACrQ,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,aAAa,2BAAA,EAA6B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,0CAAA,EAA4C,UAAA,EAAY,CAAC,iBAAiB,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7S,+BAAA,EAAiC,EAAE,MAAA,EAAQ,+BAAA,EAAiC,WAAA,EAAa,iCAAiC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,8DAAA,EAAgE,UAAA,EAAY,CAAC,mBAAmB,WAAW,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5V,4BAAA,EAA8B,EAAE,MAAA,EAAQ,4BAAA,EAA8B,aAAa,4BAAA,EAA8B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,0CAAA,EAA4C,UAAA,EAAY,CAAC,iBAAiB,CAAA,EAAG,KAAA,EAAO,oBAAA,EAAsB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9S,8BAAA,EAAgC,EAAE,MAAA,EAAQ,8BAAA,EAAgC,WAAA,EAAa,gCAAgC,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,sDAAA,EAAwD,UAAA,EAAY,CAAC,mBAAmB,WAAW,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACxV,8BAAA,EAAgC,EAAE,MAAA,EAAQ,8BAAA,EAAgC,WAAA,EAAa,gCAAgC,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,6DAAA,EAA+D,UAAA,EAAY,CAAC,mBAAmB,WAAW,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACvV,mBAAA,EAAqB,EAAE,MAAA,EAAQ,mBAAA,EAAqB,aAAa,mBAAA,EAAqB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,oBAAA,EAAsB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACjP,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,gBAAA,EAAkB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,sBAAsB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC/O,mCAAA,EAAqC,EAAE,MAAA,EAAQ,mCAAA,EAAqC,aAAa,mCAAA,EAAqC,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,+CAAA,EAAiD,UAAA,EAAY,CAAC,iBAAiB,CAAA,EAAG,KAAA,EAAO,oBAAA,EAAsB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5U,iCAAA,EAAmC,EAAE,MAAA,EAAQ,iCAAA,EAAmC,aAAa,iCAAA,EAAmC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,+CAAA,EAAiD,UAAA,EAAY,CAAC,iBAAiB,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACjU,mCAAA,EAAqC,EAAE,MAAA,EAAQ,mCAAA,EAAqC,WAAA,EAAa,qCAAqC,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,oDAAA,EAAsD,UAAA,EAAY,CAAC,mBAAmB,IAAI,CAAA,EAAG,KAAA,EAAO,oBAAA,EAAsB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7V,0BAAA,EAA4B,EAAE,MAAA,EAAQ,0BAAA,EAA4B,aAAa,0BAAA,EAA4B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,gCAAA,EAAkC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACpR,uBAAA,EAAyB,EAAE,MAAA,EAAQ,uBAAA,EAAyB,aAAa,uBAAA,EAAyB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,6BAAA,EAA+B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACxQ,kCAAA,EAAoC,EAAE,MAAA,EAAQ,kCAAA,EAAoC,aAAa,kCAAA,EAAoC,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,wCAAA,EAA0C,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACtT,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7P,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,0BAA0B,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9O,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,wBAAA,EAA0B,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAChQ,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC/N,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,wBAAA,EAA0B,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACxP,0BAAA,EAA4B,EAAE,MAAA,EAAQ,0BAAA,EAA4B,WAAA,EAAa,4BAA4B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,yCAAA,EAA2C,UAAA,EAAY,CAAC,MAAM,eAAe,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9S,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,yBAAA,EAA2B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAChQ,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,eAAe,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3M,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7N,WAAA,EAAa,EAAE,MAAA,EAAQ,WAAA,EAAa,aAAa,WAAA,EAAa,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACzM,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACnP,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,WAAA,EAAa,uBAAuB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,gCAAA,EAAkC,UAAA,EAAY,CAAC,MAAM,WAAW,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAClR,YAAA,EAAc,EAAE,MAAA,EAAQ,YAAA,EAAc,aAAa,YAAA,EAAc,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACvM,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACrN,6BAAA,EAA+B,EAAE,MAAA,EAAQ,6BAAA,EAA+B,aAAa,6BAAA,EAA+B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,uBAAA,EAAyB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,sBAAsB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACjR,6BAAA,EAA+B,EAAE,MAAA,EAAQ,6BAAA,EAA+B,aAAa,6BAAA,EAA+B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,oBAAA,EAAsB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC/R,0BAAA,EAA4B,EAAE,MAAA,EAAQ,0BAAA,EAA4B,aAAa,0BAAA,EAA4B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5Q,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,aAAa,2BAAA,EAA6B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,uBAAA,EAAyB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,qBAAqB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC1Q,iCAAA,EAAmC,EAAE,MAAA,EAAQ,iCAAA,EAAmC,aAAa,iCAAA,EAAmC,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,mCAAA,EAAqC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,oBAAA,EAAsB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1S,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,uBAAA,EAAyB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACjP,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,kBAAA,EAAoB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC/O,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,eAAe,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1N,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC/N,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACrP,gBAAA,EAAkB,EAAE,MAAA,EAAQ,gBAAA,EAAkB,aAAa,gBAAA,EAAkB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,gBAAgB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzN,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,eAAe,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACnO,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACrP,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACjO,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC/N,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,eAAe,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3O,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7O,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACpO,uBAAA,EAAyB,EAAE,MAAA,EAAQ,uBAAA,EAAyB,aAAa,uBAAA,EAAyB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,eAAe,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAChP,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,0BAA0B,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACtN,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,wBAAA,EAA0B,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACxO,WAAA,EAAa,EAAE,MAAA,EAAQ,WAAA,EAAa,aAAa,WAAA,EAAa,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACzM,YAAA,EAAc,EAAE,MAAA,EAAQ,YAAA,EAAc,aAAa,YAAA,EAAc,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACnM,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,WAAA,EAAa,2BAA2B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,yCAAA,EAA2C,UAAA,EAAY,CAAC,MAAM,eAAe,CAAA,EAAG,KAAA,EAAO,wBAAA,EAA0B,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7S,0BAAA,EAA4B,EAAE,MAAA,EAAQ,0BAAA,EAA4B,WAAA,EAAa,4BAA4B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,yCAAA,EAA2C,UAAA,EAAY,CAAC,MAAM,eAAe,CAAA,EAAG,KAAA,EAAO,wBAAA,EAA0B,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACzT,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,wBAAA,EAA0B,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAChO,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,YAAA,EAAc,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,mBAAmB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAClO,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,iBAAA,EAAmB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9O,eAAA,EAAiB,EAAE,MAAA,EAAQ,eAAA,EAAiB,aAAa,eAAA,EAAiB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,gBAAA,EAAkB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7N,gBAAA,EAAkB,EAAE,MAAA,EAAQ,gBAAA,EAAkB,aAAa,gBAAA,EAAkB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,YAAA,EAAc,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,kBAAkB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC3N,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,iBAAA,EAAmB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5O,mBAAA,EAAqB,EAAE,MAAA,EAAQ,mBAAA,EAAqB,aAAa,mBAAA,EAAqB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,eAAe,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAClO,uBAAA,EAAyB,EAAE,MAAA,EAAQ,uBAAA,EAAyB,aAAa,uBAAA,EAAyB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,iDAAA,EAAmD,UAAA,EAAY,CAAC,iBAAiB,CAAA,EAAG,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACvS,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,gBAAgB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACjP,gCAAA,EAAkC,EAAE,MAAA,EAAQ,gCAAA,EAAkC,aAAa,gCAAA,EAAkC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,8BAAA,EAAgC,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,gBAAgB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1R,gBAAA,EAAkB,EAAE,MAAA,EAAQ,gBAAA,EAAkB,aAAa,gBAAA,EAAkB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,eAAe,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACtN,mBAAA,EAAqB,EAAE,MAAA,EAAQ,mBAAA,EAAqB,aAAa,mBAAA,EAAqB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,gBAAgB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACrO,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,gCAAA,EAAkC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACrQ,uBAAA,EAAyB,EAAE,MAAA,EAAQ,uBAAA,EAAyB,aAAa,uBAAA,EAAyB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,wCAAA,EAA0C,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9Q,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,uCAAA,EAAyC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACvQ,uBAAA,EAAyB,EAAE,MAAA,EAAQ,uBAAA,EAAyB,aAAa,uBAAA,EAAyB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,gDAAA,EAAkD,UAAA,EAAY,CAAC,UAAU,CAAA,EAAG,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACxR,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,2BAAA,EAA6B,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,eAAe,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACnP,uBAAA,EAAyB,EAAE,MAAA,EAAQ,uBAAA,EAAyB,aAAa,uBAAA,EAAyB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,mCAAA,EAAqC,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,eAAe,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAChQ,mBAAA,EAAqB,EAAE,MAAA,EAAQ,mBAAA,EAAqB,aAAa,mBAAA,EAAqB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,2BAAA,EAA6B,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,gBAAgB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACjP,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,gCAAA,EAAkC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,cAAA,EAAgB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACpQ,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,eAAA,EAAiB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,oBAAoB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5O,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,kBAAA,EAAoB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1P,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,iBAAA,EAAmB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1O,mBAAA,EAAqB,EAAE,MAAA,EAAQ,mBAAA,EAAqB,aAAa,mBAAA,EAAqB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,eAAA,EAAiB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,mBAAmB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACxO,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,2BAAA,EAA6B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,kBAAA,EAAoB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3Q,0BAAA,EAA4B,EAAE,MAAA,EAAQ,0BAAA,EAA4B,aAAa,0BAAA,EAA4B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,gCAAA,EAAkC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5Q,uCAAA,EAAyC,EAAE,MAAA,EAAQ,uCAAA,EAAyC,aAAa,uCAAA,EAAyC,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,6CAAA,EAA+C,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAChU,mCAAA,EAAqC,EAAE,MAAA,EAAQ,mCAAA,EAAqC,aAAa,mCAAA,EAAqC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,oCAAA,EAAsC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACtS,oCAAA,EAAsC,EAAE,MAAA,EAAQ,oCAAA,EAAsC,aAAa,oCAAA,EAAsC,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,oCAAA,EAAsC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9S,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,kBAAA,EAAoB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,aAAa,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACjP,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,uBAAA,EAAyB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC/P,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACxQ,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,uBAAA,EAAyB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC/O,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,kBAAA,EAAoB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,YAAY,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC7O,6BAAA,EAA+B,EAAE,MAAA,EAAQ,6BAAA,EAA+B,aAAa,6BAAA,EAA+B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,mCAAA,EAAqC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACxR,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,uBAAA,EAAyB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9P,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,2BAAA,EAA6B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACxP,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,aAAa,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACjO,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAClP,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,cAAA,EAAgB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,YAAY,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EAC7N,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,0BAAA,EAA4B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,WAAA,EAAa,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACjP,0BAAA,EAA4B,EAAE,MAAA,EAAQ,0BAAA,EAA4B,aAAa,0BAAA,EAA4B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,aAAa,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzP,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,wBAAA,EAA0B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,eAAA,EAAiB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAClQ,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,iBAAiB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzP,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,aAAa,2BAAA,EAA6B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,kCAAA,EAAoC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzR,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,WAAA,EAAa,6BAA6B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,8CAAA,EAAgD,UAAA,EAAY,CAAC,MAAM,WAAW,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACvT,4BAAA,EAA8B,EAAE,MAAA,EAAQ,4BAAA,EAA8B,aAAa,4BAAA,EAA8B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,qBAAqB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzQ,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,2BAAA,EAA6B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,kBAAA,EAAoB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACvQ,0BAAA,EAA4B,EAAE,MAAA,EAAQ,0BAAA,EAA4B,aAAa,0BAAA,EAA4B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,oBAAoB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACrQ,4BAAA,EAA8B,EAAE,MAAA,EAAQ,4BAAA,EAA8B,aAAa,4BAAA,EAA8B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,kCAAA,EAAoC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC/R,4BAAA,EAA8B,EAAE,MAAA,EAAQ,4BAAA,EAA8B,aAAa,4BAAA,EAA8B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,kCAAA,EAAoC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,mBAAA,EAAqB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5R,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,eAAe,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3M,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACzO,6BAAA,EAA+B,EAAE,MAAA,EAAQ,6BAAA,EAA+B,WAAA,EAAa,+BAA+B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,yCAAA,EAA2C,UAAA,EAAY,CAAC,MAAM,SAAS,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACtS,+BAAA,EAAiC,EAAE,MAAA,EAAQ,+BAAA,EAAiC,WAAA,EAAa,iCAAiC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,yCAAA,EAA2C,UAAA,EAAY,CAAC,MAAM,SAAS,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACjT,8BAAA,EAAgC,EAAE,MAAA,EAAQ,8BAAA,EAAgC,aAAa,8BAAA,EAAgC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,+BAAA,EAAiC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACpR,gCAAA,EAAkC,EAAE,MAAA,EAAQ,gCAAA,EAAkC,WAAA,EAAa,kCAAkC,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,yCAAA,EAA2C,UAAA,EAAY,CAAC,MAAM,SAAS,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1T,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,aAAA,EAAe,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,mBAAA,EAAqB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3N,WAAA,EAAa,EAAE,MAAA,EAAQ,WAAA,EAAa,aAAa,WAAA,EAAa,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACzM,YAAA,EAAc,EAAE,MAAA,EAAQ,YAAA,EAAc,aAAa,YAAA,EAAc,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACvM,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACvO,sBAAA,EAAwB,EAAE,MAAA,EAAQ,sBAAA,EAAwB,aAAa,sBAAA,EAAwB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1P,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,aAAa,2BAAA,EAA6B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3Q,oBAAA,EAAsB,EAAE,MAAA,EAAQ,oBAAA,EAAsB,aAAa,oBAAA,EAAsB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAClP,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,wBAAA,EAA0B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5O,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAChP,uBAAA,EAAyB,EAAE,MAAA,EAAQ,uBAAA,EAAyB,WAAA,EAAa,yBAAyB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,mCAAA,EAAqC,UAAA,EAAY,CAAC,MAAM,YAAY,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5R,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,aAAa,2BAAA,EAA6B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7Q,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACxN,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,0BAAA,EAA4B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACnQ,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,aAAA,EAAe,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC/N,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,WAAA,EAAa,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,kBAAkB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7N,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,gBAAA,EAAkB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,gBAAA,EAAkB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5O,cAAA,EAAgB,EAAE,MAAA,EAAQ,cAAA,EAAgB,aAAa,cAAA,EAAgB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,gBAAA,EAAkB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,eAAA,EAAiB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACxN,eAAA,EAAiB,EAAE,MAAA,EAAQ,eAAA,EAAiB,aAAa,eAAA,EAAiB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,WAAA,EAAa,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,iBAAiB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,QAAA,EAAS;AAAA,EACtN,gBAAA,EAAkB,EAAE,MAAA,EAAQ,gBAAA,EAAkB,aAAa,gBAAA,EAAkB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,gBAAA,EAAkB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACvO,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,uBAAA,EAAyB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,gBAAA,EAAkB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3O,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,uBAAA,EAAyB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,gBAAA,EAAkB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACnQ,kCAAA,EAAoC,EAAE,MAAA,EAAQ,kCAAA,EAAoC,aAAa,kCAAA,EAAoC,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,iCAAA,EAAmC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,gBAAA,EAAkB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7S,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,gBAAA,EAAkB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,gBAAA,EAAkB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA;AACjO;AAkBO,IAAM,oBAAN,MAAwB;AAAA;AAAA,EAEpB,SAAA;AAAA,EAET,YAAY,OAAA,EAAmC;AAC7C,IAAA,IAAA,CAAK,SAAA,GAAY,IAAI,mBAAA,CAAoB,aAAA,EAAe,OAAO,CAAA;AAAA,EACjE;AAAA;AAAA,EAGA,OAAA,CACE,MAAA,EACA,IAAA,EACA,KAAA,EACA,OAAA,EAC4B;AAC5B,IAAA,OAAO,KAAK,SAAA,CAAU,OAAA,CAAkB,MAAA,EAAQ,IAAA,EAAM,OAAO,OAAO,CAAA;AAAA,EACtE;AAAA,EAES,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWvB,KAAA,EAAO,CAAsC,EAAA,EAAY,IAAA,EAA+B,YACtF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWvH,MAAA,EAAQ,CAAsC,IAAA,EAA+B,OAAA,KAC3E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAqC,qBAAA,CAAsB,uBAAuB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWvH,GAAA,EAAK,CAAsC,EAAA,EAAY,KAAA,EAA+B,YACpF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWpH,IAAA,EAAM,CAAsC,KAAA,EAAgC,OAAA,KAC1E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAEpH,OAAA,EAAS,CAAC,KAAA,EAA+C,OAAA,KACvD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA,IACjI,KAAA,EAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWL,QAAQ,CAAsC,EAAA,EAAY,MAAA,EAAgB,IAAA,EAAoC,YAC5G,IAAA,CAAK,SAAA,CAAU,IAAA,CAA0C,qBAAA,CAAsB,6BAA6B,CAAA,EAAG,CAAC,IAAI,MAAM,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW5I,IAAA,EAAM,CAAsC,EAAA,EAAY,KAAA,EAAqC,YAC3F,IAAA,CAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAEjI,OAAA,EAAS,CAAC,EAAA,EAAY,KAAA,EAAoD,YACxE,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAA8C,OAAO;AAAA;AAC3I,GACF;AAAA,EAES,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASzB,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA,GAC9H;AAAA,EAES,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYjB,IAAA,EAAM,CAAsC,cAAA,EAAwB,KAAA,EAA0B,YAC5F,IAAA,CAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,eAAe,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAEtH,OAAA,EAAS,CAAC,cAAA,EAAwB,KAAA,EAAyC,YACzE,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,eAAe,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAazI,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA,GACpH;AAAA,EAES,IAAA,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAgBd,MAAA,EAAQ,CAAsC,IAAA,EAAsB,OAAA,KAClE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYpG,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW3G,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAAyB,qBAAA,CAAsB,UAAU,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrG,IAAA,EAAM,CAAsC,KAAA,EAAuB,OAAA,KACjE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA0B,qBAAA,CAAsB,WAAW,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAEjG,OAAA,EAAS,CAAC,KAAA,EAAsC,OAAA,KAC9C,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,WAAW,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAcvH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAuB,YAC/E,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA,IACtG,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,QAAQ,CAAsC,EAAA,EAAY,GAAA,EAAa,IAAA,EAA6B,YAClG,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,IAAI,GAAG,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWxH,QAAQ,CAAsC,EAAA,EAAY,GAAA,EAAa,OAAA,KACrE,KAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,GAAG,CAAC,EAAA,EAAI,GAAG,CAAA,EAAG,QAAW,OAAO;AAAA;AAC/H,GACF;AAAA,EAES,SAAA,GAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWnB,IAAA,EAAM,CAAsC,SAAA,EAAmB,OAAA,KAC7D,KAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,gBAAgB,CAAA,EAAG,CAAC,SAAS,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWxH,IAAA,EAAM,CAAsC,KAAA,EAA4B,OAAA,KACtE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,gBAAgB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAE3G,OAAA,EAAS,CAAC,KAAA,EAA2C,OAAA,KACnD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,gBAAgB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO;AAAA,GAC9H;AAAA,EAES,IAAA,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAcd,SAAA,EAAW,CAAsC,EAAA,EAAY,OAAA,KAC3D,KAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,gBAAgB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWjH,IAAA,EAAM,CAAsC,EAAA,EAAY,IAAA,EAAoB,YAC1E,IAAA,CAAK,SAAA,CAAU,IAAA,CAA0B,qBAAA,CAAsB,WAAW,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IA2BlG,MAAA,EAAQ,CAAsC,IAAA,EAAuB,OAAA,KACnE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWpG,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW3G,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAAyB,qBAAA,CAAsB,UAAU,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrG,IAAA,EAAM,CAAsC,KAAA,EAAuB,OAAA,KACjE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA0B,qBAAA,CAAsB,WAAW,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAEjG,OAAA,EAAS,CAAC,KAAA,EAAsC,OAAA,KAC9C,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,WAAW,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWvH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAuB,YAC/E,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA,IACtG,QAAA,EAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWR,GAAA,EAAK,CAAsC,EAAA,EAAY,IAAA,EAA4B,YACjF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWjH,IAAA,EAAM,CAAsC,EAAA,EAAY,OAAA,KACtD,KAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA,KAC1H;AAAA,IACA,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,GAAA,EAAK,CAAsC,EAAA,EAAY,IAAA,EAA0B,YAC/E,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,KAC/G;AAAA,IACA,OAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAcP,IAAA,EAAM,CAAsC,EAAA,EAAY,OAAA,KACtD,KAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWtH,QAAQ,CAAsC,EAAA,EAAY,QAAA,EAAkB,OAAA,KAC1E,KAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,GAAG,CAAC,EAAA,EAAI,QAAQ,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWpI,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA6B,YACrF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,KACvH;AAAA,IACA,QAAA,EAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWR,YAAA,EAAc,CAAsC,EAAA,EAAY,IAAA,EAAqC,YACnG,IAAA,CAAK,SAAA,CAAU,IAAA,CAA0C,qBAAA,CAAsB,8BAA8B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWrI,iBAAA,EAAmB,CAAsC,EAAA,EAAY,IAAA,EAA0C,YAC7G,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+C,qBAAA,CAAsB,kCAAkC,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW9I,aAAA,EAAe,CAAsC,EAAA,EAAY,IAAA,EAAqC,YACpG,IAAA,CAAK,SAAA,CAAU,IAAA,CAA2C,qBAAA,CAAsB,8BAA8B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWtI,aAAA,EAAe,CAAsC,EAAA,EAAY,IAAA,EAAsC,YACrG,IAAA,CAAK,SAAA,CAAU,IAAA,CAA2C,qBAAA,CAAsB,8BAA8B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA;AACxI,GACF;AAAA,EAES,SAAA,GAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWnB,MAAA,EAAQ,CAAsC,KAAA,EAA8B,OAAA,KAC1E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA,IAChH,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,MAAA,EAAQ,CAAsC,IAAA,EAAiC,OAAA,KAC7E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAuC,qBAAA,CAAsB,0BAA0B,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW5H,IAAA,EAAM,CAAsC,KAAA,EAAkC,OAAA,KAC5E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAqC,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAEzH,OAAA,EAAS,CAAC,KAAA,EAAiD,OAAA,KACzD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO;AAAA,KACtI;AAAA,IACA,OAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWP,MAAA,EAAQ,CAAsC,IAAA,EAAmC,OAAA,KAC/E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW9H,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAAqC,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA,KACjI;AAAA,IACA,OAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWP,MAAA,EAAQ,CAAsC,IAAA,EAAkC,OAAA,KAC9E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW9H,MAAA,EAAQ,CAAsC,MAAA,EAAgB,OAAA,KAC5D,KAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,CAAC,MAAM,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWzI,GAAA,EAAK,CAAsC,MAAA,EAAgB,OAAA,KACzD,KAAK,SAAA,CAAU,IAAA,CAAqC,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,CAAC,MAAM,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWnI,IAAA,EAAM,CAAsC,KAAA,EAAmC,OAAA,KAC7E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,yBAAyB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAE3H,OAAA,EAAS,CAAC,KAAA,EAAkD,OAAA,KAC1D,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,yBAAyB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWrI,MAAA,EAAQ,CAAsC,MAAA,EAAgB,IAAA,EAAmC,YAC/F,IAAA,CAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,CAAC,MAAM,CAAA,EAAG,MAAM,OAAO;AAAA,KACtI;AAAA,IACA,QAAA,EAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWR,GAAA,EAAK,CAAsC,OAAA,KACzC,IAAA,CAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,yBAAyB,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW/H,MAAA,EAAQ,CAAsC,IAAA,EAAoC,OAAA,KAChF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAyC,qBAAA,CAAsB,4BAA4B,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA;AAClI,GACF;AAAA,EAES,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWf,IAAA,EAAM,CAAsC,KAAA,EAAwB,OAAA,KAClE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA2B,qBAAA,CAAsB,YAAY,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAEnG,OAAA,EAAS,CAAC,KAAA,EAAuC,OAAA,KAC/C,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,YAAY,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO;AAAA,GAC1H;AAAA,EAES,QAAA,GAAW;AAAA,IAClB,UAAA,EAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWV,GAAA,EAAK,CAAsC,KAAA,EAAoC,OAAA,KAC7E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAuC,qBAAA,CAAsB,yBAAyB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW5H,GAAA,EAAK,CAAsC,IAAA,EAAiC,OAAA,KAC1E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAuC,qBAAA,CAAsB,yBAAyB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA,KAC7H;AAAA,IACA,UAAA,EAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWV,GAAA,EAAK,CAAsC,KAAA,EAAoC,OAAA,KAC7E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAuC,qBAAA,CAAsB,yBAAyB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW5H,GAAA,EAAK,CAAsC,IAAA,EAAkC,OAAA,KAC3E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAuC,qBAAA,CAAsB,yBAAyB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA;AAC7H,GACF;AAAA,EAES,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrB,OAAA,EAAS,CAAsC,IAAA,EAA8B,OAAA,KAC3E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWpH,MAAA,EAAQ,CAAsC,IAAA,EAA6B,OAAA,KACzE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWlH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA8B,YACtF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWpH,GAAA,EAAK,CAAsC,EAAA,EAAY,KAAA,EAA6B,YAClF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW/G,IAAA,EAAM,CAAsC,KAAA,EAA8B,OAAA,KACxE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAE/G,OAAA,EAAS,CAAC,KAAA,EAA6C,OAAA,KACrD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW9H,IAAA,EAAM,CAAsC,EAAA,EAAY,IAAA,EAA4B,YAClF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWhH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA6B,YACrF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA,IACpH,WAAA,EAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWX,OAAA,EAAS,CAAsC,EAAA,EAAY,IAAA,EAAyC,YAClG,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+C,qBAAA,CAAsB,iCAAiC,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,KAC/I;AAAA,IACA,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,IAAA,EAAM,CAAsC,EAAA,EAAY,KAAA,EAAoC,YAC1F,IAAA,CAAK,SAAA,CAAU,IAAA,CAAuC,qBAAA,CAAsB,yBAAyB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAE9H,OAAA,EAAS,CAAC,EAAA,EAAY,KAAA,EAAmD,YACvE,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,yBAAyB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWvI,GAAA,EAAK,CAAsC,EAAA,EAAY,IAAA,EAAgC,YACrF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,KAC7H;AAAA,IACA,IAAA,EAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWJ,OAAA,EAAS,CAAsC,IAAA,EAAkC,OAAA,KAC/E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,0BAA0B,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA,KAC/H;AAAA,IACA,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,GAAA,EAAK,CAAsC,EAAA,EAAY,IAAA,EAAgC,YACrF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,KAC7H;AAAA,IACA,YAAA,EAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWZ,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA0C,YAClG,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+C,qBAAA,CAAsB,kCAAkC,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,KAChJ;AAAA,IACA,KAAA,EAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWL,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAmC,YAC3F,IAAA,CAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,0BAA0B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA;AACjI,GACF;AAAA,EAES,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWjB,GAAA,EAAK,CAAsC,IAAA,EAAsB,OAAA,KAC/D,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWpG,GAAA,EAAK,CAAsC,OAAA,KACzC,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWzG,MAAA,EAAQ,CAAsC,OAAA,KAC5C,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,gBAAgB,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW/G,MAAA,EAAQ,CAAsC,OAAA,KAC5C,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,gBAAgB,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO;AAAA,GACjH;AAAA,EAES,MAAA,GAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWhB,IAAA,EAAM,CAAsC,KAAA,EAAyB,OAAA,KACnE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAErG,OAAA,EAAS,CAAC,KAAA,EAAwC,OAAA,KAChD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,aAAa,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO;AAAA,GAC3H;AAAA,EAES,YAAA,GAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWtB,MAAA,EAAQ,CAAsC,IAAA,EAA8B,OAAA,KAC1E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrH,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW5H,QAAA,EAAU,CAAsC,KAAA,EAAmC,OAAA,KACjF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW1H,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWtH,IAAA,EAAM,CAAsC,KAAA,EAA+B,OAAA,KACzE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAElH,OAAA,EAAS,CAAC,KAAA,EAA8C,OAAA,KACtD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWhI,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA+B,YACvF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,GACzH;AAAA,EAES,GAAA,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWb,KAAA,EAAO,CAAsC,KAAA,EAAsB,OAAA,KACjE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA0B,qBAAA,CAAsB,WAAW,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWjG,UAAA,EAAY,CAAsC,KAAA,EAA2B,OAAA,KAC3E,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA,IAC5G,SAAA,EAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWT,IAAA,EAAM,CAAsC,KAAA,EAA8B,OAAA,KACxE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAElH,OAAA,EAAS,CAAC,KAAA,EAA8C,OAAA,KACtD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO;AAAA,KAClI;AAAA,IACA,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,GAAA,EAAK,CAAsC,OAAA,KACzC,IAAA,CAAK,SAAA,CAAU,IAAA,CAA8B,qBAAA,CAAsB,gBAAgB,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW9G,MAAA,EAAQ,CAAsC,IAAA,EAA2B,OAAA,KACvE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW/G,QAAA,EAAU,CAAsC,KAAA,EAA+B,OAAA,KAC7E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO;AAAA,KACtH;AAAA,IACA,QAAA,EAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWR,IAAA,EAAM,CAAsC,KAAA,EAA6B,OAAA,KACvE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAEhH,OAAA,EAAS,CAAC,KAAA,EAA6C,OAAA,KACrD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO;AAAA,KACjI;AAAA,IACA,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,MAAA,EAAQ,CAAsC,IAAA,EAA2B,OAAA,KACvE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW/G,IAAA,EAAM,CAAsC,KAAA,EAA4B,OAAA,KACtE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAE5G,OAAA,EAAS,CAAC,KAAA,EAA2C,OAAA,KACnD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW7H,KAAA,EAAO,CAAsC,IAAA,EAA0B,OAAA,KACrE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA;AAC/G,GACF;AAAA,EAES,YAAA,GAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWtB,MAAA,EAAQ,CAAsC,IAAA,EAA8B,OAAA,KAC1E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrH,IAAA,EAAM,CAAsC,KAAA,EAA+B,OAAA,KACzE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAElH,OAAA,EAAS,CAAC,KAAA,EAA8C,OAAA,KACtD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWhI,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW5H,UAAA,EAAY,CAAsC,EAAA,EAAY,IAAA,EAAkC,YAC9F,IAAA,CAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,GAClI;AAAA,EAES,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWf,MAAA,EAAQ,CAAsC,IAAA,EAAuB,OAAA,KACnE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWtG,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW7G,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAA0B,qBAAA,CAAsB,WAAW,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWvG,IAAA,EAAM,CAAsC,KAAA,EAAwB,OAAA,KAClE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA2B,qBAAA,CAAsB,YAAY,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAEnG,OAAA,EAAS,CAAC,KAAA,EAAuC,OAAA,KAC/C,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,YAAY,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWxH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAuB,YAC/E,IAAA,CAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,GAC1G;AAAA,EAES,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrB,IAAA,EAAM,CAAsC,cAAA,EAAwB,KAAA,EAA8B,YAChG,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAE7H,OAAA,EAAS,CAAC,cAAA,EAAwB,KAAA,EAA6C,YAC7E,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAiB5I,QAAQ,CAAsC,cAAA,EAAwB,YAAA,EAAsB,OAAA,KAC1F,KAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,oBAAoB,GAAG,CAAC,cAAA,EAAgB,YAAY,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYnJ,QAAQ,CAAsC,cAAA,EAAwB,YAAA,EAAsB,OAAA,KAC1F,KAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,oBAAoB,GAAG,CAAC,cAAA,EAAgB,YAAY,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IA6BnJ,IAAA,EAAM,CAAsC,cAAA,EAAwB,IAAA,EAA2B,YAC7F,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,MAAM,OAAO;AAAA,GAC9H;AAAA,EAES,IAAA,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWd,MAAA,EAAQ,CAAsC,IAAA,EAAsB,OAAA,KAClE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWpG,IAAA,EAAM,CAAsC,KAAA,EAAuB,OAAA,KACjE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA0B,qBAAA,CAAsB,WAAW,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAEjG,OAAA,EAAS,CAAC,KAAA,EAAsC,OAAA,KAC9C,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,WAAW,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWvH,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW3G,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAuB,YAC/E,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,GACxG;AAAA,EAES,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrB,OAAA,EAAS,CAAsC,OAAA,KAC7C,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW1H,GAAA,EAAK,CAAsC,OAAA,KACzC,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWlH,KAAA,EAAO,CAAsC,IAAA,EAA4B,OAAA,KACvE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWjH,MAAA,EAAQ,CAAsC,OAAA,KAC5C,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO;AAAA,GAC1H;AAAA,EAES,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWpB,MAAA,EAAQ,CAAsC,IAAA,EAA4B,OAAA,KACxE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWjH,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWxH,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWlH,IAAA,EAAM,CAAsC,KAAA,EAA6B,OAAA,KACvE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAE9G,OAAA,EAAS,CAAC,KAAA,EAA4C,OAAA,KACpD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW9H,IAAA,EAAM,CAAsC,EAAA,EAAY,OAAA,KACtD,KAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWpH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA6B,YACrF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,GACrH;AAAA,EAES,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAyBjB,GAAA,EAAK,CAAsC,cAAA,EAAwB,IAAA,EAAuB,YACxF,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWlH,IAAA,EAAM,CAAsC,cAAA,EAAwB,KAAA,EAA0B,YAC5F,IAAA,CAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAErH,OAAA,EAAS,CAAC,cAAA,EAAwB,KAAA,EAAyC,YACzE,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,cAAc,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYxI,QAAQ,CAAsC,cAAA,EAAwB,MAAA,EAAgB,OAAA,KACpF,KAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,gBAAgB,GAAG,CAAC,cAAA,EAAgB,MAAM,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYrI,QAAQ,CAAsC,cAAA,EAAwB,MAAA,EAAgB,IAAA,EAAyB,YAC7G,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,gBAAgB,CAAA,EAAG,CAAC,gBAAgB,MAAM,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA,IAChI,KAAA,EAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAqBL,OAAO,CAAsC,cAAA,EAAwB,QAAgB,MAAA,EAAgB,KAAA,EAAgC,YACnI,IAAA,CAAK,SAAA,CAAU,KAAmC,qBAAA,CAAsB,qBAAqB,GAAG,CAAC,cAAA,EAAgB,QAAQ,MAAM,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAalJ,MAAM,CAAsC,cAAA,EAAwB,MAAA,EAAgB,OAAA,KAClF,KAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,GAAG,CAAC,cAAA,EAAgB,MAAM,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW5I,QAAQ,CAAsC,cAAA,EAAwB,QAAgB,MAAA,EAAgB,KAAA,EAAiC,YACrI,IAAA,CAAK,SAAA,CAAU,KAAoC,qBAAA,CAAsB,sBAAsB,GAAG,CAAC,cAAA,EAAgB,QAAQ,MAAM,CAAA,EAAG,OAAO,OAAO;AAAA;AACtJ,GACF;AAAA,EAES,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWvB,MAAA,EAAQ,CAAsC,IAAA,EAA+B,OAAA,KAC3E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAqC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAiBtH,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAqC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW7H,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYvH,IAAA,EAAM,CAAsC,KAAA,EAAgC,OAAA,KAC1E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAEnH,OAAA,EAAS,CAAC,KAAA,EAA+C,OAAA,KACvD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWhI,UAAA,EAAY,CAAsC,EAAA,EAAY,OAAA,KAC5D,KAAK,SAAA,CAAU,IAAA,CAAyC,qBAAA,CAAsB,0BAA0B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrI,OAAA,EAAS,CAAsC,EAAA,EAAY,OAAA,KACzD,KAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,uBAAuB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAiB/H,iBAAA,EAAmB,CAAsC,EAAA,EAAY,IAAA,EAA0C,YAC7G,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgD,qBAAA,CAAsB,kCAAkC,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAc/I,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAgC,YACxF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAqC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA,IACxH,OAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWP,GAAA,EAAK,CAAsC,cAAA,EAAwB,IAAA,EAAmC,YACpG,IAAA,CAAK,SAAA,CAAU,IAAA,CAAyC,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW7I,SAAS,CAAsC,cAAA,EAAwB,QAAA,EAAkB,IAAA,EAAuC,YAC9H,IAAA,CAAK,SAAA,CAAU,IAAA,CAA6C,qBAAA,CAAsB,+BAA+B,CAAA,EAAG,CAAC,gBAAgB,QAAQ,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAY/J,IAAA,EAAM,CAAsC,cAAA,EAAwB,OAAA,KAClE,KAAK,SAAA,CAAU,IAAA,CAA0C,qBAAA,CAAsB,4BAA4B,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWpJ,QAAQ,CAAsC,cAAA,EAAwB,QAAA,EAAkB,OAAA,KACtF,KAAK,SAAA,CAAU,IAAA,CAA4C,qBAAA,CAAsB,8BAA8B,GAAG,CAAC,cAAA,EAAgB,QAAQ,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWlK,QAAQ,CAAsC,cAAA,EAAwB,QAAA,EAAkB,OAAA,KACtF,KAAK,SAAA,CAAU,IAAA,CAA4C,qBAAA,CAAsB,8BAA8B,GAAG,CAAC,cAAA,EAAgB,QAAQ,CAAA,EAAG,QAAW,OAAO;AAAA,KACpK;AAAA,IACA,WAAA,EAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWX,MAAA,EAAQ,CAAsC,cAAA,EAAwB,IAAA,EAA0C,YAC9G,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgD,qBAAA,CAAsB,mCAAmC,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAe5J,IAAA,EAAM,CAAsC,cAAA,EAAwB,OAAA,KAClE,KAAK,SAAA,CAAU,IAAA,CAA8C,qBAAA,CAAsB,iCAAiC,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW7J,QAAQ,CAAsC,cAAA,EAAwB,EAAA,EAAY,OAAA,KAChF,KAAK,SAAA,CAAU,IAAA,CAAgD,qBAAA,CAAsB,mCAAmC,GAAG,CAAC,cAAA,EAAgB,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA;AACvK,GACF;AAAA,EAES,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrB,MAAA,EAAQ,CAAsC,IAAA,EAA6B,OAAA,KACzE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWlH,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWzH,IAAA,EAAM,CAAsC,KAAA,EAA8B,OAAA,KACxE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAE/G,OAAA,EAAS,CAAC,KAAA,EAA6C,OAAA,KACrD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW9H,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA8B,YACtF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,GACtH;AAAA,EAES,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWf,MAAA,EAAQ,CAAsC,IAAA,EAAuB,OAAA,KACnE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWtG,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW7G,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAA0B,qBAAA,CAAsB,WAAW,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWvG,IAAA,EAAM,CAAsC,KAAA,EAAwB,OAAA,KAClE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA2B,qBAAA,CAAsB,YAAY,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAEnG,OAAA,EAAS,CAAC,KAAA,EAAuC,OAAA,KAC/C,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,YAAY,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWxH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAwB,YAChF,IAAA,CAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA,IACxG,WAAA,EAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWX,QAAQ,CAAsC,EAAA,EAAY,YAAA,EAAsB,OAAA,KAC9E,KAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,0BAA0B,GAAG,CAAC,EAAA,EAAI,YAAY,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWlJ,IAAA,EAAM,CAAsC,EAAA,EAAY,KAAA,EAAmC,YACzF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAE5H,OAAA,EAAS,CAAC,EAAA,EAAY,KAAA,EAAkD,YACtE,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAA8C,OAAO;AAAA,KACxI;AAAA,IACA,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA6B,YACrF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWrH,QAAQ,CAAsC,EAAA,EAAY,QAAA,EAAkB,OAAA,KAC1E,KAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,GAAG,CAAC,EAAA,EAAI,QAAQ,CAAA,EAAG,QAAW,OAAO;AAAA;AACtI,GACF;AAAA,EAES,YAAA,GAAe;AAAA,IACtB,OAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWP,MAAA,EAAQ,CAAsC,IAAA,EAAqC,OAAA,KACjF,IAAA,CAAK,SAAA,CAAU,IAAA,CAA2C,qBAAA,CAAsB,6BAA6B,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWnI,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAsC,YAC9F,IAAA,CAAK,SAAA,CAAU,IAAA,CAA2C,qBAAA,CAAsB,6BAA6B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWrI,GAAA,EAAK,CAAsC,EAAA,EAAY,KAAA,EAAqC,YAC1F,IAAA,CAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,0BAA0B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWhI,IAAA,EAAM,CAAsC,KAAA,EAAsC,OAAA,KAChF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAyC,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAEhI,OAAA,EAAS,CAAC,KAAA,EAAqD,OAAA,KAC7D,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA,MACvI,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAWN,GAAA,EAAK,CAAsC,EAAA,EAAY,IAAA,EAAwC,YAC7F,IAAA,CAAK,SAAA,CAAU,IAAA,CAA8C,qBAAA,CAAsB,iCAAiC,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA;AAC9I;AACF,GACF;AAAA,EAES,KAAA,GAAQ;AAAA,IACf,SAAA,EAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWT,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW1H,IAAA,EAAM,CAAsC,KAAA,EAAiC,OAAA,KAC3E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAEtH,OAAA,EAAS,CAAC,KAAA,EAAgD,OAAA,KACxD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO;AAAA,KACpI;AAAA,IACA,KAAA,EAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWL,GAAA,EAAK,CAAsC,IAAA,EAAyB,OAAA,KAClE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW3G,IAAA,EAAM,CAAsC,KAAA,EAA6B,OAAA,KACvE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAE9G,OAAA,EAAS,CAAC,KAAA,EAA4C,OAAA,KACpD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW9H,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA,KAC1H;AAAA,IACA,IAAA,EAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWJ,GAAA,EAAK,CAAsC,IAAA,EAAwB,OAAA,KACjE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA8B,qBAAA,CAAsB,gBAAgB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA,KAC3G;AAAA,IACA,KAAA,EAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWL,MAAA,EAAQ,CAAsC,IAAA,EAA4B,OAAA,KACxE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWjH,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWxH,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWlH,IAAA,EAAM,CAAsC,KAAA,EAA6B,OAAA,KACvE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAE9G,OAAA,EAAS,CAAC,KAAA,EAA4C,OAAA,KACpD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW9H,OAAA,EAAS,CAAsC,IAAA,EAA6B,OAAA,KAC1E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWnH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA6B,YACrF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,KACrH;AAAA,IACA,QAAA,EAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWR,GAAA,EAAK,CAAsC,OAAA,KACzC,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWtH,MAAA,EAAQ,CAAsC,IAAA,EAA+B,OAAA,KAC3E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAqC,qBAAA,CAAsB,uBAAuB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA;AACzH,GACF;AAAA,EAES,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWf,MAAA,EAAQ,CAAsC,IAAA,EAAuB,OAAA,KACnE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWtG,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW7G,GAAA,EAAK,CAAsC,EAAA,EAAY,KAAA,EAAuB,YAC5E,IAAA,CAAK,SAAA,CAAU,IAAA,CAA0B,qBAAA,CAAsB,WAAW,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAanG,IAAA,EAAM,CAAsC,KAAA,EAAwB,OAAA,KAClE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA2B,qBAAA,CAAsB,YAAY,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWnG,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAwB,YAChF,IAAA,CAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA,IACxG,WAAA,EAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWX,OAAO,CAAsC,EAAA,EAAY,YAAA,EAAsB,OAAA,KAC7E,KAAK,SAAA,CAAU,IAAA,CAAuC,qBAAA,CAAsB,yBAAyB,GAAG,CAAC,EAAA,EAAI,YAAY,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWhJ,QAAQ,CAAsC,EAAA,EAAY,YAAA,EAAsB,OAAA,KAC9E,KAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,0BAA0B,GAAG,CAAC,EAAA,EAAI,YAAY,CAAA,EAAG,QAAW,OAAO;AAAA;AACpJ,GACF;AAAA,EAES,QAAA,GAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWlB,MAAA,EAAQ,CAAsC,IAAA,EAA0B,OAAA,KACtE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW7G,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWpH,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,eAAe,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW9G,IAAA,EAAM,CAAsC,KAAA,EAA2B,OAAA,KACrE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA8B,qBAAA,CAAsB,gBAAgB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAE1G,OAAA,EAAS,CAAC,KAAA,EAA0C,OAAA,KAClD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,gBAAgB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW5H,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA2B,YACnF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,GACjH;AAAA,EAES,MAAA,GAAS;AAAA,IAChB,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,GAAA,EAAK,CAAsC,KAAA,EAA8B,OAAA,KACvE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWhH,OAAA,EAAS,CAAsC,cAAA,EAAwB,OAAA,KACrE,KAAK,SAAA,CAAU,IAAA,CAAqC,qBAAA,CAAsB,uBAAuB,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW1I,MAAA,EAAQ,CAAsC,IAAA,EAA+B,OAAA,KAC3E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA,KACvH;AAAA,IACA,iBAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWjB,GAAA,EAAK,CAAsC,IAAA,EAAsC,OAAA,KAC/E,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4C,qBAAA,CAAsB,gCAAgC,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA,KACzI;AAAA,IACA,GAAA,EAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWH,GAAA,EAAK,CAAsC,OAAA,KACzC,IAAA,CAAK,SAAA,CAAU,IAAA,CAA8B,qBAAA,CAAsB,gBAAgB,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW9G,MAAA,EAAQ,CAAsC,IAAA,EAA4B,OAAA,KACxE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA,KACjH;AAAA,IACA,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA+B,YACvF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWvH,OAAA,EAAS,CAAsC,EAAA,EAAY,IAAA,EAAgC,YACzF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAqC,qBAAA,CAAsB,uBAAuB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWzH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA+B,YACvF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWvH,OAAA,EAAS,CAAsC,QAAA,EAAkB,IAAA,EAA+B,YAC9F,IAAA,CAAK,SAAA,CAAU,IAAA,CAAqC,qBAAA,CAAsB,uBAAuB,CAAA,EAAG,CAAC,QAAQ,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW/H,IAAA,EAAM,CAAsC,KAAA,EAA+B,OAAA,KACzE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAElH,OAAA,EAAS,CAAC,KAAA,EAA8C,OAAA,KACtD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWhI,OAAA,EAAS,CAAsC,KAAA,EAAkC,OAAA,KAC/E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAqC,qBAAA,CAAsB,uBAAuB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWxH,GAAA,EAAK,CAAsC,IAAA,EAA2B,OAAA,KACpE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW/G,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA+B,YACvF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA;AACzH,GACF;AAAA,EAES,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrB,MAAA,EAAQ,CAAsC,IAAA,EAA6B,OAAA,KACzE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWnH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA8B,YACtF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrH,GAAA,EAAK,CAAsC,EAAA,EAAY,KAAA,EAA6B,YAClF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWhH,IAAA,EAAM,CAAsC,KAAA,EAA8B,OAAA,KACxE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAEhH,OAAA,EAAS,CAAC,KAAA,EAA6C,OAAA,KACrD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,mBAAmB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA,IAC/H,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,GAAA,EAAK,CAAsC,EAAA,EAAY,IAAA,EAAgC,YACrF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,yBAAyB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA;AAC9H,GACF;AAAA,EAES,GAAA,GAAM;AAAA,IACb,WAAA,EAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWX,QAAA,EAAU,CAAsC,EAAA,EAAY,IAAA,EAAmC,YAC7F,IAAA,CAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,0BAA0B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW/H,MAAA,EAAQ,CAAsC,IAAA,EAAgC,OAAA,KAC5E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWzH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAiC,YACzF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW3H,OAAA,EAAS,CAAsC,EAAA,EAAY,IAAA,EAAkC,YAC3F,IAAA,CAAK,SAAA,CAAU,IAAA,CAAuC,qBAAA,CAAsB,yBAAyB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW7H,GAAA,EAAK,CAAsC,EAAA,EAAY,KAAA,EAAgC,YACrF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWtH,IAAA,EAAM,CAAsC,KAAA,EAAiC,OAAA,KAC3E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAEtH,OAAA,EAAS,CAAC,KAAA,EAAgD,OAAA,KACxD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWlI,UAAA,EAAY,CAAsC,EAAA,EAAY,IAAA,EAAqC,YACjG,IAAA,CAAK,SAAA,CAAU,IAAA,CAA0C,qBAAA,CAAsB,6BAA6B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWpI,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAiC,YACzF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA,MAC3H,YAAA,EAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAWZ,QAAA,EAAU,CAAsC,EAAA,EAAY,IAAA,EAA8C,YACxG,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoD,qBAAA,CAAsB,uCAAuC,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAWxJ,IAAA,EAAM,CAAsC,EAAA,EAAY,KAAA,EAA6C,YACnG,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgD,qBAAA,CAAsB,mCAAmC,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAWjJ,KAAA,EAAO,CAAsC,EAAA,EAAY,IAAA,EAA4C,YACnG,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiD,qBAAA,CAAsB,oCAAoC,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA;AACpJ,KACF;AAAA,IACA,OAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWP,OAAA,EAAS,CAAsC,EAAA,EAAY,IAAA,EAA6B,YACtF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWrH,MAAA,EAAQ,CAAsC,IAAA,EAA4B,OAAA,KACxE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWjH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA6B,YACrF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWnH,IAAA,EAAM,CAAsC,KAAA,EAA6B,OAAA,KACvE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAE9G,OAAA,EAAS,CAAC,KAAA,EAA4C,OAAA,KACpD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW9H,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA6B,YACrF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,KACrH;AAAA,IACA,YAAA,EAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWZ,MAAA,EAAQ,CAAsC,IAAA,EAAiC,OAAA,KAC7E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAuC,qBAAA,CAAsB,0BAA0B,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA;AAC9H,GACF;AAAA,EAES,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWzB,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAAoC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAiC5H,KAAA,EAAO,CAAsC,IAAA,EAAgC,OAAA,KAC3E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA,GAC3H;AAAA,EAES,UAAA,GAAa;AAAA,IACpB,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAkC,YAC1F,IAAA,CAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWhI,QAAQ,CAAsC,EAAA,EAAY,QAAA,EAAkB,IAAA,EAAmC,YAC7G,IAAA,CAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,CAAC,IAAI,QAAQ,CAAA,EAAG,MAAM,OAAO;AAAA,KAC5I;AAAA,IACA,OAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWP,MAAA,EAAQ,CAAsC,IAAA,EAAmC,OAAA,KAC/E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAyC,qBAAA,CAAsB,4BAA4B,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWhI,GAAA,EAAK,CAAsC,EAAA,EAAY,KAAA,EAAmC,YACxF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,yBAAyB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW7H,IAAA,EAAM,CAAsC,KAAA,EAAoC,OAAA,KAC9E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAuC,qBAAA,CAAsB,0BAA0B,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAE7H,OAAA,EAAS,CAAC,KAAA,EAAmD,OAAA,KAC3D,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,0BAA0B,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWtI,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAoC,YAC5F,IAAA,CAAK,SAAA,CAAU,IAAA,CAAyC,qBAAA,CAAsB,4BAA4B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWlI,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAmC,YAC3F,IAAA,CAAK,SAAA,CAAU,IAAA,CAAyC,qBAAA,CAAsB,4BAA4B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA;AACpI,GACF;AAAA,EAES,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWf,MAAA,EAAQ,CAAsC,IAAA,EAAuB,OAAA,KACnE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IActG,UAAA,EAAY,CAAsC,EAAA,EAAY,OAAA,KAC5D,KAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrH,KAAA,EAAO,CAAsC,EAAA,EAAY,OAAA,KACvD,KAAK,SAAA,CAAU,IAAA,CAA4B,qBAAA,CAAsB,aAAa,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW3G,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAA0B,qBAAA,CAAsB,WAAW,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAavG,IAAA,EAAM,CAAsC,KAAA,EAAwB,OAAA,KAClE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA2B,qBAAA,CAAsB,YAAY,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAEnG,OAAA,EAAS,CAAC,KAAA,EAAuC,OAAA,KAC/C,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,YAAY,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWxH,UAAA,EAAY,CAAsC,EAAA,EAAY,OAAA,KAC5D,KAAK,SAAA,CAAU,IAAA,CAAiC,qBAAA,CAAsB,kBAAkB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAwB,YAChF,IAAA,CAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWxG,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA,IAC7G,gBAAA,EAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWhB,KAAK,CAAsC,EAAA,EAAY,MAAA,EAAgB,KAAA,EAAuC,YAC5G,IAAA,CAAK,SAAA,CAAU,IAAA,CAA0C,qBAAA,CAAsB,6BAA6B,CAAA,EAAG,CAAC,IAAI,MAAM,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAgB7I,OAAO,CAAsC,EAAA,EAAY,MAAA,EAAgB,KAAA,EAAyC,YAChH,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4C,qBAAA,CAAsB,+BAA+B,CAAA,EAAG,CAAC,IAAI,MAAM,CAAA,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWjJ,IAAA,EAAM,CAAsC,EAAA,EAAY,OAAA,KACtD,KAAK,SAAA,CAAU,IAAA,CAA2C,qBAAA,CAAsB,8BAA8B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW3I,QAAQ,CAAsC,EAAA,EAAY,MAAA,EAAgB,KAAA,EAA0C,YAClH,IAAA,CAAK,SAAA,CAAU,IAAA,CAA6C,qBAAA,CAAsB,gCAAgC,CAAA,EAAG,CAAC,IAAI,MAAM,CAAA,EAAG,OAAO,OAAO;AAAA,KACrJ;AAAA,IACA,GAAA,EAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWH,KAAA,EAAO,CAAsC,EAAA,EAAY,OAAA,KACvD,KAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA,MAClH,GAAA,EAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAWH,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA;AAC7H,KACF;AAAA,IACA,aAAA,EAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWb,IAAA,EAAM,CAAsC,EAAA,EAAY,OAAA,KACtD,KAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA,KACvI;AAAA,IACA,QAAA,EAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWR,GAAA,EAAK,CAAsC,EAAA,EAAY,IAAA,EAA4B,YACjF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,qBAAA,CAAsB,oBAAoB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA,KACrH;AAAA,IACA,QAAA,EAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAaR,IAAA,EAAM,CAAsC,EAAA,EAAY,OAAA,KACtD,KAAK,SAAA,CAAU,IAAA,CAAmC,qBAAA,CAAsB,qBAAqB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW1H,QAAQ,CAAsC,EAAA,EAAY,SAAA,EAAmB,OAAA,KAC3E,KAAK,SAAA,CAAU,IAAA,CAAqC,qBAAA,CAAsB,uBAAuB,GAAG,CAAC,EAAA,EAAI,SAAS,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWzI,SAAA,EAAW,CAAsC,EAAA,EAAY,OAAA,KAC3D,KAAK,SAAA,CAAU,IAAA,CAAwC,qBAAA,CAAsB,2BAA2B,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA,KACvI;AAAA,IACA,YAAA,EAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWZ,IAAA,EAAM,CAAsC,EAAA,EAAY,OAAA,KACtD,KAAK,SAAA,CAAU,IAAA,CAAuC,qBAAA,CAAsB,yBAAyB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA;AACpI,GACF;AAAA,EAES,QAAA,GAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWlB,MAAA,EAAQ,CAAsC,IAAA,EAA0B,OAAA,KACtE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW5G,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWnH,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAA6B,qBAAA,CAAsB,cAAc,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW7G,IAAA,EAAM,CAAsC,KAAA,EAA2B,OAAA,KACrE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA8B,qBAAA,CAAsB,eAAe,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAEzG,OAAA,EAAS,CAAC,KAAA,EAA0C,OAAA,KAClD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,qBAAA,CAAsB,eAAe,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW3H,KAAA,EAAO,CAAsC,EAAA,EAAY,OAAA,KACvD,KAAK,SAAA,CAAU,IAAA,CAA+B,qBAAA,CAAsB,gBAAgB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWjH,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWnH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA2B,YACnF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,qBAAA,CAAsB,iBAAiB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA,IAC9G,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAsC,qBAAA,CAAsB,wBAAwB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA,KAClI;AAAA,IACA,eAAA,EAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWf,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAAyC,YACjG,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+C,qBAAA,CAAsB,kCAAkC,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO;AAAA;AAChJ,GACF;AAEF;;;ACt/PO,IAAM,mBAAA,GAAsB;AAAA,EACjC,sBAAA,EAAwB,EAAE,MAAA,EAAQ,IAAA,EAAM,aAAa,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,kCAAA,EAAoC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,UAAU,KAAA,EAAO,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAClN,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,yBAAA,EAA2B,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,sBAAsB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3P,4BAAA,EAA8B,EAAE,MAAA,EAAQ,4BAAA,EAA8B,aAAa,4BAAA,EAA8B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,iDAAA,EAAmD,UAAA,EAAY,CAAC,gBAAgB,CAAA,EAAG,KAAA,EAAO,oBAAA,EAAsB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9T,6BAAA,EAA+B,EAAE,MAAA,EAAQ,6BAAA,EAA+B,aAAa,6BAAA,EAA+B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,iDAAA,EAAmD,UAAA,EAAY,CAAC,gBAAgB,CAAA,EAAG,KAAA,EAAO,oBAAA,EAAsB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACxT,4BAAA,EAA8B,EAAE,MAAA,EAAQ,4BAAA,EAA8B,aAAa,4BAAA,EAA8B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,wDAAA,EAA0D,UAAA,EAAY,CAAC,gBAAgB,CAAA,EAAG,KAAA,EAAO,oBAAA,EAAsB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7T,mBAAA,EAAqB,EAAE,MAAA,EAAQ,mBAAA,EAAqB,aAAa,mBAAA,EAAqB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,yBAAA,EAA2B,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,kBAAkB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,MAAA,EAAO;AAAA,EAC/O,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,+CAAA,EAAiD,UAAA,EAAY,CAAC,gBAAgB,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACrS,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,WAAA,EAAa,2BAA2B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,oDAAA,EAAsD,UAAA,EAAY,CAAC,kBAAkB,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACtT,uBAAA,EAAyB,EAAE,MAAA,EAAQ,uBAAA,EAAyB,aAAa,uBAAA,EAAyB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACjP,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,kBAAkB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,MAAA,EAAO;AAAA,EAC7O,uBAAA,EAAyB,EAAE,MAAA,EAAQ,uBAAA,EAAyB,aAAa,uBAAA,EAAyB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAChQ,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,kBAAkB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACpO,eAAA,EAAiB,EAAE,MAAA,EAAQ,eAAA,EAAiB,aAAa,eAAA,EAAiB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,kBAAkB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7N,qBAAA,EAAuB,EAAE,MAAA,EAAQ,qBAAA,EAAuB,aAAa,qBAAA,EAAuB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,qCAAA,EAAuC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,gBAAA,EAAkB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACrQ,iBAAA,EAAmB,EAAE,MAAA,EAAQ,iBAAA,EAAmB,aAAa,iBAAA,EAAmB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,0BAAA,EAA4B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,gBAAA,EAAkB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9O,kBAAA,EAAoB,EAAE,MAAA,EAAQ,kBAAA,EAAoB,aAAa,kBAAA,EAAoB,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,kCAAA,EAAoC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,gBAAA,EAAkB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACzP,8BAAA,EAAgC,EAAE,MAAA,EAAQ,8BAAA,EAAgC,aAAa,8BAAA,EAAgC,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,yCAAA,EAA2C,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,kBAAkB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAChS,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,gCAAA,EAAkC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACtQ,uBAAA,EAAyB,EAAE,MAAA,EAAQ,uBAAA,EAAyB,aAAa,uBAAA,EAAyB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,wBAAA,EAA0B,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,aAAa,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACnP,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,oCAAA,EAAsC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5Q,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,6BAAA,EAA+B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC7Q,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,aAAA,EAAe,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,cAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACnN,WAAA,EAAa,EAAE,MAAA,EAAQ,WAAA,EAAa,aAAa,WAAA,EAAa,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,aAAa,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,MAAA,EAAO;AAAA,EAC7M,aAAA,EAAe,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAa,aAAA,EAAe,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,yBAAA,EAA2B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACrO,WAAA,EAAa,EAAE,MAAA,EAAQ,WAAA,EAAa,aAAa,WAAA,EAAa,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,8BAAA,EAAgC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5N,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,4CAAA,EAA8C,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,YAAA,EAAc,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACvR,eAAA,EAAiB,EAAE,MAAA,EAAQ,eAAA,EAAiB,aAAa,eAAA,EAAiB,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,YAAA,EAAc,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,kBAAkB,MAAA,EAAQ,MAAA,EAAQ,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACpN,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,aAAa,2BAAA,EAA6B,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,YAAA,EAAc,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,kBAAkB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA;AACvP;AAcO,IAAM,kBAAN,MAAsB;AAAA;AAAA,EAElB,SAAA;AAAA,EAET,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,SAAA,GAAY,IAAI,mBAAA,CAAoB,WAAA,EAAa,SAAS,wBAAwB,CAAA;AAAA,EACzF;AAAA;AAAA,EAGA,OAAA,CACE,MAAA,EACA,IAAA,EACA,KAAA,EACA,OAAA,EAC4B;AAC5B,IAAA,OAAO,KAAK,SAAA,CAAU,OAAA,CAAkB,MAAA,EAAQ,IAAA,EAAM,OAAO,OAAO,CAAA;AAAA,EACtE;AAAA,EAES,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASzB,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAAoC,mBAAA,CAAoB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA,GAC5H;AAAA,EAES,YAAA,GAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAiBtB,MAAA,EAAQ,CAAsC,IAAA,EAA8B,OAAA,KAC1E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,mBAAA,CAAoB,qBAAqB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWlH,IAAA,EAAM,CAAsC,KAAA,EAA+B,OAAA,KACzE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,mBAAA,CAAoB,mBAAmB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAE/G,OAAA,EAAS,CAAC,KAAA,EAA6C,OAAA,KACrD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,mBAAA,CAAoB,mBAAmB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA,IAC7H,MAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWN,MAAA,EAAQ,CAAsC,aAAA,EAAuB,OAAA,KACnE,KAAK,SAAA,CAAU,IAAA,CAA0C,mBAAA,CAAoB,4BAA4B,CAAA,EAAG,CAAC,aAAa,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWjJ,OAAA,EAAS,CAAsC,aAAA,EAAuB,IAAA,EAAqC,YACzG,IAAA,CAAK,SAAA,CAAU,IAAA,CAA2C,mBAAA,CAAoB,6BAA6B,CAAA,EAAG,CAAC,aAAa,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW9I,MAAA,EAAQ,CAAsC,aAAA,EAAuB,OAAA,KACnE,KAAK,SAAA,CAAU,IAAA,CAA0C,mBAAA,CAAoB,4BAA4B,CAAA,EAAG,CAAC,aAAa,CAAA,EAAG,QAAW,OAAO;AAAA;AACnJ,GACF;AAAA,EAES,IAAA,GAAO;AAAA,IACd,WAAA,EAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWX,MAAA,EAAQ,CAAsC,aAAA,EAAuB,IAAA,EAAiC,YACpG,IAAA,CAAK,SAAA,CAAU,IAAA,CAAuC,mBAAA,CAAoB,yBAAyB,CAAA,EAAG,CAAC,aAAa,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWtI,QAAQ,CAAsC,aAAA,EAAuB,EAAA,EAAY,OAAA,KAC/E,KAAK,SAAA,CAAU,IAAA,CAAuC,mBAAA,CAAoB,yBAAyB,GAAG,CAAC,aAAA,EAAe,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA,KACjJ;AAAA,IACA,SAAA,EAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWT,MAAA,EAAQ,CAAsC,IAAA,EAA+B,OAAA,KAC3E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAqC,mBAAA,CAAoB,uBAAuB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWrH,IAAA,EAAM,CAAsC,KAAA,EAAgC,OAAA,KAC1E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,mBAAA,CAAoB,qBAAqB,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,MAElH,OAAA,EAAS,CAAC,KAAA,EAA8C,OAAA,KACtD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,mBAAA,CAAoB,qBAAqB,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW/H,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAqC,mBAAA,CAAoB,uBAAuB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA;AAC9H,GACF;AAAA,EAES,QAAA,GAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWlB,MAAA,EAAQ,CAAsC,IAAA,EAA0B,OAAA,KACtE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,mBAAA,CAAoB,iBAAiB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW1G,IAAA,EAAM,CAAsC,OAAA,KAC1C,IAAA,CAAK,SAAA,CAAU,IAAA,CAA8B,mBAAA,CAAoB,eAAe,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW3G,UAAA,EAAY,CAAsC,EAAA,EAAY,OAAA,KAC5D,KAAK,SAAA,CAAU,IAAA,CAAoC,mBAAA,CAAoB,qBAAqB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWzH,MAAA,EAAQ,CAAsC,EAAA,EAAY,IAAA,EAA0B,YAClF,IAAA,CAAK,SAAA,CAAU,IAAA,CAAgC,mBAAA,CAAoB,iBAAiB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW5G,OAAA,EAAS,CAAsC,EAAA,EAAY,OAAA,KACzD,KAAK,SAAA,CAAU,IAAA,CAAiC,mBAAA,CAAoB,kBAAkB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA,IACnH,YAAA,EAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWZ,MAAA,EAAQ,CAAsC,OAAA,KAC5C,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4C,mBAAA,CAAoB,8BAA8B,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO;AAAA;AAC1I,GACF;AAAA,EAES,IAAA,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWd,iBAAA,EAAmB,CAAsC,EAAA,EAAY,IAAA,EAAiC,YACpG,IAAA,CAAK,SAAA,CAAU,IAAA,CAAuC,mBAAA,CAAoB,yBAAyB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAgB3H,MAAA,EAAQ,CAAsC,IAAA,EAAsB,OAAA,KAClE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA4B,mBAAA,CAAoB,aAAa,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWlG,IAAA,EAAM,CAAsC,KAAA,EAAuB,OAAA,KACjE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA0B,mBAAA,CAAoB,WAAW,CAAA,EAAG,EAAC,EAAG,OAAO,OAAO,CAAA;AAAA;AAAA,IAE/F,OAAA,EAAS,CAAC,KAAA,EAAqC,OAAA,KAC7C,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,mBAAA,CAAoB,WAAW,CAAA,EAAG,EAAC,EAAG,OAA8C,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrH,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAA4B,mBAAA,CAAoB,aAAa,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWzG,IAAA,EAAM,CAAsC,EAAA,EAAY,IAAA,EAAoB,YAC1E,IAAA,CAAK,SAAA,CAAU,IAAA,CAA0B,mBAAA,CAAoB,WAAW,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWhG,iBAAA,EAAmB,CAAsC,EAAA,EAAY,OAAA,KACnE,KAAK,SAAA,CAAU,IAAA,CAAuC,mBAAA,CAAoB,yBAAyB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA,IAChI,WAAA,EAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWX,IAAA,EAAM,CAAsC,OAAA,KAC1C,IAAA,CAAK,SAAA,CAAU,IAAA,CAAqC,mBAAA,CAAoB,uBAAuB,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAa1H,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAuC,mBAAA,CAAoB,yBAAyB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWhI,MAAA,EAAQ,CAAsC,EAAA,EAAY,OAAA,KACxD,KAAK,SAAA,CAAU,IAAA,CAAuC,mBAAA,CAAoB,yBAAyB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA;AAClI,GACF;AAAA,EAES,SAAA,GAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWnB,GAAA,EAAK,CAAsC,OAAA,KACzC,IAAA,CAAK,SAAA,CAAU,IAAA,CAA8B,mBAAA,CAAoB,eAAe,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO,CAAA;AAAA,IAC3G,QAAA,EAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWR,MAAA,EAAQ,CAAsC,IAAA,EAAmC,OAAA,KAC/E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAyC,mBAAA,CAAoB,2BAA2B,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA;AAC/H,GACF;AAEF;;;AC9mBO,IAAM,kBAAA,GAAqB;AAAA,EAChC,sBAAA,EAAwB,EAAE,MAAA,EAAQ,IAAA,EAAM,aAAa,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iCAAA,EAAmC,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,UAAU,KAAA,EAAO,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACjN,8BAAA,EAAgC,EAAE,MAAA,EAAQ,8BAAA,EAAgC,aAAa,8BAAA,EAAgC,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,wBAAA,EAA0B,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,+BAA+B,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9R,iCAAA,EAAmC,EAAE,MAAA,EAAQ,iCAAA,EAAmC,aAAa,iCAAA,EAAmC,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,mDAAA,EAAqD,UAAA,EAAY,CAAC,gBAAgB,CAAA,EAAG,KAAA,EAAO,6BAAA,EAA+B,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAClV,2BAAA,EAA6B,EAAE,MAAA,EAAQ,2BAAA,EAA6B,aAAa,2BAAA,EAA6B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,qBAAA,EAAuB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,4BAA4B,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC/Q,+BAAA,EAAiC,EAAE,MAAA,EAAQ,+BAAA,EAAiC,aAAa,+BAAA,EAAiC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,0CAAA,EAA4C,UAAA,EAAY,CAAC,aAAa,CAAA,EAAG,KAAA,EAAO,0BAAA,EAA4B,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EAC5T,+BAAA,EAAiC,EAAE,MAAA,EAAQ,+BAAA,EAAiC,aAAa,+BAAA,EAAiC,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,uDAAA,EAAyD,UAAA,EAAY,CAAC,gBAAgB,CAAA,EAAG,KAAA,EAAO,8BAAA,EAAgC,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACjV,6BAAA,EAA+B,EAAE,MAAA,EAAQ,6BAAA,EAA+B,WAAA,EAAa,+BAA+B,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,gFAAA,EAAkF,UAAA,EAAY,CAAC,kBAAkB,iBAAiB,CAAA,EAAG,KAAA,EAAO,8BAAA,EAAgC,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACtX,mCAAA,EAAqC,EAAE,MAAA,EAAQ,mCAAA,EAAqC,WAAA,EAAa,qCAAqC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,gFAAA,EAAkF,UAAA,EAAY,CAAC,kBAAkB,iBAAiB,CAAA,EAAG,KAAA,EAAO,8BAAA,EAAgC,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACxY,4BAAA,EAA8B,EAAE,MAAA,EAAQ,4BAAA,EAA8B,aAAa,4BAAA,EAA8B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,6BAA6B,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACpR,gCAAA,EAAkC,EAAE,MAAA,EAAQ,gCAAA,EAAkC,aAAa,gCAAA,EAAkC,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,4CAAA,EAA8C,UAAA,EAAY,CAAC,cAAc,CAAA,EAAG,KAAA,EAAO,2BAAA,EAA6B,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA;AAChU;AAeO,IAAM,iBAAN,MAAqB;AAAA;AAAA,EAEjB,SAAA;AAAA,EAET,YAAY,OAAA,EAAgC;AAC1C,IAAA,IAAA,CAAK,SAAA,GAAY,IAAI,mBAAA,CAAoB,UAAA,EAAY,SAAS,wBAAwB,CAAA;AAAA,EACxF;AAAA;AAAA,EAGA,OAAA,CACE,MAAA,EACA,IAAA,EACA,KAAA,EACA,OAAA,EAC4B;AAC5B,IAAA,OAAO,KAAK,SAAA,CAAU,OAAA,CAAkB,MAAA,EAAQ,IAAA,EAAM,OAAO,OAAO,CAAA;AAAA,EACtE;AAAA,EAES,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAAoC,kBAAA,CAAmB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA,GAC3H;AAAA,EAES,YAAA,GAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWtB,MAAA,EAAQ,CAAsC,IAAA,EAA8B,OAAA,KAC1E,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,kBAAA,CAAmB,8BAA8B,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW1H,SAAA,EAAW,CAAsC,aAAA,EAAuB,IAAA,EAAiC,YACvG,IAAA,CAAK,SAAA,CAAU,IAAA,CAAuC,kBAAA,CAAmB,iCAAiC,CAAA,EAAG,CAAC,aAAa,CAAA,EAAG,MAAM,OAAO;AAAA,GAC/I;AAAA,EAES,SAAA,GAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWnB,MAAA,EAAQ,CAAsC,IAAA,EAA2B,OAAA,KACvE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAiC,kBAAA,CAAmB,2BAA2B,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWpH,SAAA,EAAW,CAAsC,UAAA,EAAoB,IAAA,EAA8B,YACjG,IAAA,CAAK,SAAA,CAAU,IAAA,CAAoC,kBAAA,CAAmB,+BAA+B,CAAA,EAAG,CAAC,UAAU,CAAA,EAAG,MAAM,OAAO;AAAA,GACvI;AAAA,EAES,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWvB,MAAA,EAAQ,CAAsC,aAAA,EAAuB,IAAA,EAA+B,YAClG,IAAA,CAAK,SAAA,CAAU,IAAA,CAAqC,kBAAA,CAAmB,+BAA+B,CAAA,EAAG,CAAC,aAAa,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWzI,MAAM,CAAsC,aAAA,EAAuB,cAAA,EAAwB,IAAA,EAA8B,YACvH,IAAA,CAAK,SAAA,CAAU,IAAA,CAAmC,kBAAA,CAAmB,6BAA6B,CAAA,EAAG,CAAC,eAAe,cAAc,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWrJ,WAAW,CAAsC,aAAA,EAAuB,cAAA,EAAwB,IAAA,EAAkC,YAChI,IAAA,CAAK,SAAA,CAAU,IAAA,CAAwC,kBAAA,CAAmB,mCAAmC,CAAA,EAAG,CAAC,eAAe,cAAc,CAAA,EAAG,MAAM,OAAO;AAAA,GAClK;AAAA,EAES,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWpB,MAAA,EAAQ,CAAsC,IAAA,EAA4B,OAAA,KACxE,IAAA,CAAK,SAAA,CAAU,IAAA,CAAkC,kBAAA,CAAmB,4BAA4B,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWtH,SAAA,EAAW,CAAsC,WAAA,EAAqB,IAAA,EAA+B,YACnG,IAAA,CAAK,SAAA,CAAU,IAAA,CAAqC,kBAAA,CAAmB,gCAAgC,CAAA,EAAG,CAAC,WAAW,CAAA,EAAG,MAAM,OAAO;AAAA,GAC1I;AAEF;;;AClQO,IAAM,iBAAA,GAAoB;AAAA,EAC/B,sBAAA,EAAwB,EAAE,MAAA,EAAQ,IAAA,EAAM,aAAa,IAAA,EAAM,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,2BAAA,EAA6B,UAAA,EAAY,CAAC,IAAI,CAAA,EAAG,KAAA,EAAO,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,UAAU,KAAA,EAAO,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3M,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,8CAAA,EAAgD,UAAA,EAAY,CAAC,iBAAiB,CAAA,EAAG,KAAA,EAAO,wBAAA,EAA0B,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACjT,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,WAAA,EAAa,2BAA2B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,uDAAA,EAAyD,UAAA,EAAY,CAAC,mBAAmB,QAAQ,CAAA,EAAG,KAAA,EAAO,wBAAA,EAA0B,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC1U,6BAAA,EAA+B,EAAE,MAAA,EAAQ,6BAAA,EAA+B,aAAa,6BAAA,EAA+B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,8BAAA,EAAgC,UAAA,EAAY,CAAC,WAAW,CAAA,EAAG,KAAA,EAAO,4BAAA,EAA8B,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACjT,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,yBAAA,EAA2B,UAAA,EAAY,CAAC,WAAW,CAAA,EAAG,KAAA,EAAO,uBAAA,EAAyB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACxR,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,yBAAyB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC9P,6BAAA,EAA+B,EAAE,MAAA,EAAQ,6BAAA,EAA+B,aAAa,6BAAA,EAA+B,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,2CAAA,EAA6C,UAAA,EAAY,CAAC,iBAAiB,CAAA,EAAG,KAAA,EAAO,6BAAA,EAA+B,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACnU,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,2BAAA,EAA6B,UAAA,EAAY,CAAC,YAAY,CAAA,EAAG,KAAA,EAAO,uBAAA,EAAyB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC3R,0BAAA,EAA4B,EAAE,MAAA,EAAQ,0BAAA,EAA4B,aAAa,0BAAA,EAA4B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,sBAAA,EAAwB,UAAA,EAAY,CAAC,UAAU,CAAA,EAAG,KAAA,EAAO,qBAAA,EAAuB,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACxR,wBAAA,EAA0B,EAAE,MAAA,EAAQ,wBAAA,EAA0B,aAAa,wBAAA,EAA0B,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,aAAA,EAAe,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,yBAAyB,MAAA,EAAQ,OAAA,EAAS,UAAU,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,UAAA,EAAY,IAAA,EAAK;AAAA,EACzP,yBAAA,EAA2B,EAAE,MAAA,EAAQ,yBAAA,EAA2B,aAAa,yBAAA,EAA2B,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,2BAAA,EAA6B,UAAA,EAAY,CAAC,YAAY,CAAA,EAAG,KAAA,EAAO,wBAAA,EAA0B,MAAA,EAAQ,aAAA,EAAe,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EAC/R,gCAAA,EAAkC,EAAE,MAAA,EAAQ,gCAAA,EAAkC,aAAa,gCAAA,EAAkC,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,4BAAA,EAA8B,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,0BAA0B,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA,EAAK;AAAA,EACpS,uBAAA,EAAyB,EAAE,MAAA,EAAQ,uBAAA,EAAyB,aAAa,uBAAA,EAAyB,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,uBAAA,EAAyB,UAAA,EAAY,CAAC,UAAU,CAAA,EAAG,KAAA,EAAO,uBAAA,EAAyB,MAAA,EAAQ,UAAA,EAAY,UAAU,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,IAAA;AAC5Q;AAgBO,IAAM,gBAAN,MAAoB;AAAA;AAAA,EAEhB,SAAA;AAAA,EAET,YAAY,OAAA,EAA+B;AACzC,IAAA,IAAA,CAAK,SAAA,GAAY,IAAI,mBAAA,CAAoB,SAAA,EAAW,OAAO,CAAA;AAAA,EAC7D;AAAA;AAAA,EAGA,OAAA,CACE,MAAA,EACA,IAAA,EACA,KAAA,EACA,OAAA,EAC4B;AAC5B,IAAA,OAAO,KAAK,SAAA,CAAU,OAAA,CAAkB,MAAA,EAAQ,IAAA,EAAM,OAAO,OAAO,CAAA;AAAA,EACtE;AAAA,EAES,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQzB,GAAA,EAAK,CAAsC,EAAA,EAAY,OAAA,KACrD,KAAK,SAAA,CAAU,IAAA,CAAoC,iBAAA,CAAkB,sBAAsB,CAAA,EAAG,CAAC,EAAE,CAAA,EAAG,QAAW,OAAO;AAAA,GAC1H;AAAA,EAES,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWjB,MAAA,EAAQ,CAAsC,cAAA,EAAwB,IAAA,EAAyB,YAC7F,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+B,iBAAA,CAAkB,yBAAyB,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,MAAM,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW7H,QAAQ,CAAsC,cAAA,EAAwB,KAAA,EAAe,OAAA,KACnF,KAAK,SAAA,CAAU,IAAA,CAA+B,iBAAA,CAAkB,yBAAyB,GAAG,CAAC,cAAA,EAAgB,KAAK,CAAA,EAAG,QAAW,OAAO;AAAA,GAC3I;AAAA,EAES,YAAA,GAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWtB,MAAA,EAAQ,CAAsC,QAAA,EAAkB,OAAA,KAC9D,KAAK,SAAA,CAAU,IAAA,CAAoC,iBAAA,CAAkB,6BAA6B,CAAA,EAAG,CAAC,QAAQ,CAAA,EAAG,QAAW,OAAO;AAAA,GACvI;AAAA,EAES,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWjB,MAAA,EAAQ,CAAsC,QAAA,EAAkB,OAAA,KAC9D,KAAK,SAAA,CAAU,IAAA,CAA+B,iBAAA,CAAkB,wBAAwB,CAAA,EAAG,CAAC,QAAQ,CAAA,EAAG,QAAW,OAAO;AAAA,GAC7H;AAAA,EAES,GAAA,GAAM;AAAA,IACb,GAAA,EAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWH,MAAA,EAAQ,CAAsC,OAAA,KAC5C,IAAA,CAAK,SAAA,CAAU,IAAA,CAA8B,iBAAA,CAAkB,wBAAwB,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO;AAAA;AACpH,GACF;AAAA,EAES,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWvB,KAAA,EAAO,CAAsC,cAAA,EAAwB,OAAA,KACnE,KAAK,SAAA,CAAU,IAAA,CAAoC,iBAAA,CAAkB,6BAA6B,CAAA,EAAG,CAAC,cAAc,CAAA,EAAG,QAAW,OAAO;AAAA,GAC7I;AAAA,EAES,QAAA,GAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWlB,MAAA,EAAQ,CAAsC,SAAA,EAAmB,OAAA,KAC/D,KAAK,SAAA,CAAU,IAAA,CAAgC,iBAAA,CAAkB,yBAAyB,CAAA,EAAG,CAAC,SAAS,CAAA,EAAG,QAAW,OAAO;AAAA,GAChI;AAAA,EAES,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWf,UAAA,EAAY,CAAsC,QAAA,EAAkB,OAAA,KAClE,KAAK,SAAA,CAAU,IAAA,CAAiC,iBAAA,CAAkB,0BAA0B,CAAA,EAAG,CAAC,QAAQ,CAAA,EAAG,QAAW,OAAO;AAAA,GACjI;AAAA,EAES,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWjB,MAAA,EAAQ,CAAsC,IAAA,EAAyB,OAAA,KACrE,IAAA,CAAK,SAAA,CAAU,IAAA,CAA+B,iBAAA,CAAkB,wBAAwB,CAAA,EAAG,EAAC,EAAG,MAAM,OAAO;AAAA,GAChH;AAAA,EAES,QAAA,GAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWlB,MAAA,EAAQ,CAAsC,SAAA,EAAmB,OAAA,KAC/D,KAAK,SAAA,CAAU,IAAA,CAAgC,iBAAA,CAAkB,yBAAyB,CAAA,EAAG,CAAC,SAAS,CAAA,EAAG,QAAW,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAW9H,YAAA,EAAc,CAAsC,OAAA,KAClD,IAAA,CAAK,SAAA,CAAU,IAAA,CAAsC,iBAAA,CAAkB,gCAAgC,CAAA,EAAG,EAAC,EAAG,MAAA,EAAW,OAAO;AAAA,GACpI;AAAA,EAES,MAAA,GAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWhB,MAAA,EAAQ,CAAsC,QAAA,EAAkB,OAAA,KAC9D,KAAK,SAAA,CAAU,IAAA,CAA8B,iBAAA,CAAkB,uBAAuB,CAAA,EAAG,CAAC,QAAQ,CAAA,EAAG,QAAW,OAAO;AAAA,GAC3H;AAEF;;;AChVA,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAEhC,SAAS,UAAU,KAAA,EAAyC;AAC1D,EAAA,MAAM,OAAO,KAAA,YAAiB,UAAA,GAAa,KAAA,GAAQ,IAAI,WAAW,KAAK,CAAA;AACvE,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,IAAA,EAAM;AACvB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AAEA,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;AAEA,eAAe,OAAO,KAAA,EAAgC;AACpD,EAAA,OAAO,SAAA,CAAU,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAC/E;AAGA,eAAsB,mBAAA,GAA8C;AAClE,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,WAAA,CAAY,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ,EAAG,KAAA,EAAO,CAAC,MAAA,EAAQ,QAAQ,CAAC,CAAA;AACpG;AAMA,eAAsB,iBAAiB,OAAA,EAA6C;AAClF,EAAA,MAAM,WAAW,MAAM,MAAA,CAAO,OAAO,SAAA,CAAU,KAAA,EAAO,QAAQ,SAAS,CAAA;AACvE,EAAA,MAAM,EAAE,GAAA,EAAK,CAAA,EAAG,CAAA,EAAE,GAAI,QAAA;AAEtB,EAAA,IAAI,QAAA,CAAS,GAAA,KAAQ,IAAA,IAAQ,GAAA,KAAQ,OAAA,IAAW,OAAO,CAAA,KAAM,QAAA,IAAY,OAAO,CAAA,KAAM,QAAA,EAAU;AAC9F,IAAA,MAAM,IAAI,UAAU,6CAA6C,CAAA;AAAA,EACnE;AAEA,EAAA,MAAM,MAAM,EAAE,GAAA,EAAK,GAAA,EAAK,IAAA,EAAM,GAAG,CAAA,EAAE;AAEnC,EAAA,MAAM,MAAM,MAAM,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA;AAE5C,EAAA,OAAO;AAAA,IACL,GAAA;AAAA,IACA,MAAM,KAAA,CAAM,EAAE,QAAQ,GAAA,EAAK,WAAA,EAAa,OAAM,EAAG;AAC/C,MAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,MAAA,MAAM,SAAS,EAAE,GAAA,EAAK,UAAA,EAAY,GAAA,EAAK,SAAS,GAAA,EAAI;AACpD,MAAA,MAAM,OAAA,GAAmC;AAAA,QACvC,GAAA,EAAK,OAAO,UAAA,EAAW;AAAA,QACvB,GAAA,EAAK,OAAO,WAAA,EAAY;AAAA;AAAA,QAExB,KAAK,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,EAAG,OAAO,QAAQ,CAAA,CAAA;AAAA,QACvC,KAAK,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAAA,QACjC,GAAA,EAAK,MAAM,MAAA,CAAO,WAAW;AAAA,OAC/B;AAEA,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,OAAA,CAAQ,KAAA,GAAQ,KAAA;AAAA,MAClB;AAEA,MAAA,MAAM,YAAA,GAAe,GAAG,SAAA,CAAU,OAAA,CAAQ,OAAO,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAC,CAAC,CAAA,CAAA,EAAI,SAAA,CAAU,QAAQ,MAAA,CAAO,IAAA,CAAK,UAAU,OAAO,CAAC,CAAC,CAAC,CAAA,CAAA;AAE/H,MAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA;AAAA,QACpC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,QACjC,OAAA,CAAQ,UAAA;AAAA,QACR,OAAA,CAAQ,OAAO,YAAY;AAAA,OAC7B;AAEA,MAAA,OAAO,CAAA,EAAG,YAAY,CAAA,CAAA,EAAI,SAAA,CAAU,SAAS,CAAC,CAAA,CAAA;AAAA,IAChD;AAAA,GACF;AACF;;;AC7DO,IAAM,eAAA,GAAkB;AAGxB,IAAM,mBAAA,GAAsB,GAAA,CAAI,MAAA,CAAO,EAAE;AAEhD,SAASA,KAAAA,GAAe;AACtB,EAAA,OAAO,OAAO,UAAA,EAAW;AAC3B;AA+BO,IAAM,cAAN,MAAkB;AAAA,EACd,OAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACT,UAAgC,EAAC;AAAA,EACxB,SAAkB,EAAC;AAAA,EAC5B,QAAA,GAA0B,QAAQ,OAAA,EAAQ;AAAA,EAC1C,MAAA;AAAA,EACA,OAAA,GAAU,KAAA;AAAA,EAEV,WAAA,CAAY,MAAA,EAA2B,OAAA,GAA8B,EAAC,EAAG;AACvE,IAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,eAAA;AAEvC,IAAA,IAAI,CAAC,OAAO,SAAA,CAAU,SAAS,KAAK,SAAA,GAAY,CAAA,IAAK,YAAY,eAAA,EAAiB;AAChF,MAAA,MAAM,IAAI,UAAA,CAAW,CAAA,yBAAA,EAAuB,eAAe,CAAA,CAAA,CAAG,CAAA;AAAA,IAChE;AAEA,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AACf,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AAClB,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,OAAA;AAExB,IAAA,MAAM,QAAA,GAAW,QAAQ,eAAA,IAAmB,GAAA;AAE5C,IAAA,IAAI,WAAW,CAAA,EAAG;AAChB,MAAA,IAAA,CAAK,SAAS,WAAA,CAAY,MAAM,IAAA,CAAK,WAAA,IAAe,QAAQ,CAAA;AAE5D,MAAC,IAAA,CAAK,OAAkC,KAAA,IAAQ;AAAA,IAClD;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,OAAA,GAAkB;AACpB,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,EAAG,KAAA,KAAU,CAAA,GAAI,KAAA,CAAM,MAAA,CAAO,QAAQ,CAAC,CAAA;AAAA,EAC1F;AAAA;AAAA,EAGA,OAAO,KAAA,EAA6B;AAClC,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,MAAM,IAAI,YAAY,6BAA6B,CAAA;AAAA,IACrD;AAEA,IAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAG,KAAA,EAAO,WAAA,EAAa,KAAA,CAAM,WAAA,IAAA,iBAAe,IAAI,IAAA,EAAK,EAAE,WAAA,IAAe,CAAA;AAE1F,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,MAAA,IAAU,IAAA,CAAK,UAAA,EAAY;AAC1C,MAAA,IAAA,CAAK,WAAA,EAAY;AAAA,IACnB;AAAA,EACF;AAAA;AAAA,EAGA,KAAA,GAAuB;AACrB,IAAA,IAAA,CAAK,IAAA,EAAK;AACV,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,QAAA,CAAS,KAAA,CAAM,MAAM,MAAS,CAAA,CAAE,IAAA,CAAK,MAAM,IAAA,CAAK,MAAA,EAAQ,CAAA;AACzE,IAAA,IAAA,CAAK,QAAA,GAAW,GAAA;AAChB,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AAEf,IAAA,IAAI,IAAA,CAAK,WAAW,MAAA,EAAW;AAC7B,MAAA,aAAA,CAAc,KAAK,MAAM,CAAA;AACzB,MAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,IAChB;AAEA,IAAA,MAAM,KAAK,KAAA,EAAM;AAAA,EACnB;AAAA,EAEA,WAAA,GAAoB;AAClB,IAAA,IAAA,CAAK,KAAA,EAAM,CAAE,KAAA,CAAM,CAAC,KAAA,KAAmB;AACrC,MAAA,IAAA,CAAK,QAAA,GAAW,OAAO,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,EAAG,MAAA,IAAU,EAAE,CAAA;AAAA,IACrD,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,IAAA,GAAa;AACX,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC9B,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAK,OAAA,CAAQ,MAAA,CAAO,CAAA,EAAG,IAAA,CAAK,UAAU,CAAA,EAAG,cAAA,EAAgBA,KAAAA,IAAQ,CAAA;AAAA,IAC9F;AAAA,EACF;AAAA,EAEA,MAAM,MAAA,GAAwB;AAC5B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AAC7B,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA;AAC3B,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,SAAA,CAAU,MAAA,CAAO,OAAO,EAAE,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAO,EAAG,EAAE,cAAA,EAAgB,KAAA,CAAM,gBAAgB,CAAA;AAC7G,MAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,IACpB;AAAA,EACF;AACF;AAeO,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA,EACnD,WAAA,CACE,SACS,WAAA,EACT;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAFJ,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAA,EAGX;AAAA,EAHW,WAAA;AAIb;AAEA,SAASC,MAAAA,CAAM,IAAY,MAAA,EAAqC;AAC9D,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,MAAA,CAAO,OAAO,MAAM,CAAA;AACpB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,EAAQ,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAC5C,MAAA,OAAA,EAAQ;AAAA,IACV,GAAG,EAAE,CAAA;AACL,IAAA,MAAM,UAAU,MAAY;AAC1B,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,IACvB,CAAA;AACA,IAAA,MAAA,EAAQ,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC3D,CAAC,CAAA;AACH;AAOA,eAAsB,gBACpB,MAAA,EACA,OAAA,GAAsC,EAAC,EACvC,OAAA,GAAiC,EAAC,EACT;AACzB,EAAA,MAAM,IAAA,GAAoB;AAAA,IACxB,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO,GAAI;AAAC,GACnE;AACA,EAAA,MAAM,UAAU,MAAM,MAAA,CAAO,SAAA,CAAU,OAAA,CAAQ,OAAO,OAAA,EAAS;AAAA,IAC7D,GAAG,IAAA;AAAA,IACH,GAAI,QAAQ,cAAA,KAAmB,MAAA,GAAY,EAAE,cAAA,EAAgB,OAAA,CAAQ,cAAA,EAAe,GAAI;AAAC,GAC1F,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,IAAK,QAAQ,SAAA,IAAa,GAAA,CAAA;AACpD,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,OAAA,CAAQ,kBAAkB,GAAK,CAAA;AAC5D,EAAA,IAAI,UAAU,OAAA,CAAQ,IAAA;AAEtB,EAAA,WAAS;AACP,IAAA,QAAQ,QAAQ,KAAA;AAAO,MACrB,KAAK,OAAA;AACH,QAAA,OAAO,OAAA;AAAA,MACT,KAAK,QAAA;AAAA,MACL,KAAK,SAAA;AACH,QAAA,MAAM,IAAI,oBAAoB,CAAA,iBAAA,EAAoB,OAAA,CAAQ,EAAE,CAAA,IAAA,EAAO,OAAA,CAAQ,KAAK,CAAA,CAAA,CAAA,EAAK,OAAO,CAAA;AAE5F;AAGJ,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,QAAA,EAAU;AAC1B,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,iBAAA,EAAoB,OAAA,CAAQ,EAAE,2BAA2B,OAAO,CAAA;AAAA,IAChG;AAEA,IAAA,MAAMA,MAAAA,CAAM,QAAA,EAAU,OAAA,CAAQ,MAAM,CAAA;AACpC,IAAA,OAAA,GAAA,CAAW,MAAM,OAAO,SAAA,CAAU,OAAA,CAAQ,IAAI,OAAA,CAAQ,EAAA,EAAI,IAAI,CAAA,EAAG,IAAA;AAAA,EACnE;AACF;AAIA,IAAMC,QAAAA,GAAU,IAAI,WAAA,EAAY;AAEhC,SAAS,YAAA,CAAa,GAAW,CAAA,EAAmB;AAClD,EAAA,MAAM,CAAA,GAAIA,QAAAA,CAAQ,MAAA,CAAO,CAAC,CAAA;AAC1B,EAAA,MAAM,CAAA,GAAIA,QAAAA,CAAQ,MAAA,CAAO,CAAC,CAAA;AAC1B,EAAA,MAAM,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,MAAA,EAAQ,EAAE,MAAM,CAAA;AAErC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,IAAI,CAAA,CAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,EAAG,OAAO,CAAA,CAAE,CAAC,CAAA,GAAK,CAAA,CAAE,CAAC,CAAA;AAAA,EACvC;AAEA,EAAA,OAAO,CAAA,CAAE,SAAS,CAAA,CAAE,MAAA;AACtB;AAGA,SAAS,SAAS,KAAA,EAAuB;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,UAAU,+CAA+C,CAAA;AAAA,EACrE;AAEA,EAAA,IAAI,MAAA,CAAO,EAAA,CAAG,KAAA,EAAO,EAAE,GAAG,OAAO,IAAA;AACjC,EAAA,IAAI,OAAO,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,OAAO,KAAK,CAAA;AAEpD,EAAA,MAAM,IAAA,GAAO,KAAA,GAAQ,CAAA,GAAI,GAAA,GAAM,EAAA;AAE/B,EAAA,MAAM,CAAC,QAAA,EAAU,GAAG,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA,CAAE,aAAA,EAAc,CAAE,KAAA,CAAM,GAAG,CAAA;AACjE,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,EAAK,EAAE,CAAA;AACvC,EAAA,MAAM,QAAA,GAAW,OAAO,GAAG,CAAA;AAC3B,EAAA,MAAM,QAAQ,QAAA,GAAW,CAAA;AAEzB,EAAA,IAAI,KAAA,GAAQ,EAAA,IAAM,KAAA,GAAQ,EAAA,EAAI;AAC5B,IAAA,OAAO,CAAA,EAAG,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA,CAAA,EAAI,OAAO,KAAA,CAAM,CAAC,KAAK,GAAG,CAAA,CAAA,EAAI,WAAW,CAAA,GAAI,GAAA,GAAM,GAAG,CAAA,EAAG,IAAA,CAAK,GAAA,CAAI,QAAQ,CAAC,CAAA,CAAA;AAAA,EACvG;AAEA,EAAA,IAAI,KAAA,IAAS,CAAA,EAAG,OAAO,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,GAAA,CAAI,MAAA,CAAO,CAAC,KAAK,CAAC,CAAA,EAAG,MAAM,CAAA,CAAA;AAC9D,EAAA,IAAI,KAAA,IAAS,MAAA,CAAO,MAAA,EAAQ,OAAO,GAAG,IAAI,CAAA,EAAG,MAAM,CAAA,EAAG,GAAA,CAAI,MAAA,CAAO,KAAA,GAAQ,MAAA,CAAO,MAAM,CAAC,CAAA,CAAA;AAEvF,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,EAAG,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,KAAK,CAAC,CAAA,CAAA,EAAI,MAAA,CAAO,KAAA,CAAM,KAAK,CAAC,CAAA,CAAA;AAChE;AAaO,SAAS,cAAc,KAAA,EAAwB;AACpD,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW,OAAO,MAAA;AAClD,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,QAAQ,MAAA,GAAS,OAAA;AACxD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,SAAS,KAAK,CAAA;AACpD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAK,SAAA,CAAU,KAAK,CAAA,CAAE,OAAA,CAAQ,SAAA,EAAW,SAAS,CAAA,CAAE,OAAA,CAAQ,WAAW,SAAS,CAAA;AAEtH,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,IAAI,KAAA,CAAM,GAAA,CAAI,aAAa,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EAC/C;AAEA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,KAAgC,CAAA,CAC5D,OAAO,CAAC,GAAG,CAAC,CAAA,KAAM,CAAA,KAAM,MAAS,CAAA,CACjC,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA,EAAG,CAAC,CAAC,CAAA,KAAM,YAAA,CAAa,CAAA,EAAG,CAAC,CAAC,CAAA;AAExC,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAEjC,IAAA,IAAI,OAAA,CAAQ,KAAA,CAAM,CAAC,CAAC,GAAG,CAAA,EAAG,KAAA,KAAU,GAAA,KAAQ,MAAA,CAAO,KAAK,CAAC,CAAA,EAAG;AAC1D,MAAA,OAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,GAAA,CAAI,CAAC,GAAG,CAAC,CAAA,KAAM,aAAA,CAAc,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,IAC/D;AAEA,IAAA,OAAO,CAAA,CAAA,EAAI,QAAQ,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,MAAM,CAAA,EAAG,aAAA,CAAc,CAAC,CAAC,CAAA,CAAA,EAAI,cAAc,CAAC,CAAC,EAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EACzF;AAEA,EAAA,MAAM,IAAI,SAAA,CAAU,CAAA,+BAAA,EAAkC,OAAO,KAAK,CAAA,CAAA,CAAG,CAAA;AACvE;AASA,SAAS,WAAW,KAAA,EAAyB;AAC3C,EAAA,IAAI,KAAA,CAAM,QAAQ,KAAK,CAAA,SAAU,KAAA,CAAM,MAAA,GAAS,IAAI,KAAA,GAAQ,IAAA;AAC5D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,EAAM,OAAO,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,MAAA,GAAS,CAAA,GAAI,KAAA,GAAQ,IAAA;AAChG,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,mBAAmB,KAAA,EAAqD;AACtF,EAAA,MAAM,KAAA,GAAS,KAAA,CAAM,KAAA,IAAS,EAAC;AAC/B,EAAA,MAAM,OAAA,GAAW,KAAA,CAAM,OAAA,IAAW,EAAC;AAEnC,EAAA,OAAO;AAAA,IACL,IAAI,KAAA,CAAM,EAAA;AAAA,IACV,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,aAAa,KAAA,CAAM,WAAA;AAAA,IACnB,OAAO,EAAE,EAAA,EAAI,MAAM,EAAA,IAAM,IAAA,EAAM,MAAM,KAAA,CAAM,IAAA,IAAQ,IAAA,EAAM,IAAA,EAAM,MAAM,IAAA,IAAQ,IAAA,EAAM,UAAU,UAAA,CAAW,KAAA,CAAM,QAAQ,CAAA,EAAE;AAAA,IACxH,UAAU,KAAA,CAAM,OAAA,IAAW,EAAC,EAAG,GAAA,CAAI,CAAC,MAAA,MAAY;AAAA,MAC9C,EAAA,EAAI,OAAO,EAAA,IAAM,IAAA;AAAA,MACjB,IAAA,EAAM,OAAO,IAAA,IAAQ,IAAA;AAAA,MACrB,IAAA,EAAM,OAAO,IAAA,IAAQ,IAAA;AAAA,MACrB,QAAA,EAAU,UAAA,CAAW,MAAA,CAAO,QAAQ;AAAA,KACtC,CAAE,CAAA;AAAA,IACF,OAAA,EAAS,EAAE,QAAA,EAAU,OAAA,CAAQ,YAAY,IAAA,EAAM,UAAA,EAAY,OAAA,CAAQ,UAAA,IAAc,IAAA,EAAK;AAAA,IACtF,QAAA,EAAU,UAAA,CAAW,KAAA,CAAM,QAAQ;AAAA,GACrC;AACF;AAGA,eAAsB,cAAA,CAAe,cAAsB,KAAA,EAA6C;AACtG,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,SAAA,EAAWA,QAAAA,CAAQ,MAAA,CAAO,YAAA,GAAe,aAAA,CAAc,kBAAA,CAAmB,KAAK,CAAC,CAAC,CAAC,CAAA;AAC5H,EAAA,OAAO,MAAM,IAAA,CAAK,IAAI,WAAW,MAAM,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAC3F;AA6BA,eAAsB,gBAAA,CACpB,MAAA,EACA,OAAA,GAAmC,EAAC,EACH;AACjC,EAAA,MAAM,MAAuB,EAAC;AAE9B,EAAA,WAAA,MAAiB,SAAS,MAAA,EAAQ;AAChC,IAAA,GAAA,CAAI,KAAK,KAAK,CAAA;AAAA,EAChB;AAEA,EAAA,GAAA,CAAI,KAAK,CAAC,CAAA,EAAG,MAAM,CAAA,CAAE,QAAA,GAAW,EAAE,QAAQ,CAAA;AAE1C,EAAA,MAAM,KAAA,GAAQ,IAAI,CAAC,CAAA;AACnB,EAAA,IAAI,QAAA,GAAW,QAAQ,YAAA,KAAiB,KAAA,KAAU,UAAa,KAAA,CAAM,QAAA,KAAa,CAAA,GAAI,mBAAA,GAAsB,KAAA,CAAM,SAAA,CAAA;AAClH,EAAA,IAAI,QAAA,GAAW,OAAO,QAAA,IAAY,CAAA;AAClC,EAAA,IAAI,QAAA,GAAW,CAAA;AAEf,EAAA,MAAM,MAAA,GAAS,CAAC,MAAA,MAAsE;AAAA,IACpF,OAAO,MAAA,KAAW,IAAA;AAAA,IAClB,cAAA,EAAgB,QAAA;AAAA,IAChB,cAAA,EAAgB,QAAA,KAAa,CAAA,GAAI,IAAA,GAAO,KAAA,CAAO,QAAA;AAAA,IAC/C,aAAA,EAAe,QAAA,KAAa,CAAA,GAAI,IAAA,GAAO,QAAA,GAAW,CAAA;AAAA,IAClD,kBAAA,EAAoB,MAAA,KAAW,IAAA,GAAO,IAAA,GAAO,QAAA;AAAA,IAC7C;AAAA,GACF,CAAA;AAEA,EAAA,KAAA,MAAW,SAAS,GAAA,EAAK;AACvB,IAAA,IAAI,KAAA,CAAM,QAAA,KAAa,QAAA,EAAU,OAAO,OAAO,SAAS,CAAA;AACxD,IAAA,IAAI,KAAA,CAAM,SAAA,KAAc,QAAA,EAAU,OAAO,OAAO,MAAM,CAAA;AACtD,IAAA,IAAK,MAAM,eAAe,QAAA,EAAU,KAAK,MAAO,KAAA,CAAM,IAAA,EAAM,OAAO,MAAA,CAAO,MAAM,CAAA;AAEhF,IAAA,QAAA,GAAW,KAAA,CAAM,IAAA;AACjB,IAAA,QAAA,EAAA;AACA,IAAA,QAAA,EAAA;AAAA,EACF;AAEA,EAAA,OAAO,OAAO,IAAI,CAAA;AACpB;AASA,eAAsB,mBAAA,CACpB,MAAA,EACA,KAAA,EACA,OAAA,GAAmC,EAAC,EACH;AACjC,EAAA,OAAO,gBAAA,CAAiB,MAAA,CAAO,SAAA,CAAU,MAAA,CAAO,OAAA,CAAQ,EAAE,GAAG,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,CAAA,EAAG,OAAO,CAAA;AAC9F;;;AClZO,SAAS,SAAS,KAAA,EAA4B;AACnD,EAAA,MAAM,IAAA,GAAO,CAAC,KAAA,EAAe,IAAA,KAAyB;AACpD,IAAA,IAAI,KAAA,KAAU,EAAA,IAAM,SAAA,CAAU,IAAA,CAAK,KAAK,CAAA,EAAG;AACzC,MAAA,MAAM,IAAI,UAAU,CAAA,OAAA,EAAU,IAAI,4DAA4D,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IACvH;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AACA,EAAA,MAAM,EAAA,GAAK,CAAC,KAAA,EAAe,IAAA,KAAyB;AAClD,IAAA,IAAI,KAAA,KAAU,EAAA,IAAM,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,EAAG;AACxC,MAAA,MAAM,IAAI,UAAU,CAAA,OAAA,EAAU,IAAI,uDAAuD,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IAClH;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,OAAA,GAAU,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,QAAQ,IAAA,EAAM,cAAc,CAAC,CAAA,CAAA,EAAI,EAAA,CAAG,KAAA,CAAM,OAAA,CAAQ,EAAA,EAAI,YAAY,CAAC,CAAA,CAAA;AACjG,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,CAAQ,QAAA,GAAW,CAAA,CAAA,EAAI,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,QAAA,EAAU,kBAAkB,CAAC,CAAA,CAAA,GAAK,EAAA;AAElG,EAAA,OAAO,CAAA,EAAG,KAAK,KAAA,CAAM,aAAA,EAAe,eAAe,CAAC,CAAA,CAAA,EAAI,GAAG,KAAA,CAAM,WAAA,EAAa,aAAa,CAAC,CAAA,CAAA,EAAI,KAAK,KAAA,CAAM,QAAA,EAAU,UAAU,CAAC,CAAA,CAAA,EAAI,OAAO,CAAA,EAAG,OAAO,CAAA,CAAA;AACvJ","file":"management.cjs","sourcesContent":["/**\n * Base class for every error this SDK throws, so callers can `catch (e) { if (e\n * instanceof CboxIdError) ... }` in one branch.\n */\nexport class CboxIdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\n/** The client is misconfigured (a required option is missing or empty). */\nexport class ConfigurationError extends CboxIdError {}\n\n/**\n * The login `state` did not match what was stored — the callback is forged or\n * stale. Treat as a fresh start, not an error to surface to the user.\n */\nexport class InvalidStateError extends CboxIdError {}\n\n/**\n * Login could not be completed: the provider returned an error, the callback was\n * missing a code, or a token / id_token failed verification.\n *\n * `error` carries the RFC 6749 §5.2 code the authorization server sent, when it sent one.\n * It used to be discarded at every back-channel boundary, leaving a single message string\n * for outcomes that need opposite responses: `invalid_grant` on a refresh means the\n * session is over and the person has to sign in again, while `temporarily_unavailable`\n * means try the same token in a moment. A caller reduced to matching on prose either\n * retries what can never succeed, or signs out somebody who did not need to be.\n */\nexport class AuthenticationError extends CboxIdError {\n  constructor(\n    message: string,\n    /** RFC 6749 §5.2 error code, when the server sent a parseable one. */\n    readonly error?: string,\n    /** The server's `error_description`, verbatim. Not end-user copy. */\n    readonly errorDescription?: string,\n    /** HTTP status, for the cases where the body says nothing useful. */\n    readonly status?: number,\n    /**\n     * Seconds to wait, off the `Retry-After` header — set only on a 429.\n     *\n     * The distinction it carries is the one a caller most needs and could least infer:\n     * a 429 is the ONLY back-channel failure where the same request will succeed\n     * unchanged if you simply wait. Every other one needs a different request, or a new\n     * sign-in. Without this the SDK reported \"token refresh failed\" and a caller with a\n     * retry loop hammered a limiter that was already telling it exactly how long to stop.\n     */\n    readonly retryAfter?: number,\n  ) {\n    super(message);\n  }\n\n  /** Whether waiting `retryAfter` seconds and repeating the same request is worth it. */\n  get isRateLimited(): boolean {\n    return this.status === 429;\n  }\n}\n\n/**\n * Read an OAuth error out of a failed token-endpoint response.\n *\n * Best-effort by design: a 502 from a proxy is HTML, a captive portal is worse, and the\n * caller still needs an error rather than a parse exception. What it must never do is\n * invent a code — an absent or unparseable `error` stays undefined, so\n * `e.error === 'invalid_grant'` is true only because the server said so.\n */\nexport async function oauthError(response: Response, fallback: string): Promise<AuthenticationError> {\n  const body = await response.text().catch(() => '');\n\n  let code: string | undefined;\n  let description: string | undefined;\n\n  try {\n    const parsed: unknown = JSON.parse(body);\n\n    if (typeof parsed === 'object' && parsed !== null) {\n      const { error, error_description: errorDescription } = parsed as Record<string, unknown>;\n      code = typeof error === 'string' ? error : undefined;\n      description = typeof errorDescription === 'string' ? errorDescription : undefined;\n    }\n  } catch {\n    // Not JSON. The status and the truncated body below are all there is to report.\n  }\n\n  // THE BODY IS NEVER ECHOED. These calls carry `client_secret`, `code_verifier` and\n  // refresh tokens in their REQUEST, and a debug proxy, a captive portal or an upstream\n  // error page that reflects what it received puts those straight into a thrown message\n  // — which production apps log. Only the server's own OAuth error code travels, and\n  // failing that, the status alone.\n  const detail = code ?? `HTTP ${response.status}`;\n\n  // `Retry-After` is seconds here — Laravel's throttler writes the integer form. The\n  // HTTP-date form is legal too and is deliberately NOT parsed: guessing at a clock\n  // skew is worse than saying nothing, and `status === 429` still tells the caller to\n  // back off.\n  const retryAfterHeader = response.headers.get('retry-after');\n  const retryAfter = retryAfterHeader !== null && /^\\d+$/.test(retryAfterHeader.trim())\n    ? Number(retryAfterHeader.trim())\n    : undefined;\n\n  return new AuthenticationError(`${fallback}: ${detail}`, code, description, response.status, retryAfter);\n}\n\n/**\n * The Frontend API refused, or could not be reached.\n *\n * Carries a `code` because the four ways this goes wrong need four different responses\n * from the caller, and telling them apart from a message string is the kind of thing\n * that works until somebody rewords the message:\n *\n *  - `origin_not_allowed` — the overwhelmingly likely cause of a refusal, and a\n *    configuration problem the developer fixes once in the console.\n *  - `rate_limited` — back off; `retryAfter` says for how long, when the server said.\n *  - `unavailable` — the network, or a 5xx. Transient by assumption; already retried.\n *  - `malformed` — a 200 whose body is not the document we expect, which means something\n *    between the page and us is rewriting responses (a proxy, an extension, a captive\n *    portal). Worth distinguishing, because retrying it never helps.\n */\nexport class FrontendApiError extends CboxIdError {\n  constructor(\n    message: string,\n    readonly code: 'origin_not_allowed' | 'rate_limited' | 'unavailable' | 'malformed',\n    readonly status?: number,\n    readonly retryAfter?: number,\n  ) {\n    super(message);\n  }\n}\n","import { CboxIdError } from '../errors.js';\nimport type { PendingApproval } from './types.js';\n\n/**\n * The management API answered with an error.\n *\n * Every plane answers a failure with the same envelope — `{ error, message }`, plus a\n * field-keyed `errors` map on `validation_failed` — so one class covers them all. Branch on\n * `error` (the stable machine code), never on `message` (prose, reworded freely).\n *\n * The REQUEST body is never part of the error: management writes carry secrets (a password\n * you set, a key's scopes, a webhook secret) and production apps log thrown errors.\n */\nexport class CboxIdApiError extends CboxIdError {\n  /** HTTP status. */\n  readonly status: number;\n  /** The stable machine code, e.g. `validation_failed`, `slug_taken`, `not_found`. */\n  readonly error: string;\n  /**\n   * On `validation_failed` only: the offending request fields, each mapped to its messages\n   * (`{ name: ['The name field is required.'] }`). Empty otherwise.\n   */\n  readonly errors: Readonly<Record<string, readonly string[]>>;\n  /** The id the server served the request under (`request_id`, else `X-Request-Id`). Quote it when reporting a problem. */\n  readonly requestId: string | null;\n  /** Seconds to wait, off `Retry-After` — set on a `429` the client gave up retrying. */\n  readonly retryAfter: number | undefined;\n\n  constructor(init: {\n    status: number;\n    error: string;\n    message: string;\n    errors?: Record<string, readonly string[]>;\n    requestId?: string | null;\n    retryAfter?: number | undefined;\n  }) {\n    super(init.message);\n    this.status = init.status;\n    this.error = init.error;\n    this.errors = init.errors ?? {};\n    this.requestId = init.requestId ?? null;\n    this.retryAfter = init.retryAfter;\n  }\n\n  /** Whether this is a `422 validation_failed` with field errors. */\n  get isValidationError(): boolean {\n    return this.error === 'validation_failed';\n  }\n}\n\n/**\n * The request never got an answer: DNS, TLS, a reset connection, a timeout — after every\n * retry the client was allowed. A write may or may not have happened; repeating it with the\n * same `idempotencyKey` (`error.idempotencyKey`) is safe and tells you which.\n */\nexport class ManagementNetworkError extends CboxIdError {\n  constructor(\n    message: string,\n    /** The `Idempotency-Key` the write was sent with, to repeat it safely. */\n    readonly idempotencyKey: string | undefined,\n    options?: { cause?: unknown },\n  ) {\n    super(message);\n    if (options && 'cause' in options) {\n      (this as { cause?: unknown }).cause = options.cause;\n    }\n  }\n}\n\n/**\n * An action held for a person's approval did not get it. `reason` says how: `denied` (they\n * said no), `expired` (nobody answered in time), or `consumed` (the approval was already\n * spent by another request).\n */\nexport class ApprovalError extends CboxIdError {\n  constructor(\n    message: string,\n    readonly reason: 'denied' | 'expired' | 'consumed',\n    readonly approval: PendingApproval,\n  ) {\n    super(message);\n  }\n}\n\n/** The person declined the action on their device. Do not retry it unprompted. */\nexport class ApprovalDeniedError extends ApprovalError {\n  constructor(approval: PendingApproval) {\n    super(`Approval ${approval.id} was denied.`, 'denied', approval);\n  }\n}\n\n/** Nobody approved the action before the approval expired. Ask again with a new request. */\nexport class ApprovalExpiredError extends ApprovalError {\n  constructor(approval: PendingApproval) {\n    super(`Approval ${approval.id} expired before it was approved.`, 'expired', approval);\n  }\n}\n","import { CboxIdError, ConfigurationError } from '../errors.js';\nimport type { DPoPSigner } from './dpop.js';\nimport {\n  ApprovalDeniedError,\n  ApprovalError,\n  ApprovalExpiredError,\n  CboxIdApiError,\n  ManagementNetworkError,\n} from './errors.js';\nimport type {\n  ApiResponse,\n  ApprovalContext,\n  CallOptions,\n  CursorPageMeta,\n  NumberedPageMeta,\n  OperationSpec,\n  Outcome,\n  PendingApproval,\n  PendingApprovalResult,\n} from './types.js';\n\n/** The four management planes, each with its own OpenAPI document. */\nexport type Plane = 'environment' | 'workspace' | 'platform' | 'account';\n\n/** Retry behaviour for network failures, `5xx`, `429` and `409 idempotency_in_progress`. */\nexport interface RetryOptions {\n  /** Retries after the first attempt. Default `3`; `0` turns retrying off. */\n  maxRetries?: number;\n  /** First backoff delay (ms), doubled per attempt with jitter. Default `500`. */\n  baseDelayMs?: number;\n  /**\n   * The longest the client will wait before one retry (ms). Default `30000`. A `Retry-After`\n   * longer than this is not waited out: the `429`/`503` is thrown, with `retryAfter` set.\n   */\n  maxDelayMs?: number;\n}\n\n/** Options every management client takes. Exactly one of `apiKey` and `accessToken`. */\nexport interface ManagementClientOptions {\n  /**\n   * Where the plane is served: an environment's own host (`https://acme.cboxid.com`) for the\n   * environment and account planes, the platform-root host for the workspace and platform\n   * planes. `/api/v1` is appended unless it is already there.\n   */\n  baseUrl?: string;\n  /** A management key: `cbid_env_…` (environment plane) or `cbid_ws_…` (workspace plane). */\n  apiKey?: string;\n  /**\n   * A delegated OAuth access token, or a function returning one (called before every request,\n   * so it can refresh). Platform and account planes accept nothing else.\n   */\n  accessToken?: string | (() => string | Promise<string>);\n  /**\n   * Environment plane only, with a person's access token on the PLATFORM ROOT's host: the\n   * environment to act in, by id or slug, sent as `Cbox-Environment` on every request. One\n   * root token and the root `baseUrl` can then drive any environment of the person's\n   * workspace. Not used with a key, which is bound to its own environment's host.\n   */\n  environment?: string;\n  /** Present `accessToken` as a DPoP-bound token, with a proof per request. */\n  dpop?: DPoPSigner;\n  /**\n   * Called when a write is held for a person's approval, before the client starts polling —\n   * show `approval.binding_code` so they can match it on their device. Defaults to nothing.\n   */\n  onApprovalRequired?: (approval: PendingApproval, context: ApprovalContext) => void | Promise<void>;\n  /** How often to poll an approval (ms) when the server sends no `Retry-After`. Default `2000`. */\n  approvalPollIntervalMs?: number;\n  retry?: RetryOptions;\n  /** Per-attempt timeout (ms). Default `30000`. */\n  timeoutMs?: number;\n  /** A `fetch` implementation. Defaults to the global one. */\n  fetch?: typeof fetch;\n  /** Headers sent on every request (e.g. a `User-Agent` on Node). Cannot override `Authorization`. */\n  headers?: Record<string, string>;\n}\n\nconst KEY_PREFIX: Record<Plane, string | null> = {\n  environment: 'cbid_env_',\n  workspace: 'cbid_ws_',\n  platform: null,\n  account: null,\n};\n\n/** Where each plane serves `GET …/action-approvals/{id}`, relative to `/api/v1`. */\nconst APPROVAL_MOUNT: Record<Plane, string> = {\n  environment: '',\n  workspace: '/workspace',\n  platform: '/platform',\n  account: '/me',\n};\n\nconst WRITE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);\n\n/** How many approvals one call will go through before giving up (a policy loop guard). */\nconst MAX_APPROVAL_ROUNDS = 3;\n\ninterface SendOptions {\n  idempotencyKey?: string | undefined;\n  approvalId?: string | undefined;\n  signal?: AbortSignal | undefined;\n  headers?: Record<string, string> | undefined;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction uuid(): string {\n  if (typeof crypto.randomUUID === 'function') {\n    return crypto.randomUUID();\n  }\n\n  const bytes = crypto.getRandomValues(new Uint8Array(16));\n  bytes[6] = (bytes[6]! & 0x0f) | 0x40;\n  bytes[8] = (bytes[8]! & 0x3f) | 0x80;\n  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');\n\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\n/** `Retry-After` in milliseconds: delta-seconds or an HTTP date. Undefined when absent or unparseable. */\nexport function retryAfterMs(headers: Headers): number | undefined {\n  const raw = headers.get('retry-after')?.trim();\n\n  if (raw === undefined || raw === '') {\n    return undefined;\n  }\n\n  if (/^\\d+$/.test(raw)) {\n    return Number(raw) * 1000;\n  }\n\n  const date = Date.parse(raw);\n\n  return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  if (ms <= 0) {\n    return signal?.aborted ? Promise.reject(signal.reason) : Promise.resolve();\n  }\n\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(signal.reason);\n      return;\n    }\n\n    const timer = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n    const onAbort = (): void => {\n      clearTimeout(timer);\n      reject(signal?.reason);\n    };\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\nfunction normalizeBaseUrl(raw: string): string {\n  let url: URL;\n\n  try {\n    url = new URL(raw);\n  } catch {\n    throw new ConfigurationError('Management client `baseUrl` is not a valid URL.');\n  }\n\n  const loopback = ['localhost', '127.0.0.1', '[::1]', '::1'].includes(url.hostname);\n\n  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) {\n    // Every request carries a management credential. Over http a network attacker reads it.\n    throw new ConfigurationError(`Management client \\`baseUrl\\` must be https (got ${url.protocol}//${url.hostname}).`);\n  }\n\n  const path = url.pathname.replace(/\\/+$/, '');\n\n  return `${url.origin}${path.endsWith('/api/v1') ? path : `${path}/api/v1`}`;\n}\n\nfunction appendQuery(params: URLSearchParams, key: string, value: unknown): void {\n  if (value === undefined || value === null) {\n    return;\n  }\n\n  if (Array.isArray(value)) {\n    for (const item of value) {\n      appendQuery(params, `${key}[]`, item);\n    }\n    return;\n  }\n\n  if (typeof value === 'boolean') {\n    // Laravel's `boolean` rule takes 1/0, not the strings \"true\"/\"false\".\n    params.append(key, value ? '1' : '0');\n    return;\n  }\n\n  params.append(key, typeof value === 'object' ? JSON.stringify(value) : String(value));\n}\n\nasync function readJson(response: Response): Promise<unknown> {\n  const text = await response.text();\n\n  if (text === '') {\n    return undefined;\n  }\n\n  try {\n    return JSON.parse(text) as unknown;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * The hand-written core every generated client runs on: authentication, idempotency keys,\n * retries, the approval loop, error typing and pagination. Generated code only describes\n * operations; it never talks to the network itself.\n */\nexport class ManagementTransport {\n  readonly plane: Plane;\n  readonly baseUrl: string;\n  readonly #options: ManagementClientOptions;\n  readonly #fetch: typeof fetch;\n  readonly #maxRetries: number;\n  readonly #baseDelayMs: number;\n  readonly #maxDelayMs: number;\n  #dpopNonce: string | undefined;\n\n  constructor(plane: Plane, options: ManagementClientOptions, defaultBaseUrl?: string) {\n    const baseUrl = options.baseUrl ?? defaultBaseUrl;\n\n    if (baseUrl === undefined || baseUrl === '') {\n      throw new ConfigurationError(`The ${plane} management client needs a \\`baseUrl\\` (the environment's own host).`);\n    }\n\n    const hasKey = options.apiKey !== undefined;\n    const hasToken = options.accessToken !== undefined;\n\n    if (hasKey === hasToken) {\n      throw new ConfigurationError('Pass exactly one of `apiKey` and `accessToken` to a management client.');\n    }\n\n    if (hasKey) {\n      const key = options.apiKey ?? '';\n      const expected = KEY_PREFIX[plane];\n\n      if (key === '') {\n        throw new ConfigurationError('Management client `apiKey` is empty.');\n      }\n\n      if (expected === null) {\n        throw new ConfigurationError(\n          `The ${plane} plane accepts no management key — only an access token a person delegated (\\`accessToken\\`).`,\n        );\n      }\n\n      const wrong = Object.values(KEY_PREFIX).find((prefix) => prefix !== null && prefix !== expected && key.startsWith(prefix));\n\n      if (wrong !== undefined) {\n        // Credentials never cross planes: the server would answer 401 to every request.\n        throw new ConfigurationError(`A \\`${wrong}…\\` key cannot call the ${plane} plane; it takes \\`${expected}…\\` keys.`);\n      }\n\n      if (options.dpop !== undefined) {\n        throw new ConfigurationError('`dpop` applies to an `accessToken`, not a management key.');\n      }\n    }\n\n    if (options.environment !== undefined) {\n      if (plane !== 'environment') {\n        throw new ConfigurationError(`\\`environment\\` applies to the environment plane, not the ${plane} plane.`);\n      }\n\n      if (options.environment === '') {\n        throw new ConfigurationError('Management client `environment` is empty.');\n      }\n\n      if (hasKey) {\n        throw new ConfigurationError(\n          '`environment` names the environment for a root access token. A `cbid_env_…` key is bound to its own environment\\'s host: use that host as `baseUrl` instead.',\n        );\n      }\n    }\n\n    this.plane = plane;\n    this.baseUrl = normalizeBaseUrl(baseUrl);\n    this.#options = options;\n    this.#fetch = options.fetch ?? ((input, init) => fetch(input, init));\n    this.#maxRetries = Math.max(0, options.retry?.maxRetries ?? 3);\n    this.#baseDelayMs = Math.max(0, options.retry?.baseDelayMs ?? 500);\n    this.#maxDelayMs = Math.max(0, options.retry?.maxDelayMs ?? 30_000);\n  }\n\n  /** Run one operation. Generated methods call this; so can you, with an operation spec. */\n  async call<TBody, O extends CallOptions = CallOptions>(\n    op: OperationSpec,\n    pathArgs: readonly string[],\n    input?: unknown,\n    options?: O,\n  ): Promise<Outcome<TBody, O>> {\n    const url = this.#url(op, pathArgs, op.body ? undefined : input);\n    const payload = op.body ? input : undefined;\n    const idempotencyKey = WRITE_METHODS.has(op.method) ? options?.idempotencyKey ?? uuid() : undefined;\n    const send: SendOptions = {\n      idempotencyKey,\n      approvalId: options?.approvalId,\n      signal: options?.signal,\n      headers: options?.headers,\n    };\n    const context: ApprovalContext = { action: op.action, danger: op.danger, method: op.method, path: op.path };\n\n    const response = await this.#send(op.method, url, payload, send);\n    const held = await this.#heldApproval(response);\n\n    if (held !== null && options?.approval === 'return') {\n      const result: PendingApprovalResult<TBody> = {\n        pending: true,\n        status: 202,\n        approval: held.approval,\n        idempotencyKey,\n        action: op.action,\n        resume: (resumeOptions) =>\n          this.#approveAndRepeat<TBody>(op.method, url, payload, { ...send, signal: resumeOptions?.signal ?? send.signal }, held, context, false),\n      };\n\n      return result as Outcome<TBody, O>;\n    }\n\n    if (held !== null) {\n      return (await this.#approveAndRepeat<TBody>(op.method, url, payload, send, held, context, true)) as Outcome<TBody, O>;\n    }\n\n    return (await this.#result<TBody>(response, idempotencyKey)) as Outcome<TBody, O>;\n  }\n\n  /**\n   * Every item of a paged list, fetching pages as the iteration reaches them. Works for both\n   * cursor (`after` / `meta.next_cursor`) and numbered (`page` / `meta.next_page`) lists.\n   */\n  async *paginate<TItem>(\n    op: OperationSpec,\n    pathArgs: readonly string[],\n    input?: Record<string, unknown>,\n    options?: Omit<CallOptions, 'approval'>,\n  ): AsyncGenerator<TItem, void, undefined> {\n    let query: Record<string, unknown> = { ...(input ?? {}) };\n\n    for (;;) {\n      const page = await this.call<{ data?: TItem[]; meta?: CursorPageMeta & NumberedPageMeta }>(op, pathArgs, query, {\n        ...options,\n        approval: 'wait',\n      });\n      const items = Array.isArray(page.data) ? page.data : [];\n\n      yield* items;\n\n      const meta = page.meta;\n\n      if (items.length === 0 || meta?.has_more !== true) {\n        return;\n      }\n\n      if (op.pagination === 'page') {\n        const current = typeof query.page === 'number' ? query.page : Number(query.page ?? 1);\n        query = { ...query, page: meta.next_page ?? current + 1 };\n      } else {\n        if (typeof meta.next_cursor !== 'string' || meta.next_cursor === '') {\n          return;\n        }\n        query = { ...query, after: meta.next_cursor };\n      }\n    }\n  }\n\n  /**\n   * An escape hatch for a route the generated surface does not cover. `path` is relative to\n   * `/api/v1`. Writes get an `Idempotency-Key` and the approval loop like any operation.\n   */\n  request<TBody = unknown, O extends CallOptions = CallOptions>(\n    method: OperationSpec['method'],\n    path: string,\n    input?: { query?: Record<string, unknown>; body?: unknown },\n    options?: O,\n  ): Promise<Outcome<TBody, O>> {\n    const op: OperationSpec = {\n      action: null,\n      operationId: null,\n      method,\n      path,\n      pathParams: [],\n      scope: null,\n      danger: null,\n      approval: true,\n      body: input?.body !== undefined,\n      pagination: null,\n    };\n\n    return this.call<TBody, O>(op, [], input?.body ?? input?.query, options);\n  }\n\n  #url(op: OperationSpec, pathArgs: readonly string[], query: unknown): string {\n    let index = 0;\n    const path = op.path.replace(/\\{([^}]+)\\}/g, (_, name: string) => {\n      const value = pathArgs[index++];\n\n      if (value === undefined || value === '') {\n        throw new TypeError(`${op.action ?? op.path}: missing path parameter \\`${name}\\`.`);\n      }\n\n      return encodeURIComponent(value);\n    });\n\n    const url = new URL(`${this.baseUrl}${path}`);\n\n    if (isRecord(query)) {\n      for (const [key, value] of Object.entries(query)) {\n        appendQuery(url.searchParams, key, value);\n      }\n    }\n\n    return url.toString();\n  }\n\n  async #headers(method: string, url: string, send: SendOptions, hasBody: boolean): Promise<Headers> {\n    const headers = new Headers({ ...this.#options.headers, ...send.headers });\n    headers.set('accept', 'application/json');\n\n    if (hasBody) {\n      headers.set('content-type', 'application/json');\n    }\n\n    if (send.idempotencyKey !== undefined) {\n      headers.set('idempotency-key', send.idempotencyKey);\n    }\n\n    if (send.approvalId !== undefined) {\n      headers.set('cbox-approval', send.approvalId);\n    }\n\n    if (this.#options.environment !== undefined) {\n      headers.set('cbox-environment', this.#options.environment);\n    }\n\n    if (this.#options.apiKey !== undefined) {\n      headers.set('authorization', `Bearer ${this.#options.apiKey}`);\n      return headers;\n    }\n\n    const source = this.#options.accessToken;\n    const token = typeof source === 'function' ? await source() : source;\n\n    if (typeof token !== 'string' || token === '') {\n      throw new ConfigurationError('The management client `accessToken` provider returned no token.');\n    }\n\n    const dpop = this.#options.dpop;\n\n    if (dpop === undefined) {\n      headers.set('authorization', `Bearer ${token}`);\n      return headers;\n    }\n\n    headers.set('authorization', `DPoP ${token}`);\n    headers.set(\n      'dpop',\n      await dpop.proof({\n        method,\n        url,\n        accessToken: token,\n        ...(this.#dpopNonce !== undefined ? { nonce: this.#dpopNonce } : {}),\n      }),\n    );\n\n    return headers;\n  }\n\n  /** One HTTP exchange, plus the single DPoP-nonce challenge retry RFC 9449 §8 describes. */\n  async #exchange(method: string, url: string, payload: unknown, send: SendOptions): Promise<Response> {\n    for (let nonceRetry = 0; ; nonceRetry++) {\n      const headers = await this.#headers(method, url, send, payload !== undefined);\n      const timeout = AbortSignal.timeout(this.#options.timeoutMs ?? 30_000);\n      const signal = send.signal ? AbortSignal.any([send.signal, timeout]) : timeout;\n      const init: RequestInit = { method, headers, signal };\n\n      if (payload !== undefined) {\n        init.body = JSON.stringify(payload);\n      }\n\n      const response = await this.#fetch(url, init);\n      const nonce = response.headers.get('dpop-nonce');\n\n      if (nonce !== null && this.#options.dpop !== undefined) {\n        const challenged = response.status === 401 && nonce !== this.#dpopNonce && nonceRetry === 0;\n        this.#dpopNonce = nonce;\n\n        if (challenged) {\n          await response.body?.cancel();\n          continue;\n        }\n      }\n\n      return response;\n    }\n  }\n\n  async #shouldRetry(response: Response): Promise<boolean> {\n    if (response.status >= 500 || response.status === 429) {\n      return true;\n    }\n\n    if (response.status === 409) {\n      // The first request with this Idempotency-Key is still running: its answer is coming.\n      const body = await readJson(response.clone());\n      return isRecord(body) && body.error === 'idempotency_in_progress';\n    }\n\n    return false;\n  }\n\n  #backoff(attempt: number): number {\n    const exponential = this.#baseDelayMs * 2 ** attempt;\n    return Math.min(this.#maxDelayMs, exponential / 2 + Math.random() * (exponential / 2));\n  }\n\n  /** Send with retries. Every attempt carries the SAME Idempotency-Key, so a write lands once. */\n  async #send(method: string, url: string, payload: unknown, send: SendOptions): Promise<Response> {\n    for (let attempt = 0; ; attempt++) {\n      let response: Response;\n\n      try {\n        response = await this.#exchange(method, url, payload, send);\n      } catch (error) {\n        if (send.signal?.aborted) {\n          throw send.signal.reason ?? error;\n        }\n\n        if (error instanceof CboxIdError || attempt >= this.#maxRetries) {\n          if (error instanceof CboxIdError) {\n            throw error;\n          }\n\n          throw new ManagementNetworkError(\n            `${method} ${new URL(url).pathname} failed: ${error instanceof Error ? error.message : String(error)}`,\n            send.idempotencyKey,\n            { cause: error },\n          );\n        }\n\n        await sleep(this.#backoff(attempt), send.signal);\n        continue;\n      }\n\n      if (attempt >= this.#maxRetries || !(await this.#shouldRetry(response))) {\n        return response;\n      }\n\n      const delay = retryAfterMs(response.headers) ?? this.#backoff(attempt);\n\n      if (delay > this.#maxDelayMs) {\n        return response;\n      }\n\n      await response.body?.cancel();\n      await sleep(delay, send.signal);\n    }\n  }\n\n  async #heldApproval(response: Response): Promise<{ approval: PendingApproval; retryAfter: number | undefined } | null> {\n    if (response.status !== 202) {\n      return null;\n    }\n\n    const body = await readJson(response.clone());\n\n    if (!isRecord(body) || body.error !== 'approval_required' || !isRecord(body.approval)) {\n      return null;\n    }\n\n    const approval = body.approval;\n\n    if (typeof approval.id !== 'string' || approval.id === '') {\n      return null;\n    }\n\n    return {\n      approval: {\n        id: approval.id,\n        status: typeof approval.status === 'string' ? approval.status : 'pending',\n        binding_code: typeof approval.binding_code === 'string' ? approval.binding_code : '',\n        expires_at: typeof approval.expires_at === 'string' ? approval.expires_at : '',\n        poll_url:\n          typeof approval.poll_url === 'string'\n            ? approval.poll_url\n            : `${this.baseUrl}${APPROVAL_MOUNT[this.plane]}/action-approvals/${encodeURIComponent(approval.id)}`,\n      },\n      retryAfter: retryAfterMs(response.headers),\n    };\n  }\n\n  async #approveAndRepeat<TBody>(\n    method: string,\n    url: string,\n    payload: unknown,\n    send: SendOptions,\n    first: { approval: PendingApproval; retryAfter: number | undefined },\n    context: ApprovalContext,\n    notify: boolean,\n  ): Promise<ApiResponse<TBody>> {\n    let held = first;\n\n    for (let round = 1; ; round++) {\n      if (notify || round > 1) {\n        await this.#options.onApprovalRequired?.(held.approval, context);\n      }\n\n      await this.#awaitApproval(held.approval, held.retryAfter, send.signal);\n\n      const response = await this.#send(method, url, payload, { ...send, approvalId: held.approval.id });\n      const again = await this.#heldApproval(response);\n\n      if (again === null) {\n        return this.#result<TBody>(response, send.idempotencyKey);\n      }\n\n      if (round >= MAX_APPROVAL_ROUNDS) {\n        throw new ApprovalError(\n          `The request was held for approval ${round} times; giving up.`,\n          'consumed',\n          again.approval,\n        );\n      }\n\n      held = again;\n    }\n  }\n\n  /** Poll an approval until the person decides. Resolves on `approved`; throws otherwise. */\n  async #awaitApproval(approval: PendingApproval, initialDelay: number | undefined, signal: AbortSignal | undefined): Promise<void> {\n    const pollUrl = new URL(approval.poll_url, this.baseUrl);\n\n    if (pollUrl.origin !== new URL(this.baseUrl).origin) {\n      // The poll carries the same credential as the request. Never hand it to another host.\n      throw new CboxIdError(`Refusing to poll approval ${approval.id} at another origin (${pollUrl.origin}).`);\n    }\n\n    const fallback = Math.max(0, this.#options.approvalPollIntervalMs ?? 2_000);\n    const expiresAt = Date.parse(approval.expires_at);\n    let delay = initialDelay ?? fallback;\n\n    for (;;) {\n      await sleep(Math.min(delay, 60_000), signal);\n\n      const response = await this.#send('GET', pollUrl.toString(), undefined, { signal });\n\n      if (!response.ok) {\n        throw await this.#error(response);\n      }\n\n      const body = await readJson(response);\n      const data = isRecord(body) && isRecord(body.data) ? body.data : {};\n      const status = typeof data.status === 'string' ? data.status : 'pending';\n\n      switch (status) {\n        case 'approved':\n          return;\n        case 'denied':\n          throw new ApprovalDeniedError(approval);\n        case 'expired':\n          throw new ApprovalExpiredError(approval);\n        case 'consumed':\n          throw new ApprovalError(`Approval ${approval.id} was already used by another request.`, 'consumed', approval);\n        default:\n          break;\n      }\n\n      if (!Number.isNaN(expiresAt) && Date.now() > expiresAt + 30_000) {\n        throw new ApprovalExpiredError(approval);\n      }\n\n      delay = retryAfterMs(response.headers) ?? fallback;\n    }\n  }\n\n  async #result<TBody>(response: Response, idempotencyKey: string | undefined): Promise<ApiResponse<TBody>> {\n    if (!response.ok) {\n      throw await this.#error(response);\n    }\n\n    const body = response.status === 204 ? undefined : await readJson(response);\n    const envelope = isRecord(body) && 'data' in body;\n\n    return {\n      pending: false,\n      status: response.status,\n      data: (envelope ? body.data : body) as ApiResponse<TBody>['data'],\n      meta: (envelope ? body.meta : undefined) as ApiResponse<TBody>['meta'],\n      body: body as TBody,\n      replayed: response.headers.get('idempotent-replayed')?.toLowerCase() === 'true',\n      idempotencyKey,\n      requestId: response.headers.get('x-request-id'),\n      headers: response.headers,\n    };\n  }\n\n  async #error(response: Response): Promise<CboxIdApiError> {\n    const body = await readJson(response);\n    const fields = isRecord(body) ? body : {};\n    const code = typeof fields.error === 'string' ? fields.error : `http_${response.status}`;\n    // A bearer challenge (RFC 6750) says `error_description`, the management envelope `message`.\n    const message =\n      typeof fields.message === 'string'\n        ? fields.message\n        : typeof fields.error_description === 'string'\n          ? fields.error_description\n          : `HTTP ${response.status}`;\n    const errors: Record<string, string[]> = {};\n\n    if (isRecord(fields.errors)) {\n      for (const [field, messages] of Object.entries(fields.errors)) {\n        errors[field] = Array.isArray(messages) ? messages.map(String) : [String(messages)];\n      }\n    }\n\n    const retryAfter = retryAfterMs(response.headers);\n\n    // The envelope's `request_id` first: a proxy in between may rewrite or drop the header.\n    const requestId = typeof fields.request_id === 'string' && fields.request_id !== '' ? fields.request_id : response.headers.get('x-request-id');\n\n    return new CboxIdApiError({\n      status: response.status,\n      error: code,\n      message,\n      errors,\n      requestId,\n      retryAfter: retryAfter === undefined ? undefined : Math.ceil(retryAfter / 1000),\n    });\n  }\n}\n","// GENERATED by scripts/generate-management.ts from openapi/environment.yaml — do not edit.\n// Regenerate with `npm run generate`.\n\nimport { ManagementTransport, type ManagementClientOptions } from '../transport.js';\nimport type { CallOptions, OperationSpec, Outcome } from '../types.js';\n\n// ── Schemas (components.schemas) ────────────────────────────────────────────────────────────\n\n/** A management key of this environment. `token` is present once, on the answer that minted it, and never again. */\nexport interface ManagementKey {\n  id: string;\n  name: string;\n  description?: string | null;\n  /** The key's first characters, to recognise it by. */\n  prefix: string;\n  scopes: string[];\n  active: boolean;\n  /** The key that minted this one, if a key did. */\n  parent_key_id?: string | null;\n  /** The key this one replaced, if it came from a rotation. */\n  rotated_from_id?: string | null;\n  /** The approval policy: actions held for the person behind the key. */\n  require_approval?: {\n    min_danger?: 'read' | 'write' | 'destructive' | 'critical' | null;\n    actions?: string[];\n  } | null;\n  created_by?: {\n    type: string;\n    id: string | null;\n  } | null;\n  expires_at?: string | null;\n  last_used_at?: string | null;\n  revoked_at?: string | null;\n  created_at: string | null;\n  /** The key's value. Only on the answer that minted it; null on an idempotent replay of that answer, because the value is never stored. */\n  token?: string | null;\n}\n\nexport interface LegacyLoginProbe {\n  /** What the declared legacy-login endpoint answered for the address, in words. */\n  result: string;\n}\n\nexport interface ManifestSync {\n  /** The manifest matched what is already stored. */\n  unchanged: boolean;\n  roles_declared: number;\n  permissions_declared: number;\n  /** Roles stored here that the manifest no longer declares. */\n  orphaned_role_keys: string[];\n  orphaned_permission_keys: string[];\n}\n\nexport interface SmsFactorPolicy {\n  /** Text-message codes are accepted as a second factor. Off by default. */\n  enabled: boolean;\n  /** ISO 3166-1 alpha-2 countries whose numbers may enrol and be texted. Re-checked at every send. */\n  allowed_countries: string[];\n  /** Administrators may add SMS only beside an authenticator app or a passkey. */\n  privileged_need_stronger_factor: boolean;\n  /** The deployment's ceiling (CBOX_ID_SMS_ALLOWED_COUNTRIES). Empty: no deployment restriction. A listed country outside it is never texted. */\n  deployment_countries: string[];\n}\n\nexport interface SelfServiceSignup {\n  enabled: boolean;\n  /** False on a single-tenant install, where sign-up follows CBOX_ID_SIGNUP_MODE and the switch changes nothing. */\n  decided_here: boolean;\n}\n\nexport interface Device {\n  id: string;\n  install_id: string;\n  platform: 'ios' | 'android';\n  name: string;\n  /**\n   * Operator/user INTENT, not delivery health. A device can be active and\n   * currently failing, or retired and perfectly reachable.\n   */\n  status: 'active' | 'retired';\n  app_version?: string | null;\n  os_version?: string | null;\n  model?: string | null;\n  last_seen_at?: string | null;\n  created_at?: string | null;\n}\n\nexport interface Approval {\n  /**\n   * The INTERNAL request id. Never `auth_req_id`, which is the initiating\n   * client's polling secret and is stored only as a SHA-256 hash — a client must\n   * not be able to approve its own request.\n   */\n  id: string;\n  client_id: string;\n  client_name: string;\n  /**\n   * The transaction description the user compares against what the requesting app\n   * showed them. This is the anti-phishing primitive, and the reason approvals are\n   * fetched rather than pushed.\n   */\n  binding_message?: string | null;\n  scopes: Array<{\n    scope: string;\n    /** Human wording, identical to the console. */\n    label: string;\n  }>;\n  organization_id?: string | null;\n  requested_at?: string | null;\n  expires_at?: string | null;\n}\n\nexport interface ApprovalDecision {\n  id: string;\n  status: 'approved' | 'denied';\n}\n\nexport interface VaultSecret {\n  id: string;\n  name: string;\n  provider: string;\n  owner_type?: 'organization' | 'user' | null;\n  owner_id?: string | null;\n  expires_at?: string | null;\n  /** Whether the secret has been revoked. */\n  revoked: boolean;\n}\n\nexport interface Organization {\n  id: string;\n  name: string;\n  slug: string;\n  type: 'customer' | 'reseller';\n  status: 'active' | 'suspended' | 'deleted';\n  parent_id?: string | null;\n  created_at?: string | null;\n  /** Free-form text values kept on the organization; null when there are none. */\n  metadata?: {\n    [key: string]: string;\n  } | null;\n}\n\nexport interface OrganizationDomain {\n  id: string;\n  organization_id: string;\n  /** An email domain the organization claims, like acme.com. */\n  domain: string;\n  verified: boolean;\n  verified_at?: string | null;\n  /** Whether everyone signing in with an address here is routed to the organization's SSO. */\n  capture: boolean;\n  /** Where to publish the DNS TXT record that proves the claim. */\n  record_name: string;\n  /** What to publish there. */\n  record_value: string;\n}\n\n/**\n * The built-in tiers this deployment hands out. `owner` is never assigned — ownership\n * moves with `transfer-ownership`.\n */\nexport type AssignableMemberRole = 'admin' | 'member';\n\nexport interface Member {\n  /** The membership's own id. Address a member by `user_id`. */\n  id: string;\n  user_id: string;\n  organization_id: string;\n  role: 'owner' | 'admin' | 'developer' | 'member' | 'viewer';\n  status: 'active' | 'invited' | 'suspended';\n  email?: string | null;\n  name?: string | null;\n  joined_at?: string | null;\n}\n\nexport interface Invitation {\n  id: string;\n  organization_id: string;\n  email: string;\n  role: 'owner' | 'admin' | 'developer' | 'member' | 'viewer';\n  /** Ids of the access roles granted when the invitation is accepted. */\n  roles: string[];\n  status: 'pending' | 'accepted' | 'revoked';\n  /** The app it came from. */\n  client_id?: string | null;\n  /** Where the person is sent after accepting. */\n  return_to?: string | null;\n  invited_at?: string | null;\n  expires_at?: string | null;\n}\n\nexport interface Role {\n  id: string;\n  /** The app's manifest key; null for a role made in the console. */\n  key?: string | null;\n  name: string;\n  description?: string | null;\n  /** The app that declared it; null for an app-agnostic role. */\n  client_id?: string | null;\n  /** Set only for a role one organization made for itself. */\n  organization_id?: string | null;\n  /**\n   * `false` marks a STAFF role: an organization's own administrators can never grant\n   * it, nor can an invitation carry it. This API can — see the role endpoints.\n   */\n  tenant_assignable: boolean;\n  permissions: string[];\n}\n\nexport interface RoleAssignment {\n  role_id: string;\n  key?: string | null;\n  name: string;\n  client_id?: string | null;\n  tenant_assignable?: boolean;\n  user_id: string;\n  /** The organization it is held in; null for an environment-wide (staff) grant. */\n  organization_id?: string | null;\n  source: 'manual' | 'pushed' | 'system';\n}\n\nexport interface App {\n  id: string;\n  client_id: string;\n  name: string;\n  /** The kind, read back from its grants; `advanced` when they match no preset. */\n  type: 'web' | 'spa' | 'cli' | 'service' | 'agent' | 'advanced';\n  client_type: 'confidential' | 'public';\n  organization_id?: string | null;\n  first_party: boolean;\n  grant_types: string[];\n  redirect_uris: string[];\n  post_logout_redirect_uris?: string[];\n  scopes: string[];\n  /** Where it publishes its roles-and-permissions manifest. */\n  manifest_url?: string | null;\n  /** Its access-token lifetime in seconds; null for the install's default. */\n  access_token_ttl?: number | null;\n  /** Where it is sent a logout token (OIDC Back-Channel Logout); null when it is not told. */\n  backchannel_logout_uri?: string | null;\n  backchannel_logout_session_required?: boolean;\n  /** The prefix of its customer API keys; null when it accepts none. */\n  api_key_prefix?: string | null;\n  created_at?: string | null;\n  /** Only on the response that created (or copied) the app, and only for an app that authenticates with a secret. Never again — null on an idempotent replay. */\n  client_secret?: string | null;\n}\n\nexport interface AppSecret {\n  id: string;\n  /** The characters the secret ends in; null for one older than per-secret storage. */\n  hint?: string | null;\n  created_at?: string | null;\n  /** Set on a secret a rotation replaced — it stops working then. */\n  expires_at?: string | null;\n  last_used_at?: string | null;\n  /** Only on the rotation that minted it. Never again — null on an idempotent replay. */\n  client_secret?: string | null;\n  /** On a rotation — when the secrets it replaced stop working. */\n  previous_expire_at?: string | null;\n}\n\n/**\n * An app's configuration without its identity or credentials — deterministic (lists\n * sorted), versioned, and refused rather than half-read when it carries a key this\n * server does not know.\n */\nexport interface AppBlueprint {\n  kind: 'cbox-id.client-blueprint';\n  version: 1;\n  name: string;\n  client_type: 'confidential' | 'public';\n  token_endpoint_auth_method?: string | null;\n  grant_types?: string[];\n  redirect_uris?: string[];\n  post_logout_redirect_uris?: string[];\n  scopes?: string[];\n  first_party?: boolean;\n  manifest_url?: string | null;\n  access_token_ttl?: number | null;\n  backchannel_logout_uri?: string | null;\n  backchannel_logout_session_required?: boolean;\n  api_key_prefix?: string | null;\n}\n\nexport interface ApiScope {\n  key: string;\n  description?: string | null;\n  /** Whether apps an organization owns may be granted it; false keeps it for the environment's own apps. */\n  tenant_requestable?: boolean;\n}\n\nexport interface Api {\n  id: string;\n  /** Absolute URI; the token's `aud`. */\n  identifier: string;\n  name: string;\n  /** null when the environment owns it. */\n  organization_id?: string | null;\n  /** The app whose roles and permissions it enforces. */\n  client_id?: string | null;\n  scopes: ApiScope[];\n  created_at?: string | null;\n}\n\nexport interface Webhook {\n  id: string;\n  url: string;\n  /** null when the environment owns it: it receives EVERY organization's events. */\n  organization_id: string | null;\n  event_types: string[];\n  /** false while paused. */\n  active: boolean;\n  /**\n   * How deliveries are signed. `cbox`: `X-Cbox-Timestamp` and\n   * `X-Cbox-Signature: t=<ts>,v1=<hex HMAC-SHA256 of \"<ts>.<body>\">`.\n   * `standard_webhooks`: `webhook-id`, `webhook-timestamp` and\n   * `webhook-signature: v1,<base64 HMAC-SHA256 of \"<id>.<ts>.<body>\">`, verifiable\n   * with any Standard Webhooks library. Only the chosen scheme's headers are sent.\n   */\n  signature_scheme: 'cbox' | 'standard_webhooks';\n  consecutive_failures?: number;\n  last_success_at?: string | null;\n  created_at?: string | null;\n  /**\n   * The signing secret, on the create and rotate answers only — shown once, never\n   * retrievable again. `null` on an idempotent replay of that answer. 64 hex\n   * characters under `cbox`; a `whsec_` secret under `standard_webhooks`.\n   */\n  secret?: string | null;\n}\n\nexport interface InlineHook {\n  id: string;\n  url: string;\n  hook_point: 'token_minting' | 'post_login' | 'pre_registration' | 'post_registration' | 'pre_password_change' | 'post_password_change';\n  /** null when the environment owns it: it runs for EVERY organization. */\n  organization_id: string | null;\n  active: boolean;\n  created_at?: string | null;\n  /** The signing secret, on the create answer only — shown once. `null` on an idempotent replay. */\n  secret?: string | null;\n}\n\nexport interface LogStream {\n  id: string;\n  name: string;\n  destination: 'splunk_hec' | 'elastic_ecs' | 'graylog_gelf' | 'cef_http' | 'generic_json' | 'datadog' | 's3' | 'gcs';\n  /** Where entries go. For Datadog, S3 and GCS, derived from the site or region unless a custom endpoint was given. */\n  endpoint_url: string;\n  /** An HTTP collector's scheme; `none` for the cloud destinations, which authenticate their own way. */\n  auth: 'none' | 'bearer' | 'splunk' | 'hmac';\n  /** Datadog, S3 and GCS: the destination's settings, as stored. Never a credential — the API key, secret access key or service-account key is the encrypted secret. null for an HTTP collector. */\n  options: {\n    site?: 'datadoghq.com' | 'us3.datadoghq.com' | 'us5.datadoghq.com' | 'datadoghq.eu' | 'ap1.datadoghq.com' | 'ap2.datadoghq.com' | 'ddog-gov.com';\n    service?: string;\n    source?: string;\n    hostname?: string;\n    /** Comma-separated `key:value` tags (`ddtags`). */\n    tags?: string;\n    bucket?: string;\n    region?: string;\n    prefix?: string;\n    access_key_id?: string;\n    role_arn?: string;\n    external_id?: string;\n    sse?: 'AES256' | 'aws:kms';\n    kms_key_id?: string;\n    path_style?: boolean;\n    gzip?: boolean;\n  } | null;\n  /** An assumed-role S3 stream's external ID, generated for it: the role's trust policy must require it (`sts:ExternalId`). null otherwise. */\n  external_id: string | null;\n  /** null when the environment owns it: it carries EVERY organization's entries. */\n  organization_id: string | null;\n  enabled: boolean;\n  /** `degraded`: recent transient failures, still retrying. `paused`: the circuit is open after repeated failures and resumes on its own. `action_required`: the destination refused the credential or the settings — update the stream, or run a successful test. */\n  health: 'healthy' | 'degraded' | 'paused' | 'action_required';\n  consecutive_failures?: number;\n  last_success_at?: string | null;\n  /** The latest failure, scrubbed of the stream's secret. */\n  last_error?: string | null;\n  last_failure_kind?: 'transient' | 'authentication' | 'configuration' | null;\n  last_failure_at?: string | null;\n  created_at?: string | null;\n  /** A generated HMAC key, on the answer that generated it only — shown once. `null` on an idempotent replay. A credential the caller supplied is never echoed. */\n  secret?: string | null;\n}\n\nexport interface DomainEvent {\n  /** A ULID; pass the last one you saw as `after`. */\n  id: string;\n  /** e.g. `user.created` — the webhook event name. */\n  type: string;\n  organization_id: string | null;\n  occurred_at: string | null;\n  payload: Record<string, unknown>;\n}\n\nexport interface AuditEntry {\n  /** A ULID; pass the last one you saw as `after`. */\n  id: string;\n  /** e.g. `webhook.created`. */\n  action: string;\n  actor_type: 'user' | 'service' | 'system' | 'operator' | 'organization_member';\n  /** For `service`, the management key's or app's id. */\n  actor_id: string | null;\n  organization_id: string | null;\n  target_type: string | null;\n  target_id: string | null;\n  context: Record<string, unknown>;\n  ip?: string | null;\n  recorded_at: string | null;\n}\n\nexport interface ApiKey {\n  id: string;\n  name?: string | null;\n  /** What a person recognises the key by. Never the key. */\n  prefix: string;\n  organization_id: string;\n  /** Its holder. */\n  user_id: string;\n  /** The app whose API it is for. */\n  client_id: string;\n  permissions: string[];\n  status: 'active' | 'expired' | 'revoked';\n  revoked: boolean;\n  created_at?: string | null;\n  expires_at?: string | null;\n  last_used_at?: string | null;\n  revoked_at?: string | null;\n}\n\nexport interface SupportSession {\n  id: string;\n  /** The customer's user being acted as. */\n  user_id: string;\n  organization_id: string;\n  client_id: string;\n  actor_id: string;\n  /** The RFC 8693 actor claim every token of the session carries. */\n  act: {\n    sub: string;\n  };\n  reason: string;\n  scopes: string[];\n  expires_at: string;\n  /** The first authorization code, when `redirect_uri` and `code_challenge` were sent. Shown once. */\n  code?: string | null;\n  redirect_uri?: string | null;\n}\n\nexport interface ApiKeyVerificationRequest {\n  /** The API key your API was presented with. */\n  key: string;\n  /** For `client_secret_post`. */\n  client_id?: string;\n  /** For `client_secret_post`. */\n  client_secret?: string;\n  /** For `private_key_jwt`. */\n  client_assertion_type?: string;\n  /** For `private_key_jwt`. */\n  client_assertion?: string;\n}\n\nexport interface ApiKeyVerification {\n  active: boolean;\n  key_id?: string;\n  /** The key's holder. */\n  sub?: string;\n  org?: string;\n  org_role?: 'owner' | 'admin' | 'developer' | 'member' | 'viewer' | null;\n  permissions?: string[];\n  client_id?: string;\n  expires_at?: string | null;\n}\n\n/** RFC 6749 §5.2 — the OAuth error shape, not this API's `{error, message}` envelope. */\nexport interface OAuthClientError {\n  error: 'invalid_client';\n  error_description?: string;\n}\n\nexport interface User {\n  id?: string;\n  email?: string;\n  name?: string | null;\n  status?: 'active' | 'disabled' | 'locked';\n  email_verified_at?: string | null;\n}\n\nexport interface UserSession {\n  id: string;\n  user_agent?: string | null;\n  ip?: string | null;\n  last_active_at?: string | null;\n  expires_at: string;\n  /** Somebody else opened it as this person. */\n  impersonation: boolean;\n}\n\nexport interface Permission {\n  id: string;\n  /** The `feature:action` key an app reads out of a token. */\n  name: string;\n  description?: string | null;\n  /** The app that declared it; null for one authored here. */\n  client_id?: string | null;\n  /** Set for one organization's own; null for the shared tier. */\n  organization_id?: string | null;\n  /** Whether organizations may compose it into their own roles. */\n  tenant_assignable: boolean;\n  /** Authored here rather than declared by an app. */\n  manual: boolean;\n  /** Its app stopped declaring it. */\n  orphaned: boolean;\n}\n\nexport interface SignInRules {\n  /** Minimum password length. */\n  min_length: number;\n  /** Passwords found in known breaches are refused. */\n  require_breach_check: boolean;\n  /** Days before a password must be changed; null for no limit. */\n  max_age_days: number | null;\n  /** Previous passwords that may not be reused. */\n  reuse_history: number;\n  mfa: 'off' | 'optional' | 'required';\n  /** `required` refuses every other way in. */\n  sso: 'off' | 'preferred' | 'required';\n  /** Failed attempts before a lockout; null for none. */\n  lockout_threshold: number | null;\n  /** Environment-wide. Whether passkeys may be used to sign in and be added. An organization's override never changes it. */\n  passkeys: boolean;\n  /** Environment-wide. Whether a one-time sign-in link may be emailed. */\n  magic_link: boolean;\n  /** Environment-wide. Minutes of inactivity before a session ends; null for the deployment's. */\n  session_idle_minutes: number | null;\n  /** Environment-wide. Minutes a session lasts at most; null for the deployment's. */\n  session_absolute_minutes: number | null;\n  /** Environment-wide. Whether a sign-up Radar flags is challenged with Turnstile, where the deployment has keys. */\n  bot_challenge: boolean;\n}\n\nexport interface SignInMethodsInForce {\n  passkeys: boolean;\n  magic_link: boolean;\n  /** 0 for no idle timeout. */\n  session_idle_minutes: number;\n  session_absolute_minutes: number;\n  bot_challenge: boolean;\n}\n\nexport interface SignInPolicy {\n  /** null for the environment baseline. */\n  organization_id: string | null;\n  /** What is in force at this level: the baseline, or the organization's override tightened over it. */\n  policy: SignInRules;\n  baseline: SignInRules;\n  /** What the organization stored itself; null when it inherits (and always for the baseline). */\n  override: SignInRules | null;\n  /** True for an organization with no override of its own. */\n  inheriting: boolean;\n  /** The environment-wide methods and session lengths actually in force, after the deployment's ceiling. */\n  in_force: SignInMethodsInForce;\n  /** The deployment's ceiling: which methods it offers at all, the longest sessions it allows, and whether it has Turnstile keys. */\n  deployment: SignInMethodsInForce;\n}\n\n/** Its client secret and private key are write-only and never returned. An environment provider (`level: environment`) is offered on every organization's sign-in page unless the organization has its own for the same provider or turned it off. */\nexport interface SocialProvider {\n  id: string;\n  /** null for the environment's own provider. */\n  organization_id: string | null;\n  level: 'environment' | 'organization';\n  /** False when it is turned off; its credentials are kept. */\n  enabled: boolean;\n  /** Extra scopes requested on top of the ones sign-in needs. */\n  scopes: string[];\n  /** The catalogue key: google, github, apple… */\n  provider: string | null;\n  name: string;\n  protocol: 'oidc' | 'oauth2';\n  status: string;\n  /** The redirect URI to register with the provider. */\n  callback_uri: string;\n  created_at?: string | null;\n}\n\n/** The social login buttons one sign-in page shows, after inheritance. */\nexport interface OfferedSocialProviders {\n  /** null for the plain sign-in page, before anybody has said who they are. */\n  organization_id: string | null;\n  providers: Array<{\n    id: string;\n    provider: string | null;\n    name: string;\n    /** `environment` when inherited; `organization` when the organization's own stands in its place. */\n    source: 'environment' | 'organization';\n    callback_uri: string;\n  }>;\n  /** The environment's providers this organization turned off for its page. */\n  not_inherited: string[];\n}\n\n/** A publishable key. Returned in full: it is public by design; the origins are the control. */\nexport interface FrontendKey {\n  id: string;\n  name: string;\n  key: string;\n  mode: 'test' | 'live';\n  origins: string[];\n  active: boolean;\n  created_at?: string | null;\n  last_used_at?: string | null;\n  revoked_at?: string | null;\n}\n\n/** An application that trusts this environment as its SAML identity provider. Its certificate is write-only. An application owned by an organization is only ever asserted to that organization's active members; one with no organization is open to every person in the environment. */\nexport interface SamlApp {\n  id: string;\n  entity_id: string;\n  acs_url: string;\n  name_id_format: string;\n  name_id_attribute: string;\n  attribute_mappings: Array<{\n    attribute: string;\n    field: string;\n  }>;\n  want_authn_requests_signed: boolean;\n  has_certificate: boolean;\n  /** The organization whose active members alone may sign in to it; null for an environment-wide application. */\n  organization_id: string | null;\n  status: string;\n  created_at?: string | null;\n  updated_at?: string | null;\n}\n\n/** The record of one erasure (GDPR Art. 17): what each store did, in numbers. Carries no personal data — safe to log, file with your Art. 30 records, or hand to the person who asked. */\nexport interface ErasureReceipt {\n  /** The erased person's id. Kept: the row is pseudonymised in place, not deleted. */\n  subject_id: string;\n  erased_at: string;\n  /** Whether the account row's email and name were replaced with placeholders. */\n  subject_pseudonymised: boolean;\n  /** The `user.erased` tombstone on the audit trail. */\n  audit_entry_id: string | null;\n  /** One entry per store, in the order they ran — including stores that held nothing, so a receipt shows a store was checked. */\n  steps: Array<{\n    /** The store, e.g. `identity.credentials`, `oauth.grants`, `devices.devices`. */\n    step: string;\n    /** What was removed or rewritten there, by item. */\n    counts: {\n      [key: string]: number;\n    };\n    /** Why a step could not act, when it could not. */\n    note: string | null;\n  }>;\n}\n\n/** The legacy sign-in endpoint an app declared for migration. Its shared secret is never returned. */\nexport interface LegacyLogin {\n  declared: boolean;\n  url: string | null;\n  /** The app that declared it. */\n  client_id: string | null;\n  /** That app's name. */\n  declared_by: string | null;\n  approved: boolean;\n  approved_at: string | null;\n  /** The person or key that approved it. */\n  approved_by: string | null;\n}\n\nexport interface ThemeMode {\n  primary?: string;\n  background?: string;\n  foreground?: string;\n  muted?: string;\n}\n\nexport interface Appearance {\n  /** null for the environment default. */\n  organization_id: string | null;\n  /** Whether this level has a theme of its own. */\n  customized: boolean;\n  theme: {\n    preset?: string;\n    radius?: string;\n    font?: string;\n    light?: ThemeMode;\n    dark?: ThemeMode;\n  };\n  /** The uploaded logo, served by this application at /brand-assets/…; null when none is uploaded at this level. Never a remote URL. */\n  logo: string | null;\n  /** The uploaded favicon, served the same way; null when none. */\n  favicon: string | null;\n  /** A remote logo URL saved before logos became uploads is still stored at this level. It is never fetched and no longer shown on any hosted page; upload a logo (or send `logo: null`) to clear it. */\n  remote_logo_ignored: boolean;\n}\n\nexport interface WhitelabelBranding {\n  /** null for the environment default. */\n  organization_id: string | null;\n  palette: {\n    [key: string]: string | null;\n  };\n  app_name: string | null;\n  email_from_name: string | null;\n  email_template: string | null;\n  /** Uploaded with `PUT /branding/appearance` (the console's Branding page). */\n  logo_url: string | null;\n  /** Uploaded with `PUT /branding/appearance` (the console's Branding page). */\n  favicon_url: string | null;\n}\n\nexport interface CustomDomain {\n  /** The verified domain serving this environment. */\n  domain: string | null;\n  verified_at: string | null;\n  /** A domain waiting for its DNS proof, and the TXT record to publish. */\n  pending: {\n    domain: string;\n    record_name: string;\n    record_value: string;\n  } | null;\n}\n\n/** A SAML or OIDC connection an organization signs in through. Its certificate, client secret and signing key are write-only. */\nexport interface SsoConnection {\n  id: string;\n  /** null when the environment owns it: it signs people in and enrols them nowhere. */\n  organization_id: string | null;\n  name: string;\n  type: 'saml' | 'oidc' | 'oauth2';\n  /** The catalogue provider a social sign-in connection came from; null for an organization's own identity provider. */\n  provider?: string | null;\n  status: 'draft' | 'active' | 'inactive';\n  active: boolean;\n  /** false for a draft created with pending_idp whose identity-provider details are still missing. Activation refuses it. */\n  complete?: boolean;\n  /** The settings that are not secrets. */\n  config: {\n    idp_entity_id?: string;\n    idp_sso_url?: string;\n    sp_entity_id?: string;\n    sp_acs_url?: string;\n    issuer?: string;\n    client_id?: string;\n  };\n  /** What to paste into the identity provider: this connection's own entity id, ACS URL and SP metadata URL (SAML), or its redirect URI (OIDC). null for a social sign-in connection. */\n  service_provider?: {\n    sp_entity_id?: string;\n    sp_acs_url?: string;\n    /** SAML: this connection's service-provider metadata (entity id and ACS URL as one XML document), for an identity provider that imports SP metadata. Served for a draft too, before the identity provider's half is known. */\n    sp_metadata_url?: string;\n    redirect_uri?: string;\n  } | null;\n  created_at?: string | null;\n  updated_at?: string | null;\n}\n\n/** A SAML connection's signing certificates. The certificates themselves are never returned. */\nexport interface SsoCertificates {\n  connection_id: string;\n  organization_id: string | null;\n  /** When the connection stops working if nothing is done: the latest expiry among the certificates it trusts. */\n  expires_at: string | null;\n  days_remaining: number | null;\n  certificates: Array<{\n    /** primary signs today; staged is trusted beside it until activated. */\n    role: 'primary' | 'staged';\n    /** false for a certificate on file that could not be parsed — still trusted. */\n    readable: boolean;\n    fingerprint_sha256: string | null;\n    subject: string | null;\n    issuer: string | null;\n    not_before: string | null;\n    not_after: string | null;\n    days_remaining: number | null;\n    expired: boolean | null;\n  }>;\n  /** On the stage answer only: what the new certificate was tested for. */\n  checks?: Array<{\n    check: 'readable' | 'not_expired' | 'key_strength' | 'not_on_file' | 'valid_now';\n    passed: boolean;\n  }>;\n}\n\nexport interface LogStreamTest {\n  id: string;\n  /** Whether the destination accepted the test event (action `siem.stream.test`). */\n  delivered: boolean;\n  /** Why not: `transient` (unreachable, busy — retrying can help) or `authentication` / `configuration` (somebody has to fix the stream). null when delivered. */\n  failure: 'transient' | 'authentication' | 'configuration' | null;\n  /** The destination's refusal, scrubbed of the stream's secret. */\n  error: string | null;\n  tested_at: string;\n}\n\nexport interface SsoDomain {\n  id: string;\n  organization_id: string;\n  domain: string;\n  verified: boolean;\n  verified_at?: string | null;\n  /** Everyone with an address at the domain must sign in through the organization's SSO. */\n  capture: boolean;\n  /** The DNS TXT record that proves the domain, while it is unverified. */\n  verification: {\n    type: 'TXT';\n    name: string;\n    value: string;\n  } | null;\n}\n\n/** An identity provider's settings read from its SAML metadata. Nothing is stored. */\nexport interface SamlMetadata {\n  idp_entity_id: string;\n  idp_sso_url: string;\n  /** The IdP's public signing certificate, from its own metadata. */\n  idp_x509cert: string;\n}\n\nexport interface PortalLink {\n  id: string;\n  organization_id: string;\n  /** What the link may set up. */\n  intents: Array<'sso' | 'dsync' | 'domain_verification' | 'log_streams' | 'certificate_renewal' | 'audit_logs'>;\n  /** The address the link was mailed to, or null when it was not sent — none was asked for, or the mail was suppressed (see email_suppressed). */\n  emailed_to: string | null;\n  /**\n   * True when an `email` was asked for and NOT sent because this is a sandbox\n   * environment, which sends no mail. `emailed_to` is then null, and the `url` in this\n   * answer is the only way to the link — share it yourself.\n   */\n  email_suppressed: boolean;\n  /**\n   * The one-time setup link — the whole credential. Shown once; `null` on an\n   * idempotent replay of this answer.\n   */\n  url: string | null;\n  expires_at: string | null;\n}\n\n/** An Admin Portal link as a list shows it. Never its URL: that was shown once, when it was minted, and only its hash is kept. */\nexport interface PortalLinkRecord {\n  id: string;\n  organization_id: string;\n  /** What the link may set up. */\n  intents: Array<'sso' | 'dsync' | 'domain_verification' | 'log_streams' | 'certificate_renewal' | 'audit_logs'>;\n  /**\n   * `pending`: not opened yet, and it still can be. `in_use`: opened, and the setup\n   * session it started may still be running. `completed`: its setup was finished.\n   * `expired`: never opened in time, or its setup session ran out. `revoked`: withdrawn.\n   */\n  status: 'pending' | 'in_use' | 'completed' | 'expired' | 'revoked';\n  created_at: string | null;\n  /** Who minted it: the console person's id, or the management key's. */\n  created_by: string;\n  /** The address it was mailed to, or null when it was not sent. */\n  emailed_to: string | null;\n  /** How long it could wait to be opened. */\n  expires_at: string | null;\n  /** When it was opened. It is single-use. */\n  consumed_at: string | null;\n  /** When its setup was finished. */\n  completed_at: string | null;\n  /** When it was withdrawn. */\n  revoked_at: string | null;\n}\n\n/**\n * One audit event your app sent. `hash` covers `id`, `organization_id`, `sequence`,\n * `action`, `occurred_at`, `actor`, `targets`, `context` and `metadata`, chained to\n * the organization's previous event by `prev_hash` — see the Audit Logs guide for how\n * to verify it yourself.\n */\nexport interface AuditLogEvent {\n  id: string;\n  organization_id: string;\n  /** The event's place in its organization's chain, from 1. */\n  sequence: number;\n  /** e.g. `invoice.voided`. */\n  action: string;\n  /** When it happened, as the sender said, to the millisecond. */\n  occurred_at: string;\n  actor: {\n    id: string;\n    type: string;\n    name: string | null;\n    metadata: Record<string, unknown> | null;\n  };\n  targets: Array<{\n    id: string;\n    type: string;\n    name: string | null;\n    metadata: Record<string, unknown> | null;\n  }>;\n  context: {\n    location: string | null;\n    user_agent: string | null;\n  };\n  metadata: Record<string, unknown> | null;\n  /** The version of its action's schema it was checked against; null when the action has none. */\n  schema_version: number | null;\n  /** When it arrived. Retention counts from here. */\n  received_at: string | null;\n  /** The previous event's hash; 64 zeros for an organization's first. */\n  prev_hash: string;\n  hash: string;\n}\n\nexport interface AuditLogEventBatch {\n  /** The recorded events, in the order they were sent. */\n  events: AuditLogEvent[];\n}\n\nexport interface AuditLogSchema {\n  id: string;\n  action: string;\n  /** Starts at 1; every replacement is the next. */\n  version: number;\n  /** The target types this action's events may name; null allows any. */\n  targets: Array<{\n    type: string;\n    metadata: Record<string, unknown> | null;\n  }> | null;\n  /** A metadata schema (a subset of JSON Schema). */\n  actor_metadata: Record<string, unknown> | null;\n  /** A metadata schema (a subset of JSON Schema). */\n  metadata: Record<string, unknown> | null;\n  created_at: string | null;\n  updated_at: string | null;\n}\n\nexport interface AuditLogExport {\n  id: string;\n  /** null for an export across the whole environment. */\n  organization_id: string | null;\n  state: 'pending' | 'ready' | 'failed' | 'expired';\n  /** The filters it was asked with. */\n  filters: Record<string, unknown>;\n  row_count: number | null;\n  /**\n   * Where the CSV downloads from once `ready` — signed, and valid for a few minutes;\n   * read the export again for a fresh one. null otherwise, and on an idempotent replay.\n   */\n  url: string | null;\n  created_at: string | null;\n  completed_at: string | null;\n  /** When the file is deleted. */\n  expires_at: string | null;\n}\n\nexport interface FgaSubject {\n  /** The subject's type: `user`, or `group` for a userset. */\n  type: string;\n  id: string;\n  /** For a userset — everybody with this relation on the subject (`member` of `group:eng`). null for one subject. */\n  relation: string | null;\n}\n\nexport interface FgaTuple {\n  resource_type: string;\n  resource_id: string;\n  relation: string;\n  subject: FgaSubject;\n  /** The same tuple in the notation: `document:readme#viewer@group:eng#member`. */\n  tuple: string;\n}\n\nexport interface FgaSchema {\n  /** false until a schema is first saved. */\n  defined: boolean;\n  /** The source as it was written, comments and all. */\n  schema: string | null;\n  /** How many times the schema has been replaced. */\n  version: number;\n  /** The parsed types, each with its relations and how each is decided. */\n  types: FgaType[];\n  updated_at: string | null;\n  /** The revision the model is at. */\n  consistency_token: string;\n}\n\nexport interface FgaType {\n  name: string;\n  relations: Array<{\n    name: string;\n    /**\n     * How the relation is decided, as a tree of one-key objects: `direct` (a list of\n     * `{type, relation?}`), `computed` (a relation name), `from` (`{tupleset, relation}`),\n     * `union` and `intersection` (lists of rewrites), `exclusion` (`{base, subtract}`).\n     */\n    rewrite: Record<string, unknown>;\n    /** The subjects a tuple may name on this relation; empty for a relation that is only computed. */\n    directly_related: Array<{\n      type: string;\n      relation?: string;\n    }>;\n  }>;\n}\n\nexport interface FgaSchemaValidation {\n  valid: boolean;\n  errors: Array<{\n    /** 0 when the problem is about the whole schema. */\n    line: number;\n    message: string;\n  }>;\n  types: FgaType[];\n  /** The schema as the platform prints it, when valid. */\n  canonical: string | null;\n}\n\nexport interface FgaTupleWrite {\n  /** Tuples that were new. Re-writing an existing one is not counted. */\n  written: number;\n  /** Tuples that were there to delete. */\n  deleted: number;\n  /** Pass to a check that must see this write. */\n  consistency_token: string;\n}\n\nexport interface FgaCheck {\n  allowed: boolean;\n  resource_type: string;\n  resource_id: string;\n  relation: string;\n  subject: FgaSubject;\n  /** The revision the answer was decided at. */\n  consistency_token: string;\n}\n\nexport interface FgaCheckBatch {\n  /** One answer per check, in the order asked. */\n  results: FgaCheck[];\n  consistency_token: string | null;\n}\n\nexport interface FgaObject {\n  type: string;\n  id: string;\n}\n\nexport interface AuditLogSettings {\n  /** Events are kept this many days after they arrive. */\n  retention_days: number;\n  /** Whether an action with no schema is refused. */\n  strict_schemas: boolean;\n}\n\nexport interface RadarSettings {\n  /** monitor records every verdict and acts on none; enforce blocks and challenges. */\n  mode: 'monitor' | 'enforce';\n  /** True while the environment follows the deployment's default (RISK_MODE) rather than a mode it chose. */\n  mode_inherited: boolean;\n  deployment_mode: 'monitor' | 'enforce';\n  /** The configured IP intelligence source. With none, country, network and travel facts are unknown and the rules on them never fire. */\n  ip_intelligence: 'none' | 'maxmind' | 'ipinfo';\n  builtin_rules: Array<{\n    key: 'credential_stuffing' | 'bot_velocity' | 'account_attack' | 'impossible_travel' | 'new_device' | 'anonymous_network' | 'hosting_network' | 'disposable_email' | 'risk_score_reject' | 'risk_score_elevated';\n    name: string;\n    description: string;\n    applies_to: 'all' | 'sign_in' | 'sign_up';\n    enabled: boolean;\n    action: 'allow' | 'challenge' | 'block';\n    /** null for a rule that counts nothing. */\n    threshold: number | null;\n    threshold_unit: string | null;\n    threshold_min: number | null;\n    threshold_max: number | null;\n  }>;\n}\n\nexport interface RadarRule {\n  id: string;\n  name: string;\n  description: string | null;\n  /** 1 is evaluated first; the first rule whose conditions all hold decides. */\n  position: number;\n  enabled: boolean;\n  applies_to: 'all' | 'sign_in' | 'sign_up';\n  action: 'allow' | 'challenge' | 'block';\n  conditions: Array<{\n    field: string;\n    operator: 'eq' | 'neq' | 'in' | 'not_in' | 'gt' | 'gte' | 'lt' | 'lte' | 'contains' | 'not_contains' | 'starts_with' | 'ends_with' | 'in_cidr' | 'not_in_cidr';\n    /** Normalised: a string, a number, true/false, or a list for the list operators. */\n    value: string | number | boolean | Array<string | number>;\n  }>;\n  /** The conditions as a person reads them. */\n  summary: string;\n  created_at: string;\n  updated_at: string;\n}\n\nexport interface RadarListEntry {\n  id: string;\n  list: 'allow' | 'deny';\n  kind: 'ip' | 'email' | 'email_domain' | 'device';\n  /** Normalised: an IP or CIDR range, a lower-case address or domain, or a device id. */\n  value: string;\n  note: string | null;\n  expires_at: string | null;\n  active: boolean;\n  created_at: string;\n}\n\nexport interface RadarDecision {\n  id: string;\n  assessed_at: string;\n  flow: 'sign_in' | 'sign_up';\n  method: 'password' | 'magic_link' | 'passkey' | 'sign_up' | null;\n  verdict: 'allow' | 'challenge' | 'block';\n  /** Whether the verdict was acted on; false under monitor. */\n  enforced: boolean;\n  mode: 'monitor' | 'enforce';\n  /** What decided it: deny_list:<kind>, allow_list:<kind>, rule:<id>, builtin:<key>; null when nothing matched. */\n  rule: string | null;\n  rule_name: string | null;\n  /** Every rule that fired, the deciding one included. */\n  triggered: Array<{\n    rule: string;\n    name: string;\n  }>;\n  reasons: string[];\n  risk_score: number;\n  risk_outcome: 'allow' | 'flag' | 'challenge' | 'step_up' | 'reject';\n  country: string | null;\n  asn: number | null;\n  email_domain: string | null;\n  /** The device id (a pseudonym of the device cookie), for a returning device. */\n  device: string | null;\n  /** The facts the rules were evaluated on — never the IP, the address or the user agent. */\n  facts: Record<string, unknown>;\n}\n\nexport interface AuditLogVerification {\n  organization_id: string;\n  /** Every event checked is unchanged and in place. */\n  valid: boolean;\n  /** The check reached the chain's head. When false, continue from last_sequence + 1. */\n  complete: boolean;\n  verified_count: number;\n  first_sequence: number | null;\n  last_sequence: number | null;\n  head_sequence: number;\n  broken_at_sequence: number | null;\n  reason: 'missing' | 'link' | 'hash' | 'truncated' | null;\n}\n\n/** A directory syncing an organization's people in. Its token and credentials are never returned after they are minted. */\nexport interface Directory {\n  id: string;\n  organization_id: string;\n  name: string;\n  provider: 'scim' | 'google_workspace' | 'microsoft_entra' | 'workday' | 'bamboohr' | 'rippling' | 'hibob' | 'personio';\n  /** true when this platform fetches from the provider; false for a SCIM endpoint the provider posts to. */\n  pull: boolean;\n  /** true for an HR system (Workday, BambooHR, Rippling, HiBob, Personio): employment dates decide access and departments become groups. */\n  hris?: boolean;\n  active: boolean;\n  status: 'active' | 'paused';\n  /** Where the identity provider sends SCIM requests. null for a pull directory. */\n  scim_base_url?: string | null;\n  last_synced_at?: string | null;\n  /** Why the last pull failed, or for a partial one how many records could not be synced and the first reason. Never names a person. */\n  last_sync_error?: string | null;\n  /** When the last pull started. null for a SCIM directory. */\n  last_sync_started_at?: string | null;\n  /** How the last pull went. partial: the provider answered but some records could not be reconciled, or a mass deprovisioning was refused. */\n  last_sync_status?: 'running' | 'succeeded' | 'partial' | 'failed' | null;\n  /** The last pull's counts, and up to 50 records it could not reconcile — by the provider's own id, never by name or email. */\n  last_sync_stats?: {\n    mode?: 'full' | 'incremental';\n    provisioned?: number;\n    deprovisioned?: number;\n    groups?: number;\n    /** Leavers and people who have not started, who never had an account. */\n    skipped?: number;\n    failed?: number;\n    failures?: Array<{\n      external_id?: string | null;\n      reason?: string;\n    }>;\n  } | null;\n  /** Minutes between scheduled pulls. null for a SCIM directory. */\n  sync_interval_minutes?: number | null;\n  next_sync_at?: string | null;\n  /** HR systems only: the HR system's own field names copied onto each person. */\n  custom_attributes?: string[] | null;\n  created_at?: string | null;\n  /**\n   * The SCIM bearer token, on the create and rotate answers only — shown once, never\n   * retrievable again. `null` on an idempotent replay of that answer.\n   */\n  bearer_token?: string | null;\n}\n\nexport interface DirectoryGroup {\n  id: string;\n  directory_id: string;\n  name: string;\n  external_id?: string | null;\n  /** The roles everyone in the group holds. */\n  role_ids: string[];\n}\n\n/** A downstream app people are pushed to over SCIM. Its credential is write-only. */\nexport interface ProvisioningTarget {\n  id: string;\n  /** null when it receives every organization's people. */\n  organization_id: string | null;\n  name: string;\n  base_url: string;\n  auth_scheme: 'bearer' | 'oauth2_client_credentials';\n  token_url?: string | null;\n  client_id?: string | null;\n  /** false while paused. */\n  active: boolean;\n  consecutive_failures?: number;\n  last_success_at?: string | null;\n  last_error?: string | null;\n  created_at?: string | null;\n}\n\n/** A role-conflict (segregation of duties) rule: roles no one person may hold together. */\nexport interface SodPolicy {\n  id: string;\n  /** null when it binds every organization. */\n  organization_id: string | null;\n  name: string;\n  description?: string | null;\n  role_ids: string[];\n  active: boolean;\n  created_at?: string | null;\n}\n\n/** A switch apps ask about per user and organization. First match wins: switched off, then a user rule, then an organization rule, then the rollout, then the default. */\nexport interface FeatureFlag {\n  id: string;\n  /** What code asks for and the `feature_flags` claim carries. Fixed once created. */\n  key: string;\n  description?: string | null;\n  /** The kill switch: false is off for everyone. */\n  enabled: boolean;\n  /** The answer when no rule matches. */\n  default_value: boolean;\n  /** On for this share of everyone else, by a stable hash of the user id (the organization id without one). */\n  rollout_percentage?: number | null;\n  /** Rules for named users; they outrank every other rule. */\n  users: FeatureFlagRule[];\n  /** Rules for named organizations; they outrank the rollout and the default. */\n  organizations: FeatureFlagRule[];\n  created_at?: string | null;\n  updated_at?: string | null;\n}\n\nexport interface FeatureFlagRule {\n  /** The user's or organization's id. */\n  id: string;\n  /** On or off for them. */\n  enabled: boolean;\n}\n\n/** Every flag's answer for the user and organization asked about. */\nexport interface FeatureFlagEvaluation {\n  user_id: string | null;\n  organization_id: string | null;\n  /** The keys of the flags that are on, sorted — exactly what the token's `feature_flags` claim would carry. */\n  feature_flags: string[];\n  evaluations: Array<{\n    key: string;\n    enabled: boolean;\n    /** The rule that decided. */\n    reason: 'disabled' | 'user_target' | 'organization_target' | 'rollout' | 'default';\n  }>;\n}\n\nexport interface AccessReview {\n  id: string;\n  /** null for a staff review of environment-wide grants. */\n  organization_id: string | null;\n  staff: boolean;\n  name: string;\n  status: 'open' | 'closed';\n  open: boolean;\n  /** What closing does to an item nobody decided. */\n  pending_policy: 'revoke' | 'certify';\n  item_count: number;\n  due_at?: string | null;\n  closed_at?: string | null;\n  /** The person or key that opened it. */\n  created_by?: string | null;\n  created_at?: string | null;\n}\n\nexport interface AccessReviewItem {\n  id: string;\n  review_id: string;\n  subject_id: string;\n  access_type: 'role' | 'membership' | 'environment_role';\n  /** The role id, or the organization id of a membership. */\n  access_ref: string;\n  organization_id?: string | null;\n  decision: 'pending' | 'certified' | 'revoked';\n  decided_by?: string | null;\n  decided_at?: string | null;\n  note?: string | null;\n  /** Whether a revoke was carried out when the review closed. */\n  applied: boolean;\n  /** Why a revoke could not be applied. */\n  application_note?: string | null;\n}\n\n/** A downstream credential in the token vault. Its value is write-only. */\nexport interface TokenVaultSecret {\n  id: string;\n  /** null for the environment's own secrets. */\n  organization_id: string | null;\n  name: string;\n  provider: string;\n  status: 'active' | 'expired' | 'revoked';\n  revoked: boolean;\n  expires_at?: string | null;\n  rotated_at?: string | null;\n  created_at?: string | null;\n  /** The OAuth client ids that may lease it. Not on lists. */\n  grants?: string[];\n}\n\n/** A pipe: this environment's OAuth app at a third-party provider, through which people connect their own accounts. The client secret is write-only. */\nexport interface Pipe {\n  id: string;\n  provider: 'github' | 'google' | 'microsoft' | 'slack' | 'salesforce' | 'hubspot' | 'linear' | 'notion';\n  name: string;\n  /** Your app's OAuth client id at the provider. */\n  client_id: string;\n  /** What people are asked for when they connect. */\n  scopes: string[];\n  /** Per-installation values: Microsoft's `tenant`, Salesforce's `domain`. */\n  parameters?: {\n    [key: string]: string;\n  };\n  enabled: boolean;\n  /** The callback URL to register at the provider. */\n  redirect_uri: string;\n  /** The OAuth client ids of the apps that may lease its tokens. */\n  grants: string[];\n  /** How many people have connected an account through it. */\n  connections: number;\n  created_at?: string | null;\n  updated_at?: string | null;\n}\n\n/** One person's connected account at a pipe's provider. Never a token. */\nexport interface PipeConnection {\n  id: string;\n  pipe_id: string;\n  provider: string;\n  user_id: string;\n  status: 'active' | 'needs_reauth';\n  /** The account's name at the provider, when it says (a GitHub login, an email, a workspace). */\n  account?: string | null;\n  scopes: string[];\n  metadata?: {\n    [key: string]: string;\n  };\n  /** When the current access token expires. Null when it does not. */\n  expires_at?: string | null;\n  connected_at?: string | null;\n  last_refreshed_at?: string | null;\n  /** Consecutive transient refresh failures. */\n  refresh_failures?: number;\n  last_error?: string | null;\n  /** Why it needs reconnecting: the provider's error code, or `no_refresh_token`. */\n  reauth_reason?: string | null;\n}\n\nexport interface PipeConnectRequired {\n  error: 'not_connected' | 'reauthorization_required';\n  message: string;\n  /** Where to send the person to connect. Add `?client_id=…&return_to=…` to bring them back to your app. */\n  connect_url: string;\n}\n\n/** A pending request from an agent to act as one of this environment's people (OIDC CIBA). */\nexport interface AgentRequest {\n  id: string;\n  client_id: string;\n  /** The app's name, or its client id when it has none. */\n  app: string;\n  /** Whom the agent asks to act as. */\n  subject: {\n    id: string;\n    /** Null when that person no longer exists — the request can still be denied. */\n    email: string | null;\n  };\n  /** The message the person sees on their device, to recognise the request. */\n  binding_message?: string | null;\n  scopes: string[];\n  expires_at: string | null;\n  created_at?: string | null;\n}\n\nexport interface PageMeta {\n  limit?: number;\n  has_more?: boolean;\n  next_cursor?: string | null;\n}\n\nexport interface ErrorSchema {\n  /** Stable machine code */\n  error: string;\n  /** Human-readable explanation */\n  message: string;\n  /** The id this request was served under, also sent as the X-Request-Id header. Quote it when reporting a problem. */\n  request_id?: string;\n  /**\n   * Present on `validation_failed` only: the offending request fields, each\n   * mapped to its messages.\n   */\n  errors?: {\n    [key: string]: string[];\n  };\n}\n\n/**\n * RFC 6750 §3 error shape, used by the OAuth-token-authenticated Token Vault\n * endpoints. NOT the `{error, message}` envelope — restating the envelope here\n * would be a protocol conformance bug.\n */\nexport interface BearerChallenge {\n  error: 'invalid_request' | 'invalid_token' | 'insufficient_scope';\n  error_description: string;\n}\n\n// ── Operation inputs and responses ─────────────────────────────────────────────────────────\n\n/** Request body of `access_reviews.close`. */\nexport interface AccessReviewsCloseBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `access_reviews.close`. */\nexport type AccessReviewsCloseResponse = {\n  data: AccessReview;\n};\n\n/** Request body of `access_reviews.create`. */\nexport interface AccessReviewsCreateBody {\n  /** What the review is: \"Q3 finance access\". */\n  name: string;\n  /** organization (default): one organization's access, named by organization_id. staff: every environment-wide staff grant. */\n  covers?: 'organization' | 'staff';\n  /** The organization to review. Required unless covers is staff. */\n  organization_id?: string | null;\n  /** Days until it is due. Default 7. */\n  due_in_days?: number;\n}\n\n/** Response body of `access_reviews.create`. */\nexport type AccessReviewsCreateResponse = {\n  data: AccessReview;\n};\n\n/** Query parameters of `access_reviews.get`. */\nexport interface AccessReviewsGetQuery {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `access_reviews.get`. */\nexport type AccessReviewsGetResponse = {\n  data: AccessReview;\n};\n\n/** Request body of `access_reviews.items.decide`. */\nexport interface AccessReviewsItemsDecideBody {\n  /** certified keeps the access; revoked takes it away when the review closes. */\n  decision: 'certified' | 'revoked';\n  /** Why, for whoever audits the review. */\n  note?: string | null;\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `access_reviews.items.decide`. */\nexport type AccessReviewsItemsDecideResponse = {\n  data: AccessReviewItem;\n};\n\n/** Query parameters of `access_reviews.items.list`. */\nexport interface AccessReviewsItemsListQuery {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `access_reviews.items.list`. */\nexport type AccessReviewsItemsListResponse = {\n  data: AccessReviewItem[];\n  meta: PageMeta;\n};\n\n/** Query parameters of `access_reviews.list`. */\nexport interface AccessReviewsListQuery {\n  /** Only reviews covering this organization: its own and the staff reviews. */\n  organization_id?: string | null;\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `access_reviews.list`. */\nexport type AccessReviewsListResponse = {\n  data: AccessReview[];\n  meta: PageMeta;\n};\n\n/** Response body of `action_approvals.get`. */\nexport type ActionApprovalsGetResponse = {\n  data: {\n    id: string;\n    status: 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';\n  };\n};\n\n/** Query parameters of `api_keys.list`. */\nexport interface ApiKeysListQuery {\n  limit?: number;\n  /** Opaque cursor — the `meta.next_cursor` from the previous page. */\n  after?: string;\n  client_id?: string;\n}\n\n/** Response body of `api_keys.list`. */\nexport type ApiKeysListResponse = {\n  data: ApiKey[];\n  meta: PageMeta;\n};\n\n/** Response body of `api_keys.revoke`. */\nexport type ApiKeysRevokeResponse = void;\n\n/** Request body of `apis.create`. */\nexport interface ApisCreateBody {\n  identifier: string;\n  name: string;\n  organization_id?: string | null;\n  client_id?: string | null;\n  scopes?: ApiScope[];\n}\n\n/** Response body of `apis.create`. */\nexport type ApisCreateResponse = {\n  data: Api;\n};\n\n/** Response body of `apis.delete`. */\nexport type ApisDeleteResponse = void;\n\n/** Response body of `apis.get`. */\nexport type ApisGetResponse = {\n  data: Api;\n};\n\n/** Query parameters of `apis.list`. */\nexport interface ApisListQuery {\n  limit?: number;\n  /** Opaque cursor — the `meta.next_cursor` from the previous page. */\n  after?: string;\n}\n\n/** Response body of `apis.list`. */\nexport type ApisListResponse = {\n  data: Api[];\n  meta: PageMeta;\n};\n\n/** Request body of `apis.scopes.define`. */\nexport interface ApisScopesDefineBody {\n  description?: string | null;\n  /** Whether organizations' own apps may request it. Default true. */\n  tenant_requestable?: boolean;\n}\n\n/** Response body of `apis.scopes.define`. */\nexport type ApisScopesDefineResponse = {\n  data: Api;\n};\n\n/** Response body of `apis.scopes.remove`. */\nexport type ApisScopesRemoveResponse = void;\n\n/** Request body of `apis.update`. */\nexport interface ApisUpdateBody {\n  name?: string;\n  client_id?: string | null;\n  scopes?: ApiScope[];\n}\n\n/** Response body of `apis.update`. */\nexport type ApisUpdateResponse = {\n  data: Api;\n};\n\n/** Response body of `approvals.deny`. */\nexport type ApprovalsDenyResponse = void;\n\n/** Query parameters of `approvals.list`. */\nexport interface ApprovalsListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `approvals.list`. */\nexport type ApprovalsListResponse = {\n  data: AgentRequest[];\n  meta: PageMeta;\n};\n\n/** Response body of `apps.blueprint`. */\nexport type AppsBlueprintResponse = {\n  data: AppBlueprint;\n};\n\n/** Request body of `apps.copy`. */\nexport interface AppsCopyBody {\n  /** The environment to copy into: another environment of this project. */\n  environment_id: string;\n  /** What to call the copy there. */\n  name: string;\n  /** Its redirect URIs there — staging's callback is rarely production's. Left out, none. */\n  redirect_uris?: string[];\n}\n\n/** Response body of `apps.copy`. */\nexport type AppsCopyResponse = {\n  data: App;\n};\n\n/** Request body of `apps.create`. */\nexport interface AppsCreateBody {\n  blueprint?: AppBlueprint;\n  name?: string;\n  type?: 'web' | 'spa' | 'cli' | 'service' | 'agent' | 'advanced';\n  client_type?: 'confidential' | 'public';\n  grant_types?: string[];\n  redirect_uris?: string[];\n  post_logout_redirect_uris?: string[];\n  scopes?: string[];\n  first_party?: boolean;\n  /** Where the app publishes its roles-and-permissions manifest (short form). */\n  manifest_url?: string | null;\n  /** The owning organization; null for the environment's own app. */\n  organization_id?: string | null;\n  /** A public JWK Set, for a `private_key_jwt` app. */\n  jwks?: Record<string, unknown> | null;\n}\n\n/** Response body of `apps.create`. */\nexport type AppsCreateResponse = {\n  data: App;\n};\n\n/** Response body of `apps.delete`. */\nexport type AppsDeleteResponse = void;\n\n/** Response body of `apps.get`. */\nexport type AppsGetResponse = {\n  data: App;\n};\n\n/** Query parameters of `apps.list`. */\nexport interface AppsListQuery {\n  limit?: number;\n  /** Opaque cursor — the `meta.next_cursor` from the previous page. */\n  after?: string;\n}\n\n/** Response body of `apps.list`. */\nexport type AppsListResponse = {\n  data: App[];\n  meta: PageMeta;\n};\n\n/** Request body of `apps.manifest.set`. */\nexport interface AppsManifestSetBody {\n  /** An absolute URL; null or left out clears it. */\n  manifest_url?: string | null;\n}\n\n/** Response body of `apps.manifest.set`. */\nexport type AppsManifestSetResponse = {\n  data: App;\n};\n\n/** Response body of `apps.manifest.sync`. */\nexport type AppsManifestSyncResponse = {\n  data: ManifestSync;\n};\n\n/** Request body of `apps.scopes.set`. */\nexport interface AppsScopesSetBody {\n  /** Required. The COMPLETE scope set afterwards; an empty list removes every scope. */\n  scopes?: string[];\n}\n\n/** Response body of `apps.scopes.set`. */\nexport type AppsScopesSetResponse = {\n  data: App;\n};\n\n/** Response body of `apps.secrets.list`. */\nexport type AppsSecretsListResponse = {\n  data: AppSecret[];\n  meta: PageMeta;\n};\n\n/** Response body of `apps.secrets.revoke`. */\nexport type AppsSecretsRevokeResponse = void;\n\n/** Request body of `apps.secrets.rotate`. */\nexport interface AppsSecretsRotateBody {\n  /** How long the current secrets keep working, in seconds. 0 stops them at once. */\n  grace_seconds: number;\n}\n\n/** Response body of `apps.secrets.rotate`. */\nexport type AppsSecretsRotateResponse = {\n  data: AppSecret;\n};\n\n/** Request body of `apps.settings.api_key_prefix`. */\nexport interface AppsSettingsApiKeyPrefixBody {\n  /** 2–16 lowercase letters or digits starting with a letter, then `_live` or `_test`. Null or left out: no new keys. */\n  prefix?: string | null;\n}\n\n/** Response body of `apps.settings.api_key_prefix`. */\nexport type AppsSettingsApiKeyPrefixResponse = {\n  data: App;\n};\n\n/** Request body of `apps.settings.backchannel_logout`. */\nexport interface AppsSettingsBackchannelLogoutBody {\n  /** HTTPS (HTTP on localhost only). Null or left out: the app is not told. */\n  uri?: string | null;\n  /** Every logout token carries `sid`. Default false. */\n  session_required?: boolean;\n}\n\n/** Response body of `apps.settings.backchannel_logout`. */\nexport type AppsSettingsBackchannelLogoutResponse = {\n  data: App;\n};\n\n/** Request body of `apps.settings.token_exchange`. */\nexport interface AppsSettingsTokenExchangeBody {\n  enabled: boolean;\n}\n\n/** Response body of `apps.settings.token_exchange`. */\nexport type AppsSettingsTokenExchangeResponse = {\n  data: App;\n};\n\n/** Request body of `apps.settings.token_lifetime`. */\nexport interface AppsSettingsTokenLifetimeBody {\n  /** Seconds, from 60 to the install's ceiling. Null or left out: the install's default. */\n  access_token_ttl?: number | null;\n}\n\n/** Response body of `apps.settings.token_lifetime`. */\nexport type AppsSettingsTokenLifetimeResponse = {\n  data: App;\n};\n\n/** Request body of `apps.update`. */\nexport interface AppsUpdateBody {\n  name?: string;\n  /** The COMPLETE list afterwards. */\n  redirect_uris?: string[];\n  /** The COMPLETE list afterwards. */\n  post_logout_redirect_uris?: string[];\n}\n\n/** Response body of `apps.update`. */\nexport type AppsUpdateResponse = {\n  data: App;\n};\n\n/** Request body of `audit_logs.events.create`. */\nexport interface AuditLogsEventsCreateBody {\n  /** 1–100 events, recorded all together or not at all. */\n  events: Array<{\n    /** The organization (your customer) the event happened in. */\n    organization_id: string;\n    /** What happened, as dotted words: `invoice.voided`, `user.signed_in`. */\n    action: string;\n    /** When it happened: ISO 8601 with a time zone, to the millisecond. */\n    occurred_at: string;\n    actor: {\n      /** Your id for whoever did it. */\n      id: string;\n      /** What kind of actor: `user`, `api_key`, `system`. */\n      type: string;\n      /** A name a person reads in the log. */\n      name?: string | null;\n      /** Up to 50 names to strings, numbers, booleans or null. */\n      metadata?: Record<string, unknown>;\n    };\n    /** What it was done to. */\n    targets?: Array<{\n      id: string;\n      /** What kind of thing: `invoice`, `user`, `report`. */\n      type: string;\n      name?: string | null;\n      metadata?: Record<string, unknown>;\n    }>;\n    context?: {\n      /** Where it came from — usually the client's IP address. */\n      location?: string | null;\n      user_agent?: string | null;\n    };\n    /** Up to 50 names to strings, numbers, booleans or null; values up to 500 characters. */\n    metadata?: Record<string, unknown>;\n  }>;\n}\n\n/** Response body of `audit_logs.events.create`. */\nexport type AuditLogsEventsCreateResponse = {\n  data: AuditLogEventBatch;\n};\n\n/** Query parameters of `audit_logs.events.list`. */\nexport interface AuditLogsEventsListQuery {\n  /** Only this organization's events. Required in effect for an organization's own administrator, whose events are the only ones they see. */\n  organization_id?: string;\n  /** Only these actions, e.g. `invoice.voided`. */\n  actions?: string[];\n  /** Only events this actor caused. */\n  actor_id?: string;\n  /** Only events naming this target. */\n  target_id?: string;\n  /** Only events that occurred at or after this time. */\n  range_start?: string;\n  /** Only events that occurred before this time. */\n  range_end?: string;\n  /** `desc` (default) for newest first, `asc` for oldest first. */\n  order?: 'desc' | 'asc';\n  /** Events per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `audit_logs.events.list`. */\nexport type AuditLogsEventsListResponse = {\n  data: AuditLogEvent[];\n  meta: PageMeta;\n};\n\n/** Request body of `audit_logs.exports.create`. */\nexport interface AuditLogsExportsCreateBody {\n  /** Only this organization's events. Required in effect for an organization's own administrator, whose events are the only ones they see. */\n  organization_id?: string;\n  /** Only these actions, e.g. `invoice.voided`. */\n  actions?: string[];\n  /** Only events this actor caused. */\n  actor_id?: string;\n  /** Only events naming this target. */\n  target_id?: string;\n  /** Only events that occurred at or after this time. */\n  range_start?: string;\n  /** Only events that occurred before this time. */\n  range_end?: string;\n}\n\n/** Response body of `audit_logs.exports.create`. */\nexport type AuditLogsExportsCreateResponse = {\n  data: AuditLogExport;\n};\n\n/** Response body of `audit_logs.exports.get`. */\nexport type AuditLogsExportsGetResponse = {\n  data: AuditLogExport;\n};\n\n/** Request body of `audit_logs.schemas.create`. */\nexport interface AuditLogsSchemasCreateBody {\n  /** The action this schema is for, e.g. `invoice.voided`. */\n  action: string;\n  /** The target types this action's events may name, each with an optional metadata schema. Leave out to allow any. */\n  targets?: Array<{\n    /** A target type events of this action may name. */\n    type: string;\n    /** A metadata schema for targets of this type. */\n    metadata?: Record<string, unknown>;\n  }> | null;\n  /** A metadata schema (a subset of JSON Schema) for the actor's metadata. */\n  actor_metadata?: Record<string, unknown>;\n  /** A metadata schema (a subset of JSON Schema) for the event's own metadata. */\n  metadata?: Record<string, unknown>;\n}\n\n/** Response body of `audit_logs.schemas.create`. */\nexport type AuditLogsSchemasCreateResponse = {\n  data: AuditLogSchema;\n};\n\n/** Response body of `audit_logs.schemas.delete`. */\nexport type AuditLogsSchemasDeleteResponse = void;\n\n/** Response body of `audit_logs.schemas.get`. */\nexport type AuditLogsSchemasGetResponse = {\n  data: AuditLogSchema;\n};\n\n/** Query parameters of `audit_logs.schemas.list`. */\nexport interface AuditLogsSchemasListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `audit_logs.schemas.list`. */\nexport type AuditLogsSchemasListResponse = {\n  data: AuditLogSchema[];\n  meta: PageMeta;\n};\n\n/** Request body of `audit_logs.schemas.update`. */\nexport interface AuditLogsSchemasUpdateBody {\n  /** The target types this action's events may name, each with an optional metadata schema. Leave out to allow any. */\n  targets?: Array<{\n    /** A target type events of this action may name. */\n    type: string;\n    /** A metadata schema for targets of this type. */\n    metadata?: Record<string, unknown>;\n  }> | null;\n  /** A metadata schema (a subset of JSON Schema) for the actor's metadata. */\n  actor_metadata?: Record<string, unknown>;\n  /** A metadata schema (a subset of JSON Schema) for the event's own metadata. */\n  metadata?: Record<string, unknown>;\n}\n\n/** Response body of `audit_logs.schemas.update`. */\nexport type AuditLogsSchemasUpdateResponse = {\n  data: AuditLogSchema;\n};\n\n/** Response body of `audit_logs.settings.get`. */\nexport type AuditLogsSettingsGetResponse = {\n  data: AuditLogSettings;\n};\n\n/** Request body of `audit_logs.settings.update`. */\nexport interface AuditLogsSettingsUpdateBody {\n  /** Keep events this many days after they arrive. */\n  retention_days?: number;\n  /** Refuse events whose action has no schema. */\n  strict_schemas?: boolean;\n}\n\n/** Response body of `audit_logs.settings.update`. */\nexport type AuditLogsSettingsUpdateResponse = {\n  data: AuditLogSettings;\n};\n\n/** Query parameters of `audit_logs.verify`. */\nexport interface AuditLogsVerifyQuery {\n  /** The organization whose chain to verify. An organization's own administrator may leave it out. */\n  organization_id?: string;\n  /** Start here rather than at the oldest event kept. */\n  from_sequence?: number;\n  /** Verify at most this many events. Default 10,000. */\n  limit?: number;\n}\n\n/** Response body of `audit_logs.verify`. */\nexport type AuditLogsVerifyResponse = {\n  data: AuditLogVerification;\n};\n\n/** Query parameters of `audit.list`. */\nexport interface AuditListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n  /** Only this action, e.g. `webhook.created`. */\n  action?: string;\n  /** Only entries by this kind of actor; `service` is a management key or an app. */\n  actor_type?: 'user' | 'service' | 'system' | 'operator' | 'organization_member';\n  /** Only this organization's entries. */\n  organization_id?: string;\n}\n\n/** Response body of `audit.list`. */\nexport type AuditListResponse = {\n  data: AuditEntry[];\n  meta: PageMeta;\n};\n\n/** Query parameters of `branding.appearance.get`. */\nexport interface BrandingAppearanceGetQuery {\n  /** Read this organization's theme. Left out, the environment default. */\n  organization_id?: string;\n}\n\n/** Response body of `branding.appearance.get`. */\nexport type BrandingAppearanceGetResponse = {\n  data: Appearance;\n};\n\n/** Request body of `branding.appearance.set`. */\nexport interface BrandingAppearanceSetBody {\n  /** Theme this organization. Left out, the environment default. */\n  organization_id?: string | null;\n  /** The theme. Both modes must be readable: text needs 4.5:1 against the background, muted text 3:1. */\n  theme: {\n    /** A preset id: cbox, midnight, minimal, warm, contrast. */\n    preset?: string;\n    /** Corner radius: 0rem, 0.25rem, 0.375rem, 0.5rem, 0.75rem, 1rem. */\n    radius?: string;\n    /** Type family: system, inter, geometric, rounded, serif. */\n    font?: string;\n    /** Colours as #rrggbb. One left out takes the preset's. */\n    light?: {\n      primary?: string;\n      background?: string;\n      foreground?: string;\n      muted?: string;\n    };\n    /** Colours as #rrggbb. One left out takes the preset's. */\n    dark?: {\n      primary?: string;\n      background?: string;\n      foreground?: string;\n      muted?: string;\n    };\n  };\n  /** The logo as a base64 data: URI (data:image/png;base64,…): PNG, JPEG or WebP, at most 1024 KB and 4096px on the longest side. SVG and remote URLs are refused. Null removes it; left out keeps it. */\n  logo?: string | null;\n  /** The favicon as a base64 data: URI (data:image/png;base64,…): PNG, ICO or WebP, at most 256 KB and 1024px on the longest side. SVG and remote URLs are refused. Null removes it; left out keeps it. */\n  favicon?: string | null;\n}\n\n/** Response body of `branding.appearance.set`. */\nexport type BrandingAppearanceSetResponse = {\n  data: Appearance;\n};\n\n/** Query parameters of `branding.whitelabel.get`. */\nexport interface BrandingWhitelabelGetQuery {\n  /** Read this organization's branding. Left out, the environment default. */\n  organization_id?: string;\n}\n\n/** Response body of `branding.whitelabel.get`. */\nexport type BrandingWhitelabelGetResponse = {\n  data: WhitelabelBranding;\n};\n\n/** Request body of `branding.whitelabel.set`. */\nexport interface BrandingWhitelabelSetBody {\n  /** Brand this organization. Left out, the environment default. */\n  organization_id?: string | null;\n  /** Colours as hex (#0a2540) or oklch(…), by token: primary, accent, ring, foreground, background. Sent, it is the complete palette; a token left out or blank is unset. */\n  palette?: {\n    primary?: string | null;\n    accent?: string | null;\n    ring?: string | null;\n    foreground?: string | null;\n    background?: string | null;\n  };\n  /** The product name shown in place of Cbox ID; null to unset. */\n  app_name?: string | null;\n  /** The sender name on mail; null to unset. */\n  email_from_name?: string | null;\n  /** The welcome email body; blank or null to use the default. */\n  email_template?: string | null;\n}\n\n/** Response body of `branding.whitelabel.set`. */\nexport type BrandingWhitelabelSetResponse = {\n  data: WhitelabelBranding;\n};\n\n/** Request body of `directories.connect`. */\nexport interface DirectoriesConnectBody {\n  /** The organization whose people it provisions. */\n  organization_id: string;\n  /** google_workspace or microsoft_entra. */\n  provider: 'google_workspace' | 'microsoft_entra';\n  /** The provider's credentials. Write-only: sealed, never returned. */\n  credentials: {\n    /** Google: the service account's JSON key, whole. */\n    service_account_json?: string;\n    /** Google: the administrator the service account acts as. */\n    admin_email?: string;\n    /** Entra: the directory (tenant) id. */\n    tenant_id?: string;\n    /** Entra: the app registration's client id. */\n    client_id?: string;\n    /** Entra: the app registration's client secret. */\n    client_secret?: string;\n  };\n}\n\n/** Response body of `directories.connect`. */\nexport type DirectoriesConnectResponse = {\n  data: Directory;\n};\n\n/** Request body of `directories.create`. */\nexport interface DirectoriesCreateBody {\n  /** The organization whose people it provisions. */\n  organization_id: string;\n  /** What administrators call it: \"Okta SCIM\". */\n  name: string;\n}\n\n/** Response body of `directories.create`. */\nexport type DirectoriesCreateResponse = {\n  data: Directory;\n};\n\n/** Request body of `directories.credentials.replace`. */\nexport interface DirectoriesCredentialsReplaceBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n  /** The new credentials, in the keys the provider's setup names (Google: service_account_json, admin_email; Entra: tenant_id, client_id, client_secret). Write-only. */\n  credentials: {\n    report_url?: string;\n    username?: string;\n    password?: string;\n    client_id?: string;\n    client_secret?: string;\n    refresh_token?: string;\n    subdomain?: string;\n    api_key?: string;\n    api_token?: string;\n    service_user_id?: string;\n    service_user_token?: string;\n    service_account_json?: string;\n    admin_email?: string;\n    tenant_id?: string;\n  };\n}\n\n/** Response body of `directories.credentials.replace`. */\nexport type DirectoriesCredentialsReplaceResponse = {\n  data: Directory;\n};\n\n/** Request body of `directories.delete`. */\nexport interface DirectoriesDeleteBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `directories.delete`. */\nexport type DirectoriesDeleteResponse = void;\n\n/** Query parameters of `directories.get`. */\nexport interface DirectoriesGetQuery {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `directories.get`. */\nexport type DirectoriesGetResponse = {\n  data: Directory;\n};\n\n/** Query parameters of `directories.groups.list`. */\nexport interface DirectoriesGroupsListQuery {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `directories.groups.list`. */\nexport type DirectoriesGroupsListResponse = {\n  data: DirectoryGroup[];\n  meta: PageMeta;\n};\n\n/** Request body of `directories.groups.map`. */\nexport interface DirectoriesGroupsMapBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n  /** One of the directory's groups. */\n  group_id: string;\n  /** A role the organization's own people may hold. */\n  role_id: string;\n  /** true to map the group onto the role, false to unmap it. */\n  mapped: boolean;\n}\n\n/** Response body of `directories.groups.map`. */\nexport type DirectoriesGroupsMapResponse = {\n  data: DirectoryGroup;\n};\n\n/** Request body of `directories.hris.connect`. */\nexport interface DirectoriesHrisConnectBody {\n  /** The organization whose people it provisions. */\n  organization_id: string;\n  /** workday, bamboohr, rippling, hibob or personio. */\n  provider: 'workday' | 'bamboohr' | 'rippling' | 'hibob' | 'personio';\n  /** What administrators call it. Defaults to the HR system's name. */\n  name?: string;\n  /** The HR system's credentials, in the keys its setup guide names. Write-only: sealed, never returned. */\n  credentials: {\n    /** Workday: Report web-service URL. */\n    report_url?: string;\n    /** Workday: Integration system user. */\n    username?: string;\n    /** Workday: Integration system user password (secret). */\n    password?: string;\n    /** Workday: API client ID; Personio: Client ID. */\n    client_id?: string;\n    /** Workday: API client secret (secret); Personio: Client secret (secret). */\n    client_secret?: string;\n    /** Workday: Refresh token (secret). */\n    refresh_token?: string;\n    /** BambooHR: Company subdomain. */\n    subdomain?: string;\n    /** BambooHR: API key (secret). */\n    api_key?: string;\n    /** Rippling: API token (secret). */\n    api_token?: string;\n    /** HiBob: Service user ID. */\n    service_user_id?: string;\n    /** HiBob: Service user token (secret). */\n    service_user_token?: string;\n  };\n  /** The HR system's own field names to copy onto each person, verbatim. */\n  custom_attributes?: string[];\n  /** Minutes between scheduled pulls, 15 to 1440. Omitted or null: the platform default (hourly). */\n  sync_interval_minutes?: number | null;\n}\n\n/** Response body of `directories.hris.connect`. */\nexport type DirectoriesHrisConnectResponse = {\n  data: Directory;\n};\n\n/** Query parameters of `directories.list`. */\nexport interface DirectoriesListQuery {\n  /** Only this organization's. */\n  organization_id?: string | null;\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `directories.list`. */\nexport type DirectoriesListResponse = {\n  data: Directory[];\n  meta: PageMeta;\n};\n\n/** Request body of `directories.status.set`. */\nexport interface DirectoriesStatusSetBody {\n  /** true to resume provisioning, false to pause it. */\n  active: boolean;\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `directories.status.set`. */\nexport type DirectoriesStatusSetResponse = {\n  data: Directory;\n};\n\n/** Request body of `directories.sync`. */\nexport interface DirectoriesSyncBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n  /** Ask an HR system that syncs incrementally for everybody, not only what changed. Ignored by other providers. */\n  full?: boolean;\n}\n\n/** Response body of `directories.sync`. */\nexport type DirectoriesSyncResponse = {\n  data: Directory;\n};\n\n/** Request body of `directories.sync_settings.update`. */\nexport interface DirectoriesSyncSettingsUpdateBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n  /** Minutes between scheduled pulls, 15 to 1440. null returns to the platform default (hourly). */\n  sync_interval_minutes?: number | null;\n  /** HR systems only: the HR system's own field names to copy onto each person, verbatim. */\n  custom_attributes?: string[];\n  /** Workday only: the report column holding each field, where it is not the default name. */\n  field_map?: {\n    /** The report column holding id. Default: Employee_ID. */\n    id?: string;\n    /** The report column holding email. Default: Work_Email. */\n    email?: string;\n    /** The report column holding first_name. Default: Legal_First_Name. */\n    first_name?: string;\n    /** The report column holding last_name. Default: Legal_Last_Name. */\n    last_name?: string;\n    /** The report column holding display_name. Default: Preferred_Name. */\n    display_name?: string;\n    /** The report column holding active. Default: Active_Status. */\n    active?: string;\n    /** The report column holding on_leave. Default: On_Leave. */\n    on_leave?: string;\n    /** The report column holding hire_date. Default: Hire_Date. */\n    hire_date?: string;\n    /** The report column holding termination_date. Default: Termination_Date. */\n    termination_date?: string;\n    /** The report column holding department_id. Default: Supervisory_Organization_ID. */\n    department_id?: string;\n    /** The report column holding department. Default: Supervisory_Organization. */\n    department?: string;\n    /** The report column holding manager_id. Default: Manager_Employee_ID. */\n    manager_id?: string;\n    /** The report column holding title. Default: Business_Title. */\n    title?: string;\n  };\n}\n\n/** Response body of `directories.sync_settings.update`. */\nexport type DirectoriesSyncSettingsUpdateResponse = {\n  data: Directory;\n};\n\n/** Request body of `directories.token.rotate`. */\nexport interface DirectoriesTokenRotateBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `directories.token.rotate`. */\nexport type DirectoriesTokenRotateResponse = {\n  data: Directory;\n};\n\n/** Request body of `directories.update`. */\nexport interface DirectoriesUpdateBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n  /** The new name. */\n  name: string;\n}\n\n/** Response body of `directories.update`. */\nexport type DirectoriesUpdateResponse = {\n  data: Directory;\n};\n\n/** Request body of `domains.add`. */\nexport interface DomainsAddBody {\n  /** The domain, for example login.example.com. */\n  domain: string;\n}\n\n/** Response body of `domains.add`. */\nexport type DomainsAddResponse = {\n  data: CustomDomain;\n};\n\n/** Response body of `domains.get`. */\nexport type DomainsGetResponse = {\n  data: CustomDomain;\n};\n\n/** Response body of `domains.remove`. */\nexport type DomainsRemoveResponse = void;\n\n/** Response body of `domains.verify`. */\nexport type DomainsVerifyResponse = {\n  data: CustomDomain;\n};\n\n/** Query parameters of `events.list`. */\nexport interface EventsListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n  /** Only these event types, e.g. `user.created`. */\n  types?: string[];\n  /** Only this organization's events. */\n  organization_id?: string;\n}\n\n/** Response body of `events.list`. */\nexport type EventsListResponse = {\n  data: DomainEvent[];\n  meta: PageMeta;\n};\n\n/** Request body of `feature_flags.create`. */\nexport interface FeatureFlagsCreateBody {\n  /** What code asks for and the `feature_flags` claim carries: lowercase letters and digits, with `-`, `_` or `.` between them. Fixed once created. */\n  key: string;\n  description?: string | null;\n  /** The kill switch: off means off for everyone, whatever the rules say. Defaults to true. */\n  enabled?: boolean;\n  /** The answer when no rule matches. Defaults to false. */\n  default_value?: boolean;\n  /** Rules for named users — they outrank every other rule. The COMPLETE list when sent. */\n  users?: Array<{\n    /** The user's id. */\n    id: string;\n    /** On (true, the default) or off for them, whatever the organization, rollout or default say. */\n    enabled?: boolean;\n  }>;\n  /** Rules for named organizations — they outrank the rollout and the default. The COMPLETE list when sent. */\n  organizations?: Array<{\n    /** The organization's id. */\n    id: string;\n    /** On (true, the default) or off for them, whatever the organization, rollout or default say. */\n    enabled?: boolean;\n  }>;\n  /** On for this percentage of everyone else, by a stable hash of the user id (or the organization id without one). null for no rollout. */\n  rollout_percentage?: number | null;\n}\n\n/** Response body of `feature_flags.create`. */\nexport type FeatureFlagsCreateResponse = {\n  data: FeatureFlag;\n};\n\n/** Response body of `feature_flags.delete`. */\nexport type FeatureFlagsDeleteResponse = void;\n\n/** Query parameters of `feature_flags.evaluate`. */\nexport interface FeatureFlagsEvaluateQuery {\n  /** The user to evaluate for. Left out, only organization rules, an organization-bucketed rollout and defaults apply. */\n  user_id?: string;\n  /** The organization the question is asked in. */\n  organization_id?: string;\n}\n\n/** Response body of `feature_flags.evaluate`. */\nexport type FeatureFlagsEvaluateResponse = {\n  data: FeatureFlagEvaluation;\n};\n\n/** Response body of `feature_flags.get`. */\nexport type FeatureFlagsGetResponse = {\n  data: FeatureFlag;\n};\n\n/** Query parameters of `feature_flags.list`. */\nexport interface FeatureFlagsListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `feature_flags.list`. */\nexport type FeatureFlagsListResponse = {\n  data: FeatureFlag[];\n  meta: PageMeta;\n};\n\n/** Request body of `feature_flags.update`. */\nexport interface FeatureFlagsUpdateBody {\n  /** Null or empty clears it. */\n  description?: string | null;\n  /** The kill switch: off means off for everyone. */\n  enabled?: boolean;\n  /** The answer when no rule matches. */\n  default_value?: boolean;\n  /** Rules for named users — they outrank every other rule. The COMPLETE list when sent. */\n  users?: Array<{\n    /** The user's id. */\n    id: string;\n    /** On (true, the default) or off for them, whatever the organization, rollout or default say. */\n    enabled?: boolean;\n  }>;\n  /** Rules for named organizations — they outrank the rollout and the default. The COMPLETE list when sent. */\n  organizations?: Array<{\n    /** The organization's id. */\n    id: string;\n    /** On (true, the default) or off for them, whatever the organization, rollout or default say. */\n    enabled?: boolean;\n  }>;\n  /** On for this percentage of everyone else, by a stable hash of the user id (or the organization id without one). null for no rollout. */\n  rollout_percentage?: number | null;\n}\n\n/** Response body of `feature_flags.update`. */\nexport type FeatureFlagsUpdateResponse = {\n  data: FeatureFlag;\n};\n\n/** Query parameters of `fga.check`. */\nexport interface FgaCheckQuery {\n  /** The resource's type: `document`. */\n  resource_type: string;\n  /** The resource's id: `readme`. */\n  resource_id: string;\n  /** The relation to check: `viewer`. */\n  relation: string;\n  /** The subject's type: `user`, or `group` for a userset. */\n  subject_type: string;\n  /** The subject's id: `alice`. */\n  subject_id: string;\n  /** For a userset subject — `member` with `group`/`eng` asks about every member of eng. */\n  subject_relation?: string;\n  /** A `consistency_token` a write returned: the answer is then at least as fresh as that write. */\n  consistency_token?: string | null;\n}\n\n/** Response body of `fga.check`. */\nexport type FgaCheckResponse = {\n  data: FgaCheck;\n};\n\n/** Query parameters of `fga.check_batch`. */\nexport interface FgaCheckBatchQuery {\n  /** 1–100 checks, each `resource_type:resource_id#relation@subject_type:subject_id[#subject_relation]`. */\n  checks: string[];\n  /** A `consistency_token` a write returned: the answer is then at least as fresh as that write. */\n  consistency_token?: string | null;\n}\n\n/** Response body of `fga.check_batch`. */\nexport type FgaCheckBatchResponse = {\n  data: FgaCheckBatch;\n};\n\n/** Query parameters of `fga.resources.list`. */\nexport interface FgaResourcesListQuery {\n  /** Which type of resource to list: `document`. */\n  resource_type: string;\n  /** The relation the subject must have: `viewer`. */\n  relation: string;\n  /** The subject's type: `user`. */\n  subject_type: string;\n  /** The subject's id: `alice`. */\n  subject_id: string;\n  /** For a userset subject: `member` with `group`/`eng`. */\n  subject_relation?: string;\n  /** A `consistency_token` a write returned: the answer is then at least as fresh as that write. */\n  consistency_token?: string | null;\n  /** Ids per page, 1–1000. Default 100. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `fga.resources.list`. */\nexport type FgaResourcesListResponse = {\n  data: FgaObject[];\n  meta: PageMeta;\n};\n\n/** Response body of `fga.schema.get`. */\nexport type FgaSchemaGetResponse = {\n  data: FgaSchema;\n};\n\n/** Request body of `fga.schema.update`. */\nexport interface FgaSchemaUpdateBody {\n  /** The schema, in the schema language: `type document` then `  relation viewer: [user, group#member] or editor or viewer from parent`. */\n  schema: string;\n}\n\n/** Response body of `fga.schema.update`. */\nexport type FgaSchemaUpdateResponse = {\n  data: FgaSchema;\n};\n\n/** Query parameters of `fga.schema.validate`. */\nexport interface FgaSchemaValidateQuery {\n  /** The schema to check, in the schema language. */\n  schema: string;\n}\n\n/** Response body of `fga.schema.validate`. */\nexport type FgaSchemaValidateResponse = {\n  data: FgaSchemaValidation;\n};\n\n/** Query parameters of `fga.subjects.list`. */\nexport interface FgaSubjectsListQuery {\n  /** The resource's type: `document`. */\n  resource_type: string;\n  /** The resource's id: `readme`. */\n  resource_id: string;\n  /** The relation: `viewer`. */\n  relation: string;\n  /** Which type of subject to list: `user`. */\n  subject_type: string;\n  /** A `consistency_token` a write returned: the answer is then at least as fresh as that write. */\n  consistency_token?: string | null;\n  /** Ids per page, 1–1000. Default 100. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `fga.subjects.list`. */\nexport type FgaSubjectsListResponse = {\n  data: FgaObject[];\n  meta: PageMeta;\n};\n\n/** Request body of `fga.tuples.delete`. */\nexport interface FgaTuplesDeleteBody {\n  /** 1–100 tuples to delete, all together or none. */\n  tuples: Array<{\n    /** The resource's type, as the schema names it: `document`. */\n    resource_type: string;\n    /** Your id for the resource: `readme`. */\n    resource_id: string;\n    /** The relation: `viewer`. */\n    relation: string;\n    /** Who: one subject (`user:alice`), or a userset (`group:eng#member`). */\n    subject: {\n      /** The subject's type: `user`, or `group` for a userset. */\n      type: string;\n      /** Your id for the subject: `alice`, `eng`. */\n      id: string;\n      /** For a userset — everybody with this relation on the subject: `member` of `group:eng`. Omit for one subject. */\n      relation?: string | null;\n    };\n  }>;\n}\n\n/** Response body of `fga.tuples.delete`. */\nexport type FgaTuplesDeleteResponse = {\n  data: FgaTupleWrite;\n};\n\n/** Query parameters of `fga.tuples.list`. */\nexport interface FgaTuplesListQuery {\n  /** Only tuples on this resource type. */\n  resource_type?: string;\n  /** Only tuples on this resource. */\n  resource_id?: string;\n  /** Only tuples of this relation. */\n  relation?: string;\n  /** Only tuples naming this subject type. */\n  subject_type?: string;\n  /** Only tuples naming this subject. */\n  subject_id?: string;\n  /** Only tuples naming a userset with this relation. */\n  subject_relation?: string;\n  /** Tuples per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `fga.tuples.list`. */\nexport type FgaTuplesListResponse = {\n  data: FgaTuple[];\n  meta: PageMeta;\n};\n\n/** Request body of `fga.tuples.write`. */\nexport interface FgaTuplesWriteBody {\n  /** 1–100 tuples to write, all together or none. */\n  tuples: Array<{\n    /** The resource's type, as the schema names it: `document`. */\n    resource_type: string;\n    /** Your id for the resource: `readme`. */\n    resource_id: string;\n    /** The relation: `viewer`. */\n    relation: string;\n    /** Who: one subject (`user:alice`), or a userset (`group:eng#member`). */\n    subject: {\n      /** The subject's type: `user`, or `group` for a userset. */\n      type: string;\n      /** Your id for the subject: `alice`, `eng`. */\n      id: string;\n      /** For a userset — everybody with this relation on the subject: `member` of `group:eng`. Omit for one subject. */\n      relation?: string | null;\n    };\n  }>;\n}\n\n/** Response body of `fga.tuples.write`. */\nexport type FgaTuplesWriteResponse = {\n  data: FgaTupleWrite;\n};\n\n/** Request body of `frontend_keys.create`. */\nexport interface FrontendKeysCreateBody {\n  /** What the key is for, so a person recognises it later. */\n  name: string;\n  /** `test` or `live`; it is in the key's prefix. */\n  mode: 'test' | 'live';\n  /** The exact origins (scheme, host, port) allowed to present the key, for example https://app.example.com. At least one. */\n  origins: string[];\n}\n\n/** Response body of `frontend_keys.create`. */\nexport type FrontendKeysCreateResponse = {\n  data: FrontendKey;\n};\n\n/** Query parameters of `frontend_keys.list`. */\nexport interface FrontendKeysListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `frontend_keys.list`. */\nexport type FrontendKeysListResponse = {\n  data: FrontendKey[];\n  meta: PageMeta;\n};\n\n/** Response body of `frontend_keys.revoke`. */\nexport type FrontendKeysRevokeResponse = void;\n\n/** Request body of `frontend_keys.set_origins`. */\nexport interface FrontendKeysSetOriginsBody {\n  /** The exact origins (scheme, host, port) allowed to present the key, for example https://app.example.com. At least one. */\n  origins: string[];\n}\n\n/** Response body of `frontend_keys.set_origins`. */\nexport type FrontendKeysSetOriginsResponse = {\n  data: FrontendKey;\n};\n\n/** Request body of `hooks.create`. */\nexport interface HooksCreateBody {\n  /** When it is called. */\n  hook_point: 'token_minting' | 'post_login' | 'pre_registration' | 'post_registration' | 'pre_password_change' | 'post_password_change';\n  /** A public HTTPS URL, called in the middle of the operation. */\n  url: string;\n  /** The organization it belongs to; it carries that organization's traffic only. Send this or environment_wide. */\n  organization_id?: string | null;\n  /** True to make it the environment's own, carrying EVERY organization's traffic. Send this or organization_id. */\n  environment_wide?: boolean;\n}\n\n/** Response body of `hooks.create`. */\nexport type HooksCreateResponse = {\n  data: InlineHook;\n};\n\n/** Response body of `hooks.delete`. */\nexport type HooksDeleteResponse = void;\n\n/** Response body of `hooks.get`. */\nexport type HooksGetResponse = {\n  data: InlineHook;\n};\n\n/** Query parameters of `hooks.list`. */\nexport interface HooksListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `hooks.list`. */\nexport type HooksListResponse = {\n  data: InlineHook[];\n  meta: PageMeta;\n};\n\n/** Request body of `hooks.update`. */\nexport interface HooksUpdateBody {\n  /** True to call it at its hook point; false to pause it. */\n  active: boolean;\n}\n\n/** Response body of `hooks.update`. */\nexport type HooksUpdateResponse = {\n  data: InlineHook;\n};\n\n/** Query parameters of `invitations.list`. */\nexport interface InvitationsListQuery {\n  limit?: number;\n  /** Opaque cursor — the `meta.next_cursor` from the previous page. */\n  after?: string;\n}\n\n/** Response body of `invitations.list`. */\nexport type InvitationsListResponse = {\n  data: Invitation[];\n  meta: PageMeta;\n};\n\n/** Response body of `invitations.resend`. */\nexport type InvitationsResendResponse = {\n  data: Invitation;\n};\n\n/** Response body of `invitations.revoke`. */\nexport type InvitationsRevokeResponse = void;\n\n/** Request body of `invitations.send`. */\nexport interface InvitationsSendBody {\n  email: string;\n  role?: AssignableMemberRole;\n  roles?: string[];\n  client_id?: string | null;\n  return_to?: string | null;\n  inviter_name?: string | null;\n}\n\n/** Response body of `invitations.send`. */\nexport type InvitationsSendResponse = {\n  data: Invitation;\n};\n\n/** Request body of `keys.create`. */\nexport interface KeysCreateBody {\n  name: string;\n  /** The scopes the key carries. From a key: a subset of its own. */\n  scopes: string[];\n  /** When it stops working. From a key: required to be no later than the parent; defaults to the latest allowed. */\n  expires_at?: string | null;\n  /** What it is for — shown beside it in the console. */\n  description?: string | null;\n  /** Which of this key's actions need its owner's approval on their device first. From a key: never weaker than its own. */\n  require_approval?: {\n    /** Every action at or above this danger waits for a person's approval. */\n    min_danger?: 'write' | 'destructive' | 'critical' | null;\n    /** These actions wait for approval whatever their danger. */\n    actions?: string[];\n  };\n}\n\n/** Response body of `keys.create`. */\nexport type KeysCreateResponse = {\n  data: ManagementKey;\n};\n\n/** Query parameters of `keys.list`. */\nexport interface KeysListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `keys.list`. */\nexport type KeysListResponse = {\n  data: ManagementKey[];\n  meta: PageMeta;\n};\n\n/** Response body of `keys.revoke`. */\nexport type KeysRevokeResponse = void;\n\n/** Request body of `keys.rotate`. */\nexport interface KeysRotateBody {\n  /** How long the old key keeps working. Default 24. */\n  grace_hours?: number;\n}\n\n/** Response body of `keys.rotate`. */\nexport type KeysRotateResponse = {\n  data: ManagementKey;\n};\n\n/** Response body of `legacy_login.approve`. */\nexport type LegacyLoginApproveResponse = {\n  data: LegacyLogin;\n};\n\n/** Response body of `legacy_login.get`. */\nexport type LegacyLoginGetResponse = {\n  data: LegacyLogin;\n};\n\n/** Request body of `legacy_login.probe`. */\nexport interface LegacyLoginProbeBody {\n  /** An address that exists in your old system — your own. */\n  email: string;\n}\n\n/** Response body of `legacy_login.probe`. */\nexport type LegacyLoginProbeResponse = {\n  data: LegacyLoginProbe;\n};\n\n/** Response body of `legacy_login.revoke`. */\nexport type LegacyLoginRevokeResponse = {\n  data: LegacyLogin;\n};\n\n/** Request body of `log_streams.create`. */\nexport interface LogStreamsCreateBody {\n  name: string;\n  destination: 'splunk_hec' | 'elastic_ecs' | 'graylog_gelf' | 'cef_http' | 'generic_json' | 'datadog' | 's3' | 'gcs';\n  /** An HTTP collector: the public URL entries are POSTed to (required). Datadog, S3 and GCS: leave out for the destination's own endpoint, or an https URL of an S3-compatible store (MinIO, R2). */\n  endpoint_url?: string | null;\n  /** An HTTP collector: how the endpoint is authenticated. Left out, the destination's default. The cloud destinations authenticate their own way. */\n  auth?: 'none' | 'bearer' | 'splunk' | 'hmac';\n  /** The credential, never echoed: the bearer or Splunk token (HTTP collectors; left out with `hmac`, a key is generated and returned once), the Datadog API key, the S3 secret access key (none with `role_arn`), or the GCS service-account JSON key. */\n  secret?: string | null;\n  /** Datadog, S3 and GCS only: the destination's settings. An HTTP collector takes none. */\n  options?: {\n    /** Datadog: the site your account lives on — the domain you sign in at, e.g. `datadoghq.eu` for EU1. Default `datadoghq.com` (US1). An API key only works on its own site. */\n    site?: 'datadoghq.com' | 'us3.datadoghq.com' | 'us5.datadoghq.com' | 'datadoghq.eu' | 'ap1.datadoghq.com' | 'ap2.datadoghq.com' | 'ddog-gov.com' | null;\n    /** Datadog: the `service` attribute on every entry. Default: this platform's name. */\n    service?: string | null;\n    /** Datadog: the `ddsource` attribute. Default `cbox`. */\n    source?: string | null;\n    /** Datadog: `key:value` tags (`ddtags`) on every entry, e.g. `env:prod`. */\n    tags?: string[] | null;\n    /** Datadog: the `hostname` attribute. Default: this platform's host. */\n    hostname?: string | null;\n    /** S3 and GCS: the bucket objects are written to. */\n    bucket?: string | null;\n    /** S3: the bucket's AWS Region, e.g. `eu-west-1` (`auto` for Cloudflare R2). */\n    region?: string | null;\n    /** S3 and GCS: the object key prefix, e.g. `cbox/audit`. Objects are written to `{prefix}/{yyyy}/{mm}/{dd}/{hh}/{batch}.ndjson.gz`. */\n    prefix?: string | null;\n    /** S3 with an access key: the IAM access key ID. Its secret access key is the stream's `secret`. */\n    access_key_id?: string | null;\n    /** S3 with an assumed role: the IAM role the platform assumes. No secret is stored; the role's trust policy must require the stream's `external_id`. */\n    role_arn?: string | null;\n    /** S3: server-side encryption requested on every object. Left out, the bucket's default. */\n    sse?: 'AES256' | 'aws:kms' | null;\n    /** S3 with `aws:kms`: the KMS key ID, alias or ARN. */\n    kms_key_id?: string | null;\n    /** S3: path-style addressing. Default: virtual-hosted on AWS, path-style on a custom endpoint (MinIO, R2). */\n    path_style?: boolean | null;\n    /** S3 and GCS: gzip each object (`.ndjson.gz`). Default true. */\n    gzip?: boolean | null;\n  };\n  /** The organization it belongs to; it carries that organization's traffic only. Send this or environment_wide. */\n  organization_id?: string | null;\n  /** True to make it the environment's own, carrying EVERY organization's traffic. Send this or organization_id. */\n  environment_wide?: boolean;\n}\n\n/** Response body of `log_streams.create`. */\nexport type LogStreamsCreateResponse = {\n  data: LogStream;\n};\n\n/** Response body of `log_streams.delete`. */\nexport type LogStreamsDeleteResponse = void;\n\n/** Response body of `log_streams.get`. */\nexport type LogStreamsGetResponse = {\n  data: LogStream;\n};\n\n/** Query parameters of `log_streams.list`. */\nexport interface LogStreamsListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `log_streams.list`. */\nexport type LogStreamsListResponse = {\n  data: LogStream[];\n  meta: PageMeta;\n};\n\n/** Response body of `log_streams.test`. */\nexport type LogStreamsTestResponse = {\n  data: LogStreamTest;\n};\n\n/** Request body of `log_streams.update`. */\nexport interface LogStreamsUpdateBody {\n  name?: string;\n  /** Changing it starts the stream's options and credential afresh. */\n  destination?: 'splunk_hec' | 'elastic_ecs' | 'graylog_gelf' | 'cef_http' | 'generic_json' | 'datadog' | 's3' | 'gcs';\n  /** An HTTP collector's URL; for Datadog, S3 and GCS empty means the destination's own endpoint. */\n  endpoint_url?: string | null;\n  /** An HTTP collector only. */\n  auth?: 'none' | 'bearer' | 'splunk' | 'hmac';\n  /** A new credential (token, API key, secret access key or service-account JSON key). Left out, the current one is kept. Never echoed. */\n  secret?: string | null;\n  /** Datadog, S3 and GCS only: the destination's settings. An HTTP collector takes none. */\n  options?: {\n    /** Datadog: the site your account lives on — the domain you sign in at, e.g. `datadoghq.eu` for EU1. Default `datadoghq.com` (US1). An API key only works on its own site. */\n    site?: 'datadoghq.com' | 'us3.datadoghq.com' | 'us5.datadoghq.com' | 'datadoghq.eu' | 'ap1.datadoghq.com' | 'ap2.datadoghq.com' | 'ddog-gov.com' | null;\n    /** Datadog: the `service` attribute on every entry. Default: this platform's name. */\n    service?: string | null;\n    /** Datadog: the `ddsource` attribute. Default `cbox`. */\n    source?: string | null;\n    /** Datadog: `key:value` tags (`ddtags`) on every entry, e.g. `env:prod`. */\n    tags?: string[] | null;\n    /** Datadog: the `hostname` attribute. Default: this platform's host. */\n    hostname?: string | null;\n    /** S3 and GCS: the bucket objects are written to. */\n    bucket?: string | null;\n    /** S3: the bucket's AWS Region, e.g. `eu-west-1` (`auto` for Cloudflare R2). */\n    region?: string | null;\n    /** S3 and GCS: the object key prefix, e.g. `cbox/audit`. Objects are written to `{prefix}/{yyyy}/{mm}/{dd}/{hh}/{batch}.ndjson.gz`. */\n    prefix?: string | null;\n    /** S3 with an access key: the IAM access key ID. Its secret access key is the stream's `secret`. */\n    access_key_id?: string | null;\n    /** S3 with an assumed role: the IAM role the platform assumes. No secret is stored; the role's trust policy must require the stream's `external_id`. */\n    role_arn?: string | null;\n    /** S3: server-side encryption requested on every object. Left out, the bucket's default. */\n    sse?: 'AES256' | 'aws:kms' | null;\n    /** S3 with `aws:kms`: the KMS key ID, alias or ARN. */\n    kms_key_id?: string | null;\n    /** S3: path-style addressing. Default: virtual-hosted on AWS, path-style on a custom endpoint (MinIO, R2). */\n    path_style?: boolean | null;\n    /** S3 and GCS: gzip each object (`.ndjson.gz`). Default true. */\n    gzip?: boolean | null;\n  };\n  /** True to deliver; false to stop, keeping what is pending. */\n  enabled?: boolean;\n}\n\n/** Response body of `log_streams.update`. */\nexport type LogStreamsUpdateResponse = {\n  data: LogStream;\n};\n\n/** Request body of `members.add`. */\nexport interface MembersAddBody {\n  user_id?: string;\n  /** Instead of `user_id`. */\n  email?: string;\n  role?: AssignableMemberRole;\n  roles?: string[];\n  /** The app whose manifest keys `roles` are. */\n  client_id?: string | null;\n}\n\n/** Response body of `members.add`. */\nexport type MembersAddResponse = {\n  data: Member;\n};\n\n/** Query parameters of `members.list`. */\nexport interface MembersListQuery {\n  limit?: number;\n  /** Opaque cursor — the `meta.next_cursor` from the previous page. */\n  after?: string;\n}\n\n/** Response body of `members.list`. */\nexport type MembersListResponse = {\n  data: Member[];\n  meta: PageMeta;\n};\n\n/** Response body of `members.remove`. */\nexport type MembersRemoveResponse = void;\n\n/** Query parameters of `members.roles.grant`. */\nexport interface MembersRolesGrantQuery {\n  /** The app whose manifest `key` `{role_id}` is. Not needed when `{role_id}` is an id. */\n  client_id?: string;\n}\n\n/** Response body of `members.roles.grant`. */\nexport type MembersRolesGrantResponse = {\n  data: RoleAssignment;\n};\n\n/** Response body of `members.roles.list`. */\nexport type MembersRolesListResponse = {\n  data: RoleAssignment[];\n};\n\n/** Query parameters of `members.roles.revoke`. */\nexport interface MembersRolesRevokeQuery {\n  /** The app whose manifest `key` `{role_id}` is. Not needed when `{role_id}` is an id. */\n  client_id?: string;\n}\n\n/** Response body of `members.roles.revoke`. */\nexport type MembersRolesRevokeResponse = void;\n\n/** Request body of `members.update`. */\nexport interface MembersUpdateBody {\n  role: AssignableMemberRole;\n}\n\n/** Response body of `members.update`. */\nexport type MembersUpdateResponse = {\n  data: Member;\n};\n\n/** Request body of `organizations.create`. */\nexport interface OrganizationsCreateBody {\n  name: string;\n  /**\n   * URL-safe; unique within the environment. Optional — left out, it is derived\n   * from the name and made unique (`acme`, `acme-2`, …). **Send one if you\n   * retry creates**: with your own slug a retried request is a `422\n   * slug_taken` you can recognise, not a second organization.\n   */\n  slug?: string | null;\n  /** An organization in this environment to place it under (`422 parent_not_found` otherwise). */\n  parent_id?: string | null;\n  /**\n   * An existing user of this environment who becomes the organization's\n   * **owner**, in the same transaction as the create (`422 user_not_found`\n   * otherwise). Without it the organization starts with no owner; make one\n   * later with `transfer-ownership`.\n   */\n  owner_user_id?: string | null;\n  /** `reseller` manages customer organizations beneath it in the tree; `customer` is a leaf tenant. */\n  type?: 'customer' | 'reseller';\n  /** Free-form text values you keep on the organization. */\n  metadata?: {\n    [key: string]: string;\n  } | null;\n}\n\n/** Response body of `organizations.create`. */\nexport type OrganizationsCreateResponse = {\n  data?: Organization;\n};\n\n/** Response body of `organizations.delete`. */\nexport type OrganizationsDeleteResponse = {\n  data: Organization;\n};\n\n/** Request body of `organizations.domains.add`. */\nexport interface OrganizationsDomainsAddBody {\n  /** A domain name — acme.com, not an address or a URL. */\n  domain: string;\n}\n\n/** Response body of `organizations.domains.add`. */\nexport type OrganizationsDomainsAddResponse = {\n  data: OrganizationDomain;\n};\n\n/** Request body of `organizations.domains.capture`. */\nexport interface OrganizationsDomainsCaptureBody {\n  /** Whether the domain captures sign-ins. */\n  enabled: boolean;\n}\n\n/** Response body of `organizations.domains.capture`. */\nexport type OrganizationsDomainsCaptureResponse = {\n  data: OrganizationDomain;\n};\n\n/** Response body of `organizations.domains.list`. */\nexport type OrganizationsDomainsListResponse = {\n  data: OrganizationDomain[];\n};\n\n/** Response body of `organizations.domains.remove`. */\nexport type OrganizationsDomainsRemoveResponse = void;\n\n/** Response body of `organizations.domains.verify`. */\nexport type OrganizationsDomainsVerifyResponse = {\n  data: OrganizationDomain;\n};\n\n/** Response body of `organizations.get`. */\nexport type OrganizationsGetResponse = {\n  data?: Organization;\n};\n\n/** Query parameters of `organizations.list`. */\nexport interface OrganizationsListQuery {\n  limit?: number;\n  /** Opaque cursor — the `meta.next_cursor` from the previous page. */\n  after?: string;\n  q?: string;\n  status?: 'active' | 'suspended' | 'deleted';\n}\n\n/** Response body of `organizations.list`. */\nexport type OrganizationsListResponse = {\n  data?: Organization[];\n  meta?: PageMeta;\n};\n\n/** Request body of `organizations.portal_links.create`. */\nexport interface OrganizationsPortalLinksCreateBody {\n  /** What the link may set up: sso (connection and email domains), dsync (directory sync over SCIM), domain_verification, log_streams, certificate_renewal (a SAML connection's signing certificate), audit_logs (the organization's audit events, read-only, with CSV export). */\n  intents: Array<'sso' | 'dsync' | 'domain_verification' | 'log_streams' | 'certificate_renewal' | 'audit_logs'>;\n  /** How long the link may wait to be opened, in minutes — 5 to 10080 (a week). Left out, the deployment's default (30). */\n  expires_in_minutes?: number | null;\n  /** Mail the link to this address — the customer's IT contact. Left out, nothing is sent. */\n  email?: string | null;\n  /** The language of that mail. Left out, the environment's default language. */\n  locale?: 'en' | 'da' | 'de' | 'sv' | 'nb' | 'fr' | null;\n}\n\n/** Response body of `organizations.portal_links.create`. */\nexport type OrganizationsPortalLinksCreateResponse = {\n  data: PortalLink;\n};\n\n/** Response body of `organizations.portal_links.list`. */\nexport type OrganizationsPortalLinksListResponse = {\n  data: PortalLinkRecord[];\n};\n\n/** Response body of `organizations.portal_links.revoke`. */\nexport type OrganizationsPortalLinksRevokeResponse = void;\n\n/** Response body of `organizations.reactivate`. */\nexport type OrganizationsReactivateResponse = {\n  data: Organization;\n};\n\n/** Response body of `organizations.suspend`. */\nexport type OrganizationsSuspendResponse = {\n  data: Organization;\n};\n\n/** Request body of `organizations.transfer_ownership`. */\nexport interface OrganizationsTransferOwnershipBody {\n  user_id: string;\n}\n\n/** Response body of `organizations.transfer_ownership`. */\nexport type OrganizationsTransferOwnershipResponse = {\n  data: Member;\n};\n\n/** Request body of `organizations.update`. */\nexport interface OrganizationsUpdateBody {\n  name?: string;\n  /** URL-safe; unique within the environment. */\n  slug?: string;\n  /** Replaces the metadata as a whole; `null` or `{}` clears it. */\n  metadata?: {\n    [key: string]: string;\n  } | null;\n}\n\n/** Response body of `organizations.update`. */\nexport type OrganizationsUpdateResponse = {\n  data: Organization;\n};\n\n/** Request body of `permissions.create`. */\nexport interface PermissionsCreateBody {\n  /** The key: a feature and an action joined by a colon, like invoices:create. */\n  name: string;\n  description?: string | null;\n  /** The organization it belongs to; null for the environment's shared tier. */\n  organization_id?: string | null;\n  /** Shared tier only: whether organizations may compose it into their own roles. Default false; always true on an organization's own. */\n  tenant_assignable?: boolean;\n}\n\n/** Response body of `permissions.create`. */\nexport type PermissionsCreateResponse = {\n  data: Permission;\n};\n\n/** Response body of `permissions.delete`. */\nexport type PermissionsDeleteResponse = void;\n\n/** Query parameters of `permissions.list`. */\nexport interface PermissionsListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n  /** Also the permissions this organization authored for itself. */\n  organization_id?: string;\n  /** Only the permissions this app declared. */\n  client_id?: string;\n  /** Only permissions whose key or description contains this. */\n  q?: string;\n}\n\n/** Response body of `permissions.list`. */\nexport type PermissionsListResponse = {\n  data: Permission[];\n  meta: PageMeta;\n};\n\n/** Request body of `permissions.update`. */\nexport interface PermissionsUpdateBody {\n  description?: string | null;\n  /** Shared tier only: whether organizations may compose it into their own roles. */\n  tenant_assignable?: boolean;\n}\n\n/** Response body of `permissions.update`. */\nexport type PermissionsUpdateResponse = {\n  data: Permission;\n};\n\n/** Response body of `pipes.connections.delete`. */\nexport type PipesConnectionsDeleteResponse = void;\n\n/** Query parameters of `pipes.connections.list`. */\nexport interface PipesConnectionsListQuery {\n  /** Only this person's connection. */\n  user_id?: string;\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `pipes.connections.list`. */\nexport type PipesConnectionsListResponse = {\n  data: PipeConnection[];\n  meta: PageMeta;\n};\n\n/** Request body of `pipes.create`. */\nexport interface PipesCreateBody {\n  /** The provider's key. */\n  provider: 'github' | 'google' | 'microsoft' | 'slack' | 'salesforce' | 'hubspot' | 'linear' | 'notion';\n  /** The OAuth client id of your app at the provider. */\n  client_id: string;\n  /** Its client secret. Write-only: sealed, never returned. */\n  client_secret: string;\n  /** The OAuth scopes to ask people for. Left out: the provider's defaults. */\n  scopes?: string[];\n  /** Per-installation values some providers need. Left out: the provider's defaults. */\n  parameters?: {\n    /** Microsoft 365 only: `common` (default), `organizations`, or one directory's tenant id or domain. */\n    tenant?: string;\n    /** Salesforce only: `login.salesforce.com` (default), `test.salesforce.com`, or your My Domain host. */\n    domain?: string;\n  };\n}\n\n/** Response body of `pipes.create`. */\nexport type PipesCreateResponse = {\n  data: Pipe;\n};\n\n/** Response body of `pipes.delete`. */\nexport type PipesDeleteResponse = void;\n\n/** Response body of `pipes.get`. */\nexport type PipesGetResponse = {\n  data: Pipe;\n};\n\n/** Request body of `pipes.grants.create`. */\nexport interface PipesGrantsCreateBody {\n  /** The OAuth client id of an app in this environment. */\n  client_id: string;\n}\n\n/** Response body of `pipes.grants.create`. */\nexport type PipesGrantsCreateResponse = {\n  data: Pipe;\n};\n\n/** Response body of `pipes.grants.delete`. */\nexport type PipesGrantsDeleteResponse = void;\n\n/** Query parameters of `pipes.list`. */\nexport interface PipesListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `pipes.list`. */\nexport type PipesListResponse = {\n  data: Pipe[];\n  meta: PageMeta;\n};\n\n/** Request body of `pipes.update`. */\nexport interface PipesUpdateBody {\n  /** A new OAuth client id. Left out, unchanged. */\n  client_id?: string;\n  /** A new client secret, sealed. Left out, unchanged. */\n  client_secret?: string;\n  /** The OAuth scopes to ask people for. Left out: the provider's defaults. */\n  scopes?: string[];\n  /** Per-installation values some providers need. Left out: the provider's defaults. */\n  parameters?: {\n    /** Microsoft 365 only: `common` (default), `organizations`, or one directory's tenant id or domain. */\n    tenant?: string;\n    /** Salesforce only: `login.salesforce.com` (default), `test.salesforce.com`, or your My Domain host. */\n    domain?: string;\n  };\n  /** False refuses new connections and every lease. Left out, unchanged. */\n  enabled?: boolean;\n}\n\n/** Response body of `pipes.update`. */\nexport type PipesUpdateResponse = {\n  data: Pipe;\n};\n\n/** Request body of `provisioning.targets.create`. */\nexport interface ProvisioningTargetsCreateBody {\n  /** The organization the target belongs to. Send this or environment_wide. */\n  organization_id?: string | null;\n  /** True to make the target the environment's own rather than one organization's. Send this or organization_id. */\n  environment_wide?: boolean;\n  /** What administrators call it: \"Slack\", \"Salesforce\". */\n  name: string;\n  /** The target's SCIM base URL. Must be a public address. */\n  base_url: string;\n  /** bearer (a long-lived token the app issued you) or oauth2_client_credentials (a token fetched before each batch). */\n  auth_scheme: 'bearer' | 'oauth2_client_credentials';\n  /** The bearer token, or the OAuth client secret. Write-only. */\n  secret: string;\n  /** oauth2_client_credentials: the token endpoint. */\n  token_url?: string | null;\n  /** oauth2_client_credentials: the client id. */\n  client_id?: string | null;\n  /** oauth2_client_credentials: the scope to ask for, if the app wants one. */\n  scope?: string | null;\n}\n\n/** Response body of `provisioning.targets.create`. */\nexport type ProvisioningTargetsCreateResponse = {\n  data: ProvisioningTarget;\n};\n\n/** Request body of `provisioning.targets.delete`. */\nexport interface ProvisioningTargetsDeleteBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `provisioning.targets.delete`. */\nexport type ProvisioningTargetsDeleteResponse = void;\n\n/** Query parameters of `provisioning.targets.get`. */\nexport interface ProvisioningTargetsGetQuery {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `provisioning.targets.get`. */\nexport type ProvisioningTargetsGetResponse = {\n  data: ProvisioningTarget;\n};\n\n/** Query parameters of `provisioning.targets.list`. */\nexport interface ProvisioningTargetsListQuery {\n  /** Only this organization's. */\n  organization_id?: string | null;\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `provisioning.targets.list`. */\nexport type ProvisioningTargetsListResponse = {\n  data: ProvisioningTarget[];\n  meta: PageMeta;\n};\n\n/** Request body of `provisioning.targets.status.set`. */\nexport interface ProvisioningTargetsStatusSetBody {\n  /** true to resume pushing, false to pause. */\n  active: boolean;\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `provisioning.targets.status.set`. */\nexport type ProvisioningTargetsStatusSetResponse = {\n  data: ProvisioningTarget;\n};\n\n/** Response body of `radar.decisions.get`. */\nexport type RadarDecisionsGetResponse = {\n  data: RadarDecision;\n};\n\n/** Query parameters of `radar.decisions.list`. */\nexport interface RadarDecisionsListQuery {\n  /** `allow`, `challenge` or `block`. */\n  verdict?: 'allow' | 'challenge' | 'block';\n  /** `sign_in` or `sign_up`. */\n  flow?: 'sign_in' | 'sign_up';\n  /** A rule key — `builtin:credential_stuffing`, `rule:<id>`, `deny_list:ip` — that decided or fired. */\n  rule?: string;\n  /** Two-letter country code. */\n  country?: string;\n  /** Attempts with this address (matched by pseudonym). */\n  email?: string;\n  /** Attempts from this IP (matched by pseudonym). */\n  ip?: string;\n  /** Attempts from this device id. */\n  device?: string;\n  /** Only decisions that were (true) or were not (false) acted on. */\n  enforced?: boolean;\n  /** On or after this time (ISO 8601). */\n  from?: string;\n  /** On or before this time (ISO 8601). */\n  to?: string;\n  /** Decisions per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page: the decisions older than it. */\n  after?: string;\n}\n\n/** Response body of `radar.decisions.list`. */\nexport type RadarDecisionsListResponse = {\n  data: RadarDecision[];\n  meta: PageMeta;\n};\n\n/** Request body of `radar.lists.add`. */\nexport interface RadarListsAddBody {\n  /** `allow` or `deny`. */\n  list: 'allow' | 'deny';\n  /** `ip` (an address or CIDR range), `email`, `email_domain` or `device`. */\n  kind: 'ip' | 'email' | 'email_domain' | 'device';\n  /** The IP, range, address, domain or device id. */\n  value: string;\n  /** Why it is listed. */\n  note?: string | null;\n  /** When the entry stops applying (ISO 8601). Never, when omitted. */\n  expires_at?: string | null;\n}\n\n/** Response body of `radar.lists.add`. */\nexport type RadarListsAddResponse = {\n  data: RadarListEntry;\n};\n\n/** Query parameters of `radar.lists.list`. */\nexport interface RadarListsListQuery {\n  /** `allow` or `deny`; both when omitted. */\n  list?: 'allow' | 'deny';\n  /** Only entries of this kind. */\n  kind?: 'ip' | 'email' | 'email_domain' | 'device';\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `radar.lists.list`. */\nexport type RadarListsListResponse = {\n  data: RadarListEntry[];\n  meta: PageMeta;\n};\n\n/** Response body of `radar.lists.remove`. */\nexport type RadarListsRemoveResponse = void;\n\n/** Request body of `radar.mode.set`. */\nexport interface RadarModeSetBody {\n  /** `monitor` or `enforce`. */\n  mode: 'monitor' | 'enforce';\n}\n\n/** Response body of `radar.mode.set`. */\nexport type RadarModeSetResponse = {\n  data: RadarSettings;\n};\n\n/** Request body of `radar.rules.create`. */\nexport interface RadarRulesCreateBody {\n  /** What the rule is for, as the console lists it. */\n  name: string;\n  /** Why the rule exists, for whoever reads it next. */\n  description?: string | null;\n  /** What happens when every condition holds: `allow` (skip every rule after this one), `challenge` (a second factor on sign-in; a CAPTCHA or an emailed code on sign-up) or `block`. */\n  action: 'allow' | 'challenge' | 'block';\n  /** `all` (the default), `sign_in` or `sign_up`. */\n  applies_to?: 'all' | 'sign_in' | 'sign_up';\n  /** Up to 10 conditions; the rule matches when EVERY one holds. A fact that is unknown (no IP intelligence, no address on a passkey sign-in) matches no condition. */\n  conditions: Array<{\n    /** The fact to test. */\n    field: 'ip' | 'country' | 'asn' | 'as_organization' | 'is_hosting' | 'is_vpn' | 'is_proxy' | 'is_tor' | 'email' | 'email_domain' | 'disposable_email' | 'user_agent' | 'method' | 'new_device' | 'impossible_travel' | 'travel_kmh' | 'risk_score' | 'ip_attempts_1m' | 'ip_attempts_1h' | 'ip_distinct_emails_10m' | 'ip_failures_1h' | 'email_attempts_1h' | 'email_failures_1h' | 'device_attempts_1h';\n    /** How to compare it. Which operators a field takes depends on its type. */\n    operator: 'eq' | 'neq' | 'in' | 'not_in' | 'gt' | 'gte' | 'lt' | 'lte' | 'contains' | 'not_contains' | 'starts_with' | 'ends_with' | 'in_cidr' | 'not_in_cidr';\n    /** The one value to compare with, as text — `DK`, `20`, `true`. For every operator except the list ones. */\n    value?: string;\n    /** The values to compare with, for `in`, `not_in`, `in_cidr` and `not_in_cidr`. */\n    values?: string[];\n  }>;\n  /** Whether the rule is evaluated. Default true. */\n  enabled?: boolean;\n  /** Where in the order to put it: 1 is evaluated first. Default: last. */\n  position?: number;\n}\n\n/** Response body of `radar.rules.create`. */\nexport type RadarRulesCreateResponse = {\n  data: RadarRule;\n};\n\n/** Response body of `radar.rules.delete`. */\nexport type RadarRulesDeleteResponse = void;\n\n/** Response body of `radar.rules.get`. */\nexport type RadarRulesGetResponse = {\n  data: RadarRule;\n};\n\n/** Query parameters of `radar.rules.list`. */\nexport interface RadarRulesListQuery {\n  /** Rules per page, 1–100. Default 100 — an environment holds at most 100, so one page is all of them. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `radar.rules.list`. */\nexport type RadarRulesListResponse = {\n  data: RadarRule[];\n  meta: PageMeta;\n};\n\n/** Request body of `radar.rules.reorder`. */\nexport interface RadarRulesReorderBody {\n  /** Every rule id, in the new order. */\n  rule_ids: string[];\n}\n\n/** Response body of `radar.rules.reorder`. */\nexport type RadarRulesReorderResponse = void;\n\n/** Request body of `radar.rules.update`. */\nexport interface RadarRulesUpdateBody {\n  /** What the rule is for, as the console lists it. */\n  name?: string;\n  /** Why the rule exists, for whoever reads it next. */\n  description?: string | null;\n  /** What happens when every condition holds: `allow` (skip every rule after this one), `challenge` (a second factor on sign-in; a CAPTCHA or an emailed code on sign-up) or `block`. */\n  action?: 'allow' | 'challenge' | 'block';\n  /** `all` (the default), `sign_in` or `sign_up`. */\n  applies_to?: 'all' | 'sign_in' | 'sign_up';\n  /** Up to 10 conditions; the rule matches when EVERY one holds. A fact that is unknown (no IP intelligence, no address on a passkey sign-in) matches no condition. */\n  conditions?: Array<{\n    /** The fact to test. */\n    field: 'ip' | 'country' | 'asn' | 'as_organization' | 'is_hosting' | 'is_vpn' | 'is_proxy' | 'is_tor' | 'email' | 'email_domain' | 'disposable_email' | 'user_agent' | 'method' | 'new_device' | 'impossible_travel' | 'travel_kmh' | 'risk_score' | 'ip_attempts_1m' | 'ip_attempts_1h' | 'ip_distinct_emails_10m' | 'ip_failures_1h' | 'email_attempts_1h' | 'email_failures_1h' | 'device_attempts_1h';\n    /** How to compare it. Which operators a field takes depends on its type. */\n    operator: 'eq' | 'neq' | 'in' | 'not_in' | 'gt' | 'gte' | 'lt' | 'lte' | 'contains' | 'not_contains' | 'starts_with' | 'ends_with' | 'in_cidr' | 'not_in_cidr';\n    /** The one value to compare with, as text — `DK`, `20`, `true`. For every operator except the list ones. */\n    value?: string;\n    /** The values to compare with, for `in`, `not_in`, `in_cidr` and `not_in_cidr`. */\n    values?: string[];\n  }>;\n  /** Whether the rule is evaluated. Default true. */\n  enabled?: boolean;\n  /** Where in the order to put it: 1 is evaluated first. Default: last. */\n  position?: number;\n}\n\n/** Response body of `radar.rules.update`. */\nexport type RadarRulesUpdateResponse = {\n  data: RadarRule;\n};\n\n/** Response body of `radar.settings.get`. */\nexport type RadarSettingsGetResponse = {\n  data: RadarSettings;\n};\n\n/** Request body of `radar.settings.update`. */\nexport interface RadarSettingsUpdateBody {\n  /** Rule key => `{\"enabled\": bool, \"action\": \"allow\"|\"challenge\"|\"block\", \"threshold\": int}`, each part optional. Keys: credential_stuffing, bot_velocity, account_attack, impossible_travel, new_device, anonymous_network, hosting_network, disposable_email, risk_score_reject, risk_score_elevated. */\n  builtin_rules: Record<string, unknown>;\n}\n\n/** Response body of `radar.settings.update`. */\nexport type RadarSettingsUpdateResponse = {\n  data: RadarSettings;\n};\n\n/** Request body of `roles.create`. */\nexport interface RolesCreateBody {\n  name: string;\n  description?: string | null;\n  /** The organization it belongs to; null defines it for every organization in the environment. */\n  organization_id?: string | null;\n  /** The app whose tokens it is stamped into; null for every app. */\n  client_id?: string | null;\n  /** Permission ids to grant it from the start. */\n  permissions?: string[];\n}\n\n/** Response body of `roles.create`. */\nexport type RolesCreateResponse = {\n  data: Role;\n};\n\n/** Response body of `roles.delete`. */\nexport type RolesDeleteResponse = void;\n\n/** Query parameters of `roles.get`. */\nexport interface RolesGetQuery {\n  /** The app whose manifest `key` `id` is. */\n  client_id?: string;\n}\n\n/** Response body of `roles.get`. */\nexport type RolesGetResponse = {\n  data: Role;\n};\n\n/** Query parameters of `roles.list`. */\nexport interface RolesListQuery {\n  client_id?: string;\n  organization_id?: string;\n}\n\n/** Response body of `roles.list`. */\nexport type RolesListResponse = {\n  data: Role[];\n};\n\n/** Response body of `roles.permissions.grant`. */\nexport type RolesPermissionsGrantResponse = {\n  data: Role;\n};\n\n/** Response body of `roles.permissions.revoke`. */\nexport type RolesPermissionsRevokeResponse = {\n  data: Role;\n};\n\n/** Request body of `roles.update`. */\nexport interface RolesUpdateBody {\n  name?: string;\n  description?: string | null;\n}\n\n/** Response body of `roles.update`. */\nexport type RolesUpdateResponse = {\n  data: Role;\n};\n\n/** Request body of `saml_apps.create`. */\nexport interface SamlAppsCreateBody {\n  /** The application's SAML EntityID, unique in this environment. */\n  entity_id: string;\n  /** Where assertions are posted: https (http only on localhost), absolute, no fragment. */\n  acs_url: string;\n  /** The NameID format URN. Default emailAddress. */\n  name_id_format?: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified';\n  /** The person's field the NameID is read from. Default `email`. */\n  name_id_attribute?: string;\n  /** The attributes the assertion carries. Sent, it is the COMPLETE list afterwards. */\n  attribute_mappings?: Array<{\n    /** The attribute name the assertion emits: `email`, `displayName`. */\n    attribute: string;\n    /** The person's field it is read from: `email`, `name`. */\n    field: string;\n  }>;\n  /** Verify the application's signature on every AuthnRequest. Needs a certificate. */\n  want_authn_requests_signed?: boolean;\n  /** The application's signing certificate (PEM). Write-only; left out or null keeps the one on file. */\n  certificate?: string | null;\n  /** The organization that owns the application: only its active members are signed in to it, and the assertion names it. Null makes it environment-wide — every person in the environment may sign in to it. */\n  organization_id?: string | null;\n}\n\n/** Response body of `saml_apps.create`. */\nexport type SamlAppsCreateResponse = {\n  data: SamlApp;\n};\n\n/** Response body of `saml_apps.delete`. */\nexport type SamlAppsDeleteResponse = void;\n\n/** Response body of `saml_apps.get`. */\nexport type SamlAppsGetResponse = {\n  data: SamlApp;\n};\n\n/** Query parameters of `saml_apps.list`. */\nexport interface SamlAppsListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `saml_apps.list`. */\nexport type SamlAppsListResponse = {\n  data: SamlApp[];\n  meta: PageMeta;\n};\n\n/** Request body of `saml_apps.update`. */\nexport interface SamlAppsUpdateBody {\n  /** The application's SAML EntityID, unique in this environment. */\n  entity_id?: string;\n  /** Where assertions are posted: https (http only on localhost), absolute, no fragment. */\n  acs_url?: string;\n  /** The NameID format URN. Default emailAddress. */\n  name_id_format?: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' | 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' | 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified';\n  /** The person's field the NameID is read from. Default `email`. */\n  name_id_attribute?: string;\n  /** The attributes the assertion carries. Sent, it is the COMPLETE list afterwards. */\n  attribute_mappings?: Array<{\n    /** The attribute name the assertion emits: `email`, `displayName`. */\n    attribute: string;\n    /** The person's field it is read from: `email`, `name`. */\n    field: string;\n  }>;\n  /** Verify the application's signature on every AuthnRequest. Needs a certificate. */\n  want_authn_requests_signed?: boolean;\n  /** The application's signing certificate (PEM). Write-only; left out or null keeps the one on file. */\n  certificate?: string | null;\n  /** The organization that owns the application: only its active members are signed in to it, and the assertion names it. Null makes it environment-wide — every person in the environment may sign in to it. */\n  organization_id?: string | null;\n}\n\n/** Response body of `saml_apps.update`. */\nexport type SamlAppsUpdateResponse = {\n  data: SamlApp;\n};\n\n/** Query parameters of `signin.policy.get`. */\nexport interface SigninPolicyGetQuery {\n  /** Read one organization's rules. Left out, the environment baseline. */\n  organization_id?: string;\n}\n\n/** Response body of `signin.policy.get`. */\nexport type SigninPolicyGetResponse = {\n  data: SignInPolicy;\n};\n\n/** Response body of `signin.policy.inherit`. */\nexport type SigninPolicyInheritResponse = void;\n\n/** Request body of `signin.policy.update`. */\nexport interface SigninPolicyUpdateBody {\n  /** Write this organization's override. Left out, the environment baseline. */\n  organization_id?: string | null;\n  /** Minimum password length. */\n  min_length?: number;\n  /** Refuse passwords that appear in known breaches. */\n  require_breach_check?: boolean;\n  /** Days before a password must be changed; null for no limit. */\n  max_age_days?: number | null;\n  /** How many previous passwords may not be reused. */\n  reuse_history?: number;\n  /** Whether a second factor is off, optional or required. */\n  mfa?: 'off' | 'optional' | 'required';\n  /** Whether SSO is off, preferred, or required — `required` refuses every other way in and signs out password sessions. */\n  sso?: 'off' | 'preferred' | 'required';\n  /** Failed attempts before an account is locked; null for the deployment default (10 inside 15 minutes unless CBOX_ID_LOCKOUT_THRESHOLD says otherwise). */\n  lockout_threshold?: number | null;\n  /** Environment only. Whether people may sign in with a passkey, and add one. Off at the deployment (CBOX_ID_PASSKEYS_ENABLED=false) stays off. */\n  passkeys?: boolean;\n  /** Environment only. Whether a one-time sign-in link may be emailed. Off at the deployment (CBOX_ID_MAGIC_LINK_ENABLED=false) stays off. */\n  magic_link?: boolean;\n  /** Environment only. Minutes of inactivity before a session ends; null for the deployment's. No more than the deployment allows (CBOX_ID_SESSION_IDLE_MINUTES). */\n  session_idle_minutes?: number | null;\n  /** Environment only. Minutes a session lasts at most, however active; null for the deployment's. No more than the deployment allows (CBOX_ID_SESSION_TTL_MINUTES). */\n  session_absolute_minutes?: number | null;\n  /** Environment only. Whether a sign-up Radar flags is asked to prove it is a person (Cloudflare Turnstile). Has no effect where the deployment has no Turnstile keys. */\n  bot_challenge?: boolean;\n}\n\n/** Response body of `signin.policy.update`. */\nexport type SigninPolicyUpdateResponse = {\n  data: SignInPolicy;\n};\n\n/** Request body of `signin.self_service_signup.set`. */\nexport interface SigninSelfServiceSignupSetBody {\n  /** On: anyone may create an account and their own organization. Off: people join by invitation. */\n  enabled: boolean;\n}\n\n/** Response body of `signin.self_service_signup.set`. */\nexport type SigninSelfServiceSignupSetResponse = {\n  data: SelfServiceSignup;\n};\n\n/** Response body of `signin.sms.get`. */\nexport type SigninSmsGetResponse = {\n  data: SmsFactorPolicy;\n};\n\n/** Request body of `signin.sms.update`. */\nexport interface SigninSmsUpdateBody {\n  /** Accept text messages as a second factor in this environment. Off by default: SMS is the weakest factor offered. */\n  enabled?: boolean;\n  /** ISO 3166-1 alpha-2 countries whose numbers may enrol and be texted. Required to be non-empty while SMS is on: which countries you text is your toll-fraud exposure. */\n  allowed_countries?: Array<'AC' | 'AD' | 'AE' | 'AF' | 'AG' | 'AI' | 'AL' | 'AM' | 'AO' | 'AR' | 'AS' | 'AT' | 'AU' | 'AW' | 'AZ' | 'BA' | 'BB' | 'BD' | 'BE' | 'BF' | 'BG' | 'BH' | 'BI' | 'BJ' | 'BM' | 'BN' | 'BO' | 'BR' | 'BS' | 'BT' | 'BW' | 'BY' | 'BZ' | 'CA' | 'CD' | 'CF' | 'CG' | 'CH' | 'CI' | 'CK' | 'CL' | 'CM' | 'CN' | 'CO' | 'CR' | 'CU' | 'CV' | 'CW' | 'CY' | 'CZ' | 'DE' | 'DJ' | 'DK' | 'DM' | 'DO' | 'DZ' | 'EC' | 'EE' | 'EG' | 'ER' | 'ES' | 'ET' | 'FI' | 'FJ' | 'FK' | 'FM' | 'FO' | 'FR' | 'GA' | 'GB' | 'GD' | 'GE' | 'GF' | 'GH' | 'GI' | 'GL' | 'GM' | 'GN' | 'GP' | 'GQ' | 'GR' | 'GT' | 'GU' | 'GW' | 'GY' | 'HK' | 'HN' | 'HR' | 'HT' | 'HU' | 'ID' | 'IE' | 'IL' | 'IN' | 'IO' | 'IQ' | 'IR' | 'IS' | 'IT' | 'JM' | 'JO' | 'JP' | 'KE' | 'KG' | 'KH' | 'KI' | 'KM' | 'KN' | 'KP' | 'KR' | 'KW' | 'KY' | 'KZ' | 'LA' | 'LB' | 'LC' | 'LI' | 'LK' | 'LR' | 'LS' | 'LT' | 'LU' | 'LV' | 'LY' | 'MA' | 'MC' | 'MD' | 'ME' | 'MG' | 'MH' | 'MK' | 'ML' | 'MM' | 'MN' | 'MO' | 'MP' | 'MQ' | 'MR' | 'MS' | 'MT' | 'MU' | 'MV' | 'MW' | 'MX' | 'MY' | 'MZ' | 'NA' | 'NC' | 'NE' | 'NF' | 'NG' | 'NI' | 'NL' | 'NO' | 'NP' | 'NR' | 'NU' | 'NZ' | 'OM' | 'PA' | 'PE' | 'PF' | 'PG' | 'PH' | 'PK' | 'PL' | 'PM' | 'PR' | 'PS' | 'PT' | 'PW' | 'PY' | 'QA' | 'RE' | 'RO' | 'RS' | 'RU' | 'RW' | 'SA' | 'SB' | 'SC' | 'SD' | 'SE' | 'SG' | 'SH' | 'SI' | 'SK' | 'SL' | 'SM' | 'SN' | 'SO' | 'SR' | 'SS' | 'ST' | 'SV' | 'SX' | 'SY' | 'SZ' | 'TC' | 'TD' | 'TG' | 'TH' | 'TJ' | 'TK' | 'TL' | 'TM' | 'TN' | 'TO' | 'TR' | 'TT' | 'TV' | 'TW' | 'TZ' | 'UA' | 'UG' | 'US' | 'UY' | 'UZ' | 'VC' | 'VE' | 'VG' | 'VI' | 'VN' | 'VU' | 'WF' | 'WS' | 'XK' | 'YE' | 'ZA' | 'ZM' | 'ZW'>;\n  /** Administrators may add SMS only beside an authenticator app or a passkey, and are asked to enrol one if SMS is all they hold. On by default. */\n  privileged_need_stronger_factor?: boolean;\n}\n\n/** Response body of `signin.sms.update`. */\nexport type SigninSmsUpdateResponse = {\n  data: SmsFactorPolicy;\n};\n\n/** Request body of `signin.social.delete`. */\nexport interface SigninSocialDeleteBody {\n  /** Only remove it if it is this organization's. */\n  organization_id?: string | null;\n}\n\n/** Response body of `signin.social.delete`. */\nexport type SigninSocialDeleteResponse = void;\n\n/** Request body of `signin.social.disable`. */\nexport interface SigninSocialDisableBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `signin.social.disable`. */\nexport type SigninSocialDisableResponse = {\n  data: SocialProvider;\n};\n\n/** Request body of `signin.social.enable`. */\nexport interface SigninSocialEnableBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `signin.social.enable`. */\nexport type SigninSocialEnableResponse = {\n  data: SocialProvider;\n};\n\n/** Request body of `signin.social.inherit`. */\nexport interface SigninSocialInheritBody {\n  /** The organization whose sign-in page this is about. */\n  organization_id: string;\n  /** False to stop offering the environment's provider on this organization's page; true to offer it again. */\n  offered: boolean;\n}\n\n/** Response body of `signin.social.inherit`. */\nexport type SigninSocialInheritResponse = {\n  data: OfferedSocialProviders;\n};\n\n/** Query parameters of `signin.social.list`. */\nexport interface SigninSocialListQuery {\n  /** Only this organization's own providers (not the ones it inherits — see signin.social.offered). */\n  organization_id?: string;\n  /** Only the environment's providers, which every organization inherits, or only organizations' own. */\n  level?: 'environment' | 'organization';\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `signin.social.list`. */\nexport type SigninSocialListResponse = {\n  data: SocialProvider[];\n  meta: PageMeta;\n};\n\n/** Query parameters of `signin.social.offered`. */\nexport interface SigninSocialOfferedQuery {\n  /** The organization whose sign-in page to resolve. Left out, the plain sign-in page, before anybody has said who they are. */\n  organization_id?: string;\n}\n\n/** Response body of `signin.social.offered`. */\nexport type SigninSocialOfferedResponse = {\n  data: OfferedSocialProviders;\n};\n\n/** Request body of `signin.social.set`. */\nexport interface SigninSocialSetBody {\n  /** The organization the provider belongs to. Send this or environment_wide. */\n  organization_id?: string | null;\n  /** True to make the provider the environment's own rather than one organization's. Send this or organization_id. */\n  environment_wide?: boolean;\n  /** The catalogue key: google, microsoft, okta, auth0, keycloak, gitlab, slack, github, discord, apple, facebook, linkedin, bitbucket, xero, intuit. */\n  provider: string;\n  /** The client id from your own account with the provider. For Apple, the Services ID. */\n  client_id: string;\n  /** The client secret. Write-only. Not used by Apple, which signs its own. */\n  client_secret?: string | null;\n  /** What the chosen provider needs besides its client credentials — Microsoft's directory, Okta's domain, Apple's team id, key id and private key. */\n  parameters?: {\n    /** Directory (tenant) ID (Microsoft Entra ID). */\n    directory?: string | null;\n    /** Okta domain (Okta). */\n    domain?: string | null;\n    /** Keycloak host (Keycloak). */\n    host?: string | null;\n    /** Key ID (Apple). */\n    key_id?: string | null;\n    /** Private key (.p8) (Apple). */\n    private_key?: string | null;\n    /** Realm (Keycloak). */\n    realm?: string | null;\n    /** Team ID (Apple). */\n    team_id?: string | null;\n  };\n  /** Extra scopes to request beyond the ones sign-in needs (for example `read:org` on GitHub). Replaces any extra scopes already set; an empty list removes them. */\n  scopes?: string[];\n  /** A ULID to create the provider under, so its redirect URI (which contains the id) can be registered with the provider first. Left out, one is minted. */\n  reserved_id?: string | null;\n}\n\n/** Response body of `signin.social.set`. */\nexport type SigninSocialSetResponse = {\n  data: SocialProvider;\n};\n\n/** Request body of `signin.social.update`. */\nexport interface SigninSocialUpdateBody {\n  /** Only change it if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n  /** A new client id. For Apple, the Services ID. */\n  client_id?: string;\n  /** A new client secret. Write-only; left out or blank keeps the one on file. */\n  client_secret?: string | null;\n  /** What the chosen provider needs besides its client credentials — Microsoft's directory, Okta's domain, Apple's team id, key id and private key. */\n  parameters?: {\n    /** Directory (tenant) ID (Microsoft Entra ID). */\n    directory?: string | null;\n    /** Okta domain (Okta). */\n    domain?: string | null;\n    /** Keycloak host (Keycloak). */\n    host?: string | null;\n    /** Key ID (Apple). */\n    key_id?: string | null;\n    /** Private key (.p8) (Apple). */\n    private_key?: string | null;\n    /** Realm (Keycloak). */\n    realm?: string | null;\n    /** Team ID (Apple). */\n    team_id?: string | null;\n  };\n  /** Extra scopes to request beyond the ones sign-in needs (for example `read:org` on GitHub). Replaces any extra scopes already set; an empty list removes them. */\n  scopes?: string[];\n}\n\n/** Response body of `signin.social.update`. */\nexport type SigninSocialUpdateResponse = {\n  data: SocialProvider;\n};\n\n/** Request body of `sod_policies.create`. */\nexport interface SodPoliciesCreateBody {\n  /** The organization the rule belongs to. Send this or environment_wide. */\n  organization_id?: string | null;\n  /** True to make the rule the environment's own rather than one organization's. Send this or organization_id. */\n  environment_wide?: boolean;\n  /** What the rule is for: \"Payments maker/checker\". */\n  name: string;\n  /** Why the roles conflict. */\n  description?: string | null;\n  /** The roles no one person may hold together; at least two. */\n  role_ids: string[];\n}\n\n/** Response body of `sod_policies.create`. */\nexport type SodPoliciesCreateResponse = {\n  data: SodPolicy;\n};\n\n/** Request body of `sod_policies.delete`. */\nexport interface SodPoliciesDeleteBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `sod_policies.delete`. */\nexport type SodPoliciesDeleteResponse = void;\n\n/** Query parameters of `sod_policies.get`. */\nexport interface SodPoliciesGetQuery {\n  /** Only if it binds this organization (its own, or environment-wide); anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `sod_policies.get`. */\nexport type SodPoliciesGetResponse = {\n  data: SodPolicy;\n};\n\n/** Query parameters of `sod_policies.list`. */\nexport interface SodPoliciesListQuery {\n  /** Only the rules binding this organization: its own and the environment-wide ones. */\n  organization_id?: string | null;\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `sod_policies.list`. */\nexport type SodPoliciesListResponse = {\n  data: SodPolicy[];\n  meta: PageMeta;\n};\n\n/** Request body of `sod_policies.status.set`. */\nexport interface SodPoliciesStatusSetBody {\n  /** true to enforce the rule, false to stop enforcing it. */\n  active: boolean;\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `sod_policies.status.set`. */\nexport type SodPoliciesStatusSetResponse = {\n  data: SodPolicy;\n};\n\n/** Request body of `sso.connections.activate`. */\nexport interface SsoConnectionsActivateBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `sso.connections.activate`. */\nexport type SsoConnectionsActivateResponse = {\n  data: SsoConnection;\n};\n\n/** Request body of `sso.connections.certificates.activate`. */\nexport interface SsoConnectionsCertificatesActivateBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n  /** The staged certificate's SHA-256 fingerprint, as the certificate list gives it. */\n  fingerprint_sha256: string;\n}\n\n/** Response body of `sso.connections.certificates.activate`. */\nexport type SsoConnectionsCertificatesActivateResponse = {\n  data: SsoCertificates;\n};\n\n/** Query parameters of `sso.connections.certificates.list`. */\nexport interface SsoConnectionsCertificatesListQuery {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `sso.connections.certificates.list`. */\nexport type SsoConnectionsCertificatesListResponse = {\n  data: SsoCertificates;\n};\n\n/** Request body of `sso.connections.certificates.stage`. */\nexport interface SsoConnectionsCertificatesStageBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n  /** The new signing certificate, PEM. Send this or metadata. */\n  certificate?: string | null;\n  /** The identity provider's metadata XML, or the https URL it is published at. Send this or certificate. */\n  metadata?: string | null;\n}\n\n/** Response body of `sso.connections.certificates.stage`. */\nexport type SsoConnectionsCertificatesStageResponse = {\n  data: SsoCertificates;\n};\n\n/** Request body of `sso.connections.create`. */\nexport interface SsoConnectionsCreateBody {\n  /** The organization the connection belongs to. Send this or environment_wide. */\n  organization_id?: string | null;\n  /** True to make the connection the environment's own rather than one organization's. Send this or organization_id. */\n  environment_wide?: boolean;\n  /** What administrators call it: \"Okta\", \"Entra ID\". */\n  name: string;\n  /** saml or oidc. The config fields of that type are required, unless pending_idp. */\n  type: 'saml' | 'oidc';\n  /** True to create the draft before the identity provider's details are known: the answer's service_provider is what to paste into it. Complete it with update before activating. */\n  pending_idp?: boolean;\n  /** SAML: the identity provider's entity id. */\n  idp_entity_id?: string | null;\n  /** SAML: the identity provider's single sign-on URL. */\n  idp_sso_url?: string | null;\n  /** SAML: the identity provider's signing certificate (PEM). Write-only. */\n  idp_x509cert?: string | null;\n  /** SAML: the entity id this environment presents as the service provider. Left out on create, this connection's own. */\n  sp_entity_id?: string | null;\n  /** SAML: where the identity provider posts its assertions. Left out on create, this connection's own ACS URL. */\n  sp_acs_url?: string | null;\n  /** OIDC: the provider's issuer URL; its endpoints are discovered from it. */\n  issuer?: string | null;\n  /** OIDC: the client id registered at the provider. */\n  client_id?: string | null;\n  /** OIDC: the client secret. Write-only. */\n  client_secret?: string | null;\n  /** OIDC, optional: the provider's ID-token signing key (an RS256 public key, PEM). Leave it out for any provider whose discovery document publishes a jwks_uri — the keys are read from there and follow its rotations. Needed only when it does not. Write-only. */\n  signing_key?: string | null;\n}\n\n/** Response body of `sso.connections.create`. */\nexport type SsoConnectionsCreateResponse = {\n  data: SsoConnection;\n};\n\n/** Request body of `sso.connections.delete`. */\nexport interface SsoConnectionsDeleteBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `sso.connections.delete`. */\nexport type SsoConnectionsDeleteResponse = void;\n\n/** Request body of `sso.connections.disable`. */\nexport interface SsoConnectionsDisableBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `sso.connections.disable`. */\nexport type SsoConnectionsDisableResponse = {\n  data: SsoConnection;\n};\n\n/** Query parameters of `sso.connections.get`. */\nexport interface SsoConnectionsGetQuery {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `sso.connections.get`. */\nexport type SsoConnectionsGetResponse = {\n  data: SsoConnection;\n};\n\n/** Query parameters of `sso.connections.list`. */\nexport interface SsoConnectionsListQuery {\n  /** Only this organization's. */\n  organization_id?: string | null;\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `sso.connections.list`. */\nexport type SsoConnectionsListResponse = {\n  data: SsoConnection[];\n  meta: PageMeta;\n};\n\n/** Request body of `sso.connections.require_sso`. */\nexport interface SsoConnectionsRequireSsoBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `sso.connections.require_sso`. */\nexport type SsoConnectionsRequireSsoResponse = {\n  data: SignInPolicy;\n};\n\n/** Request body of `sso.connections.update`. */\nexport interface SsoConnectionsUpdateBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n  /** A new name. */\n  name?: string;\n  /** SAML: the identity provider's entity id. */\n  idp_entity_id?: string | null;\n  /** SAML: the identity provider's single sign-on URL. */\n  idp_sso_url?: string | null;\n  /** SAML: the identity provider's signing certificate (PEM). Write-only. */\n  idp_x509cert?: string | null;\n  /** SAML: the entity id this environment presents as the service provider. Left out on create, this connection's own. */\n  sp_entity_id?: string | null;\n  /** SAML: where the identity provider posts its assertions. Left out on create, this connection's own ACS URL. */\n  sp_acs_url?: string | null;\n  /** OIDC: the provider's issuer URL; its endpoints are discovered from it. */\n  issuer?: string | null;\n  /** OIDC: the client id registered at the provider. */\n  client_id?: string | null;\n  /** OIDC: the client secret. Write-only. */\n  client_secret?: string | null;\n  /** OIDC, optional: the provider's ID-token signing key (an RS256 public key, PEM). Leave it out for any provider whose discovery document publishes a jwks_uri — the keys are read from there and follow its rotations. Needed only when it does not. Write-only. */\n  signing_key?: string | null;\n}\n\n/** Response body of `sso.connections.update`. */\nexport type SsoConnectionsUpdateResponse = {\n  data: SsoConnection;\n};\n\n/** Request body of `sso.domains.capture`. */\nexport interface SsoDomainsCaptureBody {\n  /** true to capture the domain, false to release it. */\n  capture: boolean;\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `sso.domains.capture`. */\nexport type SsoDomainsCaptureResponse = {\n  data: SsoDomain;\n};\n\n/** Request body of `sso.domains.create`. */\nexport interface SsoDomainsCreateBody {\n  /** The organization claiming it. */\n  organization_id: string;\n  /** The email domain, e.g. acme.com. */\n  domain: string;\n}\n\n/** Response body of `sso.domains.create`. */\nexport type SsoDomainsCreateResponse = {\n  data: SsoDomain;\n};\n\n/** Request body of `sso.domains.delete`. */\nexport interface SsoDomainsDeleteBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `sso.domains.delete`. */\nexport type SsoDomainsDeleteResponse = void;\n\n/** Query parameters of `sso.domains.list`. */\nexport interface SsoDomainsListQuery {\n  /** Only this organization's. */\n  organization_id?: string | null;\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `sso.domains.list`. */\nexport type SsoDomainsListResponse = {\n  data: SsoDomain[];\n  meta: PageMeta;\n};\n\n/** Request body of `sso.domains.verify`. */\nexport interface SsoDomainsVerifyBody {\n  /** Only if it is this organization's; anything else is a 404. */\n  organization_id?: string | null;\n}\n\n/** Response body of `sso.domains.verify`. */\nexport type SsoDomainsVerifyResponse = {\n  data: SsoDomain;\n};\n\n/** Request body of `sso.saml_metadata.import`. */\nexport interface SsoSamlMetadataImportBody {\n  /** The IdP metadata XML, or an https URL it is published at. */\n  metadata: string;\n}\n\n/** Response body of `sso.saml_metadata.import`. */\nexport type SsoSamlMetadataImportResponse = {\n  data: SamlMetadata;\n};\n\n/** Response body of `support_sessions.end`. */\nexport type SupportSessionsEndResponse = void;\n\n/** Request body of `support_sessions.start`. */\nexport interface SupportSessionsStartBody {\n  /** The customer's user to act as. */\n  user_id: string;\n  organization_id: string;\n  /** The app's public client id. */\n  client_id: string;\n  /** Your staff member. */\n  actor_user_id: string;\n  /** Shown to the customer. */\n  reason: string;\n  ttl_minutes?: number;\n  /** Narrowed to the app's registration; omitted means all of it. */\n  scopes?: string[];\n  redirect_uri?: string;\n  code_challenge?: string;\n  nonce?: string | null;\n}\n\n/** Response body of `support_sessions.start`. */\nexport type SupportSessionsStartResponse = {\n  data: SupportSession;\n};\n\n/** Request body of `token_vault.grants.create`. */\nexport interface TokenVaultGrantsCreateBody {\n  /** The organization whose vault this is. Left out: the environment's own secrets, a separate collection. */\n  organization_id?: string | null;\n  /** The OAuth client id of the app that may lease it. */\n  client_id: string;\n}\n\n/** Response body of `token_vault.grants.create`. */\nexport type TokenVaultGrantsCreateResponse = {\n  data: TokenVaultSecret;\n};\n\n/** Request body of `token_vault.grants.delete`. */\nexport interface TokenVaultGrantsDeleteBody {\n  /** The organization whose vault this is. Left out: the environment's own secrets, a separate collection. */\n  organization_id?: string | null;\n}\n\n/** Response body of `token_vault.grants.delete`. */\nexport type TokenVaultGrantsDeleteResponse = void;\n\n/** Request body of `token_vault.secrets.create`. */\nexport interface TokenVaultSecretsCreateBody {\n  /** The organization whose vault this is. Left out: the environment's own secrets, a separate collection. */\n  organization_id?: string | null;\n  /** What it is: \"Stripe live key\". */\n  name: string;\n  /** Whose credential it is: \"stripe\", \"openai\". */\n  provider: string;\n  /** The credential. Write-only: sealed, never returned. */\n  secret: string;\n}\n\n/** Response body of `token_vault.secrets.create`. */\nexport type TokenVaultSecretsCreateResponse = {\n  data: TokenVaultSecret;\n};\n\n/** Query parameters of `token_vault.secrets.get`. */\nexport interface TokenVaultSecretsGetQuery {\n  /** The organization whose vault this is. Left out: the environment's own secrets, a separate collection. */\n  organization_id?: string | null;\n}\n\n/** Response body of `token_vault.secrets.get`. */\nexport type TokenVaultSecretsGetResponse = {\n  data: TokenVaultSecret;\n};\n\n/** Query parameters of `token_vault.secrets.list`. */\nexport interface TokenVaultSecretsListQuery {\n  /** The organization whose vault this is. Left out: the environment's own secrets, a separate collection. */\n  organization_id?: string | null;\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `token_vault.secrets.list`. */\nexport type TokenVaultSecretsListResponse = {\n  data: TokenVaultSecret[];\n  meta: PageMeta;\n};\n\n/** Request body of `token_vault.secrets.revoke`. */\nexport interface TokenVaultSecretsRevokeBody {\n  /** The organization whose vault this is. Left out: the environment's own secrets, a separate collection. */\n  organization_id?: string | null;\n}\n\n/** Response body of `token_vault.secrets.revoke`. */\nexport type TokenVaultSecretsRevokeResponse = {\n  data: TokenVaultSecret;\n};\n\n/** Request body of `token_vault.secrets.rotate`. */\nexport interface TokenVaultSecretsRotateBody {\n  /** The organization whose vault this is. Left out: the environment's own secrets, a separate collection. */\n  organization_id?: string | null;\n  /** The new value. Write-only: sealed, never returned. */\n  secret: string;\n}\n\n/** Response body of `token_vault.secrets.rotate`. */\nexport type TokenVaultSecretsRotateResponse = {\n  data: TokenVaultSecret;\n};\n\n/** Request body of `users.create`. */\nexport interface UsersCreateBody {\n  email: string;\n  name?: string | null;\n  /** Checked against this environment's password policy (`422 password_policy`). */\n  password?: string | null;\n  /** Mail the new user a one-click sign-in link. */\n  send_sign_in_link?: boolean;\n}\n\n/** Response body of `users.create`. */\nexport type UsersCreateResponse = {\n  data?: User;\n};\n\n/** Response body of `users.deactivate`. */\nexport type UsersDeactivateResponse = {\n  data?: User;\n};\n\n/** Query parameters of `users.environment_roles.get`. */\nexport interface UsersEnvironmentRolesGetQuery {\n  /** The app whose manifest `key` `{role_id}` is. Not needed when `{role_id}` is an id. */\n  client_id?: string;\n}\n\n/** Response body of `users.environment_roles.get`. */\nexport type UsersEnvironmentRolesGetResponse = {\n  data: RoleAssignment;\n};\n\n/** Query parameters of `users.environment_roles.grant`. */\nexport interface UsersEnvironmentRolesGrantQuery {\n  /** The app whose manifest `key` `{role_id}` is. Not needed when `{role_id}` is an id. */\n  client_id?: string;\n}\n\n/** Response body of `users.environment_roles.grant`. */\nexport type UsersEnvironmentRolesGrantResponse = {\n  data: RoleAssignment;\n};\n\n/** Response body of `users.environment_roles.list`. */\nexport type UsersEnvironmentRolesListResponse = {\n  data: RoleAssignment[];\n};\n\n/** Query parameters of `users.environment_roles.revoke`. */\nexport interface UsersEnvironmentRolesRevokeQuery {\n  /** The app whose manifest `key` `{role_id}` is. Not needed when `{role_id}` is an id. */\n  client_id?: string;\n}\n\n/** Response body of `users.environment_roles.revoke`. */\nexport type UsersEnvironmentRolesRevokeResponse = void;\n\n/** Response body of `users.erase`. */\nexport type UsersEraseResponse = {\n  data: ErasureReceipt;\n};\n\n/** Response body of `users.get`. */\nexport type UsersGetResponse = {\n  data?: User;\n};\n\n/** Query parameters of `users.list`. */\nexport interface UsersListQuery {\n  limit?: number;\n  /** Opaque cursor — the `meta.next_cursor` from the previous page. */\n  after?: string;\n  email?: string;\n  /** A fragment of the address or the name. */\n  q?: string;\n  status?: 'active' | 'disabled' | 'locked';\n}\n\n/** Response body of `users.list`. */\nexport type UsersListResponse = {\n  data?: User[];\n  meta?: PageMeta;\n};\n\n/** Response body of `users.mfa.reset`. */\nexport type UsersMfaResetResponse = void;\n\n/** Response body of `users.mfa.sms.remove`. */\nexport type UsersMfaSmsRemoveResponse = void;\n\n/** Response body of `users.password_reset.send`. */\nexport type UsersPasswordResetSendResponse = void;\n\n/** Request body of `users.password.set`. */\nexport interface UsersPasswordSetBody {\n  /** The new password. Checked against this environment's password policy. */\n  password: string;\n  /** Why — recorded on the audit trail. */\n  reason: string;\n  /** The user must choose a new password at their next sign-in. Default true. */\n  temporary?: boolean;\n  /** A temporary password stops working after this many hours. 0 or absent: until changed. */\n  expires_in_hours?: number;\n  /** How much existing access to end. Default `sessions_and_tokens`. */\n  revoke?: 'sessions_and_tokens' | 'sessions_only' | 'nothing';\n  /** Mail the password to the user. Default true. */\n  send_email?: boolean;\n}\n\n/** Response body of `users.password.set`. */\nexport type UsersPasswordSetResponse = {\n  data: User;\n};\n\n/** Response body of `users.reactivate`. */\nexport type UsersReactivateResponse = {\n  data: User;\n};\n\n/** Response body of `users.sessions.list`. */\nexport type UsersSessionsListResponse = {\n  data: UserSession[];\n};\n\n/** Response body of `users.sessions.revoke`. */\nexport type UsersSessionsRevokeResponse = void;\n\n/** Response body of `users.sessions.revoke_all`. */\nexport type UsersSessionsRevokeAllResponse = void;\n\n/** Request body of `users.update`. */\nexport interface UsersUpdateBody {\n  name?: string | null;\n  /** The new address. Its verification is cleared. */\n  email?: string;\n}\n\n/** Response body of `users.update`. */\nexport type UsersUpdateResponse = {\n  data: User;\n};\n\n/** Response body of `users.verification.send`. */\nexport type UsersVerificationSendResponse = void;\n\n/** Response body of `users.verify`. */\nexport type UsersVerifyResponse = {\n  data: User;\n};\n\n/** Request body of `webhooks.create`. */\nexport interface WebhooksCreateBody {\n  /** A public HTTPS URL. Signed deliveries are POSTed here. */\n  url: string;\n  /** The events it receives. */\n  event_types: Array<'user.created' | 'user.updated' | 'user.deactivated' | 'user.login' | 'user.reactivated' | 'identity.linked' | 'user.erased' | 'organization.created' | 'organization.suspended' | 'organization.reactivated' | 'organization.updated' | 'organization.deleted' | 'membership.created' | 'membership.updated' | 'membership.deleted' | 'invitation.created' | 'invitation.accepted' | 'invitation.revoked' | 'role.assigned' | 'role.unassigned' | 'role.assigned_everywhere' | 'role.unassigned_everywhere' | 'api_key.created' | 'api_key.revoked' | 'support_session.started' | 'directory.user.provisioned' | 'directory.user.deprovisioned' | 'directory.user.deactivated' | 'directory.group.membership_changed' | 'domain.added' | 'domain.removed' | 'domain.verified' | 'connection.activated' | 'connection.certificate_expiring' | 'entitlement.set' | 'entitlement.updated' | 'entitlement.revoked' | 'vault.grant.created' | 'vault.grant.revoked' | 'vault.secret.revoked' | 'pipe.connection.connected' | 'pipe.connection.needs_reauth' | 'pipe.connection.disconnected' | 'governance.access.revoked' | 'feature_flag.created' | 'feature_flag.updated' | 'feature_flag.deleted'>;\n  /** How deliveries are signed: `cbox` (X-Cbox-Signature, the default) or `standard_webhooks` (webhook-id / webhook-timestamp / webhook-signature, verifiable with any Standard Webhooks library; the secret is a `whsec_` secret). */\n  signature_scheme?: 'cbox' | 'standard_webhooks';\n  /** The organization it belongs to; it carries that organization's traffic only. Send this or environment_wide. */\n  organization_id?: string | null;\n  /** True to make it the environment's own, carrying EVERY organization's traffic. Send this or organization_id. */\n  environment_wide?: boolean;\n}\n\n/** Response body of `webhooks.create`. */\nexport type WebhooksCreateResponse = {\n  data: Webhook;\n};\n\n/** Response body of `webhooks.delete`. */\nexport type WebhooksDeleteResponse = void;\n\n/** Response body of `webhooks.get`. */\nexport type WebhooksGetResponse = {\n  data: Webhook;\n};\n\n/** Query parameters of `webhooks.list`. */\nexport interface WebhooksListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The `next_cursor` of the previous page. */\n  after?: string;\n}\n\n/** Response body of `webhooks.list`. */\nexport type WebhooksListResponse = {\n  data: Webhook[];\n  meta: PageMeta;\n};\n\n/** Response body of `webhooks.pause`. */\nexport type WebhooksPauseResponse = {\n  data: Webhook;\n};\n\n/** Response body of `webhooks.resume`. */\nexport type WebhooksResumeResponse = {\n  data: Webhook;\n};\n\n/** Response body of `webhooks.secret.rotate`. */\nexport type WebhooksSecretRotateResponse = {\n  data: Webhook;\n};\n\n/** Request body of `webhooks.signature_scheme.change`. */\nexport interface WebhooksSignatureSchemeChangeBody {\n  /** The scheme deliveries are signed with from the next attempt. The secret is unchanged: under `standard_webhooks` a 64-hex secret is used as `whsec_` + base64 of the hex string. Update the receiver before you switch. */\n  signature_scheme: 'cbox' | 'standard_webhooks';\n}\n\n/** Response body of `webhooks.signature_scheme.change`. */\nexport type WebhooksSignatureSchemeChangeResponse = {\n  data: Webhook;\n};\n\n/** Request body of `webhooks.update`. */\nexport interface WebhooksUpdateBody {\n  /** A public HTTPS URL. Left out, unchanged. */\n  url?: string;\n  /** The COMPLETE set of events afterwards. Left out, unchanged. */\n  event_types?: string[];\n}\n\n/** Response body of `webhooks.update`. */\nexport type WebhooksUpdateResponse = {\n  data: Webhook;\n};\n\n// ── Operations ─────────────────────────────────────────────────────────────────────────────\n\n/** Every operation of the Cbox ID — Environment Management API — method, path, scope and danger — keyed by action name. */\nexport const environmentOperations = {\n  'access_reviews.close': { action: 'access_reviews.close', operationId: 'access_reviews_close', method: 'POST', path: '/access-reviews/{id}/close', pathParams: ['id'], scope: 'governance:write', danger: 'destructive', approval: true, body: true, pagination: null },\n  'access_reviews.create': { action: 'access_reviews.create', operationId: 'access_reviews_create', method: 'POST', path: '/access-reviews', pathParams: [], scope: 'governance:write', danger: 'write', approval: true, body: true, pagination: null },\n  'access_reviews.get': { action: 'access_reviews.get', operationId: 'access_reviews_get', method: 'GET', path: '/access-reviews/{id}', pathParams: ['id'], scope: 'governance:read', danger: 'read', approval: true, body: false, pagination: null },\n  'access_reviews.items.decide': { action: 'access_reviews.items.decide', operationId: 'access_reviews_items_decide', method: 'POST', path: '/access-reviews/{id}/items/{item_id}', pathParams: ['id', 'item_id'], scope: 'governance:write', danger: 'write', approval: true, body: true, pagination: null },\n  'access_reviews.items.list': { action: 'access_reviews.items.list', operationId: 'access_reviews_items_list', method: 'GET', path: '/access-reviews/{id}/items', pathParams: ['id'], scope: 'governance:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'access_reviews.list': { action: 'access_reviews.list', operationId: 'access_reviews_list', method: 'GET', path: '/access-reviews', pathParams: [], scope: 'governance:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'action_approvals.get': { action: null, operationId: null, method: 'GET', path: '/action-approvals/{id}', pathParams: ['id'], scope: null, danger: null, approval: false, body: false, pagination: null },\n  'api_keys.list': { action: 'api_keys.list', operationId: 'api_keys_list', method: 'GET', path: '/organizations/{organization_id}/api-keys', pathParams: ['organization_id'], scope: 'api_keys:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'api_keys.revoke': { action: 'api_keys.revoke', operationId: 'api_keys_revoke', method: 'DELETE', path: '/api-keys/{id}', pathParams: ['id'], scope: 'api_keys:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'apis.create': { action: 'apis.create', operationId: null, method: 'POST', path: '/apis', pathParams: [], scope: 'apis:write', danger: 'write', approval: true, body: true, pagination: null },\n  'apis.delete': { action: 'apis.delete', operationId: null, method: 'DELETE', path: '/apis/{id}', pathParams: ['id'], scope: 'apis:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'apis.get': { action: 'apis.get', operationId: null, method: 'GET', path: '/apis/{id}', pathParams: ['id'], scope: 'apis:read', danger: 'read', approval: true, body: false, pagination: null },\n  'apis.list': { action: 'apis.list', operationId: null, method: 'GET', path: '/apis', pathParams: [], scope: 'apis:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'apis.scopes.define': { action: 'apis.scopes.define', operationId: 'apis_scopes_define', method: 'PUT', path: '/apis/{id}/scopes/{key}', pathParams: ['id', 'key'], scope: 'apis:write', danger: 'write', approval: true, body: true, pagination: null },\n  'apis.scopes.remove': { action: 'apis.scopes.remove', operationId: 'apis_scopes_remove', method: 'DELETE', path: '/apis/{id}/scopes/{key}', pathParams: ['id', 'key'], scope: 'apis:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'apis.update': { action: 'apis.update', operationId: null, method: 'PATCH', path: '/apis/{id}', pathParams: ['id'], scope: 'apis:write', danger: 'write', approval: true, body: true, pagination: null },\n  'approvals.deny': { action: 'approvals.deny', operationId: 'approvals_deny', method: 'POST', path: '/agent-requests/{request_id}/deny', pathParams: ['request_id'], scope: 'approvals:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'approvals.list': { action: 'approvals.list', operationId: 'approvals_list', method: 'GET', path: '/agent-requests', pathParams: [], scope: 'approvals:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'apps.blueprint': { action: 'apps.blueprint', operationId: 'apps_blueprint', method: 'GET', path: '/apps/{id}/blueprint', pathParams: ['id'], scope: 'apps:read', danger: 'read', approval: true, body: false, pagination: null },\n  'apps.copy': { action: 'apps.copy', operationId: 'apps_copy', method: 'POST', path: '/apps/{id}/copy', pathParams: ['id'], scope: 'apps:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'apps.create': { action: 'apps.create', operationId: 'apps_create', method: 'POST', path: '/apps', pathParams: [], scope: 'apps:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'apps.delete': { action: 'apps.delete', operationId: 'apps_delete', method: 'DELETE', path: '/apps/{id}', pathParams: ['id'], scope: 'apps:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'apps.get': { action: 'apps.get', operationId: 'apps_get', method: 'GET', path: '/apps/{id}', pathParams: ['id'], scope: 'apps:read', danger: 'read', approval: true, body: false, pagination: null },\n  'apps.list': { action: 'apps.list', operationId: 'apps_list', method: 'GET', path: '/apps', pathParams: [], scope: 'apps:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'apps.manifest.set': { action: 'apps.manifest.set', operationId: 'apps_manifest_set', method: 'PUT', path: '/apps/{id}/manifest', pathParams: ['id'], scope: 'apps:write', danger: 'write', approval: true, body: true, pagination: null },\n  'apps.manifest.sync': { action: 'apps.manifest.sync', operationId: 'apps_manifest_sync', method: 'POST', path: '/apps/{id}/manifest/sync', pathParams: ['id'], scope: 'apps:write', danger: 'write', approval: true, body: false, pagination: null },\n  'apps.scopes.set': { action: 'apps.scopes.set', operationId: 'apps_scopes_set', method: 'PUT', path: '/apps/{id}/scopes', pathParams: ['id'], scope: 'apps:write', danger: 'write', approval: true, body: true, pagination: null },\n  'apps.secrets.list': { action: 'apps.secrets.list', operationId: 'apps_secrets_list', method: 'GET', path: '/apps/{id}/secrets', pathParams: ['id'], scope: 'apps:read', danger: 'read', approval: true, body: false, pagination: null },\n  'apps.secrets.revoke': { action: 'apps.secrets.revoke', operationId: 'apps_secrets_revoke', method: 'DELETE', path: '/apps/{id}/secrets/{secret_id}', pathParams: ['id', 'secret_id'], scope: 'apps:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'apps.secrets.rotate': { action: 'apps.secrets.rotate', operationId: 'apps_secrets_rotate', method: 'POST', path: '/apps/{id}/secrets', pathParams: ['id'], scope: 'apps:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'apps.settings.api_key_prefix': { action: 'apps.settings.api_key_prefix', operationId: 'apps_settings_api_key_prefix', method: 'PUT', path: '/apps/{id}/settings/api-key-prefix', pathParams: ['id'], scope: 'apps:write', danger: 'write', approval: true, body: true, pagination: null },\n  'apps.settings.backchannel_logout': { action: 'apps.settings.backchannel_logout', operationId: 'apps_settings_backchannel_logout', method: 'PUT', path: '/apps/{id}/settings/backchannel-logout', pathParams: ['id'], scope: 'apps:write', danger: 'write', approval: true, body: true, pagination: null },\n  'apps.settings.token_exchange': { action: 'apps.settings.token_exchange', operationId: 'apps_settings_token_exchange', method: 'PUT', path: '/apps/{id}/settings/token-exchange', pathParams: ['id'], scope: 'apps:write', danger: 'write', approval: true, body: true, pagination: null },\n  'apps.settings.token_lifetime': { action: 'apps.settings.token_lifetime', operationId: 'apps_settings_token_lifetime', method: 'PUT', path: '/apps/{id}/settings/token-lifetime', pathParams: ['id'], scope: 'apps:write', danger: 'write', approval: true, body: true, pagination: null },\n  'apps.update': { action: 'apps.update', operationId: 'apps_update', method: 'PATCH', path: '/apps/{id}', pathParams: ['id'], scope: 'apps:write', danger: 'write', approval: true, body: true, pagination: null },\n  'audit_logs.events.create': { action: 'audit_logs.events.create', operationId: 'audit_logs_events_create', method: 'POST', path: '/audit-logs/events', pathParams: [], scope: 'audit_logs:write', danger: 'write', approval: true, body: true, pagination: null },\n  'audit_logs.events.list': { action: 'audit_logs.events.list', operationId: 'audit_logs_events_list', method: 'GET', path: '/audit-logs/events', pathParams: [], scope: 'audit_logs:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'audit_logs.exports.create': { action: 'audit_logs.exports.create', operationId: 'audit_logs_exports_create', method: 'POST', path: '/audit-logs/exports', pathParams: [], scope: 'audit_logs:export', danger: 'write', approval: true, body: true, pagination: null },\n  'audit_logs.exports.get': { action: 'audit_logs.exports.get', operationId: 'audit_logs_exports_get', method: 'GET', path: '/audit-logs/exports/{id}', pathParams: ['id'], scope: 'audit_logs:read', danger: 'read', approval: true, body: false, pagination: null },\n  'audit_logs.schemas.create': { action: 'audit_logs.schemas.create', operationId: 'audit_logs_schemas_create', method: 'POST', path: '/audit-logs/schemas', pathParams: [], scope: 'audit_logs:manage', danger: 'write', approval: true, body: true, pagination: null },\n  'audit_logs.schemas.delete': { action: 'audit_logs.schemas.delete', operationId: 'audit_logs_schemas_delete', method: 'DELETE', path: '/audit-logs/schemas/{action}', pathParams: ['action'], scope: 'audit_logs:manage', danger: 'destructive', approval: true, body: false, pagination: null },\n  'audit_logs.schemas.get': { action: 'audit_logs.schemas.get', operationId: 'audit_logs_schemas_get', method: 'GET', path: '/audit-logs/schemas/{action}', pathParams: ['action'], scope: 'audit_logs:read', danger: 'read', approval: true, body: false, pagination: null },\n  'audit_logs.schemas.list': { action: 'audit_logs.schemas.list', operationId: 'audit_logs_schemas_list', method: 'GET', path: '/audit-logs/schemas', pathParams: [], scope: 'audit_logs:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'audit_logs.schemas.update': { action: 'audit_logs.schemas.update', operationId: 'audit_logs_schemas_update', method: 'PUT', path: '/audit-logs/schemas/{action}', pathParams: ['action'], scope: 'audit_logs:manage', danger: 'write', approval: true, body: true, pagination: null },\n  'audit_logs.settings.get': { action: 'audit_logs.settings.get', operationId: 'audit_logs_settings_get', method: 'GET', path: '/audit-logs/settings', pathParams: [], scope: 'audit_logs:read', danger: 'read', approval: true, body: false, pagination: null },\n  'audit_logs.settings.update': { action: 'audit_logs.settings.update', operationId: 'audit_logs_settings_update', method: 'PATCH', path: '/audit-logs/settings', pathParams: [], scope: 'audit_logs:manage', danger: 'destructive', approval: true, body: true, pagination: null },\n  'audit_logs.verify': { action: 'audit_logs.verify', operationId: 'audit_logs_verify', method: 'GET', path: '/audit-logs/verify', pathParams: [], scope: 'audit_logs:read', danger: 'read', approval: true, body: false, pagination: null },\n  'audit.list': { action: 'audit.list', operationId: 'audit_list', method: 'GET', path: '/audit-log', pathParams: [], scope: 'audit:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'branding.appearance.get': { action: 'branding.appearance.get', operationId: 'branding_appearance_get', method: 'GET', path: '/branding/appearance', pathParams: [], scope: 'branding:read', danger: 'read', approval: true, body: false, pagination: null },\n  'branding.appearance.set': { action: 'branding.appearance.set', operationId: 'branding_appearance_set', method: 'PUT', path: '/branding/appearance', pathParams: [], scope: 'branding:write', danger: 'write', approval: true, body: true, pagination: null },\n  'branding.whitelabel.get': { action: 'branding.whitelabel.get', operationId: 'branding_whitelabel_get', method: 'GET', path: '/branding/whitelabel', pathParams: [], scope: 'branding:read', danger: 'read', approval: true, body: false, pagination: null },\n  'branding.whitelabel.set': { action: 'branding.whitelabel.set', operationId: 'branding_whitelabel_set', method: 'PUT', path: '/branding/whitelabel', pathParams: [], scope: 'branding:write', danger: 'write', approval: true, body: true, pagination: null },\n  'directories.connect': { action: 'directories.connect', operationId: 'directories_connect', method: 'POST', path: '/directories/connect', pathParams: [], scope: 'directory_sync:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'directories.create': { action: 'directories.create', operationId: 'directories_create', method: 'POST', path: '/directories', pathParams: [], scope: 'directory_sync:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'directories.credentials.replace': { action: 'directories.credentials.replace', operationId: 'directories_credentials_replace', method: 'PUT', path: '/directories/{id}/credentials', pathParams: ['id'], scope: 'directory_sync:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'directories.delete': { action: 'directories.delete', operationId: 'directories_delete', method: 'DELETE', path: '/directories/{id}', pathParams: ['id'], scope: 'directory_sync:write', danger: 'destructive', approval: true, body: true, pagination: null },\n  'directories.get': { action: 'directories.get', operationId: 'directories_get', method: 'GET', path: '/directories/{id}', pathParams: ['id'], scope: 'directory_sync:read', danger: 'read', approval: true, body: false, pagination: null },\n  'directories.groups.list': { action: 'directories.groups.list', operationId: 'directories_groups_list', method: 'GET', path: '/directories/{id}/groups', pathParams: ['id'], scope: 'directory_sync:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'directories.groups.map': { action: 'directories.groups.map', operationId: 'directories_groups_map', method: 'POST', path: '/directories/{id}/group-roles', pathParams: ['id'], scope: 'directory_sync:write', danger: 'write', approval: true, body: true, pagination: null },\n  'directories.hris.connect': { action: 'directories.hris.connect', operationId: 'directories_hris_connect', method: 'POST', path: '/directories/hris', pathParams: [], scope: 'directory_sync:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'directories.list': { action: 'directories.list', operationId: 'directories_list', method: 'GET', path: '/directories', pathParams: [], scope: 'directory_sync:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'directories.status.set': { action: 'directories.status.set', operationId: 'directories_status_set', method: 'POST', path: '/directories/{id}/status', pathParams: ['id'], scope: 'directory_sync:write', danger: 'write', approval: true, body: true, pagination: null },\n  'directories.sync': { action: 'directories.sync', operationId: 'directories_sync', method: 'POST', path: '/directories/{id}/sync', pathParams: ['id'], scope: 'directory_sync:write', danger: 'write', approval: true, body: true, pagination: null },\n  'directories.sync_settings.update': { action: 'directories.sync_settings.update', operationId: 'directories_sync_settings_update', method: 'PATCH', path: '/directories/{id}/sync-settings', pathParams: ['id'], scope: 'directory_sync:write', danger: 'write', approval: true, body: true, pagination: null },\n  'directories.token.rotate': { action: 'directories.token.rotate', operationId: 'directories_token_rotate', method: 'POST', path: '/directories/{id}/rotate', pathParams: ['id'], scope: 'directory_sync:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'directories.update': { action: 'directories.update', operationId: 'directories_update', method: 'PATCH', path: '/directories/{id}', pathParams: ['id'], scope: 'directory_sync:write', danger: 'write', approval: true, body: true, pagination: null },\n  'domains.add': { action: 'domains.add', operationId: 'domains_add', method: 'POST', path: '/domains', pathParams: [], scope: 'domains:write', danger: 'write', approval: true, body: true, pagination: null },\n  'domains.get': { action: 'domains.get', operationId: 'domains_get', method: 'GET', path: '/domains', pathParams: [], scope: 'domains:read', danger: 'read', approval: true, body: false, pagination: null },\n  'domains.remove': { action: 'domains.remove', operationId: 'domains_remove', method: 'DELETE', path: '/domains', pathParams: [], scope: 'domains:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'domains.verify': { action: 'domains.verify', operationId: 'domains_verify', method: 'POST', path: '/domains/verify', pathParams: [], scope: 'domains:write', danger: 'write', approval: true, body: false, pagination: null },\n  'events.list': { action: 'events.list', operationId: 'events_list', method: 'GET', path: '/events', pathParams: [], scope: 'events:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'feature_flags.create': { action: 'feature_flags.create', operationId: 'feature_flags_create', method: 'POST', path: '/feature-flags', pathParams: [], scope: 'feature_flags:write', danger: 'write', approval: true, body: true, pagination: null },\n  'feature_flags.delete': { action: 'feature_flags.delete', operationId: 'feature_flags_delete', method: 'DELETE', path: '/feature-flags/{id}', pathParams: ['id'], scope: 'feature_flags:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'feature_flags.evaluate': { action: 'feature_flags.evaluate', operationId: 'feature_flags_evaluate', method: 'GET', path: '/feature-flags/evaluate', pathParams: [], scope: 'feature_flags:read', danger: 'read', approval: true, body: false, pagination: null },\n  'feature_flags.get': { action: 'feature_flags.get', operationId: 'feature_flags_get', method: 'GET', path: '/feature-flags/{id}', pathParams: ['id'], scope: 'feature_flags:read', danger: 'read', approval: true, body: false, pagination: null },\n  'feature_flags.list': { action: 'feature_flags.list', operationId: 'feature_flags_list', method: 'GET', path: '/feature-flags', pathParams: [], scope: 'feature_flags:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'feature_flags.update': { action: 'feature_flags.update', operationId: 'feature_flags_update', method: 'PATCH', path: '/feature-flags/{id}', pathParams: ['id'], scope: 'feature_flags:write', danger: 'write', approval: true, body: true, pagination: null },\n  'fga.check': { action: 'fga.check', operationId: 'fga_check', method: 'GET', path: '/fga/check', pathParams: [], scope: 'fga:read', danger: 'read', approval: true, body: false, pagination: null },\n  'fga.check_batch': { action: 'fga.check_batch', operationId: 'fga_check_batch', method: 'GET', path: '/fga/check/batch', pathParams: [], scope: 'fga:read', danger: 'read', approval: true, body: false, pagination: null },\n  'fga.resources.list': { action: 'fga.resources.list', operationId: 'fga_resources_list', method: 'GET', path: '/fga/resources', pathParams: [], scope: 'fga:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'fga.schema.get': { action: 'fga.schema.get', operationId: 'fga_schema_get', method: 'GET', path: '/fga/schema', pathParams: [], scope: 'fga:read', danger: 'read', approval: true, body: false, pagination: null },\n  'fga.schema.update': { action: 'fga.schema.update', operationId: 'fga_schema_update', method: 'PUT', path: '/fga/schema', pathParams: [], scope: 'fga:schema', danger: 'critical', approval: true, body: true, pagination: null },\n  'fga.schema.validate': { action: 'fga.schema.validate', operationId: 'fga_schema_validate', method: 'GET', path: '/fga/schema/validate', pathParams: [], scope: 'fga:read', danger: 'read', approval: true, body: false, pagination: null },\n  'fga.subjects.list': { action: 'fga.subjects.list', operationId: 'fga_subjects_list', method: 'GET', path: '/fga/subjects', pathParams: [], scope: 'fga:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'fga.tuples.delete': { action: 'fga.tuples.delete', operationId: 'fga_tuples_delete', method: 'POST', path: '/fga/tuples/delete', pathParams: [], scope: 'fga:write', danger: 'destructive', approval: true, body: true, pagination: null },\n  'fga.tuples.list': { action: 'fga.tuples.list', operationId: 'fga_tuples_list', method: 'GET', path: '/fga/tuples', pathParams: [], scope: 'fga:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'fga.tuples.write': { action: 'fga.tuples.write', operationId: 'fga_tuples_write', method: 'POST', path: '/fga/tuples', pathParams: [], scope: 'fga:write', danger: 'write', approval: true, body: true, pagination: null },\n  'frontend_keys.create': { action: 'frontend_keys.create', operationId: 'frontend_keys_create', method: 'POST', path: '/frontend-keys', pathParams: [], scope: 'frontend_keys:write', danger: 'write', approval: true, body: true, pagination: null },\n  'frontend_keys.list': { action: 'frontend_keys.list', operationId: 'frontend_keys_list', method: 'GET', path: '/frontend-keys', pathParams: [], scope: 'frontend_keys:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'frontend_keys.revoke': { action: 'frontend_keys.revoke', operationId: 'frontend_keys_revoke', method: 'DELETE', path: '/frontend-keys/{id}', pathParams: ['id'], scope: 'frontend_keys:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'frontend_keys.set_origins': { action: 'frontend_keys.set_origins', operationId: 'frontend_keys_set_origins', method: 'PUT', path: '/frontend-keys/{id}/origins', pathParams: ['id'], scope: 'frontend_keys:write', danger: 'write', approval: true, body: true, pagination: null },\n  'hooks.create': { action: 'hooks.create', operationId: 'hooks_create', method: 'POST', path: '/hooks', pathParams: [], scope: 'hooks:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'hooks.delete': { action: 'hooks.delete', operationId: 'hooks_delete', method: 'DELETE', path: '/hooks/{id}', pathParams: ['id'], scope: 'hooks:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'hooks.get': { action: 'hooks.get', operationId: 'hooks_get', method: 'GET', path: '/hooks/{id}', pathParams: ['id'], scope: 'hooks:read', danger: 'read', approval: true, body: false, pagination: null },\n  'hooks.list': { action: 'hooks.list', operationId: 'hooks_list', method: 'GET', path: '/hooks', pathParams: [], scope: 'hooks:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'hooks.update': { action: 'hooks.update', operationId: 'hooks_update', method: 'PATCH', path: '/hooks/{id}', pathParams: ['id'], scope: 'hooks:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'invitations.list': { action: 'invitations.list', operationId: 'invitations_list', method: 'GET', path: '/organizations/{organization_id}/invitations', pathParams: ['organization_id'], scope: 'invitations:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'invitations.resend': { action: 'invitations.resend', operationId: 'invitations_resend', method: 'POST', path: '/organizations/{organization_id}/invitations/{invitation_id}/resend', pathParams: ['organization_id', 'invitation_id'], scope: 'invitations:write', danger: 'write', approval: true, body: false, pagination: null },\n  'invitations.revoke': { action: 'invitations.revoke', operationId: 'invitations_revoke', method: 'DELETE', path: '/organizations/{organization_id}/invitations/{invitation_id}', pathParams: ['organization_id', 'invitation_id'], scope: 'invitations:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'invitations.send': { action: 'invitations.send', operationId: 'invitations_send', method: 'POST', path: '/organizations/{organization_id}/invitations', pathParams: ['organization_id'], scope: 'invitations:write', danger: 'write', approval: true, body: true, pagination: null },\n  'keys.create': { action: 'keys.create', operationId: 'keys_create', method: 'POST', path: '/keys', pathParams: [], scope: 'keys:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'keys.list': { action: 'keys.list', operationId: 'keys_list', method: 'GET', path: '/keys', pathParams: [], scope: 'keys:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'keys.revoke': { action: 'keys.revoke', operationId: 'keys_revoke', method: 'DELETE', path: '/keys/{id}', pathParams: ['id'], scope: 'keys:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'keys.rotate': { action: 'keys.rotate', operationId: 'keys_rotate', method: 'POST', path: '/keys/{id}/rotate', pathParams: ['id'], scope: 'keys:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'legacy_login.approve': { action: 'legacy_login.approve', operationId: 'legacy_login_approve', method: 'POST', path: '/legacy-login/approve', pathParams: [], scope: 'signin:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'legacy_login.get': { action: 'legacy_login.get', operationId: 'legacy_login_get', method: 'GET', path: '/legacy-login', pathParams: [], scope: 'signin:read', danger: 'read', approval: true, body: false, pagination: null },\n  'legacy_login.probe': { action: 'legacy_login.probe', operationId: 'legacy_login_probe', method: 'POST', path: '/legacy-login/probe', pathParams: [], scope: 'signin:write', danger: 'write', approval: true, body: true, pagination: null },\n  'legacy_login.revoke': { action: 'legacy_login.revoke', operationId: 'legacy_login_revoke', method: 'POST', path: '/legacy-login/revoke', pathParams: [], scope: 'signin:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'log_streams.create': { action: 'log_streams.create', operationId: 'log_streams_create', method: 'POST', path: '/log-streams', pathParams: [], scope: 'log_streams:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'log_streams.delete': { action: 'log_streams.delete', operationId: 'log_streams_delete', method: 'DELETE', path: '/log-streams/{id}', pathParams: ['id'], scope: 'log_streams:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'log_streams.get': { action: 'log_streams.get', operationId: 'log_streams_get', method: 'GET', path: '/log-streams/{id}', pathParams: ['id'], scope: 'log_streams:read', danger: 'read', approval: true, body: false, pagination: null },\n  'log_streams.list': { action: 'log_streams.list', operationId: 'log_streams_list', method: 'GET', path: '/log-streams', pathParams: [], scope: 'log_streams:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'log_streams.test': { action: 'log_streams.test', operationId: 'log_streams_test', method: 'POST', path: '/log-streams/{id}/test', pathParams: ['id'], scope: 'log_streams:write', danger: 'write', approval: true, body: false, pagination: null },\n  'log_streams.update': { action: 'log_streams.update', operationId: 'log_streams_update', method: 'PATCH', path: '/log-streams/{id}', pathParams: ['id'], scope: 'log_streams:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'members.add': { action: 'members.add', operationId: 'members_add', method: 'POST', path: '/organizations/{organization_id}/members', pathParams: ['organization_id'], scope: 'members:write', danger: 'write', approval: true, body: true, pagination: null },\n  'members.list': { action: 'members.list', operationId: 'members_list', method: 'GET', path: '/organizations/{organization_id}/members', pathParams: ['organization_id'], scope: 'members:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'members.remove': { action: 'members.remove', operationId: 'members_remove', method: 'DELETE', path: '/organizations/{organization_id}/members/{user_id}', pathParams: ['organization_id', 'user_id'], scope: 'members:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'members.roles.grant': { action: 'members.roles.grant', operationId: 'members_roles_grant', method: 'PUT', path: '/organizations/{organization_id}/members/{user_id}/roles/{role_id}', pathParams: ['organization_id', 'user_id', 'role_id'], scope: 'roles:write', danger: 'write', approval: true, body: false, pagination: null },\n  'members.roles.list': { action: 'members.roles.list', operationId: 'members_roles_list', method: 'GET', path: '/organizations/{organization_id}/members/{user_id}/roles', pathParams: ['organization_id', 'user_id'], scope: 'roles:read', danger: 'read', approval: true, body: false, pagination: null },\n  'members.roles.revoke': { action: 'members.roles.revoke', operationId: 'members_roles_revoke', method: 'DELETE', path: '/organizations/{organization_id}/members/{user_id}/roles/{role_id}', pathParams: ['organization_id', 'user_id', 'role_id'], scope: 'roles:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'members.update': { action: 'members.update', operationId: 'members_update', method: 'PATCH', path: '/organizations/{organization_id}/members/{user_id}', pathParams: ['organization_id', 'user_id'], scope: 'members:write', danger: 'write', approval: true, body: true, pagination: null },\n  'organizations.create': { action: 'organizations.create', operationId: 'organizations_create', method: 'POST', path: '/organizations', pathParams: [], scope: 'organizations:write', danger: 'write', approval: true, body: true, pagination: null },\n  'organizations.delete': { action: 'organizations.delete', operationId: 'organizations_delete', method: 'DELETE', path: '/organizations/{id}', pathParams: ['id'], scope: 'organizations:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'organizations.domains.add': { action: 'organizations.domains.add', operationId: 'organizations_domains_add', method: 'POST', path: '/organizations/{organization_id}/domains', pathParams: ['organization_id'], scope: 'organizations:write', danger: 'write', approval: true, body: true, pagination: null },\n  'organizations.domains.capture': { action: 'organizations.domains.capture', operationId: 'organizations_domains_capture', method: 'PUT', path: '/organizations/{organization_id}/domains/{domain_id}/capture', pathParams: ['organization_id', 'domain_id'], scope: 'organizations:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'organizations.domains.list': { action: 'organizations.domains.list', operationId: 'organizations_domains_list', method: 'GET', path: '/organizations/{organization_id}/domains', pathParams: ['organization_id'], scope: 'organizations:read', danger: 'read', approval: true, body: false, pagination: null },\n  'organizations.domains.remove': { action: 'organizations.domains.remove', operationId: 'organizations_domains_remove', method: 'DELETE', path: '/organizations/{organization_id}/domains/{domain_id}', pathParams: ['organization_id', 'domain_id'], scope: 'organizations:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'organizations.domains.verify': { action: 'organizations.domains.verify', operationId: 'organizations_domains_verify', method: 'POST', path: '/organizations/{organization_id}/domains/{domain_id}/verify', pathParams: ['organization_id', 'domain_id'], scope: 'organizations:write', danger: 'write', approval: true, body: false, pagination: null },\n  'organizations.get': { action: 'organizations.get', operationId: 'organizations_get', method: 'GET', path: '/organizations/{id}', pathParams: ['id'], scope: 'organizations:read', danger: 'read', approval: true, body: false, pagination: null },\n  'organizations.list': { action: 'organizations.list', operationId: 'organizations_list', method: 'GET', path: '/organizations', pathParams: [], scope: 'organizations:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'organizations.portal_links.create': { action: 'organizations.portal_links.create', operationId: 'organizations_portal_links_create', method: 'POST', path: '/organizations/{organization_id}/portal-links', pathParams: ['organization_id'], scope: 'portal_links:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'organizations.portal_links.list': { action: 'organizations.portal_links.list', operationId: 'organizations_portal_links_list', method: 'GET', path: '/organizations/{organization_id}/portal-links', pathParams: ['organization_id'], scope: 'portal_links:read', danger: 'read', approval: true, body: false, pagination: null },\n  'organizations.portal_links.revoke': { action: 'organizations.portal_links.revoke', operationId: 'organizations_portal_links_revoke', method: 'DELETE', path: '/organizations/{organization_id}/portal-links/{id}', pathParams: ['organization_id', 'id'], scope: 'portal_links:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'organizations.reactivate': { action: 'organizations.reactivate', operationId: 'organizations_reactivate', method: 'POST', path: '/organizations/{id}/reactivate', pathParams: ['id'], scope: 'organizations:write', danger: 'write', approval: true, body: false, pagination: null },\n  'organizations.suspend': { action: 'organizations.suspend', operationId: 'organizations_suspend', method: 'POST', path: '/organizations/{id}/suspend', pathParams: ['id'], scope: 'organizations:write', danger: 'write', approval: true, body: false, pagination: null },\n  'organizations.transfer_ownership': { action: 'organizations.transfer_ownership', operationId: 'organizations_transfer_ownership', method: 'POST', path: '/organizations/{id}/transfer-ownership', pathParams: ['id'], scope: 'organizations:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'organizations.update': { action: 'organizations.update', operationId: 'organizations_update', method: 'PATCH', path: '/organizations/{id}', pathParams: ['id'], scope: 'organizations:write', danger: 'write', approval: true, body: true, pagination: null },\n  'permissions.create': { action: 'permissions.create', operationId: 'permissions_create', method: 'POST', path: '/permissions', pathParams: [], scope: 'role_definitions:write', danger: 'write', approval: true, body: true, pagination: null },\n  'permissions.delete': { action: 'permissions.delete', operationId: 'permissions_delete', method: 'DELETE', path: '/permissions/{id}', pathParams: ['id'], scope: 'role_definitions:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'permissions.list': { action: 'permissions.list', operationId: 'permissions_list', method: 'GET', path: '/permissions', pathParams: [], scope: 'roles:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'permissions.update': { action: 'permissions.update', operationId: 'permissions_update', method: 'PATCH', path: '/permissions/{id}', pathParams: ['id'], scope: 'role_definitions:write', danger: 'write', approval: true, body: true, pagination: null },\n  'pipes.connections.delete': { action: 'pipes.connections.delete', operationId: 'pipes_connections_delete', method: 'DELETE', path: '/pipes/{id}/connections/{connection_id}', pathParams: ['id', 'connection_id'], scope: 'pipes:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'pipes.connections.list': { action: 'pipes.connections.list', operationId: 'pipes_connections_list', method: 'GET', path: '/pipes/{id}/connections', pathParams: ['id'], scope: 'pipes:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'pipes.create': { action: 'pipes.create', operationId: 'pipes_create', method: 'POST', path: '/pipes', pathParams: [], scope: 'pipes:write', danger: 'write', approval: true, body: true, pagination: null },\n  'pipes.delete': { action: 'pipes.delete', operationId: 'pipes_delete', method: 'DELETE', path: '/pipes/{id}', pathParams: ['id'], scope: 'pipes:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'pipes.get': { action: 'pipes.get', operationId: 'pipes_get', method: 'GET', path: '/pipes/{id}', pathParams: ['id'], scope: 'pipes:read', danger: 'read', approval: true, body: false, pagination: null },\n  'pipes.grants.create': { action: 'pipes.grants.create', operationId: 'pipes_grants_create', method: 'POST', path: '/pipes/{id}/grants', pathParams: ['id'], scope: 'pipes:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'pipes.grants.delete': { action: 'pipes.grants.delete', operationId: 'pipes_grants_delete', method: 'DELETE', path: '/pipes/{id}/grants/{client_id}', pathParams: ['id', 'client_id'], scope: 'pipes:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'pipes.list': { action: 'pipes.list', operationId: 'pipes_list', method: 'GET', path: '/pipes', pathParams: [], scope: 'pipes:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'pipes.update': { action: 'pipes.update', operationId: 'pipes_update', method: 'PATCH', path: '/pipes/{id}', pathParams: ['id'], scope: 'pipes:write', danger: 'write', approval: true, body: true, pagination: null },\n  'provisioning.targets.create': { action: 'provisioning.targets.create', operationId: 'provisioning_targets_create', method: 'POST', path: '/provisioning-targets', pathParams: [], scope: 'provisioning:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'provisioning.targets.delete': { action: 'provisioning.targets.delete', operationId: 'provisioning_targets_delete', method: 'DELETE', path: '/provisioning-targets/{id}', pathParams: ['id'], scope: 'provisioning:write', danger: 'destructive', approval: true, body: true, pagination: null },\n  'provisioning.targets.get': { action: 'provisioning.targets.get', operationId: 'provisioning_targets_get', method: 'GET', path: '/provisioning-targets/{id}', pathParams: ['id'], scope: 'provisioning:read', danger: 'read', approval: true, body: false, pagination: null },\n  'provisioning.targets.list': { action: 'provisioning.targets.list', operationId: 'provisioning_targets_list', method: 'GET', path: '/provisioning-targets', pathParams: [], scope: 'provisioning:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'provisioning.targets.status.set': { action: 'provisioning.targets.status.set', operationId: 'provisioning_targets_status_set', method: 'POST', path: '/provisioning-targets/{id}/status', pathParams: ['id'], scope: 'provisioning:write', danger: 'write', approval: true, body: true, pagination: null },\n  'radar.decisions.get': { action: 'radar.decisions.get', operationId: 'radar_decisions_get', method: 'GET', path: '/radar/decisions/{id}', pathParams: ['id'], scope: 'radar:read', danger: 'read', approval: true, body: false, pagination: null },\n  'radar.decisions.list': { action: 'radar.decisions.list', operationId: 'radar_decisions_list', method: 'GET', path: '/radar/decisions', pathParams: [], scope: 'radar:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'radar.lists.add': { action: 'radar.lists.add', operationId: 'radar_lists_add', method: 'POST', path: '/radar/lists', pathParams: [], scope: 'radar:write', danger: 'write', approval: true, body: true, pagination: null },\n  'radar.lists.list': { action: 'radar.lists.list', operationId: 'radar_lists_list', method: 'GET', path: '/radar/lists', pathParams: [], scope: 'radar:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'radar.lists.remove': { action: 'radar.lists.remove', operationId: 'radar_lists_remove', method: 'DELETE', path: '/radar/lists/{id}', pathParams: ['id'], scope: 'radar:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'radar.mode.set': { action: 'radar.mode.set', operationId: 'radar_mode_set', method: 'PUT', path: '/radar/mode', pathParams: [], scope: 'radar:manage', danger: 'critical', approval: true, body: true, pagination: null },\n  'radar.rules.create': { action: 'radar.rules.create', operationId: 'radar_rules_create', method: 'POST', path: '/radar/rules', pathParams: [], scope: 'radar:write', danger: 'write', approval: true, body: true, pagination: null },\n  'radar.rules.delete': { action: 'radar.rules.delete', operationId: 'radar_rules_delete', method: 'DELETE', path: '/radar/rules/{id}', pathParams: ['id'], scope: 'radar:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'radar.rules.get': { action: 'radar.rules.get', operationId: 'radar_rules_get', method: 'GET', path: '/radar/rules/{id}', pathParams: ['id'], scope: 'radar:read', danger: 'read', approval: true, body: false, pagination: null },\n  'radar.rules.list': { action: 'radar.rules.list', operationId: 'radar_rules_list', method: 'GET', path: '/radar/rules', pathParams: [], scope: 'radar:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'radar.rules.reorder': { action: 'radar.rules.reorder', operationId: 'radar_rules_reorder', method: 'PUT', path: '/radar/rules/order', pathParams: [], scope: 'radar:write', danger: 'write', approval: true, body: true, pagination: null },\n  'radar.rules.update': { action: 'radar.rules.update', operationId: 'radar_rules_update', method: 'PATCH', path: '/radar/rules/{id}', pathParams: ['id'], scope: 'radar:write', danger: 'write', approval: true, body: true, pagination: null },\n  'radar.settings.get': { action: 'radar.settings.get', operationId: 'radar_settings_get', method: 'GET', path: '/radar/settings', pathParams: [], scope: 'radar:read', danger: 'read', approval: true, body: false, pagination: null },\n  'radar.settings.update': { action: 'radar.settings.update', operationId: 'radar_settings_update', method: 'PATCH', path: '/radar/settings', pathParams: [], scope: 'radar:write', danger: 'write', approval: true, body: true, pagination: null },\n  'roles.create': { action: 'roles.create', operationId: 'roles_create', method: 'POST', path: '/roles', pathParams: [], scope: 'role_definitions:write', danger: 'write', approval: true, body: true, pagination: null },\n  'roles.delete': { action: 'roles.delete', operationId: 'roles_delete', method: 'DELETE', path: '/roles/{id}', pathParams: ['id'], scope: 'role_definitions:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'roles.get': { action: 'roles.get', operationId: 'roles_get', method: 'GET', path: '/roles/{id}', pathParams: ['id'], scope: 'roles:read', danger: 'read', approval: true, body: false, pagination: null },\n  'roles.list': { action: 'roles.list', operationId: 'roles_list', method: 'GET', path: '/roles', pathParams: [], scope: 'roles:read', danger: 'read', approval: true, body: false, pagination: null },\n  'roles.permissions.grant': { action: 'roles.permissions.grant', operationId: 'roles_permissions_grant', method: 'PUT', path: '/roles/{id}/permissions/{permission_id}', pathParams: ['id', 'permission_id'], scope: 'role_definitions:write', danger: 'write', approval: true, body: false, pagination: null },\n  'roles.permissions.revoke': { action: 'roles.permissions.revoke', operationId: 'roles_permissions_revoke', method: 'DELETE', path: '/roles/{id}/permissions/{permission_id}', pathParams: ['id', 'permission_id'], scope: 'role_definitions:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'roles.update': { action: 'roles.update', operationId: 'roles_update', method: 'PATCH', path: '/roles/{id}', pathParams: ['id'], scope: 'role_definitions:write', danger: 'write', approval: true, body: true, pagination: null },\n  'saml_apps.create': { action: 'saml_apps.create', operationId: 'saml_apps_create', method: 'POST', path: '/saml-apps', pathParams: [], scope: 'saml_apps:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'saml_apps.delete': { action: 'saml_apps.delete', operationId: 'saml_apps_delete', method: 'DELETE', path: '/saml-apps/{id}', pathParams: ['id'], scope: 'saml_apps:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'saml_apps.get': { action: 'saml_apps.get', operationId: 'saml_apps_get', method: 'GET', path: '/saml-apps/{id}', pathParams: ['id'], scope: 'saml_apps:read', danger: 'read', approval: true, body: false, pagination: null },\n  'saml_apps.list': { action: 'saml_apps.list', operationId: 'saml_apps_list', method: 'GET', path: '/saml-apps', pathParams: [], scope: 'saml_apps:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'saml_apps.update': { action: 'saml_apps.update', operationId: 'saml_apps_update', method: 'PATCH', path: '/saml-apps/{id}', pathParams: ['id'], scope: 'saml_apps:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'signin.policy.get': { action: 'signin.policy.get', operationId: 'signin_policy_get', method: 'GET', path: '/sign-in/policy', pathParams: [], scope: 'signin:read', danger: 'read', approval: true, body: false, pagination: null },\n  'signin.policy.inherit': { action: 'signin.policy.inherit', operationId: 'signin_policy_inherit', method: 'DELETE', path: '/sign-in/policy/organizations/{organization_id}', pathParams: ['organization_id'], scope: 'signin:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'signin.policy.update': { action: 'signin.policy.update', operationId: 'signin_policy_update', method: 'PATCH', path: '/sign-in/policy', pathParams: [], scope: 'signin:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'signin.self_service_signup.set': { action: 'signin.self_service_signup.set', operationId: 'signin_self_service_signup_set', method: 'PUT', path: '/sign-in/self-service-signup', pathParams: [], scope: 'signin:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'signin.sms.get': { action: 'signin.sms.get', operationId: 'signin_sms_get', method: 'GET', path: '/sign-in/sms', pathParams: [], scope: 'signin:read', danger: 'read', approval: true, body: false, pagination: null },\n  'signin.sms.update': { action: 'signin.sms.update', operationId: 'signin_sms_update', method: 'PATCH', path: '/sign-in/sms', pathParams: [], scope: 'signin:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'signin.social.delete': { action: 'signin.social.delete', operationId: 'signin_social_delete', method: 'DELETE', path: '/sign-in/social-providers/{id}', pathParams: ['id'], scope: 'signin:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'signin.social.disable': { action: 'signin.social.disable', operationId: 'signin_social_disable', method: 'POST', path: '/sign-in/social-providers/{id}/disable', pathParams: ['id'], scope: 'signin:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'signin.social.enable': { action: 'signin.social.enable', operationId: 'signin_social_enable', method: 'POST', path: '/sign-in/social-providers/{id}/enable', pathParams: ['id'], scope: 'signin:write', danger: 'write', approval: true, body: true, pagination: null },\n  'signin.social.inherit': { action: 'signin.social.inherit', operationId: 'signin_social_inherit', method: 'PUT', path: '/sign-in/social-providers/inherited/{provider}', pathParams: ['provider'], scope: 'signin:write', danger: 'write', approval: true, body: true, pagination: null },\n  'signin.social.list': { action: 'signin.social.list', operationId: 'signin_social_list', method: 'GET', path: '/sign-in/social-providers', pathParams: [], scope: 'signin:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'signin.social.offered': { action: 'signin.social.offered', operationId: 'signin_social_offered', method: 'GET', path: '/sign-in/social-providers/offered', pathParams: [], scope: 'signin:read', danger: 'read', approval: true, body: false, pagination: null },\n  'signin.social.set': { action: 'signin.social.set', operationId: 'signin_social_set', method: 'POST', path: '/sign-in/social-providers', pathParams: [], scope: 'signin:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'signin.social.update': { action: 'signin.social.update', operationId: 'signin_social_update', method: 'PATCH', path: '/sign-in/social-providers/{id}', pathParams: ['id'], scope: 'signin:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'sod_policies.create': { action: 'sod_policies.create', operationId: 'sod_policies_create', method: 'POST', path: '/sod-policies', pathParams: [], scope: 'governance:write', danger: 'write', approval: true, body: true, pagination: null },\n  'sod_policies.delete': { action: 'sod_policies.delete', operationId: 'sod_policies_delete', method: 'DELETE', path: '/sod-policies/{id}', pathParams: ['id'], scope: 'governance:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'sod_policies.get': { action: 'sod_policies.get', operationId: 'sod_policies_get', method: 'GET', path: '/sod-policies/{id}', pathParams: ['id'], scope: 'governance:read', danger: 'read', approval: true, body: false, pagination: null },\n  'sod_policies.list': { action: 'sod_policies.list', operationId: 'sod_policies_list', method: 'GET', path: '/sod-policies', pathParams: [], scope: 'governance:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'sod_policies.status.set': { action: 'sod_policies.status.set', operationId: 'sod_policies_status_set', method: 'POST', path: '/sod-policies/{id}/status', pathParams: ['id'], scope: 'governance:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'sso.connections.activate': { action: 'sso.connections.activate', operationId: 'sso_connections_activate', method: 'POST', path: '/sso/connections/{id}/activate', pathParams: ['id'], scope: 'sso:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'sso.connections.certificates.activate': { action: 'sso.connections.certificates.activate', operationId: 'sso_connections_certificates_activate', method: 'POST', path: '/sso/connections/{id}/certificates/activate', pathParams: ['id'], scope: 'sso:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'sso.connections.certificates.list': { action: 'sso.connections.certificates.list', operationId: 'sso_connections_certificates_list', method: 'GET', path: '/sso/connections/{id}/certificates', pathParams: ['id'], scope: 'sso:read', danger: 'read', approval: true, body: false, pagination: null },\n  'sso.connections.certificates.stage': { action: 'sso.connections.certificates.stage', operationId: 'sso_connections_certificates_stage', method: 'POST', path: '/sso/connections/{id}/certificates', pathParams: ['id'], scope: 'sso:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'sso.connections.create': { action: 'sso.connections.create', operationId: 'sso_connections_create', method: 'POST', path: '/sso/connections', pathParams: [], scope: 'sso:write', danger: 'write', approval: true, body: true, pagination: null },\n  'sso.connections.delete': { action: 'sso.connections.delete', operationId: 'sso_connections_delete', method: 'DELETE', path: '/sso/connections/{id}', pathParams: ['id'], scope: 'sso:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'sso.connections.disable': { action: 'sso.connections.disable', operationId: 'sso_connections_disable', method: 'POST', path: '/sso/connections/{id}/disable', pathParams: ['id'], scope: 'sso:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'sso.connections.get': { action: 'sso.connections.get', operationId: 'sso_connections_get', method: 'GET', path: '/sso/connections/{id}', pathParams: ['id'], scope: 'sso:read', danger: 'read', approval: true, body: false, pagination: null },\n  'sso.connections.list': { action: 'sso.connections.list', operationId: 'sso_connections_list', method: 'GET', path: '/sso/connections', pathParams: [], scope: 'sso:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'sso.connections.require_sso': { action: 'sso.connections.require_sso', operationId: 'sso_connections_require_sso', method: 'POST', path: '/sso/connections/{id}/require-sso', pathParams: ['id'], scope: 'sso:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'sso.connections.update': { action: 'sso.connections.update', operationId: 'sso_connections_update', method: 'PATCH', path: '/sso/connections/{id}', pathParams: ['id'], scope: 'sso:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'sso.domains.capture': { action: 'sso.domains.capture', operationId: 'sso_domains_capture', method: 'POST', path: '/sso/domains/{id}/capture', pathParams: ['id'], scope: 'sso:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'sso.domains.create': { action: 'sso.domains.create', operationId: 'sso_domains_create', method: 'POST', path: '/sso/domains', pathParams: [], scope: 'sso:write', danger: 'write', approval: true, body: true, pagination: null },\n  'sso.domains.delete': { action: 'sso.domains.delete', operationId: 'sso_domains_delete', method: 'DELETE', path: '/sso/domains/{id}', pathParams: ['id'], scope: 'sso:write', danger: 'destructive', approval: true, body: true, pagination: null },\n  'sso.domains.list': { action: 'sso.domains.list', operationId: 'sso_domains_list', method: 'GET', path: '/sso/domains', pathParams: [], scope: 'sso:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'sso.domains.verify': { action: 'sso.domains.verify', operationId: 'sso_domains_verify', method: 'POST', path: '/sso/domains/{id}/verify', pathParams: ['id'], scope: 'sso:write', danger: 'write', approval: true, body: true, pagination: null },\n  'sso.saml_metadata.import': { action: 'sso.saml_metadata.import', operationId: 'sso_saml_metadata_import', method: 'POST', path: '/sso/saml-metadata', pathParams: [], scope: 'sso:write', danger: 'write', approval: true, body: true, pagination: null },\n  'support_sessions.end': { action: 'support_sessions.end', operationId: 'support_sessions_end', method: 'DELETE', path: '/support-sessions/{id}', pathParams: ['id'], scope: 'support:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'support_sessions.start': { action: 'support_sessions.start', operationId: 'support_sessions_start', method: 'POST', path: '/support-sessions', pathParams: [], scope: 'support:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'token_vault.grants.create': { action: 'token_vault.grants.create', operationId: 'token_vault_grants_create', method: 'POST', path: '/token-vault/secrets/{id}/grants', pathParams: ['id'], scope: 'token_vault:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'token_vault.grants.delete': { action: 'token_vault.grants.delete', operationId: 'token_vault_grants_delete', method: 'DELETE', path: '/token-vault/secrets/{id}/grants/{client_id}', pathParams: ['id', 'client_id'], scope: 'token_vault:write', danger: 'destructive', approval: true, body: true, pagination: null },\n  'token_vault.secrets.create': { action: 'token_vault.secrets.create', operationId: 'token_vault_secrets_create', method: 'POST', path: '/token-vault/secrets', pathParams: [], scope: 'token_vault:write', danger: 'write', approval: true, body: true, pagination: null },\n  'token_vault.secrets.get': { action: 'token_vault.secrets.get', operationId: 'token_vault_secrets_get', method: 'GET', path: '/token-vault/secrets/{id}', pathParams: ['id'], scope: 'token_vault:read', danger: 'read', approval: true, body: false, pagination: null },\n  'token_vault.secrets.list': { action: 'token_vault.secrets.list', operationId: 'token_vault_secrets_list', method: 'GET', path: '/token-vault/secrets', pathParams: [], scope: 'token_vault:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'token_vault.secrets.revoke': { action: 'token_vault.secrets.revoke', operationId: 'token_vault_secrets_revoke', method: 'POST', path: '/token-vault/secrets/{id}/revoke', pathParams: ['id'], scope: 'token_vault:write', danger: 'destructive', approval: true, body: true, pagination: null },\n  'token_vault.secrets.rotate': { action: 'token_vault.secrets.rotate', operationId: 'token_vault_secrets_rotate', method: 'POST', path: '/token-vault/secrets/{id}/rotate', pathParams: ['id'], scope: 'token_vault:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'users.create': { action: 'users.create', operationId: 'users_create', method: 'POST', path: '/users', pathParams: [], scope: 'users:write', danger: 'write', approval: true, body: true, pagination: null },\n  'users.deactivate': { action: 'users.deactivate', operationId: 'users_deactivate', method: 'DELETE', path: '/users/{id}', pathParams: ['id'], scope: 'users:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'users.environment_roles.get': { action: 'users.environment_roles.get', operationId: 'users_environment_roles_get', method: 'GET', path: '/users/{id}/environment-roles/{role_id}', pathParams: ['id', 'role_id'], scope: 'roles:read', danger: 'read', approval: true, body: false, pagination: null },\n  'users.environment_roles.grant': { action: 'users.environment_roles.grant', operationId: 'users_environment_roles_grant', method: 'PUT', path: '/users/{id}/environment-roles/{role_id}', pathParams: ['id', 'role_id'], scope: 'roles:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'users.environment_roles.list': { action: 'users.environment_roles.list', operationId: 'users_environment_roles_list', method: 'GET', path: '/users/{id}/environment-roles', pathParams: ['id'], scope: 'roles:read', danger: 'read', approval: true, body: false, pagination: null },\n  'users.environment_roles.revoke': { action: 'users.environment_roles.revoke', operationId: 'users_environment_roles_revoke', method: 'DELETE', path: '/users/{id}/environment-roles/{role_id}', pathParams: ['id', 'role_id'], scope: 'roles:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'users.erase': { action: 'users.erase', operationId: 'users_erase', method: 'POST', path: '/users/{id}/erase', pathParams: ['id'], scope: 'users:erase', danger: 'critical', approval: true, body: false, pagination: null },\n  'users.get': { action: 'users.get', operationId: 'users_get', method: 'GET', path: '/users/{id}', pathParams: ['id'], scope: 'users:read', danger: 'read', approval: true, body: false, pagination: null },\n  'users.list': { action: 'users.list', operationId: 'users_list', method: 'GET', path: '/users', pathParams: [], scope: 'users:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'users.mfa.reset': { action: 'users.mfa.reset', operationId: 'users_mfa_reset', method: 'DELETE', path: '/users/{id}/mfa', pathParams: ['id'], scope: 'users:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'users.mfa.sms.remove': { action: 'users.mfa.sms.remove', operationId: 'users_mfa_sms_remove', method: 'DELETE', path: '/users/{id}/mfa/sms', pathParams: ['id'], scope: 'users:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'users.password_reset.send': { action: 'users.password_reset.send', operationId: 'users_password_reset_send', method: 'POST', path: '/users/{id}/password-reset', pathParams: ['id'], scope: 'users:write', danger: 'write', approval: true, body: false, pagination: null },\n  'users.password.set': { action: 'users.password.set', operationId: 'users_password_set', method: 'POST', path: '/users/{id}/password', pathParams: ['id'], scope: 'users:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'users.reactivate': { action: 'users.reactivate', operationId: 'users_reactivate', method: 'POST', path: '/users/{id}/reactivate', pathParams: ['id'], scope: 'users:write', danger: 'write', approval: true, body: false, pagination: null },\n  'users.sessions.list': { action: 'users.sessions.list', operationId: 'users_sessions_list', method: 'GET', path: '/users/{id}/sessions', pathParams: ['id'], scope: 'users:read', danger: 'read', approval: true, body: false, pagination: null },\n  'users.sessions.revoke': { action: 'users.sessions.revoke', operationId: 'users_sessions_revoke', method: 'DELETE', path: '/users/{id}/sessions/{session_id}', pathParams: ['id', 'session_id'], scope: 'users:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'users.sessions.revoke_all': { action: 'users.sessions.revoke_all', operationId: 'users_sessions_revoke_all', method: 'DELETE', path: '/users/{id}/sessions', pathParams: ['id'], scope: 'users:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'users.update': { action: 'users.update', operationId: 'users_update', method: 'PATCH', path: '/users/{id}', pathParams: ['id'], scope: 'users:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'users.verification.send': { action: 'users.verification.send', operationId: 'users_verification_send', method: 'POST', path: '/users/{id}/verification', pathParams: ['id'], scope: 'users:write', danger: 'write', approval: true, body: false, pagination: null },\n  'users.verify': { action: 'users.verify', operationId: 'users_verify', method: 'POST', path: '/users/{id}/verify', pathParams: ['id'], scope: 'users:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'webhooks.create': { action: 'webhooks.create', operationId: 'webhooks_create', method: 'POST', path: '/webhooks', pathParams: [], scope: 'webhooks:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'webhooks.delete': { action: 'webhooks.delete', operationId: 'webhooks_delete', method: 'DELETE', path: '/webhooks/{id}', pathParams: ['id'], scope: 'webhooks:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'webhooks.get': { action: 'webhooks.get', operationId: 'webhooks_get', method: 'GET', path: '/webhooks/{id}', pathParams: ['id'], scope: 'webhooks:read', danger: 'read', approval: true, body: false, pagination: null },\n  'webhooks.list': { action: 'webhooks.list', operationId: 'webhooks_list', method: 'GET', path: '/webhooks', pathParams: [], scope: 'webhooks:read', danger: 'read', approval: true, body: false, pagination: 'cursor' },\n  'webhooks.pause': { action: 'webhooks.pause', operationId: 'webhooks_pause', method: 'POST', path: '/webhooks/{id}/pause', pathParams: ['id'], scope: 'webhooks:write', danger: 'write', approval: true, body: false, pagination: null },\n  'webhooks.resume': { action: 'webhooks.resume', operationId: 'webhooks_resume', method: 'POST', path: '/webhooks/{id}/resume', pathParams: ['id'], scope: 'webhooks:write', danger: 'write', approval: true, body: false, pagination: null },\n  'webhooks.secret.rotate': { action: 'webhooks.secret.rotate', operationId: 'webhooks_secret_rotate', method: 'POST', path: '/webhooks/{id}/rotate', pathParams: ['id'], scope: 'webhooks:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'webhooks.signature_scheme.change': { action: 'webhooks.signature_scheme.change', operationId: 'webhooks_signature_scheme_change', method: 'POST', path: '/webhooks/{id}/signature-scheme', pathParams: ['id'], scope: 'webhooks:write', danger: 'destructive', approval: true, body: true, pagination: null },\n  'webhooks.update': { action: 'webhooks.update', operationId: 'webhooks_update', method: 'PATCH', path: '/webhooks/{id}', pathParams: ['id'], scope: 'webhooks:write', danger: 'write', approval: true, body: true, pagination: null },\n} as const satisfies Record<string, OperationSpec>;\n\n// ── Client ─────────────────────────────────────────────────────────────────────────────────\n\n/** Options for a {@link EnvironmentClient}. `baseUrl` is required: the environment's own host. */\nexport type EnvironmentClientOptions = ManagementClientOptions & { baseUrl: string };\n\n/**\n * Cbox ID — Environment Management API.\n *\n * The **per-environment management plane** — the API an app's own backend uses to run\n * its tenancy inside ONE environment: organizations and their owners, members,\n * invitations, roles (in one organization, or everywhere for your staff), apps, APIs,\n * the API keys customers made for them, and support sessions. It is served on\n * the environment's own host ({slug}.cboxid.com or a custom domain): the host pins\n * the environment, and the request is authenticated with an environment API key\n * (`cbid_env_…`).\n */\nexport class EnvironmentClient {\n  /** The transport every method runs on — authentication, retries, approvals. */\n  readonly transport: ManagementTransport;\n\n  constructor(options: EnvironmentClientOptions) {\n    this.transport = new ManagementTransport('environment', options);\n  }\n\n  /** Call a route by method and path (relative to `/api/v1`) — for anything not generated. */\n  request<TBody = unknown, O extends CallOptions = CallOptions>(\n    method: OperationSpec['method'],\n    path: string,\n    input?: { query?: Record<string, unknown>; body?: unknown },\n    options?: O,\n  ): Promise<Outcome<TBody, O>> {\n    return this.transport.request<TBody, O>(method, path, input, options);\n  }\n\n  readonly accessReviews = {\n    /**\n     * Close an access review and apply it: every revoke is carried out, and undecided items get the review's pending policy (revoke by default).\n     *\n     * Requires scope `governance:write`. Danger: destructive.\n     *\n     * `POST /access-reviews/{id}/close` · action `access_reviews.close`\n     * @scope `governance:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    close: <O extends CallOptions = CallOptions>(id: string, body?: AccessReviewsCloseBody, options?: O): Promise<Outcome<AccessReviewsCloseResponse, O>> =>\n      this.transport.call<AccessReviewsCloseResponse, O>(environmentOperations['access_reviews.close'], [id], body, options),\n    /**\n     * Open an access review of one organization's roles and memberships — or of staff roles — for someone to certify or revoke.\n     *\n     * Requires scope `governance:write`. Danger: write.\n     *\n     * `POST /access-reviews` · action `access_reviews.create`\n     * @scope `governance:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: AccessReviewsCreateBody, options?: O): Promise<Outcome<AccessReviewsCreateResponse, O>> =>\n      this.transport.call<AccessReviewsCreateResponse, O>(environmentOperations['access_reviews.create'], [], body, options),\n    /**\n     * Read one access review: its status, due date, pending-item policy and item count.\n     *\n     * Requires scope `governance:read`. Danger: read.\n     *\n     * `GET /access-reviews/{id}` · action `access_reviews.get`\n     * @scope `governance:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, query?: AccessReviewsGetQuery, options?: O): Promise<Outcome<AccessReviewsGetResponse, O>> =>\n      this.transport.call<AccessReviewsGetResponse, O>(environmentOperations['access_reviews.get'], [id], query, options),\n    /**\n     * List access reviews (certification campaigns), open and closed, optionally those covering one organization.\n     *\n     * Requires scope `governance:read`. Danger: read.\n     *\n     * `GET /access-reviews` · action `access_reviews.list`\n     * @scope `governance:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: AccessReviewsListQuery, options?: O): Promise<Outcome<AccessReviewsListResponse, O>> =>\n      this.transport.call<AccessReviewsListResponse, O>(environmentOperations['access_reviews.list'], [], query, options),\n    /** Every item of `access_reviews.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<AccessReviewsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<AccessReview, void, undefined> =>\n      this.transport.paginate(environmentOperations['access_reviews.list'], [], query as Record<string, unknown> | undefined, options),\n    items: {\n      /**\n       * Certify or revoke one item of an open access review. Revokes are applied when the review closes.\n       *\n       * Requires scope `governance:write`. Danger: write.\n       *\n       * `POST /access-reviews/{id}/items/{item_id}` · action `access_reviews.items.decide`\n       * @scope `governance:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      decide: <O extends CallOptions = CallOptions>(id: string, itemId: string, body: AccessReviewsItemsDecideBody, options?: O): Promise<Outcome<AccessReviewsItemsDecideResponse, O>> =>\n        this.transport.call<AccessReviewsItemsDecideResponse, O>(environmentOperations['access_reviews.items.decide'], [id, itemId], body, options),\n      /**\n       * List the items an access review asks someone to certify or revoke: who holds what, and the decision on each.\n       *\n       * Requires scope `governance:read`. Danger: read.\n       *\n       * `GET /access-reviews/{id}/items` · action `access_reviews.items.list`\n       * @scope `governance:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(id: string, query?: AccessReviewsItemsListQuery, options?: O): Promise<Outcome<AccessReviewsItemsListResponse, O>> =>\n        this.transport.call<AccessReviewsItemsListResponse, O>(environmentOperations['access_reviews.items.list'], [id], query, options),\n      /** Every item of `access_reviews.items.list`, fetching pages as the iteration reaches them. */\n      listAll: (id: string, query?: Omit<AccessReviewsItemsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<AccessReviewItem, void, undefined> =>\n        this.transport.paginate(environmentOperations['access_reviews.items.list'], [id], query as Record<string, unknown> | undefined, options),\n    },\n  };\n\n  readonly actionApprovals = {\n    /**\n     * Where an approval this key asked for stands\n     *\n     * Any key may poll the approvals it raised, and only those: another key's id is a 404.\n     * `status` is `pending`, `approved`, `denied`, `expired` or `consumed`.\n     *\n     * `GET /action-approvals/{id}`\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<ActionApprovalsGetResponse, O>> =>\n      this.transport.call<ActionApprovalsGetResponse, O>(environmentOperations['action_approvals.get'], [id], undefined, options),\n  };\n\n  readonly apiKeys = {\n    /**\n     * List the API keys an organization's members created for your apps\n     *\n     * Requires scope `api_keys:read`. Revoked and expired keys are included, marked by\n     * `status`. Never the key itself. Narrow to one app with `?client_id=`.\n     *\n     * `GET /organizations/{organization_id}/api-keys` · action `api_keys.list`\n     * @scope `api_keys:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(organizationId: string, query?: ApiKeysListQuery, options?: O): Promise<Outcome<ApiKeysListResponse, O>> =>\n      this.transport.call<ApiKeysListResponse, O>(environmentOperations['api_keys.list'], [organizationId], query, options),\n    /** Every item of `api_keys.list`, fetching pages as the iteration reaches them. */\n    listAll: (organizationId: string, query?: Omit<ApiKeysListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<ApiKey, void, undefined> =>\n      this.transport.paginate(environmentOperations['api_keys.list'], [organizationId], query as Record<string, unknown> | undefined, options),\n    /**\n     * Revoke a member API key\n     *\n     * Requires scope `api_keys:write`. The key stops verifying at once. Idempotent — an\n     * already-revoked key is a 204 too. Recorded as `api_key.revoked`, with this\n     * management key as the actor.\n     *\n     * `DELETE /api-keys/{id}` · action `api_keys.revoke`\n     * @scope `api_keys:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    revoke: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<ApiKeysRevokeResponse, O>> =>\n      this.transport.call<ApiKeysRevokeResponse, O>(environmentOperations['api_keys.revoke'], [id], undefined, options),\n  };\n\n  readonly apis = {\n    /**\n     * Register an API and its scopes\n     *\n     * Requires scope `apis:write`. Registering an API is the environment's act; no tenant\n     * surface can. `identifier` is an absolute URI (RFC 8707) and becomes the token's\n     * `aud`. Scope keys are unique across the environment. `client_id` links the app whose\n     * roles and permissions the API enforces, and must have the API's owner.\n     * `organization_id` makes the API one organization's; left out, the environment owns\n     * it. Refusals are `422 invalid_api` with the reason.\n     *\n     * `POST /apis` · action `apis.create`\n     * @scope `apis:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: ApisCreateBody, options?: O): Promise<Outcome<ApisCreateResponse, O>> =>\n      this.transport.call<ApisCreateResponse, O>(environmentOperations['apis.create'], [], body, options),\n    /**\n     * Delete an API and its scopes\n     *\n     * Requires scope `apis:write`. Tokens already minted for it keep their `aud` until they\n     * expire; apps holding its scope keys keep them as plain scopes.\n     *\n     * `DELETE /apis/{id}` · action `apis.delete`\n     * @scope `apis:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    delete: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<ApisDeleteResponse, O>> =>\n      this.transport.call<ApisDeleteResponse, O>(environmentOperations['apis.delete'], [id], undefined, options),\n    /**\n     * Get an API\n     *\n     * Requires scope `apis:read`.\n     *\n     * `GET /apis/{id}` · action `apis.get`\n     * @scope `apis:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<ApisGetResponse, O>> =>\n      this.transport.call<ApisGetResponse, O>(environmentOperations['apis.get'], [id], undefined, options),\n    /**\n     * List registered APIs\n     *\n     * Requires scope `apis:read`.\n     *\n     * `GET /apis` · action `apis.list`\n     * @scope `apis:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: ApisListQuery, options?: O): Promise<Outcome<ApisListResponse, O>> =>\n      this.transport.call<ApisListResponse, O>(environmentOperations['apis.list'], [], query, options),\n    /** Every item of `apis.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<ApisListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<Api, void, undefined> =>\n      this.transport.paginate(environmentOperations['apis.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Change an API\n     *\n     * Requires scope `apis:write`. Any of: `name`; `client_id` (null unlinks the app);\n     * `scopes`, which is the **complete** set afterwards — scopes named are added or\n     * updated, scopes left out are removed. All or nothing. The identifier never changes:\n     * register a new API instead.\n     *\n     * `PATCH /apis/{id}` · action `apis.update`\n     * @scope `apis:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(id: string, body?: ApisUpdateBody, options?: O): Promise<Outcome<ApisUpdateResponse, O>> =>\n      this.transport.call<ApisUpdateResponse, O>(environmentOperations['apis.update'], [id], body, options),\n    scopes: {\n      /**\n       * Add a scope to an API, or change the description or tenant access of one it owns.\n       *\n       * Requires scope `apis:write`. Danger: write.\n       *\n       * `PUT /apis/{id}/scopes/{key}` · action `apis.scopes.define`\n       * @scope `apis:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      define: <O extends CallOptions = CallOptions>(id: string, key: string, body?: ApisScopesDefineBody, options?: O): Promise<Outcome<ApisScopesDefineResponse, O>> =>\n        this.transport.call<ApisScopesDefineResponse, O>(environmentOperations['apis.scopes.define'], [id, key], body, options),\n      /**\n       * Remove a scope from an API. Apps holding it keep it as a plain scope that no longer reaches the API.\n       *\n       * Requires scope `apis:write`. Danger: destructive.\n       *\n       * `DELETE /apis/{id}/scopes/{key}` · action `apis.scopes.remove`\n       * @scope `apis:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      remove: <O extends CallOptions = CallOptions>(id: string, key: string, options?: O): Promise<Outcome<ApisScopesRemoveResponse, O>> =>\n        this.transport.call<ApisScopesRemoveResponse, O>(environmentOperations['apis.scopes.remove'], [id, key], undefined, options),\n    },\n  };\n\n  readonly approvals = {\n    /**\n     * Deny a pending approval request (CIBA) for the person it was raised for: the agent gets access_denied and no token.\n     *\n     * Requires scope `approvals:write`. Danger: destructive.\n     *\n     * `POST /agent-requests/{request_id}/deny` · action `approvals.deny`\n     * @scope `approvals:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    deny: <O extends CallOptions = CallOptions>(requestId: string, options?: O): Promise<Outcome<ApprovalsDenyResponse, O>> =>\n      this.transport.call<ApprovalsDenyResponse, O>(environmentOperations['approvals.deny'], [requestId], undefined, options),\n    /**\n     * List the pending requests from agents to act as one of this environment's people (CIBA): which app, for whom, and what it asks.\n     *\n     * Requires scope `approvals:read`. Danger: read.\n     *\n     * `GET /agent-requests` · action `approvals.list`\n     * @scope `approvals:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: ApprovalsListQuery, options?: O): Promise<Outcome<ApprovalsListResponse, O>> =>\n      this.transport.call<ApprovalsListResponse, O>(environmentOperations['approvals.list'], [], query, options),\n    /** Every item of `approvals.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<ApprovalsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<AgentRequest, void, undefined> =>\n      this.transport.paginate(environmentOperations['approvals.list'], [], query as Record<string, unknown> | undefined, options),\n  };\n\n  readonly apps = {\n    /**\n     * Export an app's configuration as a blueprint\n     *\n     * Requires scope `apps:read`. `{id}` is the app's id or its `client_id`. The document\n     * carries the app's settings and none of its identity or credentials: no client id,\n     * no secret, no key set, no owning organization. `POST /apps` with it as `blueprint`\n     * creates the same app in another environment.\n     *\n     * `GET /apps/{id}/blueprint` · action `apps.blueprint`\n     * @scope `apps:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    blueprint: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<AppsBlueprintResponse, O>> =>\n      this.transport.call<AppsBlueprintResponse, O>(environmentOperations['apps.blueprint'], [id], undefined, options),\n    /**\n     * Copy an app into another environment of this project, with a new client id and secret there. A person on the environment console only; a key exports the blueprint instead.\n     *\n     * Requires scope `apps:write`. Danger: critical.\n     *\n     * `POST /apps/{id}/copy` · action `apps.copy`\n     * @scope `apps:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    copy: <O extends CallOptions = CallOptions>(id: string, body: AppsCopyBody, options?: O): Promise<Outcome<AppsCopyResponse, O>> =>\n      this.transport.call<AppsCopyResponse, O>(environmentOperations['apps.copy'], [id], body, options),\n    /**\n     * Register an app\n     *\n     * Requires scope `apps:write`. Two ways to describe it:\n     *\n     * - **From a blueprint** — send `GET /apps/{id}/blueprint`'s document from another\n     *   environment as `blueprint` (promote staging to production). `name`,\n     *   `redirect_uris` and `post_logout_redirect_uris` beside it replace the\n     *   blueprint's own, since those usually name the environment it came from. A\n     *   `private_key_jwt` blueprint needs `jwks`.\n     * - **Short form** — `name` and `type` (`web`, `spa`, `cli`, `service`, `agent`; default\n     *   `web`), which decide the client type, grants and default scopes as the console's\n     *   \"Create app\" does. `advanced` takes `client_type` and `grant_types`.\n     *\n     * The response carries `client_secret` for an app that authenticates with one —\n     * **once**. Only its hash is kept, and an idempotent replay returns `client_secret: null`.\n     *\n     * A platform scope reserved for the console (`vault.manage`, `decisions:read`) is\n     * refused (`scope_not_grantable`), as is a registered API's scope this app's owner may\n     * not hold. Danger: critical — it mints a credential.\n     *\n     * `POST /apps` · action `apps.create`\n     * @scope `apps:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body?: AppsCreateBody, options?: O): Promise<Outcome<AppsCreateResponse, O>> =>\n      this.transport.call<AppsCreateResponse, O>(environmentOperations['apps.create'], [], body, options),\n    /**\n     * Delete an app and every secret it holds. Anything signing in as it stops working immediately.\n     *\n     * Requires scope `apps:write`. Danger: critical.\n     *\n     * `DELETE /apps/{id}` · action `apps.delete`\n     * @scope `apps:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    delete: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<AppsDeleteResponse, O>> =>\n      this.transport.call<AppsDeleteResponse, O>(environmentOperations['apps.delete'], [id], undefined, options),\n    /**\n     * Get one app (OAuth client) by its id or its client_id: its kind, grants, redirect URIs, scopes and settings. Never a secret.\n     *\n     * Requires scope `apps:read`. Danger: read.\n     *\n     * `GET /apps/{id}` · action `apps.get`\n     * @scope `apps:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<AppsGetResponse, O>> =>\n      this.transport.call<AppsGetResponse, O>(environmentOperations['apps.get'], [id], undefined, options),\n    /**\n     * List apps\n     *\n     * Requires scope `apps:read`. Never a secret.\n     *\n     * `GET /apps` · action `apps.list`\n     * @scope `apps:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: AppsListQuery, options?: O): Promise<Outcome<AppsListResponse, O>> =>\n      this.transport.call<AppsListResponse, O>(environmentOperations['apps.list'], [], query, options),\n    /** Every item of `apps.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<AppsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<App, void, undefined> =>\n      this.transport.paginate(environmentOperations['apps.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Rename an app and replace its redirect URIs or sign-out redirect URIs. Fields left out are unchanged.\n     *\n     * Requires scope `apps:write`. Danger: write.\n     *\n     * `PATCH /apps/{id}` · action `apps.update`\n     * @scope `apps:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(id: string, body?: AppsUpdateBody, options?: O): Promise<Outcome<AppsUpdateResponse, O>> =>\n      this.transport.call<AppsUpdateResponse, O>(environmentOperations['apps.update'], [id], body, options),\n    manifest: {\n      /**\n       * Set or clear the URL an app publishes its roles-and-permissions manifest at. Does not fetch it; apps.manifest.sync does.\n       *\n       * Requires scope `apps:write`. Danger: write.\n       *\n       * `PUT /apps/{id}/manifest` · action `apps.manifest.set`\n       * @scope `apps:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      set: <O extends CallOptions = CallOptions>(id: string, body?: AppsManifestSetBody, options?: O): Promise<Outcome<AppsManifestSetResponse, O>> =>\n        this.transport.call<AppsManifestSetResponse, O>(environmentOperations['apps.manifest.set'], [id], body, options),\n      /**\n       * Fetch an app's published manifest now and sync the roles and permissions it declares.\n       *\n       * Requires scope `apps:write`. Danger: write.\n       *\n       * `POST /apps/{id}/manifest/sync` · action `apps.manifest.sync`\n       * @scope `apps:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      sync: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<AppsManifestSyncResponse, O>> =>\n        this.transport.call<AppsManifestSyncResponse, O>(environmentOperations['apps.manifest.sync'], [id], undefined, options),\n    },\n    scopes: {\n      /**\n       * Replace an app's complete scope set — the ceiling of what it may request, applied from its next token.\n       *\n       * Requires scope `apps:write`. Danger: write.\n       *\n       * `PUT /apps/{id}/scopes` · action `apps.scopes.set`\n       * @scope `apps:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      set: <O extends CallOptions = CallOptions>(id: string, body?: AppsScopesSetBody, options?: O): Promise<Outcome<AppsScopesSetResponse, O>> =>\n        this.transport.call<AppsScopesSetResponse, O>(environmentOperations['apps.scopes.set'], [id], body, options),\n    },\n    secrets: {\n      /**\n       * List an app's live client secrets\n       *\n       * Requires scope `apps:read`. Every live secret, newest first: its id (what\n       * `DELETE /apps/{id}/secrets/{secret_id}` names), the characters it ends in, and its\n       * dates — never a secret. `expires_at` is set on one a rotation replaced, still working\n       * through its overlap. An app holds a handful at most, so there is no page to turn.\n       *\n       * `GET /apps/{id}/secrets` · action `apps.secrets.list`\n       * @scope `apps:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<AppsSecretsListResponse, O>> =>\n        this.transport.call<AppsSecretsListResponse, O>(environmentOperations['apps.secrets.list'], [id], undefined, options),\n      /**\n       * Revoke one of an app's client secrets immediately. Never its last live secret — rotate that instead.\n       *\n       * Requires scope `apps:write`. Danger: critical.\n       *\n       * `DELETE /apps/{id}/secrets/{secret_id}` · action `apps.secrets.revoke`\n       * @scope `apps:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      revoke: <O extends CallOptions = CallOptions>(id: string, secretId: string, options?: O): Promise<Outcome<AppsSecretsRevokeResponse, O>> =>\n        this.transport.call<AppsSecretsRevokeResponse, O>(environmentOperations['apps.secrets.revoke'], [id, secretId], undefined, options),\n      /**\n       * Mint a new client secret for an app and retire the current ones after grace_seconds (0 = at once). The new secret is returned once.\n       *\n       * Requires scope `apps:write`. Danger: critical.\n       *\n       * `POST /apps/{id}/secrets` · action `apps.secrets.rotate`\n       * @scope `apps:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      rotate: <O extends CallOptions = CallOptions>(id: string, body: AppsSecretsRotateBody, options?: O): Promise<Outcome<AppsSecretsRotateResponse, O>> =>\n        this.transport.call<AppsSecretsRotateResponse, O>(environmentOperations['apps.secrets.rotate'], [id], body, options),\n    },\n    settings: {\n      /**\n       * Set the prefix of an app's customer API keys (acme_live), which lets its users create keys for it, or null to stop new keys.\n       *\n       * Requires scope `apps:write`. Danger: write.\n       *\n       * `PUT /apps/{id}/settings/api-key-prefix` · action `apps.settings.api_key_prefix`\n       * @scope `apps:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      apiKeyPrefix: <O extends CallOptions = CallOptions>(id: string, body?: AppsSettingsApiKeyPrefixBody, options?: O): Promise<Outcome<AppsSettingsApiKeyPrefixResponse, O>> =>\n        this.transport.call<AppsSettingsApiKeyPrefixResponse, O>(environmentOperations['apps.settings.api_key_prefix'], [id], body, options),\n      /**\n       * Set or clear the URI an app is sent a logout token at when somebody signs out (OIDC Back-Channel Logout).\n       *\n       * Requires scope `apps:write`. Danger: write.\n       *\n       * `PUT /apps/{id}/settings/backchannel-logout` · action `apps.settings.backchannel_logout`\n       * @scope `apps:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      backchannelLogout: <O extends CallOptions = CallOptions>(id: string, body?: AppsSettingsBackchannelLogoutBody, options?: O): Promise<Outcome<AppsSettingsBackchannelLogoutResponse, O>> =>\n        this.transport.call<AppsSettingsBackchannelLogoutResponse, O>(environmentOperations['apps.settings.backchannel_logout'], [id], body, options),\n      /**\n       * Turn token exchange (RFC 8693) on or off for a confidential app.\n       *\n       * Requires scope `apps:write`. Danger: write.\n       *\n       * `PUT /apps/{id}/settings/token-exchange` · action `apps.settings.token_exchange`\n       * @scope `apps:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      tokenExchange: <O extends CallOptions = CallOptions>(id: string, body: AppsSettingsTokenExchangeBody, options?: O): Promise<Outcome<AppsSettingsTokenExchangeResponse, O>> =>\n        this.transport.call<AppsSettingsTokenExchangeResponse, O>(environmentOperations['apps.settings.token_exchange'], [id], body, options),\n      /**\n       * Set how long an app's access tokens live, in seconds, or null for the install's default.\n       *\n       * Requires scope `apps:write`. Danger: write.\n       *\n       * `PUT /apps/{id}/settings/token-lifetime` · action `apps.settings.token_lifetime`\n       * @scope `apps:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      tokenLifetime: <O extends CallOptions = CallOptions>(id: string, body?: AppsSettingsTokenLifetimeBody, options?: O): Promise<Outcome<AppsSettingsTokenLifetimeResponse, O>> =>\n        this.transport.call<AppsSettingsTokenLifetimeResponse, O>(environmentOperations['apps.settings.token_lifetime'], [id], body, options),\n    },\n  };\n\n  readonly auditLogs = {\n    /**\n     * Re-hash one organization's audit-event chain (from the oldest event retention kept, or from_sequence) and report whether every event is unchanged and in place.\n     *\n     * Requires scope `audit_logs:read`. Danger: read.\n     *\n     * `GET /audit-logs/verify` · action `audit_logs.verify`\n     * @scope `audit_logs:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    verify: <O extends CallOptions = CallOptions>(query?: AuditLogsVerifyQuery, options?: O): Promise<Outcome<AuditLogsVerifyResponse, O>> =>\n      this.transport.call<AuditLogsVerifyResponse, O>(environmentOperations['audit_logs.verify'], [], query, options),\n    events: {\n      /**\n       * Record 1–100 audit events your app's users caused, each for one of your organizations (customers); checked against the action's schema when it has one and appended to that organization's tamper-evident chain. Send an Idempotency-Key.\n       *\n       * Requires scope `audit_logs:write`. Danger: write.\n       *\n       * `POST /audit-logs/events` · action `audit_logs.events.create`\n       * @scope `audit_logs:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      create: <O extends CallOptions = CallOptions>(body: AuditLogsEventsCreateBody, options?: O): Promise<Outcome<AuditLogsEventsCreateResponse, O>> =>\n        this.transport.call<AuditLogsEventsCreateResponse, O>(environmentOperations['audit_logs.events.create'], [], body, options),\n      /**\n       * Read audit events newest first, for one organization or the whole environment, filtered by action, actor, target and time range; pass `next_cursor` as `after` to page.\n       *\n       * Requires scope `audit_logs:read`. Danger: read.\n       *\n       * `GET /audit-logs/events` · action `audit_logs.events.list`\n       * @scope `audit_logs:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query?: AuditLogsEventsListQuery, options?: O): Promise<Outcome<AuditLogsEventsListResponse, O>> =>\n        this.transport.call<AuditLogsEventsListResponse, O>(environmentOperations['audit_logs.events.list'], [], query, options),\n      /** Every item of `audit_logs.events.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<AuditLogsEventsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<AuditLogEvent, void, undefined> =>\n        this.transport.paginate(environmentOperations['audit_logs.events.list'], [], query as Record<string, unknown> | undefined, options),\n    },\n    exports: {\n      /**\n       * Start a CSV export of audit events (same filters as the list). It is written on the queue: poll audit_logs.exports.get until state is ready, then download from its short-lived url.\n       *\n       * Requires scope `audit_logs:export`. Danger: write.\n       *\n       * `POST /audit-logs/exports` · action `audit_logs.exports.create`\n       * @scope `audit_logs:export`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      create: <O extends CallOptions = CallOptions>(body?: AuditLogsExportsCreateBody, options?: O): Promise<Outcome<AuditLogsExportsCreateResponse, O>> =>\n        this.transport.call<AuditLogsExportsCreateResponse, O>(environmentOperations['audit_logs.exports.create'], [], body, options),\n      /**\n       * Read an audit-log export's state; once ready it carries a signed download url valid for a few minutes (read it again for a fresh one).\n       *\n       * Requires scope `audit_logs:read`. Danger: read.\n       *\n       * `GET /audit-logs/exports/{id}` · action `audit_logs.exports.get`\n       * @scope `audit_logs:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<AuditLogsExportsGetResponse, O>> =>\n        this.transport.call<AuditLogsExportsGetResponse, O>(environmentOperations['audit_logs.exports.get'], [id], undefined, options),\n    },\n    schemas: {\n      /**\n       * Define the schema one audit-log action's events must match — allowed target types and metadata schemas (a subset of JSON Schema). Events of that action are then validated on arrival.\n       *\n       * Requires scope `audit_logs:manage`. Danger: write.\n       *\n       * `POST /audit-logs/schemas` · action `audit_logs.schemas.create`\n       * @scope `audit_logs:manage`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      create: <O extends CallOptions = CallOptions>(body: AuditLogsSchemasCreateBody, options?: O): Promise<Outcome<AuditLogsSchemasCreateResponse, O>> =>\n        this.transport.call<AuditLogsSchemasCreateResponse, O>(environmentOperations['audit_logs.schemas.create'], [], body, options),\n      /**\n       * Delete an audit-log action's schema. Its events are then accepted unchecked — or refused, if the environment is in strict mode.\n       *\n       * Requires scope `audit_logs:manage`. Danger: destructive.\n       *\n       * `DELETE /audit-logs/schemas/{action}` · action `audit_logs.schemas.delete`\n       * @scope `audit_logs:manage`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      delete: <O extends CallOptions = CallOptions>(action: string, options?: O): Promise<Outcome<AuditLogsSchemasDeleteResponse, O>> =>\n        this.transport.call<AuditLogsSchemasDeleteResponse, O>(environmentOperations['audit_logs.schemas.delete'], [action], undefined, options),\n      /**\n       * Read the schema one audit-log action's events are validated against.\n       *\n       * Requires scope `audit_logs:read`. Danger: read.\n       *\n       * `GET /audit-logs/schemas/{action}` · action `audit_logs.schemas.get`\n       * @scope `audit_logs:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(action: string, options?: O): Promise<Outcome<AuditLogsSchemasGetResponse, O>> =>\n        this.transport.call<AuditLogsSchemasGetResponse, O>(environmentOperations['audit_logs.schemas.get'], [action], undefined, options),\n      /**\n       * List the audit-log schemas this environment validates events against, one per action.\n       *\n       * Requires scope `audit_logs:read`. Danger: read.\n       *\n       * `GET /audit-logs/schemas` · action `audit_logs.schemas.list`\n       * @scope `audit_logs:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query?: AuditLogsSchemasListQuery, options?: O): Promise<Outcome<AuditLogsSchemasListResponse, O>> =>\n        this.transport.call<AuditLogsSchemasListResponse, O>(environmentOperations['audit_logs.schemas.list'], [], query, options),\n      /** Every item of `audit_logs.schemas.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<AuditLogsSchemasListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<AuditLogSchema, void, undefined> =>\n        this.transport.paginate(environmentOperations['audit_logs.schemas.list'], [], query as Record<string, unknown> | undefined, options),\n      /**\n       * Replace an audit-log action's schema with a new version (omitted parts are removed). Recorded events keep the version they were checked against.\n       *\n       * Requires scope `audit_logs:manage`. Danger: write.\n       *\n       * `PUT /audit-logs/schemas/{action}` · action `audit_logs.schemas.update`\n       * @scope `audit_logs:manage`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      update: <O extends CallOptions = CallOptions>(action: string, body?: AuditLogsSchemasUpdateBody, options?: O): Promise<Outcome<AuditLogsSchemasUpdateResponse, O>> =>\n        this.transport.call<AuditLogsSchemasUpdateResponse, O>(environmentOperations['audit_logs.schemas.update'], [action], body, options),\n    },\n    settings: {\n      /**\n       * Read this environment's audit-log settings: retention in days and whether strict schemas are on.\n       *\n       * Requires scope `audit_logs:read`. Danger: read.\n       *\n       * `GET /audit-logs/settings` · action `audit_logs.settings.get`\n       * @scope `audit_logs:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<AuditLogsSettingsGetResponse, O>> =>\n        this.transport.call<AuditLogsSettingsGetResponse, O>(environmentOperations['audit_logs.settings.get'], [], undefined, options),\n      /**\n       * Change this environment's audit-log retention (days, 1–3650) and strict mode. Shortening retention deletes older events at the next daily prune — irreversibly.\n       *\n       * Requires scope `audit_logs:manage`. Danger: destructive.\n       *\n       * `PATCH /audit-logs/settings` · action `audit_logs.settings.update`\n       * @scope `audit_logs:manage`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      update: <O extends CallOptions = CallOptions>(body?: AuditLogsSettingsUpdateBody, options?: O): Promise<Outcome<AuditLogsSettingsUpdateResponse, O>> =>\n        this.transport.call<AuditLogsSettingsUpdateResponse, O>(environmentOperations['audit_logs.settings.update'], [], body, options),\n    },\n  };\n\n  readonly audit = {\n    /**\n     * Read this environment's audit trail oldest first, optionally narrowed by action, actor type or organization; pass the last id as `after` to page.\n     *\n     * Requires scope `audit:read`. Danger: read.\n     *\n     * `GET /audit-log` · action `audit.list`\n     * @scope `audit:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: AuditListQuery, options?: O): Promise<Outcome<AuditListResponse, O>> =>\n      this.transport.call<AuditListResponse, O>(environmentOperations['audit.list'], [], query, options),\n    /** Every item of `audit.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<AuditListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<AuditEntry, void, undefined> =>\n      this.transport.paginate(environmentOperations['audit.list'], [], query as Record<string, unknown> | undefined, options),\n  };\n\n  readonly branding = {\n    appearance: {\n      /**\n       * Read the hosted sign-in theme: the environment default, or one organization's own.\n       *\n       * Requires scope `branding:read`. Danger: read.\n       *\n       * `GET /branding/appearance` · action `branding.appearance.get`\n       * @scope `branding:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(query?: BrandingAppearanceGetQuery, options?: O): Promise<Outcome<BrandingAppearanceGetResponse, O>> =>\n        this.transport.call<BrandingAppearanceGetResponse, O>(environmentOperations['branding.appearance.get'], [], query, options),\n      /**\n       * Set the hosted sign-in theme (preset, colours, corners, type, uploaded logo and favicon) for the environment default or one organization.\n       *\n       * Requires scope `branding:write`. Danger: write.\n       *\n       * `PUT /branding/appearance` · action `branding.appearance.set`\n       * @scope `branding:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      set: <O extends CallOptions = CallOptions>(body: BrandingAppearanceSetBody, options?: O): Promise<Outcome<BrandingAppearanceSetResponse, O>> =>\n        this.transport.call<BrandingAppearanceSetResponse, O>(environmentOperations['branding.appearance.set'], [], body, options),\n    },\n    whitelabel: {\n      /**\n       * Read the white-label branding (palette, app name, email sender, logo) of the environment default or one organization.\n       *\n       * Requires scope `branding:read`. Danger: read.\n       *\n       * `GET /branding/whitelabel` · action `branding.whitelabel.get`\n       * @scope `branding:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(query?: BrandingWhitelabelGetQuery, options?: O): Promise<Outcome<BrandingWhitelabelGetResponse, O>> =>\n        this.transport.call<BrandingWhitelabelGetResponse, O>(environmentOperations['branding.whitelabel.get'], [], query, options),\n      /**\n       * Save the white-label branding (palette, app name, email sender, welcome email) of the environment default or one organization.\n       *\n       * Requires scope `branding:write`. Danger: write.\n       *\n       * `PUT /branding/whitelabel` · action `branding.whitelabel.set`\n       * @scope `branding:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      set: <O extends CallOptions = CallOptions>(body?: BrandingWhitelabelSetBody, options?: O): Promise<Outcome<BrandingWhitelabelSetResponse, O>> =>\n        this.transport.call<BrandingWhitelabelSetResponse, O>(environmentOperations['branding.whitelabel.set'], [], body, options),\n    },\n  };\n\n  readonly directories = {\n    /**\n     * Connect a Google Workspace or Microsoft Entra directory to sync an organization's people from, verifying the credentials first. Runs the first sync.\n     *\n     * Requires scope `directory_sync:write`. Danger: critical.\n     *\n     * `POST /directories/connect` · action `directories.connect`\n     * @scope `directory_sync:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    connect: <O extends CallOptions = CallOptions>(body: DirectoriesConnectBody, options?: O): Promise<Outcome<DirectoriesConnectResponse, O>> =>\n      this.transport.call<DirectoriesConnectResponse, O>(environmentOperations['directories.connect'], [], body, options),\n    /**\n     * Register a SCIM directory for an organization. Answers the SCIM base URL and a bearer token, shown once.\n     *\n     * Requires scope `directory_sync:write`. Danger: critical.\n     *\n     * `POST /directories` · action `directories.create`\n     * @scope `directory_sync:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: DirectoriesCreateBody, options?: O): Promise<Outcome<DirectoriesCreateResponse, O>> =>\n      this.transport.call<DirectoriesCreateResponse, O>(environmentOperations['directories.create'], [], body, options),\n    /**\n     * Delete an inbound directory. Its token stops working; the people it provisioned keep their accounts.\n     *\n     * Requires scope `directory_sync:write`. Danger: destructive.\n     *\n     * `DELETE /directories/{id}` · action `directories.delete`\n     * @scope `directory_sync:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    delete: <O extends CallOptions = CallOptions>(id: string, body?: DirectoriesDeleteBody, options?: O): Promise<Outcome<DirectoriesDeleteResponse, O>> =>\n      this.transport.call<DirectoriesDeleteResponse, O>(environmentOperations['directories.delete'], [id], body, options),\n    /**\n     * Read one inbound directory: its provider, status, SCIM base URL and last sync error. Never its token or credentials.\n     *\n     * Requires scope `directory_sync:read`. Danger: read.\n     *\n     * `GET /directories/{id}` · action `directories.get`\n     * @scope `directory_sync:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, query?: DirectoriesGetQuery, options?: O): Promise<Outcome<DirectoriesGetResponse, O>> =>\n      this.transport.call<DirectoriesGetResponse, O>(environmentOperations['directories.get'], [id], query, options),\n    /**\n     * List the directories (SCIM, Google Workspace, Microsoft Entra) syncing people in, optionally for one organization, with their last sync error.\n     *\n     * Requires scope `directory_sync:read`. Danger: read.\n     *\n     * `GET /directories` · action `directories.list`\n     * @scope `directory_sync:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: DirectoriesListQuery, options?: O): Promise<Outcome<DirectoriesListResponse, O>> =>\n      this.transport.call<DirectoriesListResponse, O>(environmentOperations['directories.list'], [], query, options),\n    /** Every item of `directories.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<DirectoriesListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<Directory, void, undefined> =>\n      this.transport.paginate(environmentOperations['directories.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Pull a Google Workspace, Microsoft Entra or HR-system directory now, on a worker. `full` asks an HR system for everybody rather than what changed.\n     *\n     * Requires scope `directory_sync:write`. Danger: write.\n     *\n     * `POST /directories/{id}/sync` · action `directories.sync`\n     * @scope `directory_sync:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    sync: <O extends CallOptions = CallOptions>(id: string, body?: DirectoriesSyncBody, options?: O): Promise<Outcome<DirectoriesSyncResponse, O>> =>\n      this.transport.call<DirectoriesSyncResponse, O>(environmentOperations['directories.sync'], [id], body, options),\n    /**\n     * Rename an inbound directory.\n     *\n     * Requires scope `directory_sync:write`. Danger: write.\n     *\n     * `PATCH /directories/{id}` · action `directories.update`\n     * @scope `directory_sync:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(id: string, body: DirectoriesUpdateBody, options?: O): Promise<Outcome<DirectoriesUpdateResponse, O>> =>\n      this.transport.call<DirectoriesUpdateResponse, O>(environmentOperations['directories.update'], [id], body, options),\n    credentials: {\n      /**\n       * Replace a pull directory's provider credentials, verifying the new ones first. Write-only; never returned.\n       *\n       * Requires scope `directory_sync:write`. Danger: critical.\n       *\n       * `PUT /directories/{id}/credentials` · action `directories.credentials.replace`\n       * @scope `directory_sync:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      replace: <O extends CallOptions = CallOptions>(id: string, body: DirectoriesCredentialsReplaceBody, options?: O): Promise<Outcome<DirectoriesCredentialsReplaceResponse, O>> =>\n        this.transport.call<DirectoriesCredentialsReplaceResponse, O>(environmentOperations['directories.credentials.replace'], [id], body, options),\n    },\n    groups: {\n      /**\n       * List the groups a directory has synced, with the role ids each group is mapped onto.\n       *\n       * Requires scope `directory_sync:read`. Danger: read.\n       *\n       * `GET /directories/{id}/groups` · action `directories.groups.list`\n       * @scope `directory_sync:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(id: string, query?: DirectoriesGroupsListQuery, options?: O): Promise<Outcome<DirectoriesGroupsListResponse, O>> =>\n        this.transport.call<DirectoriesGroupsListResponse, O>(environmentOperations['directories.groups.list'], [id], query, options),\n      /** Every item of `directories.groups.list`, fetching pages as the iteration reaches them. */\n      listAll: (id: string, query?: Omit<DirectoriesGroupsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<DirectoryGroup, void, undefined> =>\n        this.transport.paginate(environmentOperations['directories.groups.list'], [id], query as Record<string, unknown> | undefined, options),\n      /**\n       * Map a directory group onto a role (everyone in the group holds it as membership syncs), or unmap it.\n       *\n       * Requires scope `directory_sync:write`. Danger: write.\n       *\n       * `POST /directories/{id}/group-roles` · action `directories.groups.map`\n       * @scope `directory_sync:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      map: <O extends CallOptions = CallOptions>(id: string, body: DirectoriesGroupsMapBody, options?: O): Promise<Outcome<DirectoriesGroupsMapResponse, O>> =>\n        this.transport.call<DirectoriesGroupsMapResponse, O>(environmentOperations['directories.groups.map'], [id], body, options),\n    },\n    hris: {\n      /**\n       * Connect an HR system (Workday, BambooHR, Rippling, HiBob or Personio) to sync an organization's people from, verifying the credentials first. The first sync is queued.\n       *\n       * Requires scope `directory_sync:write`. Danger: critical.\n       *\n       * `POST /directories/hris` · action `directories.hris.connect`\n       * @scope `directory_sync:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      connect: <O extends CallOptions = CallOptions>(body: DirectoriesHrisConnectBody, options?: O): Promise<Outcome<DirectoriesHrisConnectResponse, O>> =>\n        this.transport.call<DirectoriesHrisConnectResponse, O>(environmentOperations['directories.hris.connect'], [], body, options),\n    },\n    status: {\n      /**\n       * Pause or resume an inbound directory's provisioning.\n       *\n       * Requires scope `directory_sync:write`. Danger: write.\n       *\n       * `POST /directories/{id}/status` · action `directories.status.set`\n       * @scope `directory_sync:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      set: <O extends CallOptions = CallOptions>(id: string, body: DirectoriesStatusSetBody, options?: O): Promise<Outcome<DirectoriesStatusSetResponse, O>> =>\n        this.transport.call<DirectoriesStatusSetResponse, O>(environmentOperations['directories.status.set'], [id], body, options),\n    },\n    syncSettings: {\n      /**\n       * Set how often a pull directory syncs, and for an HR system which of its fields pass through onto people.\n       *\n       * Requires scope `directory_sync:write`. Danger: write.\n       *\n       * `PATCH /directories/{id}/sync-settings` · action `directories.sync_settings.update`\n       * @scope `directory_sync:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      update: <O extends CallOptions = CallOptions>(id: string, body?: DirectoriesSyncSettingsUpdateBody, options?: O): Promise<Outcome<DirectoriesSyncSettingsUpdateResponse, O>> =>\n        this.transport.call<DirectoriesSyncSettingsUpdateResponse, O>(environmentOperations['directories.sync_settings.update'], [id], body, options),\n    },\n    token: {\n      /**\n       * Issue a new bearer token for a SCIM directory, returned once. The old token stops working immediately.\n       *\n       * Requires scope `directory_sync:write`. Danger: critical.\n       *\n       * `POST /directories/{id}/rotate` · action `directories.token.rotate`\n       * @scope `directory_sync:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      rotate: <O extends CallOptions = CallOptions>(id: string, body?: DirectoriesTokenRotateBody, options?: O): Promise<Outcome<DirectoriesTokenRotateResponse, O>> =>\n        this.transport.call<DirectoriesTokenRotateResponse, O>(environmentOperations['directories.token.rotate'], [id], body, options),\n    },\n  };\n\n  readonly domains = {\n    /**\n     * Start serving this environment on a custom domain: returns the DNS TXT record that proves you control it.\n     *\n     * Requires scope `domains:write`. Danger: write.\n     *\n     * `POST /domains` · action `domains.add`\n     * @scope `domains:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    add: <O extends CallOptions = CallOptions>(body: DomainsAddBody, options?: O): Promise<Outcome<DomainsAddResponse, O>> =>\n      this.transport.call<DomainsAddResponse, O>(environmentOperations['domains.add'], [], body, options),\n    /**\n     * Read this environment's custom domain, and the DNS TXT record that proves a pending one.\n     *\n     * Requires scope `domains:read`. Danger: read.\n     *\n     * `GET /domains` · action `domains.get`\n     * @scope `domains:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<DomainsGetResponse, O>> =>\n      this.transport.call<DomainsGetResponse, O>(environmentOperations['domains.get'], [], undefined, options),\n    /**\n     * Stop serving this environment on its custom domain. Anything using that domain stops reaching the environment.\n     *\n     * Requires scope `domains:write`. Danger: destructive.\n     *\n     * `DELETE /domains` · action `domains.remove`\n     * @scope `domains:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    remove: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<DomainsRemoveResponse, O>> =>\n      this.transport.call<DomainsRemoveResponse, O>(environmentOperations['domains.remove'], [], undefined, options),\n    /**\n     * Look for the pending domain's DNS TXT record and, once it is visible, serve this environment on that domain.\n     *\n     * Requires scope `domains:write`. Danger: write.\n     *\n     * `POST /domains/verify` · action `domains.verify`\n     * @scope `domains:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    verify: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<DomainsVerifyResponse, O>> =>\n      this.transport.call<DomainsVerifyResponse, O>(environmentOperations['domains.verify'], [], undefined, options),\n  };\n\n  readonly events = {\n    /**\n     * Read this environment's domain events (the facts webhooks deliver) oldest first; pass the last id as `after` to poll for new ones.\n     *\n     * Requires scope `events:read`. Danger: read.\n     *\n     * `GET /events` · action `events.list`\n     * @scope `events:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: EventsListQuery, options?: O): Promise<Outcome<EventsListResponse, O>> =>\n      this.transport.call<EventsListResponse, O>(environmentOperations['events.list'], [], query, options),\n    /** Every item of `events.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<EventsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<DomainEvent, void, undefined> =>\n      this.transport.paginate(environmentOperations['events.list'], [], query as Record<string, unknown> | undefined, options),\n  };\n\n  readonly featureFlags = {\n    /**\n     * Define a feature flag: a key apps ask about, its default, and who it is on for — named users, named organizations, a rollout percentage.\n     *\n     * Requires scope `feature_flags:write`. Danger: write.\n     *\n     * `POST /feature-flags` · action `feature_flags.create`\n     * @scope `feature_flags:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: FeatureFlagsCreateBody, options?: O): Promise<Outcome<FeatureFlagsCreateResponse, O>> =>\n      this.transport.call<FeatureFlagsCreateResponse, O>(environmentOperations['feature_flags.create'], [], body, options),\n    /**\n     * Delete a feature flag and its rules. Its key evaluates to off from now on; tokens already minted keep it until they expire.\n     *\n     * Requires scope `feature_flags:write`. Danger: destructive.\n     *\n     * `DELETE /feature-flags/{id}` · action `feature_flags.delete`\n     * @scope `feature_flags:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    delete: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<FeatureFlagsDeleteResponse, O>> =>\n      this.transport.call<FeatureFlagsDeleteResponse, O>(environmentOperations['feature_flags.delete'], [id], undefined, options),\n    /**\n     * Evaluate every feature flag for a user in an organization: whether each is on, and the rule that decided. For app backends without a token in hand.\n     *\n     * Requires scope `feature_flags:read`. Danger: read.\n     *\n     * `GET /feature-flags/evaluate` · action `feature_flags.evaluate`\n     * @scope `feature_flags:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    evaluate: <O extends CallOptions = CallOptions>(query?: FeatureFlagsEvaluateQuery, options?: O): Promise<Outcome<FeatureFlagsEvaluateResponse, O>> =>\n      this.transport.call<FeatureFlagsEvaluateResponse, O>(environmentOperations['feature_flags.evaluate'], [], query, options),\n    /**\n     * Read one feature flag: its default, whether it is switched on, and every user, organization and rollout rule.\n     *\n     * Requires scope `feature_flags:read`. Danger: read.\n     *\n     * `GET /feature-flags/{id}` · action `feature_flags.get`\n     * @scope `feature_flags:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<FeatureFlagsGetResponse, O>> =>\n      this.transport.call<FeatureFlagsGetResponse, O>(environmentOperations['feature_flags.get'], [id], undefined, options),\n    /**\n     * List this environment's feature flags with their default, kill switch and targeting rules.\n     *\n     * Requires scope `feature_flags:read`. Danger: read.\n     *\n     * `GET /feature-flags` · action `feature_flags.list`\n     * @scope `feature_flags:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: FeatureFlagsListQuery, options?: O): Promise<Outcome<FeatureFlagsListResponse, O>> =>\n      this.transport.call<FeatureFlagsListResponse, O>(environmentOperations['feature_flags.list'], [], query, options),\n    /** Every item of `feature_flags.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<FeatureFlagsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<FeatureFlag, void, undefined> =>\n      this.transport.paginate(environmentOperations['feature_flags.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Change a feature flag: switch it on or off for everyone, change its default, or replace its user rules, organization rules or rollout percentage.\n     *\n     * Requires scope `feature_flags:write`. Danger: write.\n     *\n     * `PATCH /feature-flags/{id}` · action `feature_flags.update`\n     * @scope `feature_flags:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(id: string, body?: FeatureFlagsUpdateBody, options?: O): Promise<Outcome<FeatureFlagsUpdateResponse, O>> =>\n      this.transport.call<FeatureFlagsUpdateResponse, O>(environmentOperations['feature_flags.update'], [id], body, options),\n  };\n\n  readonly fga = {\n    /**\n     * Check whether a subject has a relation on a resource — directly, through computed relations, parents or nested groups. Optionally at least as fresh as a consistency_token.\n     *\n     * Requires scope `fga:read`. Danger: read.\n     *\n     * `GET /fga/check` · action `fga.check`\n     * @scope `fga:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    check: <O extends CallOptions = CallOptions>(query: FgaCheckQuery, options?: O): Promise<Outcome<FgaCheckResponse, O>> =>\n      this.transport.call<FgaCheckResponse, O>(environmentOperations['fga.check'], [], query, options),\n    /**\n     * Run 1–100 checks in one round trip, each written resource#relation@subject (document:readme#viewer@user:alice), all at the same revision, answered in order.\n     *\n     * Requires scope `fga:read`. Danger: read.\n     *\n     * `GET /fga/check/batch` · action `fga.check_batch`\n     * @scope `fga:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    checkBatch: <O extends CallOptions = CallOptions>(query: FgaCheckBatchQuery, options?: O): Promise<Outcome<FgaCheckBatchResponse, O>> =>\n      this.transport.call<FgaCheckBatchResponse, O>(environmentOperations['fga.check_batch'], [], query, options),\n    resources: {\n      /**\n       * List the resources of one type a subject has a relation on (e.g. every document alice can view), through all inheritance; sorted ids, paged with after.\n       *\n       * Requires scope `fga:read`. Danger: read.\n       *\n       * `GET /fga/resources` · action `fga.resources.list`\n       * @scope `fga:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query: FgaResourcesListQuery, options?: O): Promise<Outcome<FgaResourcesListResponse, O>> =>\n        this.transport.call<FgaResourcesListResponse, O>(environmentOperations['fga.resources.list'], [], query, options),\n      /** Every item of `fga.resources.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<FgaResourcesListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<FgaObject, void, undefined> =>\n        this.transport.paginate(environmentOperations['fga.resources.list'], [], query as Record<string, unknown> | undefined, options),\n    },\n    schema: {\n      /**\n       * Read this environment's fine-grained authorization schema: the source text, its parsed types and relations, its version, and the current consistency token.\n       *\n       * Requires scope `fga:read`. Danger: read.\n       *\n       * `GET /fga/schema` · action `fga.schema.get`\n       * @scope `fga:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<FgaSchemaGetResponse, O>> =>\n        this.transport.call<FgaSchemaGetResponse, O>(environmentOperations['fga.schema.get'], [], undefined, options),\n      /**\n       * Replace this environment's fine-grained authorization schema (types, relations and how each is decided). Changes the answer to every check at once; refused if invalid or if existing tuples would no longer fit.\n       *\n       * Requires scope `fga:schema`. Danger: critical.\n       *\n       * `PUT /fga/schema` · action `fga.schema.update`\n       * @scope `fga:schema`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      update: <O extends CallOptions = CallOptions>(body: FgaSchemaUpdateBody, options?: O): Promise<Outcome<FgaSchemaUpdateResponse, O>> =>\n        this.transport.call<FgaSchemaUpdateResponse, O>(environmentOperations['fga.schema.update'], [], body, options),\n      /**\n       * Check a fine-grained authorization schema without saving it: every error by line, or the parsed types and canonical text.\n       *\n       * Requires scope `fga:read`. Danger: read.\n       *\n       * `GET /fga/schema/validate` · action `fga.schema.validate`\n       * @scope `fga:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      validate: <O extends CallOptions = CallOptions>(query: FgaSchemaValidateQuery, options?: O): Promise<Outcome<FgaSchemaValidateResponse, O>> =>\n        this.transport.call<FgaSchemaValidateResponse, O>(environmentOperations['fga.schema.validate'], [], query, options),\n    },\n    subjects: {\n      /**\n       * List the subjects of one type that have a relation on a resource (e.g. every user who can view the readme), groups and inheritance expanded; sorted ids, paged with after.\n       *\n       * Requires scope `fga:read`. Danger: read.\n       *\n       * `GET /fga/subjects` · action `fga.subjects.list`\n       * @scope `fga:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query: FgaSubjectsListQuery, options?: O): Promise<Outcome<FgaSubjectsListResponse, O>> =>\n        this.transport.call<FgaSubjectsListResponse, O>(environmentOperations['fga.subjects.list'], [], query, options),\n      /** Every item of `fga.subjects.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<FgaSubjectsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<FgaObject, void, undefined> =>\n        this.transport.paginate(environmentOperations['fga.subjects.list'], [], query as Record<string, unknown> | undefined, options),\n    },\n    tuples: {\n      /**\n       * Delete 1–100 relationship tuples in one atomic batch. Revokes the access they granted, and everything inherited through them, at once.\n       *\n       * Requires scope `fga:write`. Danger: destructive.\n       *\n       * `POST /fga/tuples/delete` · action `fga.tuples.delete`\n       * @scope `fga:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      delete: <O extends CallOptions = CallOptions>(body: FgaTuplesDeleteBody, options?: O): Promise<Outcome<FgaTuplesDeleteResponse, O>> =>\n        this.transport.call<FgaTuplesDeleteResponse, O>(environmentOperations['fga.tuples.delete'], [], body, options),\n      /**\n       * List stored relationship tuples oldest first, filtered by resource type and id, relation and subject; pass next_cursor as after to page.\n       *\n       * Requires scope `fga:read`. Danger: read.\n       *\n       * `GET /fga/tuples` · action `fga.tuples.list`\n       * @scope `fga:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query?: FgaTuplesListQuery, options?: O): Promise<Outcome<FgaTuplesListResponse, O>> =>\n        this.transport.call<FgaTuplesListResponse, O>(environmentOperations['fga.tuples.list'], [], query, options),\n      /** Every item of `fga.tuples.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<FgaTuplesListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<FgaTuple, void, undefined> =>\n        this.transport.paginate(environmentOperations['fga.tuples.list'], [], query as Record<string, unknown> | undefined, options),\n      /**\n       * Write 1–100 relationship tuples (resource#relation@subject) in one atomic batch, each checked against the schema. Grants access at once; returns a consistency_token for checks that must see it.\n       *\n       * Requires scope `fga:write`. Danger: write.\n       *\n       * `POST /fga/tuples` · action `fga.tuples.write`\n       * @scope `fga:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      write: <O extends CallOptions = CallOptions>(body: FgaTuplesWriteBody, options?: O): Promise<Outcome<FgaTuplesWriteResponse, O>> =>\n        this.transport.call<FgaTuplesWriteResponse, O>(environmentOperations['fga.tuples.write'], [], body, options),\n    },\n  };\n\n  readonly frontendKeys = {\n    /**\n     * Create a publishable frontend key for a browser app, usable only from the origins listed. The key is public by design.\n     *\n     * Requires scope `frontend_keys:write`. Danger: write.\n     *\n     * `POST /frontend-keys` · action `frontend_keys.create`\n     * @scope `frontend_keys:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: FrontendKeysCreateBody, options?: O): Promise<Outcome<FrontendKeysCreateResponse, O>> =>\n      this.transport.call<FrontendKeysCreateResponse, O>(environmentOperations['frontend_keys.create'], [], body, options),\n    /**\n     * List the publishable frontend keys browser apps present to the Frontend API, in full, with their allowed origins.\n     *\n     * Requires scope `frontend_keys:read`. Danger: read.\n     *\n     * `GET /frontend-keys` · action `frontend_keys.list`\n     * @scope `frontend_keys:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: FrontendKeysListQuery, options?: O): Promise<Outcome<FrontendKeysListResponse, O>> =>\n      this.transport.call<FrontendKeysListResponse, O>(environmentOperations['frontend_keys.list'], [], query, options),\n    /** Every item of `frontend_keys.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<FrontendKeysListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<FrontendKey, void, undefined> =>\n      this.transport.paginate(environmentOperations['frontend_keys.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Revoke a publishable frontend key. Pages still holding it stop working immediately.\n     *\n     * Requires scope `frontend_keys:write`. Danger: destructive.\n     *\n     * `DELETE /frontend-keys/{id}` · action `frontend_keys.revoke`\n     * @scope `frontend_keys:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    revoke: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<FrontendKeysRevokeResponse, O>> =>\n      this.transport.call<FrontendKeysRevokeResponse, O>(environmentOperations['frontend_keys.revoke'], [id], undefined, options),\n    /**\n     * Replace the exact list of origins allowed to present a publishable frontend key. Live on the next request.\n     *\n     * Requires scope `frontend_keys:write`. Danger: write.\n     *\n     * `PUT /frontend-keys/{id}/origins` · action `frontend_keys.set_origins`\n     * @scope `frontend_keys:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    setOrigins: <O extends CallOptions = CallOptions>(id: string, body: FrontendKeysSetOriginsBody, options?: O): Promise<Outcome<FrontendKeysSetOriginsResponse, O>> =>\n      this.transport.call<FrontendKeysSetOriginsResponse, O>(environmentOperations['frontend_keys.set_origins'], [id], body, options),\n  };\n\n  readonly hooks = {\n    /**\n     * Register a hook at a hook point (token minting, login, registration, password change). Returns its signing secret once.\n     *\n     * Requires scope `hooks:write`. Danger: critical.\n     *\n     * `POST /hooks` · action `hooks.create`\n     * @scope `hooks:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: HooksCreateBody, options?: O): Promise<Outcome<HooksCreateResponse, O>> =>\n      this.transport.call<HooksCreateResponse, O>(environmentOperations['hooks.create'], [], body, options),\n    /**\n     * Remove a hook. It is no longer called at its hook point.\n     *\n     * Requires scope `hooks:write`. Danger: destructive.\n     *\n     * `DELETE /hooks/{id}` · action `hooks.delete`\n     * @scope `hooks:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    delete: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<HooksDeleteResponse, O>> =>\n      this.transport.call<HooksDeleteResponse, O>(environmentOperations['hooks.delete'], [id], undefined, options),\n    /**\n     * Get one hook: its URL, hook point, owner and whether it is active. Never its signing secret.\n     *\n     * Requires scope `hooks:read`. Danger: read.\n     *\n     * `GET /hooks/{id}` · action `hooks.get`\n     * @scope `hooks:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<HooksGetResponse, O>> =>\n      this.transport.call<HooksGetResponse, O>(environmentOperations['hooks.get'], [id], undefined, options),\n    /**\n     * List the hooks — endpoints called during sign-in and token issuance — with their hook point, owner and whether each is active.\n     *\n     * Requires scope `hooks:read`. Danger: read.\n     *\n     * `GET /hooks` · action `hooks.list`\n     * @scope `hooks:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: HooksListQuery, options?: O): Promise<Outcome<HooksListResponse, O>> =>\n      this.transport.call<HooksListResponse, O>(environmentOperations['hooks.list'], [], query, options),\n    /** Every item of `hooks.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<HooksListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<InlineHook, void, undefined> =>\n      this.transport.paginate(environmentOperations['hooks.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Pause (active: false) or activate (active: true) a hook.\n     *\n     * Requires scope `hooks:write`. Danger: critical.\n     *\n     * `PATCH /hooks/{id}` · action `hooks.update`\n     * @scope `hooks:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(id: string, body: HooksUpdateBody, options?: O): Promise<Outcome<HooksUpdateResponse, O>> =>\n      this.transport.call<HooksUpdateResponse, O>(environmentOperations['hooks.update'], [id], body, options),\n  };\n\n  readonly invitations = {\n    /**\n     * List an organization's pending invitations\n     *\n     * Requires scope `invitations:read`. Pending and unexpired only.\n     *\n     * `GET /organizations/{organization_id}/invitations` · action `invitations.list`\n     * @scope `invitations:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(organizationId: string, query?: InvitationsListQuery, options?: O): Promise<Outcome<InvitationsListResponse, O>> =>\n      this.transport.call<InvitationsListResponse, O>(environmentOperations['invitations.list'], [organizationId], query, options),\n    /** Every item of `invitations.list`, fetching pages as the iteration reaches them. */\n    listAll: (organizationId: string, query?: Omit<InvitationsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<Invitation, void, undefined> =>\n      this.transport.paginate(environmentOperations['invitations.list'], [organizationId], query as Record<string, unknown> | undefined, options),\n    /**\n     * Mail a pending invitation again\n     *\n     * Requires scope `invitations:write`. On a **fresh link**: only a hash of the old one is\n     * kept, so it cannot be re-sent, and the reason people ask is usually that it expired.\n     * The response is the NEW invitation — its `id` replaces the old one, which stops\n     * working. Its roles and app context move with it.\n     *\n     * One re-send per address per minute (`429 too_soon`); `409 not_pending` for one that\n     * was accepted, withdrawn or has expired; `503 mail_failed` keeps the invitation.\n     *\n     * `POST /organizations/{organization_id}/invitations/{invitation_id}/resend` · action `invitations.resend`\n     * @scope `invitations:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    resend: <O extends CallOptions = CallOptions>(organizationId: string, invitationId: string, options?: O): Promise<Outcome<InvitationsResendResponse, O>> =>\n      this.transport.call<InvitationsResendResponse, O>(environmentOperations['invitations.resend'], [organizationId, invitationId], undefined, options),\n    /**\n     * Withdraw a pending invitation\n     *\n     * Requires scope `invitations:write`. The link stops working, and the roles parked\n     * for it go with it. `409 not_pending` for one already accepted, withdrawn or expired.\n     *\n     * `DELETE /organizations/{organization_id}/invitations/{invitation_id}` · action `invitations.revoke`\n     * @scope `invitations:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    revoke: <O extends CallOptions = CallOptions>(organizationId: string, invitationId: string, options?: O): Promise<Outcome<InvitationsRevokeResponse, O>> =>\n      this.transport.call<InvitationsRevokeResponse, O>(environmentOperations['invitations.revoke'], [organizationId, invitationId], undefined, options),\n    /**\n     * Invite someone to the organization\n     *\n     * Requires scope `invitations:write`. Mails a link; the person joins when they open it\n     * and confirm. Inviting an address again replaces its earlier pending invitation.\n     *\n     * - `role` — `admin` or `member` (default `member`). Never `owner`.\n     * - `roles` — access roles granted when the invitation is accepted: role ids, or your\n     *   app's manifest **keys** when `client_id` names the app that declared them. Only\n     *   roles the organization's own administrators could grant are accepted: a **staff\n     *   role** is refused (`422 role_not_assignable`) — grant it after they join, with\n     *   `PUT …/members/{user_id}/roles/{role_id}`.\n     * - `client_id` + `return_to` — after accepting, the person is sent to `return_to`,\n     *   which must be on one of that app's registered redirect-URI origins (checked again\n     *   when the invitation is accepted).\n     * - `inviter_name` — who the mail says it is from. Defaults to the app's name, or the\n     *   environment's.\n     *\n     * Refusals: `409 already_member`, `409 access_role_conflict` (segregation of duties),\n     * `422 unknown_role`, `422 role_not_assignable`, `422 unknown_app`,\n     * `422 return_without_app`, `422 return_to_malformed`, `422 return_to_not_registered`,\n     * `503 mail_failed` (nothing was created — retry).\n     *\n     * `POST /organizations/{organization_id}/invitations` · action `invitations.send`\n     * @scope `invitations:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    send: <O extends CallOptions = CallOptions>(organizationId: string, body: InvitationsSendBody, options?: O): Promise<Outcome<InvitationsSendResponse, O>> =>\n      this.transport.call<InvitationsSendResponse, O>(environmentOperations['invitations.send'], [organizationId], body, options),\n  };\n\n  readonly keys = {\n    /**\n     * Mint a management key for this environment, at most as wide as the caller. The value is returned once, as `token`.\n     *\n     * Requires scope `keys:write`. Danger: critical.\n     *\n     * `POST /keys` · action `keys.create`\n     * @scope `keys:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: KeysCreateBody, options?: O): Promise<Outcome<KeysCreateResponse, O>> =>\n      this.transport.call<KeysCreateResponse, O>(environmentOperations['keys.create'], [], body, options),\n    /**\n     * List this environment's management keys (names, scopes, parents, expiry, last use — never their values).\n     *\n     * Requires scope `keys:read`. Danger: read.\n     *\n     * `GET /keys` · action `keys.list`\n     * @scope `keys:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: KeysListQuery, options?: O): Promise<Outcome<KeysListResponse, O>> =>\n      this.transport.call<KeysListResponse, O>(environmentOperations['keys.list'], [], query, options),\n    /** Every item of `keys.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<KeysListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<ManagementKey, void, undefined> =>\n      this.transport.paginate(environmentOperations['keys.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Revoke a management key and every key it minted, immediately.\n     *\n     * Requires scope `keys:write`. Danger: destructive.\n     *\n     * `DELETE /keys/{id}` · action `keys.revoke`\n     * @scope `keys:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    revoke: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<KeysRevokeResponse, O>> =>\n      this.transport.call<KeysRevokeResponse, O>(environmentOperations['keys.revoke'], [id], undefined, options),\n    /**\n     * Rotate a management key: mint a successor with the same scopes and retire the old one after a grace period.\n     *\n     * Requires scope `keys:write`. Danger: critical.\n     *\n     * `POST /keys/{id}/rotate` · action `keys.rotate`\n     * @scope `keys:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    rotate: <O extends CallOptions = CallOptions>(id: string, body?: KeysRotateBody, options?: O): Promise<Outcome<KeysRotateResponse, O>> =>\n      this.transport.call<KeysRotateResponse, O>(environmentOperations['keys.rotate'], [id], body, options),\n  };\n\n  readonly legacyLogin = {\n    /**\n     * Approve the declared legacy login endpoint: sign-ins for people not yet migrated, with their passwords, go to that URL.\n     *\n     * Requires scope `signin:write`. Danger: critical.\n     *\n     * `POST /legacy-login/approve` · action `legacy_login.approve`\n     * @scope `signin:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    approve: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<LegacyLoginApproveResponse, O>> =>\n      this.transport.call<LegacyLoginApproveResponse, O>(environmentOperations['legacy_login.approve'], [], undefined, options),\n    /**\n     * Read the legacy login endpoint an app declared for migration, and whether it is approved to receive sign-ins.\n     *\n     * Requires scope `signin:read`. Danger: read.\n     *\n     * `GET /legacy-login` · action `legacy_login.get`\n     * @scope `signin:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<LegacyLoginGetResponse, O>> =>\n      this.transport.call<LegacyLoginGetResponse, O>(environmentOperations['legacy_login.get'], [], undefined, options),\n    /**\n     * Ask the declared legacy login endpoint whether it knows an address — your own — to test it before approving. Sends no password.\n     *\n     * Requires scope `signin:write`. Danger: write.\n     *\n     * `POST /legacy-login/probe` · action `legacy_login.probe`\n     * @scope `signin:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    probe: <O extends CallOptions = CallOptions>(body: LegacyLoginProbeBody, options?: O): Promise<Outcome<LegacyLoginProbeResponse, O>> =>\n      this.transport.call<LegacyLoginProbeResponse, O>(environmentOperations['legacy_login.probe'], [], body, options),\n    /**\n     * Withdraw the legacy login approval. People not yet migrated can no longer sign in; the declaration stays on file.\n     *\n     * Requires scope `signin:write`. Danger: critical.\n     *\n     * `POST /legacy-login/revoke` · action `legacy_login.revoke`\n     * @scope `signin:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    revoke: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<LegacyLoginRevokeResponse, O>> =>\n      this.transport.call<LegacyLoginRevokeResponse, O>(environmentOperations['legacy_login.revoke'], [], undefined, options),\n  };\n\n  readonly logStreams = {\n    /**\n     * Stream the audit trail to a SIEM (Splunk, Elastic, Graylog, CEF, JSON), Datadog, or an S3 or GCS bucket. A generated HMAC key is returned once.\n     *\n     * Requires scope `log_streams:write`. Danger: critical.\n     *\n     * `POST /log-streams` · action `log_streams.create`\n     * @scope `log_streams:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: LogStreamsCreateBody, options?: O): Promise<Outcome<LogStreamsCreateResponse, O>> =>\n      this.transport.call<LogStreamsCreateResponse, O>(environmentOperations['log_streams.create'], [], body, options),\n    /**\n     * Delete an audit log stream. Nothing more is delivered to its endpoint.\n     *\n     * Requires scope `log_streams:write`. Danger: destructive.\n     *\n     * `DELETE /log-streams/{id}` · action `log_streams.delete`\n     * @scope `log_streams:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    delete: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<LogStreamsDeleteResponse, O>> =>\n      this.transport.call<LogStreamsDeleteResponse, O>(environmentOperations['log_streams.delete'], [id], undefined, options),\n    /**\n     * Get one audit log stream: destination, endpoint, auth scheme, owner and health. Never its secret.\n     *\n     * Requires scope `log_streams:read`. Danger: read.\n     *\n     * `GET /log-streams/{id}` · action `log_streams.get`\n     * @scope `log_streams:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<LogStreamsGetResponse, O>> =>\n      this.transport.call<LogStreamsGetResponse, O>(environmentOperations['log_streams.get'], [id], undefined, options),\n    /**\n     * List the SIEM destinations this environment's audit trail is streamed to, and whether each is enabled. Never a secret.\n     *\n     * Requires scope `log_streams:read`. Danger: read.\n     *\n     * `GET /log-streams` · action `log_streams.list`\n     * @scope `log_streams:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: LogStreamsListQuery, options?: O): Promise<Outcome<LogStreamsListResponse, O>> =>\n      this.transport.call<LogStreamsListResponse, O>(environmentOperations['log_streams.list'], [], query, options),\n    /** Every item of `log_streams.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<LogStreamsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<LogStream, void, undefined> =>\n      this.transport.paginate(environmentOperations['log_streams.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Send one test event to a log stream now and report whether the destination accepted it, and if not, why.\n     *\n     * Requires scope `log_streams:write`. Danger: write.\n     *\n     * `POST /log-streams/{id}/test` · action `log_streams.test`\n     * @scope `log_streams:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    test: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<LogStreamsTestResponse, O>> =>\n      this.transport.call<LogStreamsTestResponse, O>(environmentOperations['log_streams.test'], [id], undefined, options),\n    /**\n     * Change an audit log stream's name, destination, endpoint, options or credential (re-validated; resets its circuit breaker), or disable (enabled: false) / resume (enabled: true) it.\n     *\n     * Requires scope `log_streams:write`. Danger: critical.\n     *\n     * `PATCH /log-streams/{id}` · action `log_streams.update`\n     * @scope `log_streams:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(id: string, body?: LogStreamsUpdateBody, options?: O): Promise<Outcome<LogStreamsUpdateResponse, O>> =>\n      this.transport.call<LogStreamsUpdateResponse, O>(environmentOperations['log_streams.update'], [id], body, options),\n  };\n\n  readonly members = {\n    /**\n     * Add an existing user as a member\n     *\n     * Requires scope `members:write`. Straight in — no invitation, no mail. Name the user by\n     * `user_id` or by `email`; they must exist in this environment (`422 user_not_found`).\n     * A suspended or archived organization takes no new members (`409 organization_inactive`).\n     *\n     * `roles` grants access roles at the same time — ids, or your app's manifest keys with\n     * `client_id` — with the environment's authority (staff roles included). One the\n     * organization cannot hold is `422 role_not_assignable`; a segregation-of-duties\n     * conflict is `409 role_conflict`, and nothing is added.\n     *\n     * `role` is `admin` or `member` (default `member`). `owner` is never assignable:\n     * ownership moves with `transfer-ownership`.\n     *\n     * **Idempotent for the same role**: repeating the request answers `200` with the\n     * existing membership. A member on a *different* role is `409 already_member` — change\n     * the role with `PATCH`.\n     *\n     * `POST /organizations/{organization_id}/members` · action `members.add`\n     * @scope `members:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    add: <O extends CallOptions = CallOptions>(organizationId: string, body?: MembersAddBody, options?: O): Promise<Outcome<MembersAddResponse, O>> =>\n      this.transport.call<MembersAddResponse, O>(environmentOperations['members.add'], [organizationId], body, options),\n    /**\n     * List an organization's members\n     *\n     * Requires scope `members:read`. Every membership, whatever its status, oldest first.\n     *\n     * `GET /organizations/{organization_id}/members` · action `members.list`\n     * @scope `members:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(organizationId: string, query?: MembersListQuery, options?: O): Promise<Outcome<MembersListResponse, O>> =>\n      this.transport.call<MembersListResponse, O>(environmentOperations['members.list'], [organizationId], query, options),\n    /** Every item of `members.list`, fetching pages as the iteration reaches them. */\n    listAll: (organizationId: string, query?: Omit<MembersListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<Member, void, undefined> =>\n      this.transport.paginate(environmentOperations['members.list'], [organizationId], query as Record<string, unknown> | undefined, options),\n    /**\n     * Remove a member\n     *\n     * Requires scope `members:write`. The member's roles in the organization go with the\n     * membership. Removing the only owner is refused with `409 last_owner`.\n     *\n     * `DELETE /organizations/{organization_id}/members/{user_id}` · action `members.remove`\n     * @scope `members:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    remove: <O extends CallOptions = CallOptions>(organizationId: string, userId: string, options?: O): Promise<Outcome<MembersRemoveResponse, O>> =>\n      this.transport.call<MembersRemoveResponse, O>(environmentOperations['members.remove'], [organizationId, userId], undefined, options),\n    /**\n     * Change a member's role\n     *\n     * Requires scope `members:write`. `role` is `admin` or `member`. Demoting the only\n     * owner is refused with `409 last_owner` — transfer ownership first.\n     *\n     * `PATCH /organizations/{organization_id}/members/{user_id}` · action `members.update`\n     * @scope `members:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(organizationId: string, userId: string, body: MembersUpdateBody, options?: O): Promise<Outcome<MembersUpdateResponse, O>> =>\n      this.transport.call<MembersUpdateResponse, O>(environmentOperations['members.update'], [organizationId, userId], body, options),\n    roles: {\n      /**\n       * Grant a member a role in the organization\n       *\n       * Requires scope `roles:write`. Idempotent.\n       *\n       * **This API grants with the environment's authority.** It is your backend, so it may\n       * grant any role the organization can hold — including a **staff role**\n       * (`tenant_assignable: false`), such as your support lead's \"Support\" role at one\n       * customer. An organization's own administrators still cannot: their console, their\n       * invitations and their directory mappings refuse staff roles, and nothing here\n       * changes that.\n       *\n       * Refusals: `422 role_not_assignable` (another organization's role, or one from an app\n       * this organization cannot use), `409 role_conflict` (segregation of duties).\n       *\n       * `PUT /organizations/{organization_id}/members/{user_id}/roles/{role_id}` · action `members.roles.grant`\n       * @scope `roles:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      grant: <O extends CallOptions = CallOptions>(organizationId: string, userId: string, roleId: string, query?: MembersRolesGrantQuery, options?: O): Promise<Outcome<MembersRolesGrantResponse, O>> =>\n        this.transport.call<MembersRolesGrantResponse, O>(environmentOperations['members.roles.grant'], [organizationId, userId, roleId], query, options),\n      /**\n       * List the roles a member holds in the organization\n       *\n       * Requires scope `roles:read`. Roles granted AT this organization. Roles a person holds\n       * everywhere in the environment (staff) are listed under\n       * `/users/{id}/environment-roles`.\n       *\n       * `GET /organizations/{organization_id}/members/{user_id}/roles` · action `members.roles.list`\n       * @scope `roles:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(organizationId: string, userId: string, options?: O): Promise<Outcome<MembersRolesListResponse, O>> =>\n        this.transport.call<MembersRolesListResponse, O>(environmentOperations['members.roles.list'], [organizationId, userId], undefined, options),\n      /**\n       * Take a role back from a member\n       *\n       * Requires scope `roles:write`. Idempotent — a role the member does not hold is a 204 too.\n       *\n       * `DELETE /organizations/{organization_id}/members/{user_id}/roles/{role_id}` · action `members.roles.revoke`\n       * @scope `roles:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      revoke: <O extends CallOptions = CallOptions>(organizationId: string, userId: string, roleId: string, query?: MembersRolesRevokeQuery, options?: O): Promise<Outcome<MembersRolesRevokeResponse, O>> =>\n        this.transport.call<MembersRolesRevokeResponse, O>(environmentOperations['members.roles.revoke'], [organizationId, userId, roleId], query, options),\n    },\n  };\n\n  readonly organizations = {\n    /**\n     * Create an organization, optionally with its owner\n     *\n     * Requires scope `organizations:write`.\n     *\n     * `POST /organizations` · action `organizations.create`\n     * @scope `organizations:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: OrganizationsCreateBody, options?: O): Promise<Outcome<OrganizationsCreateResponse, O>> =>\n      this.transport.call<OrganizationsCreateResponse, O>(environmentOperations['organizations.create'], [], body, options),\n    /**\n     * Archive an organization\n     *\n     * Requires scope `organizations:write`. **Archives** rather than erases: the status\n     * becomes `deleted`, every member loses access from their next request, the rows stay\n     * for the audit trail, and `organization.deleted` is announced. Idempotent — archiving\n     * an archived organization answers with it unchanged.\n     *\n     * Refused with `409 owns_products` for an organization that owns identity-provider\n     * projects on this platform (a platform customer, not a tenant of your app).\n     *\n     * `DELETE /organizations/{id}` · action `organizations.delete`\n     * @scope `organizations:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    delete: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<OrganizationsDeleteResponse, O>> =>\n      this.transport.call<OrganizationsDeleteResponse, O>(environmentOperations['organizations.delete'], [id], undefined, options),\n    /**\n     * Get an organization\n     *\n     * Requires scope `organizations:read`.\n     *\n     * `GET /organizations/{id}` · action `organizations.get`\n     * @scope `organizations:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<OrganizationsGetResponse, O>> =>\n      this.transport.call<OrganizationsGetResponse, O>(environmentOperations['organizations.get'], [id], undefined, options),\n    /**\n     * List organizations\n     *\n     * Requires scope `organizations:read`. A page at a time, archived ones included. Narrow\n     * with `q` (a fragment of the name or slug) or `status`.\n     *\n     * `GET /organizations` · action `organizations.list`\n     * @scope `organizations:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: OrganizationsListQuery, options?: O): Promise<Outcome<OrganizationsListResponse, O>> =>\n      this.transport.call<OrganizationsListResponse, O>(environmentOperations['organizations.list'], [], query, options),\n    /** Every item of `organizations.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<OrganizationsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<Organization, void, undefined> =>\n      this.transport.paginate(environmentOperations['organizations.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Lift an organization's suspension so its members can sign in again.\n     *\n     * Requires scope `organizations:write`. Danger: write.\n     *\n     * `POST /organizations/{id}/reactivate` · action `organizations.reactivate`\n     * @scope `organizations:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    reactivate: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<OrganizationsReactivateResponse, O>> =>\n      this.transport.call<OrganizationsReactivateResponse, O>(environmentOperations['organizations.reactivate'], [id], undefined, options),\n    /**\n     * Suspend an organization: its members cannot sign in to it until it is reactivated.\n     *\n     * Requires scope `organizations:write`. Danger: write.\n     *\n     * `POST /organizations/{id}/suspend` · action `organizations.suspend`\n     * @scope `organizations:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    suspend: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<OrganizationsSuspendResponse, O>> =>\n      this.transport.call<OrganizationsSuspendResponse, O>(environmentOperations['organizations.suspend'], [id], undefined, options),\n    /**\n     * Make a member the organization's owner\n     *\n     * Requires scope `organizations:write`. The new owner must be an **active** member.\n     * With one current owner this is a hand-over: the previous owner stays on as `admin`.\n     * An organization with no owner (created without `owner_user_id`) gets its first; one\n     * with several (from before ownership was transfer-only) ends with exactly one, the\n     * others stepping down to `admin`.\n     *\n     * Refusals: `422 not_a_member`, `409 not_active`, `409 already_owner`.\n     *\n     * `POST /organizations/{id}/transfer-ownership` · action `organizations.transfer_ownership`\n     * @scope `organizations:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    transferOwnership: <O extends CallOptions = CallOptions>(id: string, body: OrganizationsTransferOwnershipBody, options?: O): Promise<Outcome<OrganizationsTransferOwnershipResponse, O>> =>\n      this.transport.call<OrganizationsTransferOwnershipResponse, O>(environmentOperations['organizations.transfer_ownership'], [id], body, options),\n    /**\n     * Rename an organization, change its slug, or replace its metadata\n     *\n     * Requires scope `organizations:write`. A field left out is left alone; a request\n     * that changes nothing answers with the organization as it is and records nothing.\n     * A change is announced as the `organization.updated` webhook and recorded on the\n     * organization's trail as `organization.renamed`, with the values before and after.\n     *\n     * `PATCH /organizations/{id}` · action `organizations.update`\n     * @scope `organizations:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(id: string, body?: OrganizationsUpdateBody, options?: O): Promise<Outcome<OrganizationsUpdateResponse, O>> =>\n      this.transport.call<OrganizationsUpdateResponse, O>(environmentOperations['organizations.update'], [id], body, options),\n    domains: {\n      /**\n       * Claim an email domain (acme.com) for an organization. Returns the DNS TXT record to publish before verifying it.\n       *\n       * Requires scope `organizations:write`. Danger: write.\n       *\n       * `POST /organizations/{organization_id}/domains` · action `organizations.domains.add`\n       * @scope `organizations:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      add: <O extends CallOptions = CallOptions>(organizationId: string, body: OrganizationsDomainsAddBody, options?: O): Promise<Outcome<OrganizationsDomainsAddResponse, O>> =>\n        this.transport.call<OrganizationsDomainsAddResponse, O>(environmentOperations['organizations.domains.add'], [organizationId], body, options),\n      /**\n       * Turn capture on or off for a verified domain: with it on, everyone with an address there signs in through the organization's SSO.\n       *\n       * Requires scope `organizations:write`. Danger: critical.\n       *\n       * `PUT /organizations/{organization_id}/domains/{domain_id}/capture` · action `organizations.domains.capture`\n       * @scope `organizations:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      capture: <O extends CallOptions = CallOptions>(organizationId: string, domainId: string, body: OrganizationsDomainsCaptureBody, options?: O): Promise<Outcome<OrganizationsDomainsCaptureResponse, O>> =>\n        this.transport.call<OrganizationsDomainsCaptureResponse, O>(environmentOperations['organizations.domains.capture'], [organizationId, domainId], body, options),\n      /**\n       * List the email domains an organization claims\n       *\n       * Requires scope `organizations:read`. Verified or not, each with the DNS TXT record\n       * that proves it (`record_name`, `record_value`). A handful at most; not paged.\n       *\n       * `GET /organizations/{organization_id}/domains` · action `organizations.domains.list`\n       * @scope `organizations:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(organizationId: string, options?: O): Promise<Outcome<OrganizationsDomainsListResponse, O>> =>\n        this.transport.call<OrganizationsDomainsListResponse, O>(environmentOperations['organizations.domains.list'], [organizationId], undefined, options),\n      /**\n       * Remove a claimed email domain from an organization. Capture on it ends.\n       *\n       * Requires scope `organizations:write`. Danger: destructive.\n       *\n       * `DELETE /organizations/{organization_id}/domains/{domain_id}` · action `organizations.domains.remove`\n       * @scope `organizations:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      remove: <O extends CallOptions = CallOptions>(organizationId: string, domainId: string, options?: O): Promise<Outcome<OrganizationsDomainsRemoveResponse, O>> =>\n        this.transport.call<OrganizationsDomainsRemoveResponse, O>(environmentOperations['organizations.domains.remove'], [organizationId, domainId], undefined, options),\n      /**\n       * Check a claimed domain's DNS TXT record and mark the domain verified if it is published.\n       *\n       * Requires scope `organizations:write`. Danger: write.\n       *\n       * `POST /organizations/{organization_id}/domains/{domain_id}/verify` · action `organizations.domains.verify`\n       * @scope `organizations:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      verify: <O extends CallOptions = CallOptions>(organizationId: string, domainId: string, options?: O): Promise<Outcome<OrganizationsDomainsVerifyResponse, O>> =>\n        this.transport.call<OrganizationsDomainsVerifyResponse, O>(environmentOperations['organizations.domains.verify'], [organizationId, domainId], undefined, options),\n    },\n    portalLinks: {\n      /**\n       * Create a one-time Admin Portal link an organization's IT administrator uses to set up SSO, directory sync, domain verification, log streams or SAML certificate renewal, or to read its audit logs, without an account. The URL is shown once.\n       *\n       * Requires scope `portal_links:write`. Danger: critical.\n       *\n       * `POST /organizations/{organization_id}/portal-links` · action `organizations.portal_links.create`\n       * @scope `portal_links:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      create: <O extends CallOptions = CallOptions>(organizationId: string, body: OrganizationsPortalLinksCreateBody, options?: O): Promise<Outcome<OrganizationsPortalLinksCreateResponse, O>> =>\n        this.transport.call<OrganizationsPortalLinksCreateResponse, O>(environmentOperations['organizations.portal_links.create'], [organizationId], body, options),\n      /**\n       * List an organization's Admin Portal links\n       *\n       * Requires scope `portal_links:read`. Danger: read. The links minted in the last 30\n       * days, newest first — every link that can still be opened is among them, since a link\n       * waits a week at most. Each says what it opens, who minted it, whom it was mailed to\n       * and where it stands (`status`). Never the link itself: it was shown once, when it was\n       * minted, and only its hash is kept. Not paged.\n       *\n       * `GET /organizations/{organization_id}/portal-links` · action `organizations.portal_links.list`\n       * @scope `portal_links:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(organizationId: string, options?: O): Promise<Outcome<OrganizationsPortalLinksListResponse, O>> =>\n        this.transport.call<OrganizationsPortalLinksListResponse, O>(environmentOperations['organizations.portal_links.list'], [organizationId], undefined, options),\n      /**\n       * Withdraw an Admin Portal link: it can no longer be opened, and a setup session it already opened ends on its next request. What was already set up through it stays.\n       *\n       * Requires scope `portal_links:write`. Danger: destructive.\n       *\n       * `DELETE /organizations/{organization_id}/portal-links/{id}` · action `organizations.portal_links.revoke`\n       * @scope `portal_links:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      revoke: <O extends CallOptions = CallOptions>(organizationId: string, id: string, options?: O): Promise<Outcome<OrganizationsPortalLinksRevokeResponse, O>> =>\n        this.transport.call<OrganizationsPortalLinksRevokeResponse, O>(environmentOperations['organizations.portal_links.revoke'], [organizationId, id], undefined, options),\n    },\n  };\n\n  readonly permissions = {\n    /**\n     * Author a manual `feature:action` permission, shared with the environment (organization_id null) or one organization's own.\n     *\n     * Requires scope `role_definitions:write`. Danger: write.\n     *\n     * `POST /permissions` · action `permissions.create`\n     * @scope `role_definitions:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: PermissionsCreateBody, options?: O): Promise<Outcome<PermissionsCreateResponse, O>> =>\n      this.transport.call<PermissionsCreateResponse, O>(environmentOperations['permissions.create'], [], body, options),\n    /**\n     * Delete a manual permission: every role carrying it loses it first.\n     *\n     * Requires scope `role_definitions:write`. Danger: destructive.\n     *\n     * `DELETE /permissions/{id}` · action `permissions.delete`\n     * @scope `role_definitions:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    delete: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<PermissionsDeleteResponse, O>> =>\n      this.transport.call<PermissionsDeleteResponse, O>(environmentOperations['permissions.delete'], [id], undefined, options),\n    /**\n     * List the permission catalogue roles are composed from, a page at a time. Narrow by `client_id` (one app's), `organization_id` (what it can see) or a `q` fragment.\n     *\n     * Requires scope `roles:read`. Danger: read.\n     *\n     * `GET /permissions` · action `permissions.list`\n     * @scope `roles:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: PermissionsListQuery, options?: O): Promise<Outcome<PermissionsListResponse, O>> =>\n      this.transport.call<PermissionsListResponse, O>(environmentOperations['permissions.list'], [], query, options),\n    /** Every item of `permissions.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<PermissionsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<Permission, void, undefined> =>\n      this.transport.paginate(environmentOperations['permissions.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Change a manual permission's description, and on the shared tier whether organizations may use it. The key itself never changes.\n     *\n     * Requires scope `role_definitions:write`. Danger: write.\n     *\n     * `PATCH /permissions/{id}` · action `permissions.update`\n     * @scope `role_definitions:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(id: string, body?: PermissionsUpdateBody, options?: O): Promise<Outcome<PermissionsUpdateResponse, O>> =>\n      this.transport.call<PermissionsUpdateResponse, O>(environmentOperations['permissions.update'], [id], body, options),\n  };\n\n  readonly pipes = {\n    /**\n     * Configure a pipe: the environment's OAuth app at a third-party provider (GitHub, Google, Microsoft 365, Slack, Salesforce, HubSpot, Linear, Notion), so people can connect their accounts. The client secret is sealed and never returned.\n     *\n     * Requires scope `pipes:write`. Danger: write.\n     *\n     * `POST /pipes` · action `pipes.create`\n     * @scope `pipes:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: PipesCreateBody, options?: O): Promise<Outcome<PipesCreateResponse, O>> =>\n      this.transport.call<PipesCreateResponse, O>(environmentOperations['pipes.create'], [], body, options),\n    /**\n     * Remove a pipe and every connection through it. Their tokens are revoked here, not at the provider — disconnect people first if that matters.\n     *\n     * Requires scope `pipes:write`. Danger: destructive.\n     *\n     * `DELETE /pipes/{id}` · action `pipes.delete`\n     * @scope `pipes:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    delete: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<PipesDeleteResponse, O>> =>\n      this.transport.call<PipesDeleteResponse, O>(environmentOperations['pipes.delete'], [id], undefined, options),\n    /**\n     * Show one pipe: its provider, OAuth client id, scopes, the redirect URI to register at the provider, and the apps granted its tokens.\n     *\n     * Requires scope `pipes:read`. Danger: read.\n     *\n     * `GET /pipes/{id}` · action `pipes.get`\n     * @scope `pipes:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<PipesGetResponse, O>> =>\n      this.transport.call<PipesGetResponse, O>(environmentOperations['pipes.get'], [id], undefined, options),\n    /**\n     * List the pipes — the third-party providers people can connect their accounts to — with their scopes and the apps granted their tokens. Never a client secret.\n     *\n     * Requires scope `pipes:read`. Danger: read.\n     *\n     * `GET /pipes` · action `pipes.list`\n     * @scope `pipes:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: PipesListQuery, options?: O): Promise<Outcome<PipesListResponse, O>> =>\n      this.transport.call<PipesListResponse, O>(environmentOperations['pipes.list'], [], query, options),\n    /** Every item of `pipes.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<PipesListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<Pipe, void, undefined> =>\n      this.transport.paginate(environmentOperations['pipes.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Change a pipe — client id, client secret (sealed), scopes, parameters, or whether it is enabled. Only what is sent changes.\n     *\n     * Requires scope `pipes:write`. Danger: write.\n     *\n     * `PATCH /pipes/{id}` · action `pipes.update`\n     * @scope `pipes:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(id: string, body?: PipesUpdateBody, options?: O): Promise<Outcome<PipesUpdateResponse, O>> =>\n      this.transport.call<PipesUpdateResponse, O>(environmentOperations['pipes.update'], [id], body, options),\n    connections: {\n      /**\n       * Disconnect a person's connected account: revoke it at the provider where supported, revoke its tokens here, and forget it.\n       *\n       * Requires scope `pipes:write`. Danger: destructive.\n       *\n       * `DELETE /pipes/{id}/connections/{connection_id}` · action `pipes.connections.delete`\n       * @scope `pipes:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      delete: <O extends CallOptions = CallOptions>(id: string, connectionId: string, options?: O): Promise<Outcome<PipesConnectionsDeleteResponse, O>> =>\n        this.transport.call<PipesConnectionsDeleteResponse, O>(environmentOperations['pipes.connections.delete'], [id, connectionId], undefined, options),\n      /**\n       * List the accounts people connected through a pipe: who, which account, granted scopes, status (active / needs_reauth) and when the token expires. Never a token.\n       *\n       * Requires scope `pipes:read`. Danger: read.\n       *\n       * `GET /pipes/{id}/connections` · action `pipes.connections.list`\n       * @scope `pipes:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(id: string, query?: PipesConnectionsListQuery, options?: O): Promise<Outcome<PipesConnectionsListResponse, O>> =>\n        this.transport.call<PipesConnectionsListResponse, O>(environmentOperations['pipes.connections.list'], [id], query, options),\n      /** Every item of `pipes.connections.list`, fetching pages as the iteration reaches them. */\n      listAll: (id: string, query?: Omit<PipesConnectionsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<PipeConnection, void, undefined> =>\n        this.transport.paginate(environmentOperations['pipes.connections.list'], [id], query as Record<string, unknown> | undefined, options),\n    },\n    grants: {\n      /**\n       * Grant an app (by OAuth client id) the right to lease fresh access tokens for the accounts people connected through this pipe.\n       *\n       * Requires scope `pipes:write`. Danger: critical.\n       *\n       * `POST /pipes/{id}/grants` · action `pipes.grants.create`\n       * @scope `pipes:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      create: <O extends CallOptions = CallOptions>(id: string, body: PipesGrantsCreateBody, options?: O): Promise<Outcome<PipesGrantsCreateResponse, O>> =>\n        this.transport.call<PipesGrantsCreateResponse, O>(environmentOperations['pipes.grants.create'], [id], body, options),\n      /**\n       * Withdraw an app's right to lease the tokens people connected through this pipe.\n       *\n       * Requires scope `pipes:write`. Danger: destructive.\n       *\n       * `DELETE /pipes/{id}/grants/{client_id}` · action `pipes.grants.delete`\n       * @scope `pipes:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      delete: <O extends CallOptions = CallOptions>(id: string, clientId: string, options?: O): Promise<Outcome<PipesGrantsDeleteResponse, O>> =>\n        this.transport.call<PipesGrantsDeleteResponse, O>(environmentOperations['pipes.grants.delete'], [id, clientId], undefined, options),\n    },\n  };\n\n  readonly provisioning = {\n    targets: {\n      /**\n       * Register a downstream app this platform pushes an organization's people to over SCIM, or every organization's with environment_wide.\n       *\n       * Requires scope `provisioning:write`. Danger: critical.\n       *\n       * `POST /provisioning-targets` · action `provisioning.targets.create`\n       * @scope `provisioning:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      create: <O extends CallOptions = CallOptions>(body: ProvisioningTargetsCreateBody, options?: O): Promise<Outcome<ProvisioningTargetsCreateResponse, O>> =>\n        this.transport.call<ProvisioningTargetsCreateResponse, O>(environmentOperations['provisioning.targets.create'], [], body, options),\n      /**\n       * Delete a downstream SCIM target. Nothing more is pushed to it.\n       *\n       * Requires scope `provisioning:write`. Danger: destructive.\n       *\n       * `DELETE /provisioning-targets/{id}` · action `provisioning.targets.delete`\n       * @scope `provisioning:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      delete: <O extends CallOptions = CallOptions>(id: string, body?: ProvisioningTargetsDeleteBody, options?: O): Promise<Outcome<ProvisioningTargetsDeleteResponse, O>> =>\n        this.transport.call<ProvisioningTargetsDeleteResponse, O>(environmentOperations['provisioning.targets.delete'], [id], body, options),\n      /**\n       * Read one downstream SCIM target: its URL, auth scheme, status and last error. Never its credential.\n       *\n       * Requires scope `provisioning:read`. Danger: read.\n       *\n       * `GET /provisioning-targets/{id}` · action `provisioning.targets.get`\n       * @scope `provisioning:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(id: string, query?: ProvisioningTargetsGetQuery, options?: O): Promise<Outcome<ProvisioningTargetsGetResponse, O>> =>\n        this.transport.call<ProvisioningTargetsGetResponse, O>(environmentOperations['provisioning.targets.get'], [id], query, options),\n      /**\n       * List the downstream SCIM targets people are provisioned to, optionally for one organization, with their failures. Never their credentials.\n       *\n       * Requires scope `provisioning:read`. Danger: read.\n       *\n       * `GET /provisioning-targets` · action `provisioning.targets.list`\n       * @scope `provisioning:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query?: ProvisioningTargetsListQuery, options?: O): Promise<Outcome<ProvisioningTargetsListResponse, O>> =>\n        this.transport.call<ProvisioningTargetsListResponse, O>(environmentOperations['provisioning.targets.list'], [], query, options),\n      /** Every item of `provisioning.targets.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<ProvisioningTargetsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<ProvisioningTarget, void, undefined> =>\n        this.transport.paginate(environmentOperations['provisioning.targets.list'], [], query as Record<string, unknown> | undefined, options),\n      status: {\n        /**\n         * Pause or resume pushing people to a downstream SCIM target.\n         *\n         * Requires scope `provisioning:write`. Danger: write.\n         *\n         * `POST /provisioning-targets/{id}/status` · action `provisioning.targets.status.set`\n         * @scope `provisioning:write`\n         * @danger write\n         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n         */\n        set: <O extends CallOptions = CallOptions>(id: string, body: ProvisioningTargetsStatusSetBody, options?: O): Promise<Outcome<ProvisioningTargetsStatusSetResponse, O>> =>\n          this.transport.call<ProvisioningTargetsStatusSetResponse, O>(environmentOperations['provisioning.targets.status.set'], [id], body, options),\n      },\n    },\n  };\n\n  readonly radar = {\n    decisions: {\n      /**\n       * Read one Radar decision: the verdict, whether it was enforced, the deciding rule, every rule that fired, the reasons, the risk score and the facts it was decided on.\n       *\n       * Requires scope `radar:read`. Danger: read.\n       *\n       * `GET /radar/decisions/{id}` · action `radar.decisions.get`\n       * @scope `radar:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<RadarDecisionsGetResponse, O>> =>\n        this.transport.call<RadarDecisionsGetResponse, O>(environmentOperations['radar.decisions.get'], [id], undefined, options),\n      /**\n       * List this environment's Radar decisions newest first — verdict, deciding rule, every rule that fired, reasons and facts — filtered by verdict, flow, rule, country, email, IP, device or time; pass `next_cursor` as `after` to page. Email and IP are matched by keyed pseudonym and never returned.\n       *\n       * Requires scope `radar:read`. Danger: read.\n       *\n       * `GET /radar/decisions` · action `radar.decisions.list`\n       * @scope `radar:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query?: RadarDecisionsListQuery, options?: O): Promise<Outcome<RadarDecisionsListResponse, O>> =>\n        this.transport.call<RadarDecisionsListResponse, O>(environmentOperations['radar.decisions.list'], [], query, options),\n      /** Every item of `radar.decisions.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<RadarDecisionsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<RadarDecision, void, undefined> =>\n        this.transport.paginate(environmentOperations['radar.decisions.list'], [], query as Record<string, unknown> | undefined, options),\n    },\n    lists: {\n      /**\n       * Add an entry to this environment's Radar allow or deny list: an IP or CIDR range, an email address, a mail domain (and its subdomains), or a device id from the decisions explorer. Deny blocks before every rule; allow skips every rule.\n       *\n       * Requires scope `radar:write`. Danger: write.\n       *\n       * `POST /radar/lists` · action `radar.lists.add`\n       * @scope `radar:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      add: <O extends CallOptions = CallOptions>(body: RadarListsAddBody, options?: O): Promise<Outcome<RadarListsAddResponse, O>> =>\n        this.transport.call<RadarListsAddResponse, O>(environmentOperations['radar.lists.add'], [], body, options),\n      /**\n       * List this environment's Radar allow and deny entries — IPs and CIDR ranges, addresses, mail domains, devices — optionally one list or one kind.\n       *\n       * Requires scope `radar:read`. Danger: read.\n       *\n       * `GET /radar/lists` · action `radar.lists.list`\n       * @scope `radar:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query?: RadarListsListQuery, options?: O): Promise<Outcome<RadarListsListResponse, O>> =>\n        this.transport.call<RadarListsListResponse, O>(environmentOperations['radar.lists.list'], [], query, options),\n      /** Every item of `radar.lists.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<RadarListsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<RadarListEntry, void, undefined> =>\n        this.transport.paginate(environmentOperations['radar.lists.list'], [], query as Record<string, unknown> | undefined, options),\n      /**\n       * Remove an entry from this environment's Radar allow or deny list.\n       *\n       * Requires scope `radar:write`. Danger: destructive.\n       *\n       * `DELETE /radar/lists/{id}` · action `radar.lists.remove`\n       * @scope `radar:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      remove: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<RadarListsRemoveResponse, O>> =>\n        this.transport.call<RadarListsRemoveResponse, O>(environmentOperations['radar.lists.remove'], [id], undefined, options),\n    },\n    mode: {\n      /**\n       * Switch this environment's Radar between `monitor` (verdicts recorded, never acted on) and `enforce` (blocks refuse sign-ins and sign-ups, challenges demand a second factor). Changes the environment's security posture.\n       *\n       * Requires scope `radar:manage`. Danger: critical.\n       *\n       * `PUT /radar/mode` · action `radar.mode.set`\n       * @scope `radar:manage`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      set: <O extends CallOptions = CallOptions>(body: RadarModeSetBody, options?: O): Promise<Outcome<RadarModeSetResponse, O>> =>\n        this.transport.call<RadarModeSetResponse, O>(environmentOperations['radar.mode.set'], [], body, options),\n    },\n    rules: {\n      /**\n       * Add a Radar rule: when EVERY condition (field, operator, value) holds, allow, challenge or block. Rules run in order after the allow/deny lists and before the built-in rules; the first match decides. Example: country not_in [DK, SE] → challenge.\n       *\n       * Requires scope `radar:write`. Danger: write.\n       *\n       * `POST /radar/rules` · action `radar.rules.create`\n       * @scope `radar:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      create: <O extends CallOptions = CallOptions>(body: RadarRulesCreateBody, options?: O): Promise<Outcome<RadarRulesCreateResponse, O>> =>\n        this.transport.call<RadarRulesCreateResponse, O>(environmentOperations['radar.rules.create'], [], body, options),\n      /**\n       * Delete a Radar rule. Attempts it decided are decided by the next matching rule, or the built-in rules, from then on.\n       *\n       * Requires scope `radar:write`. Danger: destructive.\n       *\n       * `DELETE /radar/rules/{id}` · action `radar.rules.delete`\n       * @scope `radar:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      delete: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<RadarRulesDeleteResponse, O>> =>\n        this.transport.call<RadarRulesDeleteResponse, O>(environmentOperations['radar.rules.delete'], [id], undefined, options),\n      /**\n       * Read one Radar rule: its action, the flows it applies to, its position and its conditions.\n       *\n       * Requires scope `radar:read`. Danger: read.\n       *\n       * `GET /radar/rules/{id}` · action `radar.rules.get`\n       * @scope `radar:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<RadarRulesGetResponse, O>> =>\n        this.transport.call<RadarRulesGetResponse, O>(environmentOperations['radar.rules.get'], [id], undefined, options),\n      /**\n       * List this environment's own Radar rules in evaluation order (the first whose conditions all hold decides), with their conditions and a readable summary of each.\n       *\n       * Requires scope `radar:read`. Danger: read.\n       *\n       * `GET /radar/rules` · action `radar.rules.list`\n       * @scope `radar:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query?: RadarRulesListQuery, options?: O): Promise<Outcome<RadarRulesListResponse, O>> =>\n        this.transport.call<RadarRulesListResponse, O>(environmentOperations['radar.rules.list'], [], query, options),\n      /** Every item of `radar.rules.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<RadarRulesListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<RadarRule, void, undefined> =>\n        this.transport.paginate(environmentOperations['radar.rules.list'], [], query as Record<string, unknown> | undefined, options),\n      /**\n       * Set the order Radar rules are evaluated in: `rule_ids` lists every rule of the environment exactly once, first evaluated first.\n       *\n       * Requires scope `radar:write`. Danger: write.\n       *\n       * `PUT /radar/rules/order` · action `radar.rules.reorder`\n       * @scope `radar:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      reorder: <O extends CallOptions = CallOptions>(body: RadarRulesReorderBody, options?: O): Promise<Outcome<RadarRulesReorderResponse, O>> =>\n        this.transport.call<RadarRulesReorderResponse, O>(environmentOperations['radar.rules.reorder'], [], body, options),\n      /**\n       * Change a Radar rule: its name, description, action, flows, enabled state, position, or (replaced whole) its conditions.\n       *\n       * Requires scope `radar:write`. Danger: write.\n       *\n       * `PATCH /radar/rules/{id}` · action `radar.rules.update`\n       * @scope `radar:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      update: <O extends CallOptions = CallOptions>(id: string, body?: RadarRulesUpdateBody, options?: O): Promise<Outcome<RadarRulesUpdateResponse, O>> =>\n        this.transport.call<RadarRulesUpdateResponse, O>(environmentOperations['radar.rules.update'], [id], body, options),\n    },\n    settings: {\n      /**\n       * Read this environment's Radar settings: the mode (monitor or enforce, and whether it is inherited from the deployment), the IP intelligence source, and every built-in rule with its action and threshold.\n       *\n       * Requires scope `radar:read`. Danger: read.\n       *\n       * `GET /radar/settings` · action `radar.settings.get`\n       * @scope `radar:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<RadarSettingsGetResponse, O>> =>\n        this.transport.call<RadarSettingsGetResponse, O>(environmentOperations['radar.settings.get'], [], undefined, options),\n      /**\n       * Tune this environment's built-in Radar rules: `builtin_rules` maps a rule key (credential_stuffing, bot_velocity, account_attack, impossible_travel, new_device, anonymous_network, hosting_network, disposable_email, risk_score_reject, risk_score_elevated) to any of enabled, action and threshold.\n       *\n       * Requires scope `radar:write`. Danger: write.\n       *\n       * `PATCH /radar/settings` · action `radar.settings.update`\n       * @scope `radar:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      update: <O extends CallOptions = CallOptions>(body: RadarSettingsUpdateBody, options?: O): Promise<Outcome<RadarSettingsUpdateResponse, O>> =>\n        this.transport.call<RadarSettingsUpdateResponse, O>(environmentOperations['radar.settings.update'], [], body, options),\n    },\n  };\n\n  readonly roles = {\n    /**\n     * Define a role for one organization, or (organization_id null) for the whole environment, optionally scoped to one app, with its opening permissions.\n     *\n     * Requires scope `role_definitions:write`. Danger: write.\n     *\n     * `POST /roles` · action `roles.create`\n     * @scope `role_definitions:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: RolesCreateBody, options?: O): Promise<Outcome<RolesCreateResponse, O>> =>\n      this.transport.call<RolesCreateResponse, O>(environmentOperations['roles.create'], [], body, options),\n    /**\n     * Delete a role: everyone who holds it loses it. An app-declared role is removed from the app's manifest instead.\n     *\n     * Requires scope `role_definitions:write`. Danger: destructive.\n     *\n     * `DELETE /roles/{id}` · action `roles.delete`\n     * @scope `role_definitions:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    delete: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<RolesDeleteResponse, O>> =>\n      this.transport.call<RolesDeleteResponse, O>(environmentOperations['roles.delete'], [id], undefined, options),\n    /**\n     * Get one role and the permissions it carries. Name it by id, or by manifest `key` with `client_id`.\n     *\n     * Requires scope `roles:read`. Danger: read.\n     *\n     * `GET /roles/{id}` · action `roles.get`\n     * @scope `roles:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, query?: RolesGetQuery, options?: O): Promise<Outcome<RolesGetResponse, O>> =>\n      this.transport.call<RolesGetResponse, O>(environmentOperations['roles.get'], [id], query, options),\n    /**\n     * List roles\n     *\n     * Requires scope `roles:read`. Every role that can still be granted, ordered by name,\n     * with the permissions each carries. Not paginated. `?client_id=` narrows to one\n     * app's roles; `?organization_id=` to what can be granted in that organization.\n     *\n     * `GET /roles` · action `roles.list`\n     * @scope `roles:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: RolesListQuery, options?: O): Promise<Outcome<RolesListResponse, O>> =>\n      this.transport.call<RolesListResponse, O>(environmentOperations['roles.list'], [], query, options),\n    /**\n     * Rename a role or change its description. An app-declared role is changed in the app's manifest instead.\n     *\n     * Requires scope `role_definitions:write`. Danger: write.\n     *\n     * `PATCH /roles/{id}` · action `roles.update`\n     * @scope `role_definitions:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(id: string, body?: RolesUpdateBody, options?: O): Promise<Outcome<RolesUpdateResponse, O>> =>\n      this.transport.call<RolesUpdateResponse, O>(environmentOperations['roles.update'], [id], body, options),\n    permissions: {\n      /**\n       * Add a permission to a role: everyone holding the role gains it. The permission must be unscoped or declared by the role's own app.\n       *\n       * Requires scope `role_definitions:write`. Danger: write.\n       *\n       * `PUT /roles/{id}/permissions/{permission_id}` · action `roles.permissions.grant`\n       * @scope `role_definitions:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      grant: <O extends CallOptions = CallOptions>(id: string, permissionId: string, options?: O): Promise<Outcome<RolesPermissionsGrantResponse, O>> =>\n        this.transport.call<RolesPermissionsGrantResponse, O>(environmentOperations['roles.permissions.grant'], [id, permissionId], undefined, options),\n      /**\n       * Remove a permission from a role: everyone holding the role loses it.\n       *\n       * Requires scope `role_definitions:write`. Danger: destructive.\n       *\n       * `DELETE /roles/{id}/permissions/{permission_id}` · action `roles.permissions.revoke`\n       * @scope `role_definitions:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      revoke: <O extends CallOptions = CallOptions>(id: string, permissionId: string, options?: O): Promise<Outcome<RolesPermissionsRevokeResponse, O>> =>\n        this.transport.call<RolesPermissionsRevokeResponse, O>(environmentOperations['roles.permissions.revoke'], [id, permissionId], undefined, options),\n    },\n  };\n\n  readonly samlApps = {\n    /**\n     * Register a SAML app that signs people in with their account here. Decides where assertions — and their attributes — are sent.\n     *\n     * Requires scope `saml_apps:write`. Danger: critical.\n     *\n     * `POST /saml-apps` · action `saml_apps.create`\n     * @scope `saml_apps:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: SamlAppsCreateBody, options?: O): Promise<Outcome<SamlAppsCreateResponse, O>> =>\n      this.transport.call<SamlAppsCreateResponse, O>(environmentOperations['saml_apps.create'], [], body, options),\n    /**\n     * Remove a SAML app. People can no longer sign in to it with their account here.\n     *\n     * Requires scope `saml_apps:write`. Danger: critical.\n     *\n     * `DELETE /saml-apps/{id}` · action `saml_apps.delete`\n     * @scope `saml_apps:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    delete: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<SamlAppsDeleteResponse, O>> =>\n      this.transport.call<SamlAppsDeleteResponse, O>(environmentOperations['saml_apps.delete'], [id], undefined, options),\n    /**\n     * Read one SAML app: its entity id, ACS URL, NameID and attribute mappings. Never its certificate.\n     *\n     * Requires scope `saml_apps:read`. Danger: read.\n     *\n     * `GET /saml-apps/{id}` · action `saml_apps.get`\n     * @scope `saml_apps:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<SamlAppsGetResponse, O>> =>\n      this.transport.call<SamlAppsGetResponse, O>(environmentOperations['saml_apps.get'], [id], undefined, options),\n    /**\n     * List the SAML apps that trust this environment as their identity provider.\n     *\n     * Requires scope `saml_apps:read`. Danger: read.\n     *\n     * `GET /saml-apps` · action `saml_apps.list`\n     * @scope `saml_apps:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: SamlAppsListQuery, options?: O): Promise<Outcome<SamlAppsListResponse, O>> =>\n      this.transport.call<SamlAppsListResponse, O>(environmentOperations['saml_apps.list'], [], query, options),\n    /** Every item of `saml_apps.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<SamlAppsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<SamlApp, void, undefined> =>\n      this.transport.paginate(environmentOperations['saml_apps.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Change a SAML app's entity id, ACS URL, NameID, attribute mappings, signing certificate or owning organization.\n     *\n     * Requires scope `saml_apps:write`. Danger: critical.\n     *\n     * `PATCH /saml-apps/{id}` · action `saml_apps.update`\n     * @scope `saml_apps:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(id: string, body?: SamlAppsUpdateBody, options?: O): Promise<Outcome<SamlAppsUpdateResponse, O>> =>\n      this.transport.call<SamlAppsUpdateResponse, O>(environmentOperations['saml_apps.update'], [id], body, options),\n  };\n\n  readonly signin = {\n    policy: {\n      /**\n       * Read the authentication policy (password, MFA, SSO, lockout): the environment baseline, or one organization's effective rules and override.\n       *\n       * Requires scope `signin:read`. Danger: read.\n       *\n       * `GET /sign-in/policy` · action `signin.policy.get`\n       * @scope `signin:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(query?: SigninPolicyGetQuery, options?: O): Promise<Outcome<SigninPolicyGetResponse, O>> =>\n        this.transport.call<SigninPolicyGetResponse, O>(environmentOperations['signin.policy.get'], [], query, options),\n      /**\n       * Drop one organization's authentication policy override, so it inherits the environment baseline again.\n       *\n       * Requires scope `signin:write`. Danger: critical.\n       *\n       * `DELETE /sign-in/policy/organizations/{organization_id}` · action `signin.policy.inherit`\n       * @scope `signin:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      inherit: <O extends CallOptions = CallOptions>(organizationId: string, options?: O): Promise<Outcome<SigninPolicyInheritResponse, O>> =>\n        this.transport.call<SigninPolicyInheritResponse, O>(environmentOperations['signin.policy.inherit'], [organizationId], undefined, options),\n      /**\n       * Change the authentication policy of the environment baseline — including whether passkeys and magic links are offered and how long sessions last — or tighten one organization's override. Requiring SSO signs out password sessions.\n       *\n       * Requires scope `signin:write`. Danger: critical.\n       *\n       * `PATCH /sign-in/policy` · action `signin.policy.update`\n       * @scope `signin:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      update: <O extends CallOptions = CallOptions>(body?: SigninPolicyUpdateBody, options?: O): Promise<Outcome<SigninPolicyUpdateResponse, O>> =>\n        this.transport.call<SigninPolicyUpdateResponse, O>(environmentOperations['signin.policy.update'], [], body, options),\n    },\n    selfServiceSignup: {\n      /**\n       * Switch self-service sign-up on or off: whether people can create an account and their own organization in this environment.\n       *\n       * Requires scope `signin:write`. Danger: critical.\n       *\n       * `PUT /sign-in/self-service-signup` · action `signin.self_service_signup.set`\n       * @scope `signin:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      set: <O extends CallOptions = CallOptions>(body: SigninSelfServiceSignupSetBody, options?: O): Promise<Outcome<SigninSelfServiceSignupSetResponse, O>> =>\n        this.transport.call<SigninSelfServiceSignupSetResponse, O>(environmentOperations['signin.self_service_signup.set'], [], body, options),\n    },\n    sms: {\n      /**\n       * Read the SMS second-factor policy: whether text-message codes are accepted, for which countries, and the administrator rule.\n       *\n       * Requires scope `signin:read`. Danger: read.\n       *\n       * `GET /sign-in/sms` · action `signin.sms.get`\n       * @scope `signin:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<SigninSmsGetResponse, O>> =>\n        this.transport.call<SigninSmsGetResponse, O>(environmentOperations['signin.sms.get'], [], undefined, options),\n      /**\n       * Change the SMS second-factor policy: accept text-message codes or not, the countries they may go to, and whether SMS may be an administrator's only factor.\n       *\n       * Requires scope `signin:write`. Danger: critical.\n       *\n       * `PATCH /sign-in/sms` · action `signin.sms.update`\n       * @scope `signin:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      update: <O extends CallOptions = CallOptions>(body?: SigninSmsUpdateBody, options?: O): Promise<Outcome<SigninSmsUpdateResponse, O>> =>\n        this.transport.call<SigninSmsUpdateResponse, O>(environmentOperations['signin.sms.update'], [], body, options),\n    },\n    social: {\n      /**\n       * Stop offering a social login provider. People who used it keep their accounts.\n       *\n       * Requires scope `signin:write`. Danger: critical.\n       *\n       * `DELETE /sign-in/social-providers/{id}` · action `signin.social.delete`\n       * @scope `signin:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      delete: <O extends CallOptions = CallOptions>(id: string, body?: SigninSocialDeleteBody, options?: O): Promise<Outcome<SigninSocialDeleteResponse, O>> =>\n        this.transport.call<SigninSocialDeleteResponse, O>(environmentOperations['signin.social.delete'], [id], body, options),\n      /**\n       * Turn a social login provider off without removing it. People who used it keep their accounts.\n       *\n       * Requires scope `signin:write`. Danger: critical.\n       *\n       * `POST /sign-in/social-providers/{id}/disable` · action `signin.social.disable`\n       * @scope `signin:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      disable: <O extends CallOptions = CallOptions>(id: string, body?: SigninSocialDisableBody, options?: O): Promise<Outcome<SigninSocialDisableResponse, O>> =>\n        this.transport.call<SigninSocialDisableResponse, O>(environmentOperations['signin.social.disable'], [id], body, options),\n      /**\n       * Turn a social login provider that was turned off back on, with the credentials it already has.\n       *\n       * Requires scope `signin:write`. Danger: write.\n       *\n       * `POST /sign-in/social-providers/{id}/enable` · action `signin.social.enable`\n       * @scope `signin:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      enable: <O extends CallOptions = CallOptions>(id: string, body?: SigninSocialEnableBody, options?: O): Promise<Outcome<SigninSocialEnableResponse, O>> =>\n        this.transport.call<SigninSocialEnableResponse, O>(environmentOperations['signin.social.enable'], [id], body, options),\n      /**\n       * Turn one of the environment's social login providers off (or back on) for one organization's sign-in page.\n       *\n       * Requires scope `signin:write`. Danger: write.\n       *\n       * `PUT /sign-in/social-providers/inherited/{provider}` · action `signin.social.inherit`\n       * @scope `signin:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      inherit: <O extends CallOptions = CallOptions>(provider: string, body: SigninSocialInheritBody, options?: O): Promise<Outcome<SigninSocialInheritResponse, O>> =>\n        this.transport.call<SigninSocialInheritResponse, O>(environmentOperations['signin.social.inherit'], [provider], body, options),\n      /**\n       * List the social login providers (Google, GitHub, Apple…) set up in this environment — the environment's own and organizations' — optionally for one organization.\n       *\n       * Requires scope `signin:read`. Danger: read.\n       *\n       * `GET /sign-in/social-providers` · action `signin.social.list`\n       * @scope `signin:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query?: SigninSocialListQuery, options?: O): Promise<Outcome<SigninSocialListResponse, O>> =>\n        this.transport.call<SigninSocialListResponse, O>(environmentOperations['signin.social.list'], [], query, options),\n      /** Every item of `signin.social.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<SigninSocialListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<SocialProvider, void, undefined> =>\n        this.transport.paginate(environmentOperations['signin.social.list'], [], query as Record<string, unknown> | undefined, options),\n      /**\n       * The social login buttons one organization's sign-in page shows (or the plain sign-in page's), after inheritance from the environment, with where each comes from.\n       *\n       * Requires scope `signin:read`. Danger: read.\n       *\n       * `GET /sign-in/social-providers/offered` · action `signin.social.offered`\n       * @scope `signin:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      offered: <O extends CallOptions = CallOptions>(query?: SigninSocialOfferedQuery, options?: O): Promise<Outcome<SigninSocialOfferedResponse, O>> =>\n        this.transport.call<SigninSocialOfferedResponse, O>(environmentOperations['signin.social.offered'], [], query, options),\n      /**\n       * Enable a social login provider (Google, GitHub, Apple…) for the whole environment or for one organization, with its client credentials. The secret is never returned.\n       *\n       * Requires scope `signin:write`. Danger: critical.\n       *\n       * `POST /sign-in/social-providers` · action `signin.social.set`\n       * @scope `signin:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      set: <O extends CallOptions = CallOptions>(body: SigninSocialSetBody, options?: O): Promise<Outcome<SigninSocialSetResponse, O>> =>\n        this.transport.call<SigninSocialSetResponse, O>(environmentOperations['signin.social.set'], [], body, options),\n      /**\n       * Change a social login provider's client credentials, provider values or extra scopes. Secrets left out keep the ones on file.\n       *\n       * Requires scope `signin:write`. Danger: critical.\n       *\n       * `PATCH /sign-in/social-providers/{id}` · action `signin.social.update`\n       * @scope `signin:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      update: <O extends CallOptions = CallOptions>(id: string, body?: SigninSocialUpdateBody, options?: O): Promise<Outcome<SigninSocialUpdateResponse, O>> =>\n        this.transport.call<SigninSocialUpdateResponse, O>(environmentOperations['signin.social.update'], [id], body, options),\n    },\n  };\n\n  readonly sodPolicies = {\n    /**\n     * Define a role-conflict rule: two or more roles no one person may hold together. Enforced on every grant from now on.\n     *\n     * Requires scope `governance:write`. Danger: write.\n     *\n     * `POST /sod-policies` · action `sod_policies.create`\n     * @scope `governance:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: SodPoliciesCreateBody, options?: O): Promise<Outcome<SodPoliciesCreateResponse, O>> =>\n      this.transport.call<SodPoliciesCreateResponse, O>(environmentOperations['sod_policies.create'], [], body, options),\n    /**\n     * Remove a role-conflict rule. Grants it refused are allowed from then on.\n     *\n     * Requires scope `governance:write`. Danger: critical.\n     *\n     * `DELETE /sod-policies/{id}` · action `sod_policies.delete`\n     * @scope `governance:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    delete: <O extends CallOptions = CallOptions>(id: string, body?: SodPoliciesDeleteBody, options?: O): Promise<Outcome<SodPoliciesDeleteResponse, O>> =>\n      this.transport.call<SodPoliciesDeleteResponse, O>(environmentOperations['sod_policies.delete'], [id], body, options),\n    /**\n     * Read one role-conflict rule: the roles no one person may hold together, and whether it is enforced.\n     *\n     * Requires scope `governance:read`. Danger: read.\n     *\n     * `GET /sod-policies/{id}` · action `sod_policies.get`\n     * @scope `governance:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, query?: SodPoliciesGetQuery, options?: O): Promise<Outcome<SodPoliciesGetResponse, O>> =>\n      this.transport.call<SodPoliciesGetResponse, O>(environmentOperations['sod_policies.get'], [id], query, options),\n    /**\n     * List role-conflict (segregation of duties) rules: sets of roles no one person may hold together. Optionally those binding one organization.\n     *\n     * Requires scope `governance:read`. Danger: read.\n     *\n     * `GET /sod-policies` · action `sod_policies.list`\n     * @scope `governance:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: SodPoliciesListQuery, options?: O): Promise<Outcome<SodPoliciesListResponse, O>> =>\n      this.transport.call<SodPoliciesListResponse, O>(environmentOperations['sod_policies.list'], [], query, options),\n    /** Every item of `sod_policies.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<SodPoliciesListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<SodPolicy, void, undefined> =>\n      this.transport.paginate(environmentOperations['sod_policies.list'], [], query as Record<string, unknown> | undefined, options),\n    status: {\n      /**\n       * Enforce a role-conflict rule, or stop enforcing it — switched off, grants that break it are allowed again.\n       *\n       * Requires scope `governance:write`. Danger: critical.\n       *\n       * `POST /sod-policies/{id}/status` · action `sod_policies.status.set`\n       * @scope `governance:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      set: <O extends CallOptions = CallOptions>(id: string, body: SodPoliciesStatusSetBody, options?: O): Promise<Outcome<SodPoliciesStatusSetResponse, O>> =>\n        this.transport.call<SodPoliciesStatusSetResponse, O>(environmentOperations['sod_policies.status.set'], [id], body, options),\n    },\n  };\n\n  readonly sso = {\n    connections: {\n      /**\n       * Activate an SSO connection: people whose email domain routes to it start signing in through it.\n       *\n       * Requires scope `sso:write`. Danger: critical.\n       *\n       * `POST /sso/connections/{id}/activate` · action `sso.connections.activate`\n       * @scope `sso:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      activate: <O extends CallOptions = CallOptions>(id: string, body?: SsoConnectionsActivateBody, options?: O): Promise<Outcome<SsoConnectionsActivateResponse, O>> =>\n        this.transport.call<SsoConnectionsActivateResponse, O>(environmentOperations['sso.connections.activate'], [id], body, options),\n      /**\n       * Connect an organization's SAML or OIDC identity provider as a draft. Activate it to start signing people in through it.\n       *\n       * Requires scope `sso:write`. Danger: write.\n       *\n       * `POST /sso/connections` · action `sso.connections.create`\n       * @scope `sso:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      create: <O extends CallOptions = CallOptions>(body: SsoConnectionsCreateBody, options?: O): Promise<Outcome<SsoConnectionsCreateResponse, O>> =>\n        this.transport.call<SsoConnectionsCreateResponse, O>(environmentOperations['sso.connections.create'], [], body, options),\n      /**\n       * Delete an SSO connection and its settings. Where SSO is required, its people cannot sign in until another is activated.\n       *\n       * Requires scope `sso:write`. Danger: critical.\n       *\n       * `DELETE /sso/connections/{id}` · action `sso.connections.delete`\n       * @scope `sso:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      delete: <O extends CallOptions = CallOptions>(id: string, body?: SsoConnectionsDeleteBody, options?: O): Promise<Outcome<SsoConnectionsDeleteResponse, O>> =>\n        this.transport.call<SsoConnectionsDeleteResponse, O>(environmentOperations['sso.connections.delete'], [id], body, options),\n      /**\n       * Disable an SSO connection without deleting it. Where SSO is required, its people cannot sign in until it is re-activated.\n       *\n       * Requires scope `sso:write`. Danger: critical.\n       *\n       * `POST /sso/connections/{id}/disable` · action `sso.connections.disable`\n       * @scope `sso:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      disable: <O extends CallOptions = CallOptions>(id: string, body?: SsoConnectionsDisableBody, options?: O): Promise<Outcome<SsoConnectionsDisableResponse, O>> =>\n        this.transport.call<SsoConnectionsDisableResponse, O>(environmentOperations['sso.connections.disable'], [id], body, options),\n      /**\n       * Read one SSO connection: its type, status, entity ids, URLs, issuer and client id. Never a certificate or secret.\n       *\n       * Requires scope `sso:read`. Danger: read.\n       *\n       * `GET /sso/connections/{id}` · action `sso.connections.get`\n       * @scope `sso:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(id: string, query?: SsoConnectionsGetQuery, options?: O): Promise<Outcome<SsoConnectionsGetResponse, O>> =>\n        this.transport.call<SsoConnectionsGetResponse, O>(environmentOperations['sso.connections.get'], [id], query, options),\n      /**\n       * List the SAML and OIDC connections organizations sign in through, optionally for one organization. Never a certificate or secret.\n       *\n       * Requires scope `sso:read`. Danger: read.\n       *\n       * `GET /sso/connections` · action `sso.connections.list`\n       * @scope `sso:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query?: SsoConnectionsListQuery, options?: O): Promise<Outcome<SsoConnectionsListResponse, O>> =>\n        this.transport.call<SsoConnectionsListResponse, O>(environmentOperations['sso.connections.list'], [], query, options),\n      /** Every item of `sso.connections.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<SsoConnectionsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<SsoConnection, void, undefined> =>\n        this.transport.paginate(environmentOperations['sso.connections.list'], [], query as Record<string, unknown> | undefined, options),\n      /**\n       * Require single sign-on for the organization an SSO connection belongs to. Ends every password session there.\n       *\n       * Requires scope `sso:write`. Danger: critical.\n       *\n       * `POST /sso/connections/{id}/require-sso` · action `sso.connections.require_sso`\n       * @scope `sso:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      requireSso: <O extends CallOptions = CallOptions>(id: string, body?: SsoConnectionsRequireSsoBody, options?: O): Promise<Outcome<SsoConnectionsRequireSsoResponse, O>> =>\n        this.transport.call<SsoConnectionsRequireSsoResponse, O>(environmentOperations['sso.connections.require_sso'], [id], body, options),\n      /**\n       * Change an SSO connection's name or identity-provider settings. Secrets left out keep the ones on file.\n       *\n       * Requires scope `sso:write`. Danger: critical.\n       *\n       * `PATCH /sso/connections/{id}` · action `sso.connections.update`\n       * @scope `sso:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      update: <O extends CallOptions = CallOptions>(id: string, body?: SsoConnectionsUpdateBody, options?: O): Promise<Outcome<SsoConnectionsUpdateResponse, O>> =>\n        this.transport.call<SsoConnectionsUpdateResponse, O>(environmentOperations['sso.connections.update'], [id], body, options),\n      certificates: {\n        /**\n         * Make a staged SAML signing certificate the connection's primary. The certificate it replaces stops being trusted.\n         *\n         * Requires scope `sso:write`. Danger: critical.\n         *\n         * `POST /sso/connections/{id}/certificates/activate` · action `sso.connections.certificates.activate`\n         * @scope `sso:write`\n         * @danger critical\n         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n         */\n        activate: <O extends CallOptions = CallOptions>(id: string, body: SsoConnectionsCertificatesActivateBody, options?: O): Promise<Outcome<SsoConnectionsCertificatesActivateResponse, O>> =>\n          this.transport.call<SsoConnectionsCertificatesActivateResponse, O>(environmentOperations['sso.connections.certificates.activate'], [id], body, options),\n        /**\n         * List a SAML connection's signing certificates — primary and staged — with each one's fingerprint and expiry.\n         *\n         * Requires scope `sso:read`. Danger: read.\n         *\n         * `GET /sso/connections/{id}/certificates` · action `sso.connections.certificates.list`\n         * @scope `sso:read`\n         * @danger read\n         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n         */\n        list: <O extends CallOptions = CallOptions>(id: string, query?: SsoConnectionsCertificatesListQuery, options?: O): Promise<Outcome<SsoConnectionsCertificatesListResponse, O>> =>\n          this.transport.call<SsoConnectionsCertificatesListResponse, O>(environmentOperations['sso.connections.certificates.list'], [id], query, options),\n        /**\n         * Stage a SAML connection's new IdP signing certificate (PEM or IdP metadata) beside the current one, so a renewal has no outage. Activate it once the IdP signs with it.\n         *\n         * Requires scope `sso:write`. Danger: critical.\n         *\n         * `POST /sso/connections/{id}/certificates` · action `sso.connections.certificates.stage`\n         * @scope `sso:write`\n         * @danger critical\n         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n         */\n        stage: <O extends CallOptions = CallOptions>(id: string, body?: SsoConnectionsCertificatesStageBody, options?: O): Promise<Outcome<SsoConnectionsCertificatesStageResponse, O>> =>\n          this.transport.call<SsoConnectionsCertificatesStageResponse, O>(environmentOperations['sso.connections.certificates.stage'], [id], body, options),\n      },\n    },\n    domains: {\n      /**\n       * Turn capture on or off for a verified domain: captured, everyone with an address at it must sign in through the organization's SSO.\n       *\n       * Requires scope `sso:write`. Danger: critical.\n       *\n       * `POST /sso/domains/{id}/capture` · action `sso.domains.capture`\n       * @scope `sso:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      capture: <O extends CallOptions = CallOptions>(id: string, body: SsoDomainsCaptureBody, options?: O): Promise<Outcome<SsoDomainsCaptureResponse, O>> =>\n        this.transport.call<SsoDomainsCaptureResponse, O>(environmentOperations['sso.domains.capture'], [id], body, options),\n      /**\n       * Claim an email domain for an organization's single sign-on, and get the DNS TXT record to publish to prove it.\n       *\n       * Requires scope `sso:write`. Danger: write.\n       *\n       * `POST /sso/domains` · action `sso.domains.create`\n       * @scope `sso:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      create: <O extends CallOptions = CallOptions>(body: SsoDomainsCreateBody, options?: O): Promise<Outcome<SsoDomainsCreateResponse, O>> =>\n        this.transport.call<SsoDomainsCreateResponse, O>(environmentOperations['sso.domains.create'], [], body, options),\n      /**\n       * Remove a claimed email domain. Its people stop being routed to the organization's SSO connection.\n       *\n       * Requires scope `sso:write`. Danger: destructive.\n       *\n       * `DELETE /sso/domains/{id}` · action `sso.domains.delete`\n       * @scope `sso:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      delete: <O extends CallOptions = CallOptions>(id: string, body?: SsoDomainsDeleteBody, options?: O): Promise<Outcome<SsoDomainsDeleteResponse, O>> =>\n        this.transport.call<SsoDomainsDeleteResponse, O>(environmentOperations['sso.domains.delete'], [id], body, options),\n      /**\n       * List the email domains organizations claimed for single sign-on, whether each is verified and captured, and the DNS record that proves an unverified one.\n       *\n       * Requires scope `sso:read`. Danger: read.\n       *\n       * `GET /sso/domains` · action `sso.domains.list`\n       * @scope `sso:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query?: SsoDomainsListQuery, options?: O): Promise<Outcome<SsoDomainsListResponse, O>> =>\n        this.transport.call<SsoDomainsListResponse, O>(environmentOperations['sso.domains.list'], [], query, options),\n      /** Every item of `sso.domains.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<SsoDomainsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<SsoDomain, void, undefined> =>\n        this.transport.paginate(environmentOperations['sso.domains.list'], [], query as Record<string, unknown> | undefined, options),\n      /**\n       * Check a claimed domain's DNS TXT record now. Answers the domain, with verified true once the record is found.\n       *\n       * Requires scope `sso:write`. Danger: write.\n       *\n       * `POST /sso/domains/{id}/verify` · action `sso.domains.verify`\n       * @scope `sso:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      verify: <O extends CallOptions = CallOptions>(id: string, body?: SsoDomainsVerifyBody, options?: O): Promise<Outcome<SsoDomainsVerifyResponse, O>> =>\n        this.transport.call<SsoDomainsVerifyResponse, O>(environmentOperations['sso.domains.verify'], [id], body, options),\n    },\n    samlMetadata: {\n      /**\n       * Parse an identity provider's SAML metadata (XML or a metadata URL) into the entity id, SSO URL and certificate a SAML connection needs. Stores nothing.\n       *\n       * Requires scope `sso:write`. Danger: write.\n       *\n       * `POST /sso/saml-metadata` · action `sso.saml_metadata.import`\n       * @scope `sso:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      import: <O extends CallOptions = CallOptions>(body: SsoSamlMetadataImportBody, options?: O): Promise<Outcome<SsoSamlMetadataImportResponse, O>> =>\n        this.transport.call<SsoSamlMetadataImportResponse, O>(environmentOperations['sso.saml_metadata.import'], [], body, options),\n    },\n  };\n\n  readonly supportSessions = {\n    /**\n     * End a support session now: every token it issued is revoked.\n     *\n     * Requires scope `support:write`. Danger: destructive.\n     *\n     * `DELETE /support-sessions/{id}` · action `support_sessions.end`\n     * @scope `support:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    end: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<SupportSessionsEndResponse, O>> =>\n      this.transport.call<SupportSessionsEndResponse, O>(environmentOperations['support_sessions.end'], [id], undefined, options),\n    /**\n     * Start a support session\n     *\n     * Requires scope `support:write`. A member of your staff (`actor_user_id`) signs in to\n     * one of your apps (`client_id`) AS one of a customer's users (`user_id` in\n     * `organization_id`), for a stated `reason`, for at most 60 minutes.\n     *\n     * The actor must hold your app's own `support:impersonate` permission through an\n     * **environment-wide** grant (see `PUT /users/{id}/environment-roles/{role_id}`);\n     * otherwise `403 not_permitted`. The app must be a first-party app the environment\n     * owns that uses the authorization-code grant (`422 client_not_eligible`). The target\n     * must be an active member (`422 target_not_member`) of an active organization\n     * (`409 organization_inactive`).\n     *\n     * Send `redirect_uri` (registered for the app) and a PKCE S256 `code_challenge` to get\n     * the first authorization `code` in the response. Your app redeems it at `/oauth/token`\n     * with the verifier; every token carries `act: {\"sub\": actor_user_id}` and there is\n     * never a refresh token. The session is audited on the customer's trail and the\n     * environment's, and announced as the `support_session.started` webhook.\n     *\n     * `scopes` in the response are exactly what every token of the session carries: the\n     * ones asked for (or, with none, the app's registration), never `offline_access`, and\n     * audienced the way the token endpoint audiences them — once any of them belongs to a\n     * registered API, the token is for that API and a scope no API registered (such as\n     * `apps.manifest`) is left out. Scopes of two registered APIs cannot be audienced to\n     * one token and are refused before the session starts (`422 invalid_target`).\n     *\n     * `POST /support-sessions` · action `support_sessions.start`\n     * @scope `support:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    start: <O extends CallOptions = CallOptions>(body: SupportSessionsStartBody, options?: O): Promise<Outcome<SupportSessionsStartResponse, O>> =>\n      this.transport.call<SupportSessionsStartResponse, O>(environmentOperations['support_sessions.start'], [], body, options),\n  };\n\n  readonly tokenVault = {\n    grants: {\n      /**\n       * Grant an app (by OAuth client id) the right to lease a stored credential.\n       *\n       * Requires scope `token_vault:write`. Danger: critical.\n       *\n       * `POST /token-vault/secrets/{id}/grants` · action `token_vault.grants.create`\n       * @scope `token_vault:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      create: <O extends CallOptions = CallOptions>(id: string, body: TokenVaultGrantsCreateBody, options?: O): Promise<Outcome<TokenVaultGrantsCreateResponse, O>> =>\n        this.transport.call<TokenVaultGrantsCreateResponse, O>(environmentOperations['token_vault.grants.create'], [id], body, options),\n      /**\n       * Withdraw an app's right to lease a stored credential.\n       *\n       * Requires scope `token_vault:write`. Danger: destructive.\n       *\n       * `DELETE /token-vault/secrets/{id}/grants/{client_id}` · action `token_vault.grants.delete`\n       * @scope `token_vault:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      delete: <O extends CallOptions = CallOptions>(id: string, clientId: string, body?: TokenVaultGrantsDeleteBody, options?: O): Promise<Outcome<TokenVaultGrantsDeleteResponse, O>> =>\n        this.transport.call<TokenVaultGrantsDeleteResponse, O>(environmentOperations['token_vault.grants.delete'], [id, clientId], body, options),\n    },\n    secrets: {\n      /**\n       * Store a downstream credential (a third-party API key) in an organization's token vault, or the environment's own. The value is sealed and never returned.\n       *\n       * Requires scope `token_vault:write`. Danger: write.\n       *\n       * `POST /token-vault/secrets` · action `token_vault.secrets.create`\n       * @scope `token_vault:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      create: <O extends CallOptions = CallOptions>(body: TokenVaultSecretsCreateBody, options?: O): Promise<Outcome<TokenVaultSecretsCreateResponse, O>> =>\n        this.transport.call<TokenVaultSecretsCreateResponse, O>(environmentOperations['token_vault.secrets.create'], [], body, options),\n      /**\n       * Read one stored credential and the client ids granted to lease it. Never its value.\n       *\n       * Requires scope `token_vault:read`. Danger: read.\n       *\n       * `GET /token-vault/secrets/{id}` · action `token_vault.secrets.get`\n       * @scope `token_vault:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(id: string, query?: TokenVaultSecretsGetQuery, options?: O): Promise<Outcome<TokenVaultSecretsGetResponse, O>> =>\n        this.transport.call<TokenVaultSecretsGetResponse, O>(environmentOperations['token_vault.secrets.get'], [id], query, options),\n      /**\n       * List the downstream credentials stored in an organization's token vault (or the environment's own): names, providers, status. Never a value.\n       *\n       * Requires scope `token_vault:read`. Danger: read.\n       *\n       * `GET /token-vault/secrets` · action `token_vault.secrets.list`\n       * @scope `token_vault:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query?: TokenVaultSecretsListQuery, options?: O): Promise<Outcome<TokenVaultSecretsListResponse, O>> =>\n        this.transport.call<TokenVaultSecretsListResponse, O>(environmentOperations['token_vault.secrets.list'], [], query, options),\n      /** Every item of `token_vault.secrets.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<TokenVaultSecretsListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<TokenVaultSecret, void, undefined> =>\n        this.transport.paginate(environmentOperations['token_vault.secrets.list'], [], query as Record<string, unknown> | undefined, options),\n      /**\n       * Revoke a stored credential permanently. No app can lease it again.\n       *\n       * Requires scope `token_vault:write`. Danger: destructive.\n       *\n       * `POST /token-vault/secrets/{id}/revoke` · action `token_vault.secrets.revoke`\n       * @scope `token_vault:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      revoke: <O extends CallOptions = CallOptions>(id: string, body?: TokenVaultSecretsRevokeBody, options?: O): Promise<Outcome<TokenVaultSecretsRevokeResponse, O>> =>\n        this.transport.call<TokenVaultSecretsRevokeResponse, O>(environmentOperations['token_vault.secrets.revoke'], [id], body, options),\n      /**\n       * Replace a stored credential's value. Every later lease hands out the new one. The value is never returned.\n       *\n       * Requires scope `token_vault:write`. Danger: critical.\n       *\n       * `POST /token-vault/secrets/{id}/rotate` · action `token_vault.secrets.rotate`\n       * @scope `token_vault:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      rotate: <O extends CallOptions = CallOptions>(id: string, body: TokenVaultSecretsRotateBody, options?: O): Promise<Outcome<TokenVaultSecretsRotateResponse, O>> =>\n        this.transport.call<TokenVaultSecretsRotateResponse, O>(environmentOperations['token_vault.secrets.rotate'], [id], body, options),\n    },\n  };\n\n  readonly users = {\n    /**\n     * Create a user\n     *\n     * Requires scope `users:write`. Password is optional — omit it to create a passwordless identity the user completes via an invite/magic-link.\n     *\n     * `POST /users` · action `users.create`\n     * @scope `users:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: UsersCreateBody, options?: O): Promise<Outcome<UsersCreateResponse, O>> =>\n      this.transport.call<UsersCreateResponse, O>(environmentOperations['users.create'], [], body, options),\n    /**\n     * Deactivate a user\n     *\n     * Requires scope `users:write`. A **soft disable** — the identity can no longer\n     * authenticate, but is never hard-deleted — and every OAuth grant they hold is\n     * revoked, which reactivating them does not bring back. Returns the user in its new\n     * `disabled` state. Idempotent. The console's \"Deactivate\" is this action.\n     *\n     * `DELETE /users/{id}` · action `users.deactivate`\n     * @scope `users:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    deactivate: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<UsersDeactivateResponse, O>> =>\n      this.transport.call<UsersDeactivateResponse, O>(environmentOperations['users.deactivate'], [id], undefined, options),\n    /**\n     * Erase a person (GDPR Art. 17): revoke their sessions and tokens, delete their credentials, memberships and personal data, and pseudonymise their account. Cannot be undone.\n     *\n     * Requires scope `users:erase`. Danger: critical.\n     *\n     * `POST /users/{id}/erase` · action `users.erase`\n     * @scope `users:erase`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    erase: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<UsersEraseResponse, O>> =>\n      this.transport.call<UsersEraseResponse, O>(environmentOperations['users.erase'], [id], undefined, options),\n    /**\n     * Get a user\n     *\n     * Requires scope `users:read`.\n     *\n     * `GET /users/{id}` · action `users.get`\n     * @scope `users:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<UsersGetResponse, O>> =>\n      this.transport.call<UsersGetResponse, O>(environmentOperations['users.get'], [id], undefined, options),\n    /**\n     * List users\n     *\n     * Requires scope `users:read`. A page at a time, in id order. Narrow it the ways you\n     * look for somebody: `email` (exactly that address, case-insensitive), `q` (a fragment\n     * of the address or the name) and `status`. Filters combine.\n     *\n     * `GET /users` · action `users.list`\n     * @scope `users:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: UsersListQuery, options?: O): Promise<Outcome<UsersListResponse, O>> =>\n      this.transport.call<UsersListResponse, O>(environmentOperations['users.list'], [], query, options),\n    /** Every item of `users.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<UsersListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<User, void, undefined> =>\n      this.transport.paginate(environmentOperations['users.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Reactivate a deactivated user so they can sign in again. Grants revoked on deactivation stay revoked.\n     *\n     * Requires scope `users:write`. Danger: write.\n     *\n     * `POST /users/{id}/reactivate` · action `users.reactivate`\n     * @scope `users:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    reactivate: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<UsersReactivateResponse, O>> =>\n      this.transport.call<UsersReactivateResponse, O>(environmentOperations['users.reactivate'], [id], undefined, options),\n    /**\n     * Change a user's name and/or email address. A changed address must be verified again.\n     *\n     * Requires scope `users:write`. Danger: critical.\n     *\n     * `PATCH /users/{id}` · action `users.update`\n     * @scope `users:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(id: string, body?: UsersUpdateBody, options?: O): Promise<Outcome<UsersUpdateResponse, O>> =>\n      this.transport.call<UsersUpdateResponse, O>(environmentOperations['users.update'], [id], body, options),\n    /**\n     * Mark a user's email address verified without the emailed link. It can then be used to recover the account.\n     *\n     * Requires scope `users:write`. Danger: critical.\n     *\n     * `POST /users/{id}/verify` · action `users.verify`\n     * @scope `users:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    verify: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<UsersVerifyResponse, O>> =>\n      this.transport.call<UsersVerifyResponse, O>(environmentOperations['users.verify'], [id], undefined, options),\n    environmentRoles: {\n      /**\n       * Whether a user holds a role everywhere\n       *\n       * Requires scope `roles:read`. `200` with the grant, or `404` when it is not held.\n       *\n       * `GET /users/{id}/environment-roles/{role_id}` · action `users.environment_roles.get`\n       * @scope `roles:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      get: <O extends CallOptions = CallOptions>(id: string, roleId: string, query?: UsersEnvironmentRolesGetQuery, options?: O): Promise<Outcome<UsersEnvironmentRolesGetResponse, O>> =>\n        this.transport.call<UsersEnvironmentRolesGetResponse, O>(environmentOperations['users.environment_roles.get'], [id, roleId], query, options),\n      /**\n       * Grant a role everywhere in the environment (staff)\n       *\n       * Requires scope `roles:write`. Idempotent. For your own people who act across every\n       * customer. Any role that belongs to no organization may be granted this way: an\n       * app-agnostic one reaches every app's tokens, one your app declared reaches only\n       * your app's. An organization's own role is refused with `422 role_not_assignable`; a\n       * grant that would form a segregation-of-duties conflict in any organization the\n       * person belongs to with `409 role_conflict`.\n       *\n       * `PUT /users/{id}/environment-roles/{role_id}` · action `users.environment_roles.grant`\n       * @scope `roles:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      grant: <O extends CallOptions = CallOptions>(id: string, roleId: string, query?: UsersEnvironmentRolesGrantQuery, options?: O): Promise<Outcome<UsersEnvironmentRolesGrantResponse, O>> =>\n        this.transport.call<UsersEnvironmentRolesGrantResponse, O>(environmentOperations['users.environment_roles.grant'], [id, roleId], query, options),\n      /**\n       * List the roles a user holds everywhere (staff)\n       *\n       * Requires scope `roles:read`.\n       *\n       * `GET /users/{id}/environment-roles` · action `users.environment_roles.list`\n       * @scope `roles:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<UsersEnvironmentRolesListResponse, O>> =>\n        this.transport.call<UsersEnvironmentRolesListResponse, O>(environmentOperations['users.environment_roles.list'], [id], undefined, options),\n      /**\n       * Take back an environment-wide grant\n       *\n       * Requires scope `roles:write`. Idempotent.\n       *\n       * `DELETE /users/{id}/environment-roles/{role_id}` · action `users.environment_roles.revoke`\n       * @scope `roles:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      revoke: <O extends CallOptions = CallOptions>(id: string, roleId: string, query?: UsersEnvironmentRolesRevokeQuery, options?: O): Promise<Outcome<UsersEnvironmentRolesRevokeResponse, O>> =>\n        this.transport.call<UsersEnvironmentRolesRevokeResponse, O>(environmentOperations['users.environment_roles.revoke'], [id, roleId], query, options),\n    },\n    mfa: {\n      /**\n       * Reset a user's two-factor authentication: their authenticator and recovery codes are removed and they must enrol again.\n       *\n       * Requires scope `users:write`. Danger: critical.\n       *\n       * `DELETE /users/{id}/mfa` · action `users.mfa.reset`\n       * @scope `users:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      reset: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<UsersMfaResetResponse, O>> =>\n        this.transport.call<UsersMfaResetResponse, O>(environmentOperations['users.mfa.reset'], [id], undefined, options),\n      sms: {\n        /**\n         * Remove a user's phone number for text-message sign-in codes. Their other factors and recovery codes stay.\n         *\n         * Requires scope `users:write`. Danger: critical.\n         *\n         * `DELETE /users/{id}/mfa/sms` · action `users.mfa.sms.remove`\n         * @scope `users:write`\n         * @danger critical\n         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n         */\n        remove: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<UsersMfaSmsRemoveResponse, O>> =>\n          this.transport.call<UsersMfaSmsRemoveResponse, O>(environmentOperations['users.mfa.sms.remove'], [id], undefined, options),\n      },\n    },\n    passwordReset: {\n      /**\n       * Mail a user a password-reset link at their own address.\n       *\n       * Requires scope `users:write`. Danger: write.\n       *\n       * `POST /users/{id}/password-reset` · action `users.password_reset.send`\n       * @scope `users:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      send: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<UsersPasswordResetSendResponse, O>> =>\n        this.transport.call<UsersPasswordResetSendResponse, O>(environmentOperations['users.password_reset.send'], [id], undefined, options),\n    },\n    password: {\n      /**\n       * Set a user's password, temporary by default, and mail it to them unless told not to. Signs them out according to `revoke`.\n       *\n       * Requires scope `users:write`. Danger: critical.\n       *\n       * `POST /users/{id}/password` · action `users.password.set`\n       * @scope `users:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      set: <O extends CallOptions = CallOptions>(id: string, body: UsersPasswordSetBody, options?: O): Promise<Outcome<UsersPasswordSetResponse, O>> =>\n        this.transport.call<UsersPasswordSetResponse, O>(environmentOperations['users.password.set'], [id], body, options),\n    },\n    sessions: {\n      /**\n       * List a user's live sign-in sessions\n       *\n       * Requires scope `users:read`. The fifty most recently active, newest first — enough to\n       * recognise a device and end one (`DELETE /users/{id}/sessions/{session_id}`), not a log.\n       * `impersonation` marks a session somebody else opened as this person.\n       *\n       * `GET /users/{id}/sessions` · action `users.sessions.list`\n       * @scope `users:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<UsersSessionsListResponse, O>> =>\n        this.transport.call<UsersSessionsListResponse, O>(environmentOperations['users.sessions.list'], [id], undefined, options),\n      /**\n       * End one of a user's sign-in sessions.\n       *\n       * Requires scope `users:write`. Danger: destructive.\n       *\n       * `DELETE /users/{id}/sessions/{session_id}` · action `users.sessions.revoke`\n       * @scope `users:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      revoke: <O extends CallOptions = CallOptions>(id: string, sessionId: string, options?: O): Promise<Outcome<UsersSessionsRevokeResponse, O>> =>\n        this.transport.call<UsersSessionsRevokeResponse, O>(environmentOperations['users.sessions.revoke'], [id, sessionId], undefined, options),\n      /**\n       * Sign a user out everywhere: end every session and revoke every OAuth grant they hold.\n       *\n       * Requires scope `users:write`. Danger: destructive.\n       *\n       * `DELETE /users/{id}/sessions` · action `users.sessions.revoke_all`\n       * @scope `users:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      revokeAll: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<UsersSessionsRevokeAllResponse, O>> =>\n        this.transport.call<UsersSessionsRevokeAllResponse, O>(environmentOperations['users.sessions.revoke_all'], [id], undefined, options),\n    },\n    verification: {\n      /**\n       * Mail a user the link that verifies their email address. Does nothing for an address already verified.\n       *\n       * Requires scope `users:write`. Danger: write.\n       *\n       * `POST /users/{id}/verification` · action `users.verification.send`\n       * @scope `users:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      send: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<UsersVerificationSendResponse, O>> =>\n        this.transport.call<UsersVerificationSendResponse, O>(environmentOperations['users.verification.send'], [id], undefined, options),\n    },\n  };\n\n  readonly webhooks = {\n    /**\n     * Register a webhook endpoint for one organization or the whole environment. Returns its signing secret once.\n     *\n     * Requires scope `webhooks:write`. Danger: critical.\n     *\n     * `POST /webhooks` · action `webhooks.create`\n     * @scope `webhooks:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: WebhooksCreateBody, options?: O): Promise<Outcome<WebhooksCreateResponse, O>> =>\n      this.transport.call<WebhooksCreateResponse, O>(environmentOperations['webhooks.create'], [], body, options),\n    /**\n     * Delete a webhook endpoint. It stops receiving events at once.\n     *\n     * Requires scope `webhooks:write`. Danger: destructive.\n     *\n     * `DELETE /webhooks/{id}` · action `webhooks.delete`\n     * @scope `webhooks:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    delete: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<WebhooksDeleteResponse, O>> =>\n      this.transport.call<WebhooksDeleteResponse, O>(environmentOperations['webhooks.delete'], [id], undefined, options),\n    /**\n     * Get one webhook endpoint: URL, owner, subscribed events, health. Never its signing secret.\n     *\n     * Requires scope `webhooks:read`. Danger: read.\n     *\n     * `GET /webhooks/{id}` · action `webhooks.get`\n     * @scope `webhooks:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<WebhooksGetResponse, O>> =>\n      this.transport.call<WebhooksGetResponse, O>(environmentOperations['webhooks.get'], [id], undefined, options),\n    /**\n     * List the webhook endpoints registered in this environment: URL, owner, subscribed events and whether each is active.\n     *\n     * Requires scope `webhooks:read`. Danger: read.\n     *\n     * `GET /webhooks` · action `webhooks.list`\n     * @scope `webhooks:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: WebhooksListQuery, options?: O): Promise<Outcome<WebhooksListResponse, O>> =>\n      this.transport.call<WebhooksListResponse, O>(environmentOperations['webhooks.list'], [], query, options),\n    /** Every item of `webhooks.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<WebhooksListQuery, 'after'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<Webhook, void, undefined> =>\n      this.transport.paginate(environmentOperations['webhooks.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Pause a webhook endpoint: it stops receiving events until resumed.\n     *\n     * Requires scope `webhooks:write`. Danger: write.\n     *\n     * `POST /webhooks/{id}/pause` · action `webhooks.pause`\n     * @scope `webhooks:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    pause: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<WebhooksPauseResponse, O>> =>\n      this.transport.call<WebhooksPauseResponse, O>(environmentOperations['webhooks.pause'], [id], undefined, options),\n    /**\n     * Resume a paused webhook endpoint: it receives events again.\n     *\n     * Requires scope `webhooks:write`. Danger: write.\n     *\n     * `POST /webhooks/{id}/resume` · action `webhooks.resume`\n     * @scope `webhooks:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    resume: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<WebhooksResumeResponse, O>> =>\n      this.transport.call<WebhooksResumeResponse, O>(environmentOperations['webhooks.resume'], [id], undefined, options),\n    /**\n     * Change a webhook endpoint's URL and/or the events it subscribes to.\n     *\n     * Requires scope `webhooks:write`. Danger: write.\n     *\n     * `PATCH /webhooks/{id}` · action `webhooks.update`\n     * @scope `webhooks:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(id: string, body?: WebhooksUpdateBody, options?: O): Promise<Outcome<WebhooksUpdateResponse, O>> =>\n      this.transport.call<WebhooksUpdateResponse, O>(environmentOperations['webhooks.update'], [id], body, options),\n    secret: {\n      /**\n       * Issue a new signing secret for a webhook endpoint, returned once. The old secret stops verifying immediately.\n       *\n       * Requires scope `webhooks:write`. Danger: critical.\n       *\n       * `POST /webhooks/{id}/rotate` · action `webhooks.secret.rotate`\n       * @scope `webhooks:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      rotate: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<WebhooksSecretRotateResponse, O>> =>\n        this.transport.call<WebhooksSecretRotateResponse, O>(environmentOperations['webhooks.secret.rotate'], [id], undefined, options),\n    },\n    signatureScheme: {\n      /**\n       * Change how a webhook endpoint's deliveries are signed (cbox or standard_webhooks). No new secret is issued: a hex secret is used as whsec_ + base64 of itself. Update the receiver first.\n       *\n       * Requires scope `webhooks:write`. Danger: destructive.\n       *\n       * `POST /webhooks/{id}/signature-scheme` · action `webhooks.signature_scheme.change`\n       * @scope `webhooks:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      change: <O extends CallOptions = CallOptions>(id: string, body: WebhooksSignatureSchemeChangeBody, options?: O): Promise<Outcome<WebhooksSignatureSchemeChangeResponse, O>> =>\n        this.transport.call<WebhooksSignatureSchemeChangeResponse, O>(environmentOperations['webhooks.signature_scheme.change'], [id], body, options),\n    },\n  };\n\n}\n","// GENERATED by scripts/generate-management.ts from openapi/workspace.yaml — do not edit.\n// Regenerate with `npm run generate`.\n\nimport { ManagementTransport, type ManagementClientOptions } from '../transport.js';\nimport type { CallOptions, OperationSpec, Outcome } from '../types.js';\n\n// ── Schemas (components.schemas) ────────────────────────────────────────────────────────────\n\nexport interface VerificationResend {\n  outcome: 'sent' | 'already_provisioned';\n  message: string;\n}\n\nexport interface Organization {\n  id?: string;\n  name?: string;\n  status?: 'active' | 'suspended';\n  /** The workspace's projects with each one's plan/allowance. Present only for billing-readers (plans are per project). */\n  projects?: Project[];\n}\n\nexport interface Project {\n  id?: string;\n  name?: string;\n  slug?: string;\n  status?: 'active' | 'suspended';\n  /** This project's plan environment allowance. */\n  environment_limit?: number;\n  environments_used?: number;\n}\n\nexport interface Environment {\n  id?: string;\n  name?: string;\n  slug?: string;\n  type?: 'production' | 'sandbox';\n  status?: string;\n  /** The project (billing anchor) this environment belongs to. */\n  project_id?: string;\n  domain?: string | null;\n  /** The environment's own host — where its OIDC/environment API lives. */\n  issuer?: string;\n}\n\nexport interface Member {\n  id?: string;\n  email?: string;\n  name?: string | null;\n  role?: 'owner' | 'admin' | 'developer' | 'member' | 'viewer';\n  status?: 'active' | 'invited';\n  all_environments?: boolean;\n}\n\n/** An environment, and — when the request asked for one — its first management key. */\nexport type CreatedEnvironment = Environment & {\n  initial_key?: EnvironmentKey;\n};\n\n/** A management key (`cbid_env_…`) of one of the workspace's environments. `token` is present only in the answer that minted it, and `null` on an idempotent replay. */\nexport interface EnvironmentKey {\n  id: string;\n  environment_id: string;\n  name: string;\n  prefix?: string;\n  scopes: string[];\n  expires_at?: string | null;\n  /** The key's value. Shown once. */\n  token?: string | null;\n}\n\n/** A workspace key (`cbid_ws_…`). `token` is present only in the answer that minted it, and `null` on an idempotent replay. */\nexport interface WorkspaceKey {\n  id: string;\n  name: string;\n  prefix?: string;\n  role: 'owner' | 'admin' | 'developer' | 'member' | 'viewer';\n  /** Null when the role alone bounds the key. */\n  scopes?: Array<'workspace:read' | 'projects:write' | 'environments:write' | 'team:read' | 'team:write' | 'keys:write' | 'settings:write'> | null;\n  /** The key that minted it, if a key did. Revoking the parent revokes it. */\n  parent_key_id?: string | null;\n  /** `organization_member` or `workspace_key`; null for a key minted before this was recorded. */\n  created_by_type?: string | null;\n  expires_at?: string | null;\n  revoked_at?: string | null;\n  last_used_at?: string | null;\n  /** The key's value. Shown once. */\n  token?: string | null;\n}\n\nexport interface TeamInvitation {\n  id: string;\n  email: string;\n  role: 'admin' | 'developer' | 'member' | 'viewer';\n  /** The person, or the API key, that sent it — by name. */\n  invited_by?: string | null;\n  invited_at?: string | null;\n  expires_at: string;\n}\n\nexport interface CustomDomain {\n  /** The verified domain serving the environment. */\n  domain: string | null;\n  verified_at: string | null;\n  /** A domain waiting for its DNS proof, and the TXT record to publish. */\n  pending: {\n    domain: string;\n    record_name: string;\n    record_value: string;\n  } | null;\n}\n\n/** Paging for a list response. `has_more` used to be returned with nothing to act on it — no page parameter and no cursor — so a caller told there was more had no way to ask for it. `next_page` is present exactly when `has_more` is true, so a client can loop without computing anything. */\nexport interface PageMeta {\n  limit?: number;\n  page?: number;\n  /** Present on lists that can count cheaply. */\n  total?: number;\n  has_more?: boolean;\n  /** Pass as `page` on the next request; absent on the last page. */\n  next_page?: number | null;\n}\n\nexport interface ErrorSchema {\n  /** Stable machine code */\n  error: string;\n  /** Human-readable explanation */\n  message: string;\n  /** The id this request was served under, also sent as the X-Request-Id header. Quote it when reporting a problem. */\n  request_id?: string;\n  /**\n   * Present on `validation_failed` only: the offending request fields, each\n   * mapped to its messages.\n   */\n  errors?: {\n    [key: string]: string[];\n  };\n}\n\n// ── Operation inputs and responses ─────────────────────────────────────────────────────────\n\n/** Response body of `action_approvals.get`. */\nexport type ActionApprovalsGetResponse = {\n  data: {\n    id: string;\n    status: 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';\n  };\n};\n\n/** Request body of `environments.create`. */\nexport interface EnvironmentsCreateBody {\n  name: string;\n  type?: 'production' | 'sandbox';\n  /** The project (billing anchor) to create the environment under. Defaults to the workspace's first project when omitted. */\n  project_id?: string;\n  /** Mint the environment's first management key in the same call. */\n  initial_key?: {\n    name: string;\n    /** Environment-key scopes, for example `apis:write`. */\n    scopes: string[];\n    expires_at?: string | null;\n  } | null;\n}\n\n/** Response body of `environments.create`. */\nexport type EnvironmentsCreateResponse = {\n  data?: CreatedEnvironment;\n};\n\n/** Response body of `environments.domain.remove`. */\nexport type EnvironmentsDomainRemoveResponse = void;\n\n/** Request body of `environments.domain.request`. */\nexport interface EnvironmentsDomainRequestBody {\n  /** The domain, for example login.example.com. */\n  domain: string;\n}\n\n/** Response body of `environments.domain.request`. */\nexport type EnvironmentsDomainRequestResponse = {\n  data: CustomDomain;\n};\n\n/** Response body of `environments.domain.verify`. */\nexport type EnvironmentsDomainVerifyResponse = {\n  data: CustomDomain;\n};\n\n/** Query parameters of `environments.list`. */\nexport interface EnvironmentsListQuery {\n  limit?: number;\n  page?: number;\n}\n\n/** Response body of `environments.list`. */\nexport type EnvironmentsListResponse = {\n  data?: Environment[];\n  meta?: PageMeta;\n};\n\n/** Request body of `keys.environment.create`. */\nexport interface KeysEnvironmentCreateBody {\n  name: string;\n  /** The environment-key scopes it carries, for example `apis:write`. */\n  scopes: string[];\n  /** When it stops working. Left out, it does not expire. */\n  expires_at?: string | null;\n}\n\n/** Response body of `keys.environment.create`. */\nexport type KeysEnvironmentCreateResponse = {\n  data: EnvironmentKey;\n};\n\n/** Response body of `keys.environment.revoke`. */\nexport type KeysEnvironmentRevokeResponse = void;\n\n/** Request body of `keys.workspace.create`. */\nexport interface KeysWorkspaceCreateBody {\n  name: string;\n  role: 'admin' | 'developer' | 'member' | 'viewer';\n  /** Narrow the key below its role. Left out, the role alone bounds it — or, minted by a key with scopes, that key's scopes. */\n  scopes?: Array<'workspace:read' | 'projects:write' | 'environments:write' | 'team:read' | 'team:write' | 'keys:write' | 'settings:write'> | null;\n  /** When it stops working. Left out, it does not expire — or, minted by a key that does, expires with it. */\n  expires_at?: string | null;\n}\n\n/** Response body of `keys.workspace.create`. */\nexport type KeysWorkspaceCreateResponse = {\n  data: WorkspaceKey;\n};\n\n/** Query parameters of `keys.workspace.list`. */\nexport interface KeysWorkspaceListQuery {\n  /** Items per page, 1–100. Default 50. */\n  limit?: number;\n  /** The page to read, from 1. A list says `next_page` when there is one. */\n  page?: number;\n}\n\n/** Response body of `keys.workspace.list`. */\nexport type KeysWorkspaceListResponse = {\n  data: WorkspaceKey[];\n  meta: PageMeta;\n};\n\n/** Response body of `keys.workspace.revoke`. */\nexport type KeysWorkspaceRevokeResponse = void;\n\n/** Request body of `projects.create`. */\nexport interface ProjectsCreateBody {\n  name: string;\n  /** This project's plan environment allowance (default 2). */\n  environment_limit?: number;\n}\n\n/** Response body of `projects.create`. */\nexport type ProjectsCreateResponse = {\n  data?: Project;\n};\n\n/** Response body of `projects.list`. */\nexport type ProjectsListResponse = {\n  data?: Project[];\n};\n\n/** Response body of `projects.reactivate`. */\nexport type ProjectsReactivateResponse = {\n  data: Project;\n};\n\n/** Request body of `projects.rename`. */\nexport interface ProjectsRenameBody {\n  name: string;\n}\n\n/** Response body of `projects.rename`. */\nexport type ProjectsRenameResponse = {\n  data: Project;\n};\n\n/** Response body of `projects.suspend`. */\nexport type ProjectsSuspendResponse = {\n  data: Project;\n};\n\n/** Response body of `projects.verification.resend`. */\nexport type ProjectsVerificationResendResponse = {\n  data: VerificationResend;\n};\n\n/** Request body of `team.environment_access`. */\nexport interface TeamEnvironmentAccessBody {\n  /** True: every environment, including ones created later. */\n  all_environments: boolean;\n  /** With `all_environments` false: the environments they reach. */\n  environment_ids?: string[];\n}\n\n/** Response body of `team.environment_access`. */\nexport type TeamEnvironmentAccessResponse = {\n  data: Member;\n};\n\n/** Response body of `team.invitations.list`. */\nexport type TeamInvitationsListResponse = {\n  data?: TeamInvitation[];\n};\n\n/** Response body of `team.invitations.resend`. */\nexport type TeamInvitationsResendResponse = {\n  data?: Member;\n};\n\n/** Response body of `team.invitations.revoke`. */\nexport type TeamInvitationsRevokeResponse = void;\n\n/** Request body of `team.invite`. */\nexport interface TeamInviteBody {\n  email: string;\n  name?: string | null;\n  role: 'admin' | 'developer' | 'member' | 'viewer';\n}\n\n/** Response body of `team.invite`. */\nexport type TeamInviteResponse = {\n  data?: Member;\n};\n\n/** Query parameters of `team.list`. */\nexport interface TeamListQuery {\n  limit?: number;\n  page?: number;\n}\n\n/** Response body of `team.list`. */\nexport type TeamListResponse = {\n  data?: Member[];\n  meta?: PageMeta;\n};\n\n/** Response body of `team.remove`. */\nexport type TeamRemoveResponse = void;\n\n/** Request body of `team.role`. */\nexport interface TeamRoleBody {\n  role: 'admin' | 'developer' | 'member' | 'viewer';\n}\n\n/** Response body of `team.role`. */\nexport type TeamRoleResponse = {\n  data: Member;\n};\n\n/** Response body of `team.transfer_ownership`. */\nexport type TeamTransferOwnershipResponse = void;\n\n/** Response body of `workspace.get`. */\nexport type WorkspaceGetResponse = {\n  data?: Organization;\n};\n\n/** Request body of `workspace.settings.update`. */\nexport interface WorkspaceSettingsUpdateBody {\n  name: string;\n}\n\n/** Response body of `workspace.settings.update`. */\nexport type WorkspaceSettingsUpdateResponse = {\n  data: Organization;\n};\n\n// ── Operations ─────────────────────────────────────────────────────────────────────────────\n\n/** Every operation of the Cbox ID — Workspace Management API — method, path, scope and danger — keyed by action name. */\nexport const workspaceOperations = {\n  'action_approvals.get': { action: null, operationId: null, method: 'GET', path: '/workspace/action-approvals/{id}', pathParams: ['id'], scope: null, danger: null, approval: false, body: false, pagination: null },\n  'environments.create': { action: 'environments.create', operationId: 'environments_create', method: 'POST', path: '/workspace/environments', pathParams: [], scope: 'environments:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'environments.domain.remove': { action: 'environments.domain.remove', operationId: 'environments_domain_remove', method: 'DELETE', path: '/workspace/environments/{environment_id}/domain', pathParams: ['environment_id'], scope: 'environments:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'environments.domain.request': { action: 'environments.domain.request', operationId: 'environments_domain_request', method: 'POST', path: '/workspace/environments/{environment_id}/domain', pathParams: ['environment_id'], scope: 'environments:write', danger: 'write', approval: true, body: true, pagination: null },\n  'environments.domain.verify': { action: 'environments.domain.verify', operationId: 'environments_domain_verify', method: 'POST', path: '/workspace/environments/{environment_id}/domain/verify', pathParams: ['environment_id'], scope: 'environments:write', danger: 'write', approval: true, body: false, pagination: null },\n  'environments.list': { action: 'environments.list', operationId: 'environments_list', method: 'GET', path: '/workspace/environments', pathParams: [], scope: 'workspace:read', danger: 'read', approval: true, body: false, pagination: 'page' },\n  'keys.environment.create': { action: 'keys.environment.create', operationId: 'keys_environment_create', method: 'POST', path: '/workspace/environments/{environment_id}/keys', pathParams: ['environment_id'], scope: 'keys:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'keys.environment.revoke': { action: 'keys.environment.revoke', operationId: 'keys_environment_revoke', method: 'DELETE', path: '/workspace/environments/{environment_id}/keys/{id}', pathParams: ['environment_id', 'id'], scope: 'keys:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'keys.workspace.create': { action: 'keys.workspace.create', operationId: 'keys_workspace_create', method: 'POST', path: '/workspace/keys', pathParams: [], scope: 'keys:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'keys.workspace.list': { action: 'keys.workspace.list', operationId: 'keys_workspace_list', method: 'GET', path: '/workspace/keys', pathParams: [], scope: 'workspace:read', danger: 'read', approval: true, body: false, pagination: 'page' },\n  'keys.workspace.revoke': { action: 'keys.workspace.revoke', operationId: 'keys_workspace_revoke', method: 'DELETE', path: '/workspace/keys/{id}', pathParams: ['id'], scope: 'keys:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'projects.create': { action: 'projects.create', operationId: 'projects_create', method: 'POST', path: '/workspace/projects', pathParams: [], scope: 'projects:write', danger: 'write', approval: true, body: true, pagination: null },\n  'projects.list': { action: 'projects.list', operationId: 'projects_list', method: 'GET', path: '/workspace/projects', pathParams: [], scope: 'workspace:read', danger: 'read', approval: true, body: false, pagination: null },\n  'projects.reactivate': { action: 'projects.reactivate', operationId: 'projects_reactivate', method: 'POST', path: '/workspace/projects/{id}/reactivate', pathParams: ['id'], scope: 'projects:write', danger: 'write', approval: true, body: false, pagination: null },\n  'projects.rename': { action: 'projects.rename', operationId: 'projects_rename', method: 'PATCH', path: '/workspace/projects/{id}', pathParams: ['id'], scope: 'projects:write', danger: 'write', approval: true, body: true, pagination: null },\n  'projects.suspend': { action: 'projects.suspend', operationId: 'projects_suspend', method: 'POST', path: '/workspace/projects/{id}/suspend', pathParams: ['id'], scope: 'projects:write', danger: 'write', approval: true, body: false, pagination: null },\n  'projects.verification.resend': { action: 'projects.verification.resend', operationId: 'projects_verification_resend', method: 'POST', path: '/workspace/projects/verification/resend', pathParams: [], scope: 'projects:write', danger: 'write', approval: true, body: false, pagination: null },\n  'team.environment_access': { action: 'team.environment_access', operationId: 'team_environment_access', method: 'PUT', path: '/workspace/members/{id}/access', pathParams: ['id'], scope: 'team:write', danger: 'write', approval: true, body: true, pagination: null },\n  'team.invitations.list': { action: 'team.invitations.list', operationId: 'team_invitations_list', method: 'GET', path: '/workspace/invitations', pathParams: [], scope: 'team:read', danger: 'read', approval: true, body: false, pagination: null },\n  'team.invitations.resend': { action: 'team.invitations.resend', operationId: 'team_invitations_resend', method: 'POST', path: '/workspace/invitations/{id}/resend', pathParams: ['id'], scope: 'team:write', danger: 'write', approval: true, body: false, pagination: null },\n  'team.invitations.revoke': { action: 'team.invitations.revoke', operationId: 'team_invitations_revoke', method: 'DELETE', path: '/workspace/invitations/{id}', pathParams: ['id'], scope: 'team:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'team.invite': { action: 'team.invite', operationId: 'team_invite', method: 'POST', path: '/workspace/members', pathParams: [], scope: 'team:write', danger: 'write', approval: true, body: true, pagination: null },\n  'team.list': { action: 'team.list', operationId: 'team_list', method: 'GET', path: '/workspace/members', pathParams: [], scope: 'team:read', danger: 'read', approval: true, body: false, pagination: 'page' },\n  'team.remove': { action: 'team.remove', operationId: 'team_remove', method: 'DELETE', path: '/workspace/members/{id}', pathParams: ['id'], scope: 'team:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'team.role': { action: 'team.role', operationId: 'team_role', method: 'PATCH', path: '/workspace/members/{id}/role', pathParams: ['id'], scope: 'team:write', danger: 'write', approval: true, body: true, pagination: null },\n  'team.transfer_ownership': { action: 'team.transfer_ownership', operationId: 'team_transfer_ownership', method: 'POST', path: '/workspace/members/{id}/transfer-ownership', pathParams: ['id'], scope: 'team:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'workspace.get': { action: 'workspace.get', operationId: 'workspace_get', method: 'GET', path: '/workspace', pathParams: [], scope: 'workspace:read', danger: 'read', approval: true, body: false, pagination: null },\n  'workspace.settings.update': { action: 'workspace.settings.update', operationId: 'workspace_settings_update', method: 'PATCH', path: '/workspace', pathParams: [], scope: 'settings:write', danger: 'write', approval: true, body: true, pagination: null },\n} as const satisfies Record<string, OperationSpec>;\n\n// ── Client ─────────────────────────────────────────────────────────────────────────────────\n\n/** Options for a {@link WorkspaceClient}. `baseUrl` defaults to `https://api.cboxid.com`. */\nexport type WorkspaceClientOptions = ManagementClientOptions;\n\n/**\n * Cbox ID — Workspace Management API.\n *\n * The **workspace plane** — the customer's own Cbox account, above every environment it owns. Manage the\n * workspace, its **projects** (IdP products, each a billing anchor) and their\n * environments, its team, and its keys with a workspace key.\n */\nexport class WorkspaceClient {\n  /** The transport every method runs on — authentication, retries, approvals. */\n  readonly transport: ManagementTransport;\n\n  constructor(options: WorkspaceClientOptions) {\n    this.transport = new ManagementTransport('workspace', options, 'https://api.cboxid.com');\n  }\n\n  /** Call a route by method and path (relative to `/api/v1`) — for anything not generated. */\n  request<TBody = unknown, O extends CallOptions = CallOptions>(\n    method: OperationSpec['method'],\n    path: string,\n    input?: { query?: Record<string, unknown>; body?: unknown },\n    options?: O,\n  ): Promise<Outcome<TBody, O>> {\n    return this.transport.request<TBody, O>(method, path, input, options);\n  }\n\n  readonly actionApprovals = {\n    /**\n     * Where an approval this key asked for stands\n     *\n     * Any workspace key — or a member's token — may poll the approvals it raised, and only\n     * those: another credential's id is a 404. `status` is `pending`, `approved`, `denied`, `expired` or `consumed`.\n     *\n     * `GET /workspace/action-approvals/{id}`\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<ActionApprovalsGetResponse, O>> =>\n      this.transport.call<ActionApprovalsGetResponse, O>(workspaceOperations['action_approvals.get'], [id], undefined, options),\n  };\n\n  readonly environments = {\n    /**\n     * Create an environment\n     *\n     * Requires scope `environments:write` and the `manage-environments` capability\n     * (owner/admin/developer). Danger: critical — with `initial_key` it mints a credential.\n     *\n     * With `initial_key`, the environment's first management key is minted in the same\n     * call and returned once as `initial_key.token` — enough for an agent holding one\n     * workspace key to stand an environment up and start configuring it on the\n     * environment's own host. An idempotent replay returns `initial_key.token: null`.\n     *\n     * `POST /workspace/environments` · action `environments.create`\n     * @scope `environments:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: EnvironmentsCreateBody, options?: O): Promise<Outcome<EnvironmentsCreateResponse, O>> =>\n      this.transport.call<EnvironmentsCreateResponse, O>(workspaceOperations['environments.create'], [], body, options),\n    /**\n     * List environments\n     *\n     * Requires scope `workspace:read` (any role).\n     *\n     * `GET /workspace/environments` · action `environments.list`\n     * @scope `workspace:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: EnvironmentsListQuery, options?: O): Promise<Outcome<EnvironmentsListResponse, O>> =>\n      this.transport.call<EnvironmentsListResponse, O>(workspaceOperations['environments.list'], [], query, options),\n    /** Every item of `environments.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<EnvironmentsListQuery, 'page'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<Environment, void, undefined> =>\n      this.transport.paginate(workspaceOperations['environments.list'], [], query as Record<string, unknown> | undefined, options),\n    domain: {\n      /**\n       * Stop serving one of the workspace's environments on its custom domain. Anything using that domain stops reaching it.\n       *\n       * Requires scope `environments:write` and a role that may `manage-environments`. Danger: destructive.\n       *\n       * `DELETE /workspace/environments/{environment_id}/domain` · action `environments.domain.remove`\n       * @scope `environments:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      remove: <O extends CallOptions = CallOptions>(environmentId: string, options?: O): Promise<Outcome<EnvironmentsDomainRemoveResponse, O>> =>\n        this.transport.call<EnvironmentsDomainRemoveResponse, O>(workspaceOperations['environments.domain.remove'], [environmentId], undefined, options),\n      /**\n       * Start serving one of the workspace's environments on a custom domain: returns the DNS TXT record that proves you control it.\n       *\n       * Requires scope `environments:write` and a role that may `manage-environments`. Danger: write.\n       *\n       * `POST /workspace/environments/{environment_id}/domain` · action `environments.domain.request`\n       * @scope `environments:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      request: <O extends CallOptions = CallOptions>(environmentId: string, body: EnvironmentsDomainRequestBody, options?: O): Promise<Outcome<EnvironmentsDomainRequestResponse, O>> =>\n        this.transport.call<EnvironmentsDomainRequestResponse, O>(workspaceOperations['environments.domain.request'], [environmentId], body, options),\n      /**\n       * Look for the pending domain's DNS TXT record and, once it is visible, serve the environment on that domain.\n       *\n       * Requires scope `environments:write` and a role that may `manage-environments`. Danger: write.\n       *\n       * `POST /workspace/environments/{environment_id}/domain/verify` · action `environments.domain.verify`\n       * @scope `environments:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      verify: <O extends CallOptions = CallOptions>(environmentId: string, options?: O): Promise<Outcome<EnvironmentsDomainVerifyResponse, O>> =>\n        this.transport.call<EnvironmentsDomainVerifyResponse, O>(workspaceOperations['environments.domain.verify'], [environmentId], undefined, options),\n    },\n  };\n\n  readonly keys = {\n    environment: {\n      /**\n       * Mint a management key for one of the workspace's environments, with the scopes it needs. The value is returned once, as `token`.\n       *\n       * Requires scope `keys:write` and a role that may `manage-environments`. Danger: critical.\n       *\n       * `POST /workspace/environments/{environment_id}/keys` · action `keys.environment.create`\n       * @scope `keys:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      create: <O extends CallOptions = CallOptions>(environmentId: string, body: KeysEnvironmentCreateBody, options?: O): Promise<Outcome<KeysEnvironmentCreateResponse, O>> =>\n        this.transport.call<KeysEnvironmentCreateResponse, O>(workspaceOperations['keys.environment.create'], [environmentId], body, options),\n      /**\n       * Revoke one of an environment's management keys; whatever uses it stops immediately.\n       *\n       * Requires scope `keys:write` and a role that may `manage-environments`. Danger: destructive.\n       *\n       * `DELETE /workspace/environments/{environment_id}/keys/{id}` · action `keys.environment.revoke`\n       * @scope `keys:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      revoke: <O extends CallOptions = CallOptions>(environmentId: string, id: string, options?: O): Promise<Outcome<KeysEnvironmentRevokeResponse, O>> =>\n        this.transport.call<KeysEnvironmentRevokeResponse, O>(workspaceOperations['keys.environment.revoke'], [environmentId, id], undefined, options),\n    },\n    workspace: {\n      /**\n       * Mint a workspace key with a role and optional scopes, never wider than the caller. The value is returned once, as `token`.\n       *\n       * Requires scope `keys:write` and a role that may `manage-environments` and `manage-members`. Danger: critical.\n       *\n       * `POST /workspace/keys` · action `keys.workspace.create`\n       * @scope `keys:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      create: <O extends CallOptions = CallOptions>(body: KeysWorkspaceCreateBody, options?: O): Promise<Outcome<KeysWorkspaceCreateResponse, O>> =>\n        this.transport.call<KeysWorkspaceCreateResponse, O>(workspaceOperations['keys.workspace.create'], [], body, options),\n      /**\n       * List the workspace's keys, newest first, revoked ones included — names, roles, scopes and expiry, never their values.\n       *\n       * Requires scope `workspace:read` and a role that may `manage-members`. Danger: read.\n       *\n       * `GET /workspace/keys` · action `keys.workspace.list`\n       * @scope `workspace:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(query?: KeysWorkspaceListQuery, options?: O): Promise<Outcome<KeysWorkspaceListResponse, O>> =>\n        this.transport.call<KeysWorkspaceListResponse, O>(workspaceOperations['keys.workspace.list'], [], query, options),\n      /** Every item of `keys.workspace.list`, fetching pages as the iteration reaches them. */\n      listAll: (query?: Omit<KeysWorkspaceListQuery, 'page'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<WorkspaceKey, void, undefined> =>\n        this.transport.paginate(workspaceOperations['keys.workspace.list'], [], query as Record<string, unknown> | undefined, options),\n      /**\n       * Revoke a workspace key, and every key it minted on either plane (workspace keys and environment management keys, all the way down); whatever uses them stops immediately.\n       *\n       * Requires scope `keys:write` and a role that may `manage-environments` and `manage-members`. Danger: destructive.\n       *\n       * `DELETE /workspace/keys/{id}` · action `keys.workspace.revoke`\n       * @scope `keys:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      revoke: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<KeysWorkspaceRevokeResponse, O>> =>\n        this.transport.call<KeysWorkspaceRevokeResponse, O>(workspaceOperations['keys.workspace.revoke'], [id], undefined, options),\n    },\n  };\n\n  readonly projects = {\n    /**\n     * Create a project\n     *\n     * Stand up another independently-billed IdP product. Requires scope `projects:write` and the `manage-environments` capability (owner/admin/developer).\n     *\n     * `POST /workspace/projects` · action `projects.create`\n     * @scope `projects:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: ProjectsCreateBody, options?: O): Promise<Outcome<ProjectsCreateResponse, O>> =>\n      this.transport.call<ProjectsCreateResponse, O>(workspaceOperations['projects.create'], [], body, options),\n    /**\n     * List projects\n     *\n     * Requires scope `workspace:read` (any role). The workspace's projects (IdP products). Each carries its own plan and environment allowance.\n     *\n     * `GET /workspace/projects` · action `projects.list`\n     * @scope `workspace:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<ProjectsListResponse, O>> =>\n      this.transport.call<ProjectsListResponse, O>(workspaceOperations['projects.list'], [], undefined, options),\n    /**\n     * Reactivate a suspended project, so environments can be added to it again.\n     *\n     * Requires scope `projects:write` and a role that may `manage-environments`. Danger: write.\n     *\n     * `POST /workspace/projects/{id}/reactivate` · action `projects.reactivate`\n     * @scope `projects:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    reactivate: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<ProjectsReactivateResponse, O>> =>\n      this.transport.call<ProjectsReactivateResponse, O>(workspaceOperations['projects.reactivate'], [id], undefined, options),\n    /**\n     * Rename a project.\n     *\n     * Requires scope `projects:write` and a role that may `manage-environments`. Danger: write.\n     *\n     * `PATCH /workspace/projects/{id}` · action `projects.rename`\n     * @scope `projects:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    rename: <O extends CallOptions = CallOptions>(id: string, body: ProjectsRenameBody, options?: O): Promise<Outcome<ProjectsRenameResponse, O>> =>\n      this.transport.call<ProjectsRenameResponse, O>(workspaceOperations['projects.rename'], [id], body, options),\n    /**\n     * Suspend a project: its environments stay live, but no new ones can be added until it is reactivated.\n     *\n     * Requires scope `projects:write` and a role that may `manage-environments`. Danger: write.\n     *\n     * `POST /workspace/projects/{id}/suspend` · action `projects.suspend`\n     * @scope `projects:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    suspend: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<ProjectsSuspendResponse, O>> =>\n      this.transport.call<ProjectsSuspendResponse, O>(workspaceOperations['projects.suspend'], [id], undefined, options),\n    verification: {\n      /**\n       * Re-send the signup confirmation the workspace's first environment is waiting on, to the owner's address on file.\n       *\n       * Requires scope `projects:write` and a role that may `manage-environments`. Danger: write.\n       *\n       * `POST /workspace/projects/verification/resend` · action `projects.verification.resend`\n       * @scope `projects:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      resend: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<ProjectsVerificationResendResponse, O>> =>\n        this.transport.call<ProjectsVerificationResendResponse, O>(workspaceOperations['projects.verification.resend'], [], undefined, options),\n    },\n  };\n\n  readonly team = {\n    /**\n     * Set which of the workspace's environments a team member reaches: all of them, or the listed ones.\n     *\n     * Requires scope `team:write` and a role that may `manage-members`. Danger: write.\n     *\n     * `PUT /workspace/members/{id}/access` · action `team.environment_access`\n     * @scope `team:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    environmentAccess: <O extends CallOptions = CallOptions>(id: string, body: TeamEnvironmentAccessBody, options?: O): Promise<Outcome<TeamEnvironmentAccessResponse, O>> =>\n      this.transport.call<TeamEnvironmentAccessResponse, O>(workspaceOperations['team.environment_access'], [id], body, options),\n    /**\n     * Invite a member\n     *\n     * Requires scope `team:write` and the `manage-members` capability (owner/admin). Invites the address onto the\n     * workspace's team — the same invitation the console's Team page sends: a mail naming\n     * this key as the inviter and the role, with a signed link on which the invitee sets a\n     * password and is signed in. Owner is never invited; ownership is transferred. An\n     * earlier pending invitation for the same address is superseded. List, re-send and\n     * withdraw it under `/workspace/invitations`.\n     *\n     * `POST /workspace/members` · action `team.invite`\n     * @scope `team:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    invite: <O extends CallOptions = CallOptions>(body: TeamInviteBody, options?: O): Promise<Outcome<TeamInviteResponse, O>> =>\n      this.transport.call<TeamInviteResponse, O>(workspaceOperations['team.invite'], [], body, options),\n    /**\n     * List members\n     *\n     * Requires scope `team:read` and the `read-members` capability (owner/admin/viewer). The roster is PII — a developer key is refused.\n     *\n     * `GET /workspace/members` · action `team.list`\n     * @scope `team:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    list: <O extends CallOptions = CallOptions>(query?: TeamListQuery, options?: O): Promise<Outcome<TeamListResponse, O>> =>\n      this.transport.call<TeamListResponse, O>(workspaceOperations['team.list'], [], query, options),\n    /** Every item of `team.list`, fetching pages as the iteration reaches them. */\n    listAll: (query?: Omit<TeamListQuery, 'page'>, options?: Omit<CallOptions, 'approval'>): AsyncGenerator<Member, void, undefined> =>\n      this.transport.paginate(workspaceOperations['team.list'], [], query as Record<string, unknown> | undefined, options),\n    /**\n     * Remove a member from the workspace's team. The owner is never removed; transfer ownership first.\n     *\n     * Requires scope `team:write` and a role that may `manage-members`. Danger: destructive.\n     *\n     * `DELETE /workspace/members/{id}` · action `team.remove`\n     * @scope `team:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    remove: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<TeamRemoveResponse, O>> =>\n      this.transport.call<TeamRemoveResponse, O>(workspaceOperations['team.remove'], [id], undefined, options),\n    /**\n     * Change a team member's role (admin, developer, member or viewer). The owner's role changes only by transferring ownership.\n     *\n     * Requires scope `team:write` and a role that may `manage-members`. Danger: write.\n     *\n     * `PATCH /workspace/members/{id}/role` · action `team.role`\n     * @scope `team:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    role: <O extends CallOptions = CallOptions>(id: string, body: TeamRoleBody, options?: O): Promise<Outcome<TeamRoleResponse, O>> =>\n      this.transport.call<TeamRoleResponse, O>(workspaceOperations['team.role'], [id], body, options),\n    /**\n     * Make another member the workspace's owner; the current owner stays on as an admin. Only the owner, signed in, may do this.\n     *\n     * Requires scope `team:write` and a role that may `manage-members`. Danger: critical.\n     *\n     * `POST /workspace/members/{id}/transfer-ownership` · action `team.transfer_ownership`\n     * @scope `team:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    transferOwnership: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<TeamTransferOwnershipResponse, O>> =>\n      this.transport.call<TeamTransferOwnershipResponse, O>(workspaceOperations['team.transfer_ownership'], [id], undefined, options),\n    invitations: {\n      /**\n       * List pending invitations\n       *\n       * Requires scope `team:read` and the `read-members` capability. The team's invitations nobody has accepted yet, newest first (at most 100).\n       *\n       * `GET /workspace/invitations` · action `team.invitations.list`\n       * @scope `team:read`\n       * @danger read\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      list: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<TeamInvitationsListResponse, O>> =>\n        this.transport.call<TeamInvitationsListResponse, O>(workspaceOperations['team.invitations.list'], [], undefined, options),\n      /**\n       * Re-send an invitation\n       *\n       * Requires scope `team:write` and the `manage-members` capability. Mails a fresh link; the earlier link stops\n       * working and the invitation gets a new `id`. At most once a minute per address\n       * (`429`, `too_soon`). If the mail server refuses, the earlier invitation is kept (`503`).\n       *\n       * `POST /workspace/invitations/{id}/resend` · action `team.invitations.resend`\n       * @scope `team:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      resend: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<TeamInvitationsResendResponse, O>> =>\n        this.transport.call<TeamInvitationsResendResponse, O>(workspaceOperations['team.invitations.resend'], [id], undefined, options),\n      /**\n       * Withdraw an invitation\n       *\n       * Requires scope `team:write` and the `manage-members` capability. The link stops working. An invitation that is not pending in this workspace is a `404`.\n       *\n       * `DELETE /workspace/invitations/{id}` · action `team.invitations.revoke`\n       * @scope `team:write`\n       * @danger destructive\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      revoke: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<TeamInvitationsRevokeResponse, O>> =>\n        this.transport.call<TeamInvitationsRevokeResponse, O>(workspaceOperations['team.invitations.revoke'], [id], undefined, options),\n    },\n  };\n\n  readonly workspace = {\n    /**\n     * Get the workspace\n     *\n     * Requires scope `workspace:read` (any role). Returns the workspace's identity. The `projects` block (each project's plan/allowance) is included only for keys whose role can read billing (owner/admin/viewer — not developer).\n     *\n     * `GET /workspace` · action `workspace.get`\n     * @scope `workspace:read`\n     * @danger read\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    get: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<WorkspaceGetResponse, O>> =>\n      this.transport.call<WorkspaceGetResponse, O>(workspaceOperations['workspace.get'], [], undefined, options),\n    settings: {\n      /**\n       * Rename the workspace.\n       *\n       * Requires scope `settings:write` and a role that may `manage-members`. Danger: write.\n       *\n       * `PATCH /workspace` · action `workspace.settings.update`\n       * @scope `settings:write`\n       * @danger write\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      update: <O extends CallOptions = CallOptions>(body: WorkspaceSettingsUpdateBody, options?: O): Promise<Outcome<WorkspaceSettingsUpdateResponse, O>> =>\n        this.transport.call<WorkspaceSettingsUpdateResponse, O>(workspaceOperations['workspace.settings.update'], [], body, options),\n    },\n  };\n\n}\n","// GENERATED by scripts/generate-management.ts from openapi/platform.yaml — do not edit.\n// Regenerate with `npm run generate`.\n\nimport { ManagementTransport, type ManagementClientOptions } from '../transport.js';\nimport type { CallOptions, OperationSpec, Outcome } from '../types.js';\n\n// ── Schemas (components.schemas) ────────────────────────────────────────────────────────────\n\nexport interface ProvisionedWorkspace {\n  id: string;\n  name: string;\n  owner: {\n    id: string;\n    email: string;\n  };\n  /** The workspace's first project. */\n  project_id: string;\n  /** That project's first environment. */\n  environment_id: string;\n  /** Whether the owner was emailed a link to set their password. */\n  owner_invited: boolean;\n}\n\nexport interface PlatformOrganization {\n  id: string;\n  name: string;\n  slug: string;\n  type: 'customer' | 'reseller';\n  status: 'active' | 'suspended' | 'deleted';\n  parent_id?: string | null;\n  /** The environment it lives in. */\n  environment_id?: string | null;\n  created_at?: string | null;\n}\n\nexport interface PlatformEnvironment {\n  id: string;\n  name: string;\n  slug: string;\n  /** The verified domain it serves on — null until one is verified by DNS. */\n  domain?: string | null;\n  status: string;\n  /** The project that owns it; null for one no customer owns yet. */\n  project_id?: string | null;\n  created_at?: string | null;\n}\n\nexport interface ProvisionedEnvironment {\n  environment_id: string;\n  organization: PlatformOrganization;\n  admin: {\n    id: string;\n    email: string;\n  };\n}\n\nexport interface PlatformOperator {\n  id: string;\n  email: string;\n  name?: string | null;\n  status: 'active' | 'suspended';\n  created_at?: string | null;\n}\n\nexport interface ErrorSchema {\n  /** Stable machine code */\n  error: string;\n  /** Human-readable explanation */\n  message: string;\n  /** The id this request was served under, also sent as the X-Request-Id header. Quote it when reporting a problem. */\n  request_id?: string;\n  /** Present on `validation_failed` only — the offending fields, each mapped to its messages. */\n  errors?: {\n    [key: string]: string[];\n  };\n}\n\n// ── Operation inputs and responses ─────────────────────────────────────────────────────────\n\n/** Response body of `action_approvals.get`. */\nexport type ActionApprovalsGetResponse = {\n  data: {\n    id: string;\n    status: 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';\n  };\n};\n\n/** Request body of `environments.create`. */\nexport interface EnvironmentsCreateBody {\n  name: string;\n  /** The domain it will serve on, once verified by DNS. Checked to be free; not written yet. */\n  domain?: string | null;\n}\n\n/** Response body of `environments.create`. */\nexport type EnvironmentsCreateResponse = {\n  data: PlatformEnvironment;\n};\n\n/** Request body of `environments.provision`. */\nexport interface EnvironmentsProvisionBody {\n  organization_name: string;\n  admin_name: string;\n  admin_email: string;\n  /** Write-only. Must meet the environment's own password policy. */\n  admin_password: string;\n}\n\n/** Response body of `environments.provision`. */\nexport type EnvironmentsProvisionResponse = {\n  data: ProvisionedEnvironment;\n};\n\n/** Request body of `operators.create`. */\nexport interface OperatorsCreateBody {\n  name: string;\n  email: string;\n  /** Write-only. At least 12 characters, and not one known from a breach. */\n  password: string;\n}\n\n/** Response body of `operators.create`. */\nexport type OperatorsCreateResponse = {\n  data: PlatformOperator;\n};\n\n/** Request body of `operators.set_status`. */\nexport interface OperatorsSetStatusBody {\n  status: 'active' | 'suspended';\n}\n\n/** Response body of `operators.set_status`. */\nexport type OperatorsSetStatusResponse = {\n  data: PlatformOperator;\n};\n\n/** Request body of `organizations.create`. */\nexport interface OrganizationsCreateBody {\n  name: string;\n  type: 'customer' | 'reseller';\n  /** An organization of the same environment to create it under. */\n  parent_id?: string | null;\n}\n\n/** Response body of `organizations.create`. */\nexport type OrganizationsCreateResponse = {\n  data: PlatformOrganization;\n};\n\n/** Request body of `organizations.move`. */\nexport interface OrganizationsMoveBody {\n  /** The new parent, of the same environment; null for the top of the hierarchy. */\n  parent_id?: string | null;\n}\n\n/** Response body of `organizations.move`. */\nexport type OrganizationsMoveResponse = {\n  data: PlatformOrganization;\n};\n\n/** Request body of `organizations.set_status`. */\nexport interface OrganizationsSetStatusBody {\n  status: 'active' | 'suspended';\n}\n\n/** Response body of `organizations.set_status`. */\nexport type OrganizationsSetStatusResponse = {\n  data: PlatformOrganization;\n};\n\n/** Request body of `workspaces.create`. */\nexport interface WorkspacesCreateBody {\n  /** The workspace's name — usually the company it belongs to. */\n  name: string;\n  /** The owner. An address that already has an account keeps it; the workspace is added to it. */\n  owner_email: string;\n  owner_name: string;\n  /** The first project's environment allowance: 1, 2, 3, 5, 10 or 25. */\n  environment_limit: number;\n}\n\n/** Response body of `workspaces.create`. */\nexport type WorkspacesCreateResponse = {\n  data: ProvisionedWorkspace;\n};\n\n/** Request body of `workspaces.set_status`. */\nexport interface WorkspacesSetStatusBody {\n  status: 'active' | 'suspended';\n}\n\n/** Response body of `workspaces.set_status`. */\nexport type WorkspacesSetStatusResponse = {\n  data: PlatformOrganization;\n};\n\n// ── Operations ─────────────────────────────────────────────────────────────────────────────\n\n/** Every operation of the Cbox ID — Operator API — method, path, scope and danger — keyed by action name. */\nexport const platformOperations = {\n  'action_approvals.get': { action: null, operationId: null, method: 'GET', path: '/platform/action-approvals/{id}', pathParams: ['id'], scope: null, danger: null, approval: false, body: false, pagination: null },\n  'platform.environments.create': { action: 'platform.environments.create', operationId: 'platform_environments_create', method: 'POST', path: '/platform/environments', pathParams: [], scope: 'operator:environments:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'platform.environments.provision': { action: 'platform.environments.provision', operationId: 'platform_environments_provision', method: 'POST', path: '/platform/environments/{environment_id}/provision', pathParams: ['environment_id'], scope: 'operator:environments:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'platform.operators.create': { action: 'platform.operators.create', operationId: 'platform_operators_create', method: 'POST', path: '/platform/operators', pathParams: [], scope: 'operator:operators:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'platform.operators.set_status': { action: 'platform.operators.set_status', operationId: 'platform_operators_set_status', method: 'PUT', path: '/platform/operators/{operator_id}/status', pathParams: ['operator_id'], scope: 'operator:operators:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'platform.organizations.create': { action: 'platform.organizations.create', operationId: 'platform_organizations_create', method: 'POST', path: '/platform/environments/{environment_id}/organizations', pathParams: ['environment_id'], scope: 'operator:organizations:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'platform.organizations.move': { action: 'platform.organizations.move', operationId: 'platform_organizations_move', method: 'PUT', path: '/platform/environments/{environment_id}/organizations/{organization_id}/parent', pathParams: ['environment_id', 'organization_id'], scope: 'operator:organizations:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'platform.organizations.set_status': { action: 'platform.organizations.set_status', operationId: 'platform_organizations_set_status', method: 'PUT', path: '/platform/environments/{environment_id}/organizations/{organization_id}/status', pathParams: ['environment_id', 'organization_id'], scope: 'operator:organizations:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'platform.workspaces.create': { action: 'platform.workspaces.create', operationId: 'platform_workspaces_create', method: 'POST', path: '/platform/workspaces', pathParams: [], scope: 'operator:workspaces:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'platform.workspaces.set_status': { action: 'platform.workspaces.set_status', operationId: 'platform_workspaces_set_status', method: 'PUT', path: '/platform/workspaces/{workspace_id}/status', pathParams: ['workspace_id'], scope: 'operator:workspaces:write', danger: 'critical', approval: true, body: true, pagination: null },\n} as const satisfies Record<string, OperationSpec>;\n\n// ── Client ─────────────────────────────────────────────────────────────────────────────────\n\n/** Options for a {@link PlatformClient}. `baseUrl` defaults to `https://api.cboxid.com`. */\nexport type PlatformClientOptions = ManagementClientOptions;\n\n/**\n * Cbox ID — Operator API.\n *\n * The **deployment itself**, for the staff who run it: stand up customer workspaces,\n * create and bootstrap environments, manage organizations inside any environment, and\n * keep the operator roster. Everything the console's Platform pages do, as the same\n * actions — the same rules, refusals and audit trail.\n */\nexport class PlatformClient {\n  /** The transport every method runs on — authentication, retries, approvals. */\n  readonly transport: ManagementTransport;\n\n  constructor(options: PlatformClientOptions) {\n    this.transport = new ManagementTransport('platform', options, 'https://api.cboxid.com');\n  }\n\n  /** Call a route by method and path (relative to `/api/v1`) — for anything not generated. */\n  request<TBody = unknown, O extends CallOptions = CallOptions>(\n    method: OperationSpec['method'],\n    path: string,\n    input?: { query?: Record<string, unknown>; body?: unknown },\n    options?: O,\n  ): Promise<Outcome<TBody, O>> {\n    return this.transport.request<TBody, O>(method, path, input, options);\n  }\n\n  readonly actionApprovals = {\n    /**\n     * Where an approval you asked for stands\n     *\n     * The `poll_url` of a `202 approval_required`: an approval this token raised, and only those — another token's id is a 404. `status` is `pending`, `approved`, `denied`, `expired` or `consumed`.\n     *\n     * `GET /platform/action-approvals/{id}`\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<ActionApprovalsGetResponse, O>> =>\n      this.transport.call<ActionApprovalsGetResponse, O>(platformOperations['action_approvals.get'], [id], undefined, options),\n  };\n\n  readonly environments = {\n    /**\n     * Create an environment on the deployment, with its own signing key. A domain is verified separately, by DNS.\n     *\n     * Requires scope `operator:environments:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.\n     *\n     * `POST /platform/environments` · action `platform.environments.create`\n     * @scope `operator:environments:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: EnvironmentsCreateBody, options?: O): Promise<Outcome<EnvironmentsCreateResponse, O>> =>\n      this.transport.call<EnvironmentsCreateResponse, O>(platformOperations['platform.environments.create'], [], body, options),\n    /**\n     * Bootstrap an environment with its first organization and an owner administrator, so people can sign in to it.\n     *\n     * Requires scope `operator:environments:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.\n     *\n     * `POST /platform/environments/{environment_id}/provision` · action `platform.environments.provision`\n     * @scope `operator:environments:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    provision: <O extends CallOptions = CallOptions>(environmentId: string, body: EnvironmentsProvisionBody, options?: O): Promise<Outcome<EnvironmentsProvisionResponse, O>> =>\n      this.transport.call<EnvironmentsProvisionResponse, O>(platformOperations['platform.environments.provision'], [environmentId], body, options),\n  };\n\n  readonly operators = {\n    /**\n     * Add a platform operator: a person with authority over the whole deployment.\n     *\n     * Requires scope `operator:operators:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.\n     *\n     * `POST /platform/operators` · action `platform.operators.create`\n     * @scope `operator:operators:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: OperatorsCreateBody, options?: O): Promise<Outcome<OperatorsCreateResponse, O>> =>\n      this.transport.call<OperatorsCreateResponse, O>(platformOperations['platform.operators.create'], [], body, options),\n    /**\n     * Suspend a platform operator, or reactivate one. Never yourself, and never the last active operator.\n     *\n     * Requires scope `operator:operators:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.\n     *\n     * `PUT /platform/operators/{operator_id}/status` · action `platform.operators.set_status`\n     * @scope `operator:operators:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    setStatus: <O extends CallOptions = CallOptions>(operatorId: string, body: OperatorsSetStatusBody, options?: O): Promise<Outcome<OperatorsSetStatusResponse, O>> =>\n      this.transport.call<OperatorsSetStatusResponse, O>(platformOperations['platform.operators.set_status'], [operatorId], body, options),\n  };\n\n  readonly organizations = {\n    /**\n     * Create an organization inside an environment, optionally under a parent organization of the same environment.\n     *\n     * Requires scope `operator:organizations:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.\n     *\n     * `POST /platform/environments/{environment_id}/organizations` · action `platform.organizations.create`\n     * @scope `operator:organizations:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(environmentId: string, body: OrganizationsCreateBody, options?: O): Promise<Outcome<OrganizationsCreateResponse, O>> =>\n      this.transport.call<OrganizationsCreateResponse, O>(platformOperations['platform.organizations.create'], [environmentId], body, options),\n    /**\n     * Move an organization under another organization of the same environment, or to the top of its hierarchy.\n     *\n     * Requires scope `operator:organizations:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.\n     *\n     * `PUT /platform/environments/{environment_id}/organizations/{organization_id}/parent` · action `platform.organizations.move`\n     * @scope `operator:organizations:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    move: <O extends CallOptions = CallOptions>(environmentId: string, organizationId: string, body?: OrganizationsMoveBody, options?: O): Promise<Outcome<OrganizationsMoveResponse, O>> =>\n      this.transport.call<OrganizationsMoveResponse, O>(platformOperations['platform.organizations.move'], [environmentId, organizationId], body, options),\n    /**\n     * Suspend an organization inside an environment (its members can no longer sign in to it) or reactivate it.\n     *\n     * Requires scope `operator:organizations:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.\n     *\n     * `PUT /platform/environments/{environment_id}/organizations/{organization_id}/status` · action `platform.organizations.set_status`\n     * @scope `operator:organizations:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    setStatus: <O extends CallOptions = CallOptions>(environmentId: string, organizationId: string, body: OrganizationsSetStatusBody, options?: O): Promise<Outcome<OrganizationsSetStatusResponse, O>> =>\n      this.transport.call<OrganizationsSetStatusResponse, O>(platformOperations['platform.organizations.set_status'], [environmentId, organizationId], body, options),\n  };\n\n  readonly workspaces = {\n    /**\n     * Create a workspace with its owner, first project and first environment; the owner is emailed a link to set their password.\n     *\n     * Requires scope `operator:workspaces:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.\n     *\n     * `POST /platform/workspaces` · action `platform.workspaces.create`\n     * @scope `operator:workspaces:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(body: WorkspacesCreateBody, options?: O): Promise<Outcome<WorkspacesCreateResponse, O>> =>\n      this.transport.call<WorkspacesCreateResponse, O>(platformOperations['platform.workspaces.create'], [], body, options),\n    /**\n     * Suspend a workspace (its people can no longer sign in, its environments stop serving) or reactivate it.\n     *\n     * Requires scope `operator:workspaces:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.\n     *\n     * `PUT /platform/workspaces/{workspace_id}/status` · action `platform.workspaces.set_status`\n     * @scope `operator:workspaces:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    setStatus: <O extends CallOptions = CallOptions>(workspaceId: string, body: WorkspacesSetStatusBody, options?: O): Promise<Outcome<WorkspacesSetStatusResponse, O>> =>\n      this.transport.call<WorkspacesSetStatusResponse, O>(platformOperations['platform.workspaces.set_status'], [workspaceId], body, options),\n  };\n\n}\n","// GENERATED by scripts/generate-management.ts from openapi/account.yaml — do not edit.\n// Regenerate with `npm run generate`.\n\nimport { ManagementTransport, type ManagementClientOptions } from '../transport.js';\nimport type { CallOptions, OperationSpec, Outcome } from '../types.js';\n\n// ── Schemas (components.schemas) ────────────────────────────────────────────────────────────\n\nexport interface Profile {\n  id: string;\n  name: string | null;\n  email: string | null;\n}\n\nexport interface SessionsRevoked {\n  /** How many sessions were signed out. */\n  revoked: number;\n}\n\nexport interface PersonalApiKey {\n  id: string;\n  name?: string | null;\n  organization_id: string;\n  client_id: string;\n  prefix?: string;\n  permissions: string[];\n  expires_at?: string | null;\n  created_at?: string | null;\n  /** The key's value — shown once, on creation; null on an idempotent replay. */\n  token?: string | null;\n}\n\nexport interface ErrorSchema {\n  /** Stable machine code */\n  error: string;\n  /** Human-readable explanation */\n  message: string;\n  /** The id this request was served under, also sent as the X-Request-Id header. Quote it when reporting a problem. */\n  request_id?: string;\n  /** Present on `validation_failed` only — the offending fields, each mapped to its messages. */\n  errors?: {\n    [key: string]: string[];\n  };\n}\n\n// ── Operation inputs and responses ─────────────────────────────────────────────────────────\n\n/** Response body of `action_approvals.get`. */\nexport type ActionApprovalsGetResponse = {\n  data: {\n    id: string;\n    status: 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';\n  };\n};\n\n/** Request body of `api_keys.create`. */\nexport interface ApiKeysCreateBody {\n  /** The app this key is for. */\n  client_id: string;\n  name: string;\n  /** What the key may do in the app — each one a permission you hold there. Empty: it only identifies you. */\n  permissions?: string[];\n  /** When it stops working. Left out, it does not expire. */\n  expires_at?: string | null;\n}\n\n/** Response body of `api_keys.create`. */\nexport type ApiKeysCreateResponse = {\n  data: PersonalApiKey;\n};\n\n/** Response body of `api_keys.revoke`. */\nexport type ApiKeysRevokeResponse = void;\n\n/** Response body of `applications.revoke`. */\nexport type ApplicationsRevokeResponse = void;\n\n/** Response body of `devices.remove`. */\nexport type DevicesRemoveResponse = void;\n\n/** Response body of `mfa.sms.remove`. */\nexport type MfaSmsRemoveResponse = void;\n\n/** Response body of `organizations.leave`. */\nexport type OrganizationsLeaveResponse = void;\n\n/** Response body of `passkeys.remove`. */\nexport type PasskeysRemoveResponse = void;\n\n/** Response body of `pipes.disconnect`. */\nexport type PipesDisconnectResponse = void;\n\n/** Request body of `profile.update`. */\nexport interface ProfileUpdateBody {\n  /** Your display name. */\n  name: string;\n}\n\n/** Response body of `profile.update`. */\nexport type ProfileUpdateResponse = {\n  data: Profile;\n};\n\n/** Response body of `sessions.revoke`. */\nexport type SessionsRevokeResponse = void;\n\n/** Response body of `sessions.revoke_others`. */\nexport type SessionsRevokeOthersResponse = {\n  data: SessionsRevoked;\n};\n\n/** Response body of `social.unlink`. */\nexport type SocialUnlinkResponse = void;\n\n// ── Operations ─────────────────────────────────────────────────────────────────────────────\n\n/** Every operation of the Cbox ID — My Account API — method, path, scope and danger — keyed by action name. */\nexport const accountOperations = {\n  'action_approvals.get': { action: null, operationId: null, method: 'GET', path: '/me/action-approvals/{id}', pathParams: ['id'], scope: null, danger: null, approval: false, body: false, pagination: null },\n  'account.api_keys.create': { action: 'account.api_keys.create', operationId: 'account_api_keys_create', method: 'POST', path: '/me/organizations/{organization_id}/api-keys', pathParams: ['organization_id'], scope: 'account:api_keys:write', danger: 'critical', approval: true, body: true, pagination: null },\n  'account.api_keys.revoke': { action: 'account.api_keys.revoke', operationId: 'account_api_keys_revoke', method: 'DELETE', path: '/me/organizations/{organization_id}/api-keys/{key_id}', pathParams: ['organization_id', 'key_id'], scope: 'account:api_keys:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'account.applications.revoke': { action: 'account.applications.revoke', operationId: 'account_applications_revoke', method: 'DELETE', path: '/me/applications/{client_id}', pathParams: ['client_id'], scope: 'account:applications:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'account.devices.remove': { action: 'account.devices.remove', operationId: 'account_devices_remove', method: 'DELETE', path: '/me/devices/{device_id}', pathParams: ['device_id'], scope: 'account:devices:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'account.mfa.sms.remove': { action: 'account.mfa.sms.remove', operationId: 'account_mfa_sms_remove', method: 'DELETE', path: '/me/mfa/sms', pathParams: [], scope: 'account:sign_in:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'account.organizations.leave': { action: 'account.organizations.leave', operationId: 'account_organizations_leave', method: 'POST', path: '/me/organizations/{organization_id}/leave', pathParams: ['organization_id'], scope: 'account:organizations:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'account.passkeys.remove': { action: 'account.passkeys.remove', operationId: 'account_passkeys_remove', method: 'DELETE', path: '/me/passkeys/{passkey_id}', pathParams: ['passkey_id'], scope: 'account:sign_in:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'account.pipes.disconnect': { action: 'account.pipes.disconnect', operationId: 'account_pipes_disconnect', method: 'DELETE', path: '/me/pipes/{provider}', pathParams: ['provider'], scope: 'account:pipes:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'account.profile.update': { action: 'account.profile.update', operationId: 'account_profile_update', method: 'PATCH', path: '/me/profile', pathParams: [], scope: 'account:profile:write', danger: 'write', approval: true, body: true, pagination: null },\n  'account.sessions.revoke': { action: 'account.sessions.revoke', operationId: 'account_sessions_revoke', method: 'DELETE', path: '/me/sessions/{session_id}', pathParams: ['session_id'], scope: 'account:sessions:write', danger: 'destructive', approval: true, body: false, pagination: null },\n  'account.sessions.revoke_others': { action: 'account.sessions.revoke_others', operationId: 'account_sessions_revoke_others', method: 'POST', path: '/me/sessions/revoke-others', pathParams: [], scope: 'account:sessions:write', danger: 'critical', approval: true, body: false, pagination: null },\n  'account.social.unlink': { action: 'account.social.unlink', operationId: 'account_social_unlink', method: 'DELETE', path: '/me/social/{provider}', pathParams: ['provider'], scope: 'account:sign_in:write', danger: 'critical', approval: true, body: false, pagination: null },\n} as const satisfies Record<string, OperationSpec>;\n\n// ── Client ─────────────────────────────────────────────────────────────────────────────────\n\n/** Options for a {@link AccountClient}. `baseUrl` is required: the environment's own host. */\nexport type AccountClientOptions = ManagementClientOptions & { baseUrl: string };\n\n/**\n * Cbox ID — My Account API.\n *\n * **Your own account** — the person calling, and nobody else: your profile, where you are\n * signed in, which applications may act as you, your own API keys for the apps built on\n * this environment, your sign-in methods, your trusted devices and the organizations you\n * belong to. The same actions the\n * console's My account pages run, with the same rules, refusals and audit trail.\n */\nexport class AccountClient {\n  /** The transport every method runs on — authentication, retries, approvals. */\n  readonly transport: ManagementTransport;\n\n  constructor(options: AccountClientOptions) {\n    this.transport = new ManagementTransport('account', options);\n  }\n\n  /** Call a route by method and path (relative to `/api/v1`) — for anything not generated. */\n  request<TBody = unknown, O extends CallOptions = CallOptions>(\n    method: OperationSpec['method'],\n    path: string,\n    input?: { query?: Record<string, unknown>; body?: unknown },\n    options?: O,\n  ): Promise<Outcome<TBody, O>> {\n    return this.transport.request<TBody, O>(method, path, input, options);\n  }\n\n  readonly actionApprovals = {\n    /**\n     * Where an approval you asked for stands\n     *\n     * The `poll_url` of a `202 approval_required`: an approval this token raised, and only those — another token's id is a 404. `status` is `pending`, `approved`, `denied`, `expired` or `consumed`.\n     *\n     * `GET /me/action-approvals/{id}`\n     */\n    get: <O extends CallOptions = CallOptions>(id: string, options?: O): Promise<Outcome<ActionApprovalsGetResponse, O>> =>\n      this.transport.call<ActionApprovalsGetResponse, O>(accountOperations['action_approvals.get'], [id], undefined, options),\n  };\n\n  readonly apiKeys = {\n    /**\n     * Create an API key of your own for one of this environment's apps, in an organization you belong to. The value is returned once, as `token`.\n     *\n     * Requires scope `account:api_keys:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.\n     *\n     * `POST /me/organizations/{organization_id}/api-keys` · action `account.api_keys.create`\n     * @scope `account:api_keys:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    create: <O extends CallOptions = CallOptions>(organizationId: string, body: ApiKeysCreateBody, options?: O): Promise<Outcome<ApiKeysCreateResponse, O>> =>\n      this.transport.call<ApiKeysCreateResponse, O>(accountOperations['account.api_keys.create'], [organizationId], body, options),\n    /**\n     * Revoke one of your own API keys.\n     *\n     * Requires scope `account:api_keys:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: destructive.\n     *\n     * `DELETE /me/organizations/{organization_id}/api-keys/{key_id}` · action `account.api_keys.revoke`\n     * @scope `account:api_keys:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    revoke: <O extends CallOptions = CallOptions>(organizationId: string, keyId: string, options?: O): Promise<Outcome<ApiKeysRevokeResponse, O>> =>\n      this.transport.call<ApiKeysRevokeResponse, O>(accountOperations['account.api_keys.revoke'], [organizationId, keyId], undefined, options),\n  };\n\n  readonly applications = {\n    /**\n     * Withdraw an application's access to your account; it must ask you again to act as you.\n     *\n     * Requires scope `account:applications:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: destructive.\n     *\n     * `DELETE /me/applications/{client_id}` · action `account.applications.revoke`\n     * @scope `account:applications:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    revoke: <O extends CallOptions = CallOptions>(clientId: string, options?: O): Promise<Outcome<ApplicationsRevokeResponse, O>> =>\n      this.transport.call<ApplicationsRevokeResponse, O>(accountOperations['account.applications.revoke'], [clientId], undefined, options),\n  };\n\n  readonly devices = {\n    /**\n     * Remove one of your trusted devices; it is no longer asked to approve anything.\n     *\n     * Requires scope `account:devices:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: destructive.\n     *\n     * `DELETE /me/devices/{device_id}` · action `account.devices.remove`\n     * @scope `account:devices:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    remove: <O extends CallOptions = CallOptions>(deviceId: string, options?: O): Promise<Outcome<DevicesRemoveResponse, O>> =>\n      this.transport.call<DevicesRemoveResponse, O>(accountOperations['account.devices.remove'], [deviceId], undefined, options),\n  };\n\n  readonly mfa = {\n    sms: {\n      /**\n       * Remove your phone number for text-message sign-in codes.\n       *\n       * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.\n       *\n       * `DELETE /me/mfa/sms` · action `account.mfa.sms.remove`\n       * @scope `account:sign_in:write`\n       * @danger critical\n       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n       */\n      remove: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<MfaSmsRemoveResponse, O>> =>\n        this.transport.call<MfaSmsRemoveResponse, O>(accountOperations['account.mfa.sms.remove'], [], undefined, options),\n    },\n  };\n\n  readonly organizations = {\n    /**\n     * Leave one of your own organizations. The last owner cannot leave — transfer ownership first.\n     *\n     * Requires scope `account:organizations:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: destructive.\n     *\n     * `POST /me/organizations/{organization_id}/leave` · action `account.organizations.leave`\n     * @scope `account:organizations:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    leave: <O extends CallOptions = CallOptions>(organizationId: string, options?: O): Promise<Outcome<OrganizationsLeaveResponse, O>> =>\n      this.transport.call<OrganizationsLeaveResponse, O>(accountOperations['account.organizations.leave'], [organizationId], undefined, options),\n  };\n\n  readonly passkeys = {\n    /**\n     * Remove one of your passkeys.\n     *\n     * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.\n     *\n     * `DELETE /me/passkeys/{passkey_id}` · action `account.passkeys.remove`\n     * @scope `account:sign_in:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    remove: <O extends CallOptions = CallOptions>(passkeyId: string, options?: O): Promise<Outcome<PasskeysRemoveResponse, O>> =>\n      this.transport.call<PasskeysRemoveResponse, O>(accountOperations['account.passkeys.remove'], [passkeyId], undefined, options),\n  };\n\n  readonly pipes = {\n    /**\n     * Disconnect one of your connected services, revoking the access you gave it.\n     *\n     * Requires scope `account:pipes:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: destructive.\n     *\n     * `DELETE /me/pipes/{provider}` · action `account.pipes.disconnect`\n     * @scope `account:pipes:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    disconnect: <O extends CallOptions = CallOptions>(provider: string, options?: O): Promise<Outcome<PipesDisconnectResponse, O>> =>\n      this.transport.call<PipesDisconnectResponse, O>(accountOperations['account.pipes.disconnect'], [provider], undefined, options),\n  };\n\n  readonly profile = {\n    /**\n     * Change the display name on your own account.\n     *\n     * Requires scope `account:profile:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: write.\n     *\n     * `PATCH /me/profile` · action `account.profile.update`\n     * @scope `account:profile:write`\n     * @danger write\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    update: <O extends CallOptions = CallOptions>(body: ProfileUpdateBody, options?: O): Promise<Outcome<ProfileUpdateResponse, O>> =>\n      this.transport.call<ProfileUpdateResponse, O>(accountOperations['account.profile.update'], [], body, options),\n  };\n\n  readonly sessions = {\n    /**\n     * Sign out one of your own sessions.\n     *\n     * Requires scope `account:sessions:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: destructive.\n     *\n     * `DELETE /me/sessions/{session_id}` · action `account.sessions.revoke`\n     * @scope `account:sessions:write`\n     * @danger destructive\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    revoke: <O extends CallOptions = CallOptions>(sessionId: string, options?: O): Promise<Outcome<SessionsRevokeResponse, O>> =>\n      this.transport.call<SessionsRevokeResponse, O>(accountOperations['account.sessions.revoke'], [sessionId], undefined, options),\n    /**\n     * Sign out every one of your sessions except the one you are using.\n     *\n     * Requires scope `account:sessions:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.\n     *\n     * `POST /me/sessions/revoke-others` · action `account.sessions.revoke_others`\n     * @scope `account:sessions:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    revokeOthers: <O extends CallOptions = CallOptions>(options?: O): Promise<Outcome<SessionsRevokeOthersResponse, O>> =>\n      this.transport.call<SessionsRevokeOthersResponse, O>(accountOperations['account.sessions.revoke_others'], [], undefined, options),\n  };\n\n  readonly social = {\n    /**\n     * Disconnect a social account from yours — never the last way you can sign in.\n     *\n     * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.\n     *\n     * `DELETE /me/social/{provider}` · action `account.social.unlink`\n     * @scope `account:sign_in:write`\n     * @danger critical\n     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.\n     */\n    unlink: <O extends CallOptions = CallOptions>(provider: string, options?: O): Promise<Outcome<SocialUnlinkResponse, O>> =>\n      this.transport.call<SocialUnlinkResponse, O>(accountOperations['account.social.unlink'], [provider], undefined, options),\n  };\n\n}\n","/**\n * DPoP (RFC 9449) proofs for a sender-constrained access token, on WebCrypto alone — no\n * dependency, so it runs on Node, edge runtimes and the browser alike.\n *\n * A DPoP-bound token (its `cnf.jkt` names a key) is presented as `Authorization: DPoP <token>`\n * with a fresh proof per request, signed by that key: `htm` and `htu` pin the request, `ath`\n * pins the token, `jti` and `iat` make it single-use. A stolen token without the private key\n * is useless.\n */\n\n/** Produces the `DPoP` header value for one request. */\nexport interface DPoPSigner {\n  /** The RFC 7638 thumbprint of the public key — the `jkt` a bound token's `cnf` names. */\n  readonly jkt: string;\n  proof(input: { method: string; url: string; accessToken: string; nonce?: string }): Promise<string>;\n}\n\nconst encoder = new TextEncoder();\n\nfunction base64url(bytes: ArrayBuffer | Uint8Array): string {\n  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);\n  let binary = '';\n  for (const byte of view) {\n    binary += String.fromCharCode(byte);\n  }\n\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nasync function sha256(input: string): Promise<string> {\n  return base64url(await crypto.subtle.digest('SHA-256', encoder.encode(input)));\n}\n\n/** A fresh, non-extractable P-256 key pair for {@link createDPoPSigner}. */\nexport async function generateDPoPKeyPair(): Promise<CryptoKeyPair> {\n  return crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']);\n}\n\n/**\n * A signer for ES256 proofs with `keyPair` — the key the access token was bound to when it\n * was issued (the same one the token request's own DPoP proof used).\n */\nexport async function createDPoPSigner(keyPair: CryptoKeyPair): Promise<DPoPSigner> {\n  const exported = await crypto.subtle.exportKey('jwk', keyPair.publicKey);\n  const { crv, x, y } = exported;\n\n  if (exported.kty !== 'EC' || crv !== 'P-256' || typeof x !== 'string' || typeof y !== 'string') {\n    throw new TypeError('A DPoP key must be an ECDSA P-256 key pair.');\n  }\n\n  const jwk = { crv, kty: 'EC', x, y };\n  // RFC 7638: the required members, lexicographic order, no whitespace.\n  const jkt = await sha256(JSON.stringify(jwk));\n\n  return {\n    jkt,\n    async proof({ method, url, accessToken, nonce }) {\n      const target = new URL(url);\n      const header = { typ: 'dpop+jwt', alg: 'ES256', jwk };\n      const payload: Record<string, unknown> = {\n        jti: crypto.randomUUID(),\n        htm: method.toUpperCase(),\n        // RFC 9449 §4.2: the URI without query and fragment.\n        htu: `${target.origin}${target.pathname}`,\n        iat: Math.floor(Date.now() / 1000),\n        ath: await sha256(accessToken),\n      };\n\n      if (nonce !== undefined) {\n        payload.nonce = nonce;\n      }\n\n      const signingInput = `${base64url(encoder.encode(JSON.stringify(header)))}.${base64url(encoder.encode(JSON.stringify(payload)))}`;\n      // WebCrypto's ECDSA signature is already IEEE P1363 (r || s) — exactly JWS's ES256 form.\n      const signature = await crypto.subtle.sign(\n        { name: 'ECDSA', hash: 'SHA-256' },\n        keyPair.privateKey,\n        encoder.encode(signingInput),\n      );\n\n      return `${signingInput}.${base64url(signature)}`;\n    },\n  };\n}\n","/**\n * Ergonomics for the environment plane's Audit Logs product, on top of the generated\n * `env.auditLogs.*` methods: a buffered sender, an export that waits until it is ready, and\n * a client-side check of an organization's hash chain.\n */\nimport { CboxIdError } from '../errors.js';\nimport type {\n  AuditLogEvent,\n  AuditLogExport,\n  AuditLogsEventsCreateBody,\n  AuditLogsExportsCreateBody,\n  EnvironmentClient,\n} from './generated/environment.js';\nimport type { CallOptions } from './types.js';\n\n/** One event as `audit_logs.events.create` takes it. */\nexport type AuditLogEventInput = AuditLogsEventsCreateBody['events'][number];\n\n/** An event for {@link AuditLogger.record}: `occurred_at` defaults to now. */\nexport type AuditLogRecord = Omit<AuditLogEventInput, 'occurred_at'> & { occurred_at?: string };\n\n/** The most events one `POST /audit-logs/events` takes. */\nexport const MAX_AUDIT_BATCH = 100;\n\n/** The `prev_hash` of an organization's first event: 64 zeros. */\nexport const AUDIT_CHAIN_GENESIS = '0'.repeat(64);\n\nfunction uuid(): string {\n  return crypto.randomUUID();\n}\n\n// ── Buffered sender ─────────────────────────────────────────────────────────────────────\n\nexport interface AuditLoggerOptions {\n  /** Events per request, 1–100. Default 100. */\n  batchSize?: number;\n  /** Send whatever is buffered this often (ms). Default 5000; `0` sends only on size and `flush()`. */\n  flushIntervalMs?: number;\n  /**\n   * Called when a background flush (the interval, or a full batch from `record()`) fails.\n   * The batch stays at the head of the queue with its Idempotency-Key, so the next flush\n   * sends it again without recording it twice. Default: nothing — call `flush()` to see errors.\n   */\n  onError?: (error: unknown, batch: readonly AuditLogEventInput[]) => void;\n}\n\ninterface Batch {\n  events: AuditLogEventInput[];\n  /** Fixed when the batch is cut, so every resend of it is the same request to the server. */\n  idempotencyKey: string;\n}\n\n/**\n * Buffers audit events and sends them in batches of up to 100, each batch under its own\n * `Idempotency-Key`: on a full batch, on an interval, and on `flush()` / `close()`.\n *\n * Batches go out one at a time and in order, because the server appends each to its\n * organization's hash chain in the order received. A batch that fails stays queued with\n * the SAME key, so sending it again can never record an event twice.\n */\nexport class AuditLogger {\n  readonly #client: EnvironmentClient;\n  readonly #batchSize: number;\n  readonly #onError: AuditLoggerOptions['onError'];\n  #buffer: AuditLogEventInput[] = [];\n  readonly #queue: Batch[] = [];\n  #sending: Promise<void> = Promise.resolve();\n  #timer: ReturnType<typeof setInterval> | undefined;\n  #closed = false;\n\n  constructor(client: EnvironmentClient, options: AuditLoggerOptions = {}) {\n    const batchSize = options.batchSize ?? MAX_AUDIT_BATCH;\n\n    if (!Number.isInteger(batchSize) || batchSize < 1 || batchSize > MAX_AUDIT_BATCH) {\n      throw new RangeError(`batchSize must be 1–${MAX_AUDIT_BATCH}.`);\n    }\n\n    this.#client = client;\n    this.#batchSize = batchSize;\n    this.#onError = options.onError;\n\n    const interval = options.flushIntervalMs ?? 5_000;\n\n    if (interval > 0) {\n      this.#timer = setInterval(() => this.#background(), interval);\n      // Never keep a Node process alive just to flush an empty buffer.\n      (this.#timer as { unref?: () => void }).unref?.();\n    }\n  }\n\n  /** Events buffered or queued, not yet acknowledged by the server. */\n  get pending(): number {\n    return this.#buffer.length + this.#queue.reduce((n, batch) => n + batch.events.length, 0);\n  }\n\n  /** Buffer one event. A full batch is sent in the background. */\n  record(event: AuditLogRecord): void {\n    if (this.#closed) {\n      throw new CboxIdError('This AuditLogger is closed.');\n    }\n\n    this.#buffer.push({ ...event, occurred_at: event.occurred_at ?? new Date().toISOString() });\n\n    if (this.#buffer.length >= this.#batchSize) {\n      this.#background();\n    }\n  }\n\n  /** Send everything buffered, and resolve once the server has it. Throws if a batch fails. */\n  flush(): Promise<void> {\n    this.#cut();\n    const run = this.#sending.catch(() => undefined).then(() => this.#drain());\n    this.#sending = run;\n    return run;\n  }\n\n  /** Stop the interval and flush. */\n  async close(): Promise<void> {\n    this.#closed = true;\n\n    if (this.#timer !== undefined) {\n      clearInterval(this.#timer);\n      this.#timer = undefined;\n    }\n\n    await this.flush();\n  }\n\n  #background(): void {\n    this.flush().catch((error: unknown) => {\n      this.#onError?.(error, this.#queue[0]?.events ?? []);\n    });\n  }\n\n  /** Move the buffer into batches, each with the key every resend of it will carry. */\n  #cut(): void {\n    while (this.#buffer.length > 0) {\n      this.#queue.push({ events: this.#buffer.splice(0, this.#batchSize), idempotencyKey: uuid() });\n    }\n  }\n\n  async #drain(): Promise<void> {\n    while (this.#queue.length > 0) {\n      const batch = this.#queue[0]!;\n      await this.#client.auditLogs.events.create({ events: batch.events }, { idempotencyKey: batch.idempotencyKey });\n      this.#queue.shift();\n    }\n  }\n}\n\n// ── Exports ─────────────────────────────────────────────────────────────────────────────\n\nexport interface AuditLogExportOptions {\n  /** How often to read the export while it is `pending` (ms). Default 2000. */\n  pollIntervalMs?: number;\n  /** Give up after this long (ms). Default 10 minutes. */\n  timeoutMs?: number;\n  signal?: AbortSignal;\n  /** The create call's Idempotency-Key, to resume an export you started before. */\n  idempotencyKey?: string;\n}\n\n/** An export ended `failed` or `expired`, or was not ready in time. */\nexport class AuditLogExportError extends CboxIdError {\n  constructor(\n    message: string,\n    readonly auditExport: AuditLogExport | undefined,\n  ) {\n    super(message);\n  }\n}\n\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(signal.reason);\n      return;\n    }\n\n    const timer = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n    const onAbort = (): void => {\n      clearTimeout(timer);\n      reject(signal?.reason);\n    };\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\n/**\n * Start a CSV export (`audit_logs.exports.create`) and read it (`audit_logs.exports.get`)\n * until it is `ready`. The result's `url` is signed and short-lived: download it straight\n * away, or call `exports.get` again for a fresh one.\n */\nexport async function exportAuditLogs(\n  client: EnvironmentClient,\n  filters: AuditLogsExportsCreateBody = {},\n  options: AuditLogExportOptions = {},\n): Promise<AuditLogExport> {\n  const call: CallOptions = {\n    ...(options.signal !== undefined ? { signal: options.signal } : {}),\n  };\n  const created = await client.auditLogs.exports.create(filters, {\n    ...call,\n    ...(options.idempotencyKey !== undefined ? { idempotencyKey: options.idempotencyKey } : {}),\n  });\n  const deadline = Date.now() + (options.timeoutMs ?? 600_000);\n  const interval = Math.max(0, options.pollIntervalMs ?? 2_000);\n  let current = created.data;\n\n  for (;;) {\n    switch (current.state) {\n      case 'ready':\n        return current;\n      case 'failed':\n      case 'expired':\n        throw new AuditLogExportError(`Audit log export ${current.id} is ${current.state}.`, current);\n      default:\n        break;\n    }\n\n    if (Date.now() >= deadline) {\n      throw new AuditLogExportError(`Audit log export ${current.id} was not ready in time.`, current);\n    }\n\n    await sleep(interval, options.signal);\n    current = (await client.auditLogs.exports.get(current.id, call)).data;\n  }\n}\n\n// ── Chain verification ──────────────────────────────────────────────────────────────────\n\nconst encoder = new TextEncoder();\n\nfunction compareBytes(a: string, b: string): number {\n  const x = encoder.encode(a);\n  const y = encoder.encode(b);\n  const n = Math.min(x.length, y.length);\n\n  for (let i = 0; i < n; i++) {\n    if (x[i] !== y[i]) return x[i]! - y[i]!;\n  }\n\n  return x.length - y.length;\n}\n\n/** A float the way PHP's `json_encode` writes it (serialize_precision -1). */\nfunction phpFloat(value: number): string {\n  if (!Number.isFinite(value)) {\n    throw new TypeError('Canonical JSON cannot encode NaN or Infinity.');\n  }\n\n  if (Object.is(value, -0)) return '-0';\n  if (Number.isSafeInteger(value)) return String(value);\n\n  const sign = value < 0 ? '-' : '';\n  // The shortest round-trip digits — the same digits PHP's mode-0 conversion picks.\n  const [mantissa, exp] = Math.abs(value).toExponential().split('e') as [string, string];\n  const digits = mantissa.replace('.', '');\n  const exponent = Number(exp);\n  const decpt = exponent + 1;\n\n  if (decpt < -3 || decpt > 17) {\n    return `${sign}${digits[0]}.${digits.slice(1) || '0'}e${exponent < 0 ? '-' : '+'}${Math.abs(exponent)}`;\n  }\n\n  if (decpt <= 0) return `${sign}0.${'0'.repeat(-decpt)}${digits}`;\n  if (decpt >= digits.length) return `${sign}${digits}${'0'.repeat(decpt - digits.length)}`;\n\n  return `${sign}${digits.slice(0, decpt)}.${digits.slice(decpt)}`;\n}\n\n/**\n * Canonical JSON exactly as Cbox ID hashes it (`Cbox\\AuditChain\\Codec\\CanonicalJson`):\n * object keys sorted byte-wise at every depth, lists in order, slashes and Unicode written\n * as-is — plus the two places PHP's arrays show through, so the bytes match:\n *\n * - an object whose sorted keys are `\"0\"…\"n-1\"` is a PHP list, and is written as an array;\n * - an empty object is an empty PHP array, written `[]`.\n *\n * And, like PHP, U+2028 and U+2029 are escaped. Floats are written in PHP's form; keep them\n * out of anything you hash if you can (a sender's `1.0` and `1` arrive as the same number).\n */\nexport function canonicalJson(value: unknown): string {\n  if (value === null || value === undefined) return 'null';\n  if (typeof value === 'boolean') return value ? 'true' : 'false';\n  if (typeof value === 'number') return phpFloat(value);\n  if (typeof value === 'string') return JSON.stringify(value).replace(/\\u2028/g, '\\\\u2028').replace(/\\u2029/g, '\\\\u2029');\n\n  if (Array.isArray(value)) {\n    return `[${value.map(canonicalJson).join(',')}]`;\n  }\n\n  if (typeof value === 'object') {\n    const entries = Object.entries(value as Record<string, unknown>)\n      .filter(([, v]) => v !== undefined)\n      .sort(([a], [b]) => compareBytes(a, b));\n\n    if (entries.length === 0) return '[]';\n\n    if (entries.every(([key], index) => key === String(index))) {\n      return `[${entries.map(([, v]) => canonicalJson(v)).join(',')}]`;\n    }\n\n    return `{${entries.map(([k, v]) => `${canonicalJson(k)}:${canonicalJson(v)}`).join(',')}}`;\n  }\n\n  throw new TypeError(`Canonical JSON cannot encode a ${typeof value}.`);\n}\n\n/** The fields of an audit event its hash covers. */\nexport type AuditEventHashInput = Pick<\n  AuditLogEvent,\n  'id' | 'organization_id' | 'sequence' | 'action' | 'occurred_at' | 'actor' | 'targets' | 'context' | 'metadata'\n>;\n\n/** Metadata as it is hashed: the value, or null for none — never an empty `[]`/`{}`. */\nfunction metadataOf(value: unknown): unknown {\n  if (Array.isArray(value)) return value.length > 0 ? value : null;\n  if (typeof value === 'object' && value !== null) return Object.keys(value).length > 0 ? value : null;\n  return null;\n}\n\n/** The document an event's hash covers, in the server's shape (`AuditLogEventResource::document`). */\nexport function auditEventDocument(event: AuditEventHashInput): Record<string, unknown> {\n  const actor = (event.actor ?? {}) as Partial<AuditLogEvent['actor']>;\n  const context = (event.context ?? {}) as Partial<AuditLogEvent['context']>;\n\n  return {\n    id: event.id,\n    organization_id: event.organization_id,\n    sequence: event.sequence,\n    action: event.action,\n    occurred_at: event.occurred_at,\n    actor: { id: actor.id ?? null, type: actor.type ?? null, name: actor.name ?? null, metadata: metadataOf(actor.metadata) },\n    targets: (event.targets ?? []).map((target) => ({\n      id: target.id ?? null,\n      type: target.type ?? null,\n      name: target.name ?? null,\n      metadata: metadataOf(target.metadata),\n    })),\n    context: { location: context.location ?? null, user_agent: context.user_agent ?? null },\n    metadata: metadataOf(event.metadata),\n  };\n}\n\n/** `sha256(previousHash ‖ canonicalJson(document))`, lowercase hex. */\nexport async function auditEventHash(previousHash: string, event: AuditEventHashInput): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', encoder.encode(previousHash + canonicalJson(auditEventDocument(event))));\n  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, '0')).join('');\n}\n\n/** What {@link verifyAuditChain} found — the server's `AuditLogVerification`, minus its view of the head. */\nexport interface AuditChainVerification {\n  valid: boolean;\n  verified_count: number;\n  first_sequence: number | null;\n  last_sequence: number | null;\n  broken_at_sequence: number | null;\n  /** `missing` (a sequence gap), `link` (`prev_hash` does not name the event before), `hash` (the event changed). */\n  reason: 'missing' | 'link' | 'hash' | null;\n}\n\nexport interface VerifyAuditChainOptions {\n  /**\n   * The hash the first event must chain from. Default: 64 zeros when the first event is\n   * sequence 1; otherwise the first event's own `prev_hash`, taken on trust — pass the hash\n   * you kept for the event before it to check that link too.\n   */\n  previousHash?: string;\n}\n\n/**\n * Check one organization's events the way `GET /audit-logs/verify` does: in sequence order,\n * every sequence present, every `prev_hash` naming the event before, every `hash` matching\n * the event. Takes events as the API returns them, in any order (they are sorted by\n * `sequence`). Unlike the server's check it cannot see the chain's head, so it cannot tell\n * whether events were removed from the end.\n */\nexport async function verifyAuditChain(\n  events: Iterable<AuditLogEvent> | AsyncIterable<AuditLogEvent>,\n  options: VerifyAuditChainOptions = {},\n): Promise<AuditChainVerification> {\n  const all: AuditLogEvent[] = [];\n\n  for await (const event of events) {\n    all.push(event);\n  }\n\n  all.sort((a, b) => a.sequence - b.sequence);\n\n  const first = all[0];\n  let previous = options.previousHash ?? (first === undefined || first.sequence === 1 ? AUDIT_CHAIN_GENESIS : first.prev_hash);\n  let expected = first?.sequence ?? 1;\n  let verified = 0;\n\n  const result = (reason: AuditChainVerification['reason']): AuditChainVerification => ({\n    valid: reason === null,\n    verified_count: verified,\n    first_sequence: verified === 0 ? null : first!.sequence,\n    last_sequence: verified === 0 ? null : expected - 1,\n    broken_at_sequence: reason === null ? null : expected,\n    reason,\n  });\n\n  for (const event of all) {\n    if (event.sequence !== expected) return result('missing');\n    if (event.prev_hash !== previous) return result('link');\n    if ((await auditEventHash(previous, event)) !== event.hash) return result('hash');\n\n    previous = event.hash;\n    expected++;\n    verified++;\n  }\n\n  return result(null);\n}\n\n/**\n * Read every event of one organization (`audit_logs.events.list`) and verify its chain on\n * this side, independently of the server's own check (`env.auditLogs.verify()`). The events\n * are held in memory to be put in sequence order — the list is ordered by `occurred_at`,\n * which the sender chose, not by `sequence` — so this suits a chain of thousands, not\n * millions. For a long chain, use the server's check, which pages by sequence.\n */\nexport async function verifyAuditLogChain(\n  client: EnvironmentClient,\n  query: { organization_id: string; limit?: number },\n  options: VerifyAuditChainOptions = {},\n): Promise<AuditChainVerification> {\n  return verifyAuditChain(client.auditLogs.events.listAll({ ...query, order: 'asc' }), options);\n}\n","/**\n * Fine-grained authorization helpers for `env.fga.*`.\n *\n * The batch check (`env.fga.checkBatch({ checks })`) takes each check in the tuple notation\n * — `document:readme#viewer@user:alice`, or `folder:policies#viewer@group:eng#member` for a\n * userset. {@link fgaTuple} writes that notation from the same object `env.fga.tuples.write`\n * takes, so a page that writes tuples and checks them speaks one shape.\n */\n\n/** A subject: one user (`{ type: 'user', id: 'alice' }`) or a userset (`relation: 'member'`). */\nexport interface FgaSubjectRef {\n  type: string;\n  id: string;\n  relation?: string | null;\n}\n\n/** One relationship: `resource_type:resource_id#relation@subject`. */\nexport interface FgaTupleRef {\n  resource_type: string;\n  resource_id: string;\n  relation: string;\n  subject: FgaSubjectRef;\n}\n\n/**\n * Write a tuple in the notation the batch check and the console use:\n * `document:readme#viewer@user:alice`, `folder:policies#viewer@group:eng#member`.\n *\n * Refuses a part that contains `#`, `@`, `:` (in a type or relation) or whitespace — the\n * notation has no escaping, so such a part would be read back as a different tuple.\n */\nexport function fgaTuple(tuple: FgaTupleRef): string {\n  const name = (value: string, what: string): string => {\n    if (value === '' || /[\\s#@:]/.test(value)) {\n      throw new TypeError(`An FGA ${what} cannot be empty or contain whitespace, '#', '@' or ':': ${JSON.stringify(value)}`);\n    }\n    return value;\n  };\n  const id = (value: string, what: string): string => {\n    if (value === '' || /[\\s#@]/.test(value)) {\n      throw new TypeError(`An FGA ${what} cannot be empty or contain whitespace, '#' or '@': ${JSON.stringify(value)}`);\n    }\n    return value;\n  };\n\n  const subject = `${name(tuple.subject.type, 'subject type')}:${id(tuple.subject.id, 'subject id')}`;\n  const userset = tuple.subject.relation ? `#${name(tuple.subject.relation, 'subject relation')}` : '';\n\n  return `${name(tuple.resource_type, 'resource type')}:${id(tuple.resource_id, 'resource id')}#${name(tuple.relation, 'relation')}@${subject}${userset}`;\n}\n"]}