@greensecurity/javascript-sdk 0.46.0 → 0.47.0-beta.0

package/dist/commonjs/funcs/oauthCreateToken.js

@@ -0,0 +1,167 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthCreateToken = oauthCreateToken;
+const encodings_js_1 = require("../lib/encodings.js");
+const http_js_1 = require("../lib/http.js");
+const M = __importStar(require("../lib/matchers.js"));
+const primitives_js_1 = require("../lib/primitives.js");
+const schemas_js_1 = require("../lib/schemas.js");
+const security_js_1 = require("../lib/security.js");
+const url_js_1 = require("../lib/url.js");
+const components = __importStar(require("../models/components/index.js"));
+const errors = __importStar(require("../models/errors/index.js"));
+const async_js_1 = require("../types/async.js");
+/**
+ * Issue an access, app or developer token
+ *
+ * @remarks
+ * The OAuth 2.0 token endpoint. It issues four kinds of short-lived token, chosen by
+ * `grant_type`:
+ *
+ * | Grant | Authenticate with | Issues |
+ * | --- | --- | --- |
+ * | `urn:ietf:params:oauth:grant-type:token-exchange` | The user's session token, as `subject_token` | An app user token (`gsu_`) or an app installation token (`gsi_`), 15 minutes |
+ * | `client_credentials` with `activation_id` | The app service account's `client_id` and `client_secret`, or its permanent token as `Authorization: Bearer` | An app installation token (`gsi_`), 15 minutes |
+ * | `client_credentials` without `activation_id` | An API service account's `client_id` and `client_secret`, or its permanent token as `Authorization: Bearer` | A plain API access token, 15 minutes |
+ * | `refresh_token` (service account) | The service account's `client_id` and `client_secret`, and a `refresh_token` | A plain API access token, 15 minutes, and a new refresh token |
+ * | `refresh_token` (apps CLI) | A `gsdr_` refresh token and `client_id=greensecurity-apps-cli`, no secret | A new developer CLI token (`gsd_`), 15 minutes, and a new `gsdr_` refresh token |
+ * | `urn:ietf:params:oauth:grant-type:device_code` | The `device_code` from `POST /oauth/device_authorization` | A developer CLI token (`gsd_`), 15 minutes, and a `gsdr_` refresh token |
+ *
+ * Token exchange is what the Green Security app does when it opens an app's views: the user
+ * must be covered by an activation of the app named in `audience`. `client_credentials` with
+ * `activation_id` is for the app's own backend. Without `activation_id`, `client_credentials`
+ * and a service account's `refresh_token` are the API service account flows: the response is
+ * a plain access token with no `issued_token_type` and no `activation_id` (see
+ * `TokenResponse`). An app token can never be used to obtain another token.
+ *
+ * The apps CLI logs in with the device grant and then renews its 15-minute developer token
+ * with the public-client `refresh_token` grant. Refresh tokens rotate and are single-use;
+ * presenting a spent one revokes the whole login, except for a retry within 30 seconds whose
+ * replacement is still unused. A login lasts at most 90 days from its device authorization.
+ * See `OAuthCliRefreshTokenGrant`.
+ *
+ * Every grant takes an optional `scope`, which can only narrow the token: it gets what was
+ * requested intersected with what the client is allowed, and if that is empty the request
+ * fails with `invalid_scope`. A refreshed token is never wider than the one it replaces.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`, and every parameter
+ * must be in the body: one sent in the query string is refused with `invalid_request`. Errors
+ * follow RFC 6749 and use `OAuthError` rather than the usual error envelope, including a
+ * body that fails validation (`400` `invalid_request`, never `422`). For the device grant,
+ * `authorization_pending` and `slow_down` mean "poll again later", not failure.
+ *
+ * Only `client_credentials` reads `Authorization`, and only when the body carries neither
+ * `client_id` nor `client_secret`. It accepts only the service account's permanent token
+ * there: a short-lived token (including one this endpoint issued), a narrowed token or an app
+ * token (`gsu_`, `gsi_`, `gsd_`) is answered `401` `invalid_client`, so a token can never be
+ * renewed or widened by presenting it. The other grants ignore the header.
+ *
+ * A narrowed `subject_token` is refused with `invalid_grant`, and a locked service account
+ * gets `401` `invalid_client` on `client_credentials` and `refresh_token`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** No named permission.
+ *
+ * If set, this operation will use {@link Security.bearerJwt} from the global security.
+ */
+function oauthCreateToken(client, request, options) {
+    return new async_js_1.APIPromise($do(client, request, options));
+}
+async function $do(client, request, options) {
+    const parsed = (0, schemas_js_1.safeParse)(request, (value) => components.OAuthTokenRequest$outboundSchema.parse(value), "Input validation failed");
+    if (!parsed.ok) {
+        return [parsed, { status: "invalid" }];
+    }
+    const payload = parsed.value;
+    const body = (0, encodings_js_1.encodeJSON)("body", payload, { explode: true });
+    const path = (0, url_js_1.pathToFunc)("/oauth/token")();
+    const headers = new Headers((0, primitives_js_1.compactMap)({
+        "Content-Type": "application/json",
+        Accept: "application/json",
+    }));
+    const securityInput = await (0, security_js_1.extractSecurity)(client._options.security);
+    const requestSecurity = (0, security_js_1.resolveGlobalSecurity)(securityInput, [1]);
+    const context = {
+        options: client._options,
+        baseURL: options?.serverURL ?? client._baseURL ?? "",
+        operationID: "createToken",
+        oAuth2Scopes: null,
+        resolvedSecurity: requestSecurity,
+        securitySource: client._options.security,
+        retryConfig: options?.retries
+            || client._options.retryConfig
+            || { strategy: "none" },
+        retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+    };
+    const requestRes = client._createRequest(context, {
+        security: requestSecurity,
+        method: "POST",
+        baseURL: options?.serverURL,
+        path: path,
+        headers: headers,
+        body: body,
+        userAgent: client._options.userAgent,
+        timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+    }, options);
+    if (!requestRes.ok) {
+        return [requestRes, { status: "invalid" }];
+    }
+    const req = requestRes.value;
+    const doResult = await client._do(req, {
+        context,
+        isErrorStatusCode: (statusCode) => (0, http_js_1.matchStatusCode)({ status: statusCode }, ["4XX", "5XX"]),
+        retryConfig: context.retryConfig,
+        retryCodes: context.retryCodes,
+    });
+    if (!doResult.ok) {
+        return [doResult, { status: "request-error", request: req }];
+    }
+    const response = doResult.value;
+    const responseFields = {
+        HttpMeta: { Response: response, Request: req },
+    };
+    const [result] = await M.match(M.json(200, components.TokenResponse$inboundSchema), M.jsonErr([400, 401, 429], errors.OAuthError$inboundSchema), M.fail("4XX"), M.fail([500, "5XX"]))(response, req, { extraFields: responseFields });
+    if (!result.ok) {
+        return [result, { status: "complete", request: req, response }];
+    }
+    return [result, { status: "complete", request: req, response }];
+}
+//# sourceMappingURL=oauthCreateToken.js.map

package/dist/commonjs/funcs/oauthCreateToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthCreateToken.js","sourceRoot":"","sources":["../../../src/funcs/oauthCreateToken.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiFH,4CAuBC;AArGD,sDAAiD;AACjD,4CAAiD;AACjD,sDAAwC;AACxC,wDAAkD;AAClD,kDAA8C;AAE9C,oDAA4E;AAC5E,0CAA2C;AAC3C,0EAA4D;AAS5D,kEAAoD;AAGpD,gDAAwD;AAGxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,SAAgB,gBAAgB,CAC9B,MAAyB,EACzB,OAAqC,EACrC,OAAwB;IAexB,OAAO,IAAI,qBAAU,CAAC,GAAG,CACvB,MAAM,EACN,OAAO,EACP,OAAO,CACR,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,MAAyB,EACzB,OAAqC,EACrC,OAAwB;IAkBxB,MAAM,MAAM,GAAG,IAAA,sBAAS,EACtB,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,gCAAgC,CAAC,KAAK,CAAC,KAAK,CAAC,EACnE,yBAAyB,CAC1B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAA,yBAAU,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,cAAc,CAAC,EAAE,CAAC;IAE1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAA,0BAAU,EAAC;QACrC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC,CAAC,CAAC;IAEJ,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAe,EAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,IAAA,mCAAqB,EAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,OAAO,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE;QACpD,WAAW,EAAE,aAAa;QAC1B,YAAY,EAAE,IAAI;QAElB,gBAAgB,EAAE,eAAe;QAEjC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;QACxC,WAAW,EAAE,OAAO,EAAE,OAAO;eACxB,MAAM,CAAC,QAAQ,CAAC,WAAW;eAC3B,EAAE,QAAQ,EAAE,MAAM,EAAE;QACzB,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;KACvE,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE;QAChD,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO,EAAE,SAAS;QAC3B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;QACpC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;KACjE,EAAE,OAAO,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC;IAE7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;QACrC,OAAO;QACP,iBAAiB,EAAE,CAAC,UAAkB,EAAE,EAAE,CACxC,IAAA,yBAAe,EAAC,EAAE,MAAM,EAAE,UAAU,EAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG;QACrB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;KAC/C,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAY5B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,2BAA2B,CAAC,EACnD,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,wBAAwB,CAAC,EAC3D,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EACb,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACrB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/commonjs/funcs/oauthIntrospectToken.d.ts

@@ -0,0 +1,45 @@
+import { GreenSecurityCore } from "../core.js";
+import { RequestOptions } from "../lib/sdks.js";
+import * as components from "../models/components/index.js";
+import { GreenSecurityError } from "../models/errors/greensecurityerror.js";
+import { ConnectionError, InvalidRequestError, RequestAbortedError, RequestTimeoutError, UnexpectedClientError } from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import { APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+/**
+ * Check an app token
+ *
+ * @remarks
+ * RFC 7662 token introspection, for your app's backend. When your app's UI calls your own
+ * API it sends the app user token it was given; call this endpoint to confirm the token is
+ * live and find out which user, app and activation it belongs to before you act on it.
+ *
+ * A back-end-only app (a manifest with no `ui_extensions`) has no UI, so no user token
+ * ever reaches it, and the installation tokens it uses it mints itself with
+ * `client_credentials`. It needs this endpoint only to check an app token that another
+ * party sends it.
+ *
+ * Only app user and app installation tokens issued to your own app are reported as
+ * `active`. Any other token, whether unknown, expired, revoked, another app's, a developer
+ * CLI token, or one whose user has since been locked, returns `{"active": false}` with a
+ * `200`, never an error.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** Only your app service account's permanent token is accepted, as
+ * `Authorization: Bearer`. A short-lived or narrowed token (including one from
+ * `client_credentials`), a locked service account's token, or a token of a user who is not
+ * an API service account is refused with `401` `invalid_client`. Every app token is refused
+ * the same way, and that includes installation tokens (`gsi_`): the host also hands those to
+ * your app's sandboxed UI, so accepting them here would let code running in the UI introspect
+ * tokens. Keep the service account token on your backend.
+ *
+ * If set, this operation will use {@link Security.bearerJwt} from the global security.
+ */
+export declare function oauthIntrospectToken(client: GreenSecurityCore, request: components.TokenIntrospectionRequest, options?: RequestOptions): APIPromise<Result<components.TokenIntrospection, errors.OAuthError | GreenSecurityError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
+//# sourceMappingURL=oauthIntrospectToken.d.ts.map

package/dist/commonjs/funcs/oauthIntrospectToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthIntrospectToken.d.ts","sourceRoot":"","sources":["../../../src/funcs/oauthIntrospectToken.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAM/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAW,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,UAAU,CAAC,yBAAyB,EAC7C,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CACX,MAAM,CACJ,UAAU,CAAC,kBAAkB,EAC3B,MAAM,CAAC,UAAU,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CACrB,CACF,CAMA"}

package/dist/commonjs/funcs/oauthIntrospectToken.js

@@ -0,0 +1,145 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthIntrospectToken = oauthIntrospectToken;
+const encodings_js_1 = require("../lib/encodings.js");
+const http_js_1 = require("../lib/http.js");
+const M = __importStar(require("../lib/matchers.js"));
+const primitives_js_1 = require("../lib/primitives.js");
+const schemas_js_1 = require("../lib/schemas.js");
+const security_js_1 = require("../lib/security.js");
+const url_js_1 = require("../lib/url.js");
+const components = __importStar(require("../models/components/index.js"));
+const errors = __importStar(require("../models/errors/index.js"));
+const async_js_1 = require("../types/async.js");
+/**
+ * Check an app token
+ *
+ * @remarks
+ * RFC 7662 token introspection, for your app's backend. When your app's UI calls your own
+ * API it sends the app user token it was given; call this endpoint to confirm the token is
+ * live and find out which user, app and activation it belongs to before you act on it.
+ *
+ * A back-end-only app (a manifest with no `ui_extensions`) has no UI, so no user token
+ * ever reaches it, and the installation tokens it uses it mints itself with
+ * `client_credentials`. It needs this endpoint only to check an app token that another
+ * party sends it.
+ *
+ * Only app user and app installation tokens issued to your own app are reported as
+ * `active`. Any other token, whether unknown, expired, revoked, another app's, a developer
+ * CLI token, or one whose user has since been locked, returns `{"active": false}` with a
+ * `200`, never an error.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** Only your app service account's permanent token is accepted, as
+ * `Authorization: Bearer`. A short-lived or narrowed token (including one from
+ * `client_credentials`), a locked service account's token, or a token of a user who is not
+ * an API service account is refused with `401` `invalid_client`. Every app token is refused
+ * the same way, and that includes installation tokens (`gsi_`): the host also hands those to
+ * your app's sandboxed UI, so accepting them here would let code running in the UI introspect
+ * tokens. Keep the service account token on your backend.
+ *
+ * If set, this operation will use {@link Security.bearerJwt} from the global security.
+ */
+function oauthIntrospectToken(client, request, options) {
+    return new async_js_1.APIPromise($do(client, request, options));
+}
+async function $do(client, request, options) {
+    const parsed = (0, schemas_js_1.safeParse)(request, (value) => components.TokenIntrospectionRequest$outboundSchema.parse(value), "Input validation failed");
+    if (!parsed.ok) {
+        return [parsed, { status: "invalid" }];
+    }
+    const payload = parsed.value;
+    const body = (0, encodings_js_1.encodeJSON)("body", payload, { explode: true });
+    const path = (0, url_js_1.pathToFunc)("/oauth/introspect")();
+    const headers = new Headers((0, primitives_js_1.compactMap)({
+        "Content-Type": "application/json",
+        Accept: "application/json",
+    }));
+    const securityInput = await (0, security_js_1.extractSecurity)(client._options.security);
+    const requestSecurity = (0, security_js_1.resolveGlobalSecurity)(securityInput, [1]);
+    const context = {
+        options: client._options,
+        baseURL: options?.serverURL ?? client._baseURL ?? "",
+        operationID: "introspectToken",
+        oAuth2Scopes: null,
+        resolvedSecurity: requestSecurity,
+        securitySource: client._options.security,
+        retryConfig: options?.retries
+            || client._options.retryConfig
+            || { strategy: "none" },
+        retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+    };
+    const requestRes = client._createRequest(context, {
+        security: requestSecurity,
+        method: "POST",
+        baseURL: options?.serverURL,
+        path: path,
+        headers: headers,
+        body: body,
+        userAgent: client._options.userAgent,
+        timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+    }, options);
+    if (!requestRes.ok) {
+        return [requestRes, { status: "invalid" }];
+    }
+    const req = requestRes.value;
+    const doResult = await client._do(req, {
+        context,
+        isErrorStatusCode: (statusCode) => (0, http_js_1.matchStatusCode)({ status: statusCode }, ["4XX", "5XX"]),
+        retryConfig: context.retryConfig,
+        retryCodes: context.retryCodes,
+    });
+    if (!doResult.ok) {
+        return [doResult, { status: "request-error", request: req }];
+    }
+    const response = doResult.value;
+    const responseFields = {
+        HttpMeta: { Response: response, Request: req },
+    };
+    const [result] = await M.match(M.json(200, components.TokenIntrospection$inboundSchema), M.jsonErr([400, 401], errors.OAuthError$inboundSchema), M.fail("4XX"), M.fail([500, "5XX"]))(response, req, { extraFields: responseFields });
+    if (!result.ok) {
+        return [result, { status: "complete", request: req, response }];
+    }
+    return [result, { status: "complete", request: req, response }];
+}
+//# sourceMappingURL=oauthIntrospectToken.js.map

package/dist/commonjs/funcs/oauthIntrospectToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthIntrospectToken.js","sourceRoot":"","sources":["../../../src/funcs/oauthIntrospectToken.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DH,oDAuBC;AA/ED,sDAAiD;AACjD,4CAAiD;AACjD,sDAAwC;AACxC,wDAAkD;AAClD,kDAA8C;AAE9C,oDAA4E;AAC5E,0CAA2C;AAC3C,0EAA4D;AAS5D,kEAAoD;AAGpD,gDAAwD;AAGxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,SAAgB,oBAAoB,CAClC,MAAyB,EACzB,OAA6C,EAC7C,OAAwB;IAexB,OAAO,IAAI,qBAAU,CAAC,GAAG,CACvB,MAAM,EACN,OAAO,EACP,OAAO,CACR,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,MAAyB,EACzB,OAA6C,EAC7C,OAAwB;IAkBxB,MAAM,MAAM,GAAG,IAAA,sBAAS,EACtB,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,wCAAwC,CAAC,KAAK,CAAC,KAAK,CAAC,EAC3E,yBAAyB,CAC1B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAA,yBAAU,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,mBAAmB,CAAC,EAAE,CAAC;IAE/C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAA,0BAAU,EAAC;QACrC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC,CAAC,CAAC;IAEJ,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAe,EAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,IAAA,mCAAqB,EAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,OAAO,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE;QACpD,WAAW,EAAE,iBAAiB;QAC9B,YAAY,EAAE,IAAI;QAElB,gBAAgB,EAAE,eAAe;QAEjC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;QACxC,WAAW,EAAE,OAAO,EAAE,OAAO;eACxB,MAAM,CAAC,QAAQ,CAAC,WAAW;eAC3B,EAAE,QAAQ,EAAE,MAAM,EAAE;QACzB,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;KACvE,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE;QAChD,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO,EAAE,SAAS;QAC3B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;QACpC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;KACjE,EAAE,OAAO,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC;IAE7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;QACrC,OAAO;QACP,iBAAiB,EAAE,CAAC,UAAkB,EAAE,EAAE,CACxC,IAAA,yBAAe,EAAC,EAAE,MAAM,EAAE,UAAU,EAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG;QACrB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;KAC/C,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAY5B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,gCAAgC,CAAC,EACxD,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,wBAAwB,CAAC,EACtD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EACb,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACrB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/commonjs/funcs/oauthRevokeToken.d.ts

@@ -0,0 +1,49 @@
+import { GreenSecurityCore } from "../core.js";
+import { RequestOptions } from "../lib/sdks.js";
+import * as components from "../models/components/index.js";
+import { GreenSecurityError } from "../models/errors/greensecurityerror.js";
+import { ConnectionError, InvalidRequestError, RequestAbortedError, RequestTimeoutError, UnexpectedClientError } from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import * as operations from "../models/operations/index.js";
+import { APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+/**
+ * Revoke a token
+ *
+ * @remarks
+ * RFC 7009 token revocation. Revokes an app user, app installation or developer CLI token,
+ * or an apps CLI refresh token, immediately. Revoking any token of an apps CLI login (its
+ * `gsd_` developer token or its `gsdr_` refresh token) revokes every token of that login.
+ * `apps-cli logout` sends its refresh token this way.
+ *
+ * Once the caller is authenticated the response is `200` with `{}`, whether or not anything
+ * was revoked, so it cannot be used to probe for valid tokens. A token the caller may not
+ * revoke is left alone.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** For an apps CLI refresh token, send `token=gsdr_…` with
+ * `client_id=greensecurity-apps-cli` and no `Authorization` (RFC 7009 public client). It
+ * always answers `200`.
+ *
+ * Otherwise send one of these as `Authorization: Bearer`:
+ *
+ * - the token being revoked, which may revoke itself (a `gsd_` token may also revoke any
+ *   token of its own login), and no other token;
+ * - an unscoped token (session, permanent, or an access token issued without `scope`) of the
+ *   token's subject, or of the user whose view caused it to be issued;
+ * - an unscoped token of the service account of the app it was issued for.
+ *
+ * A narrowed token (an access token issued with `scope`) is refused with `401`
+ * `invalid_client`: its scope says nothing about revoking the caller's other tokens. So is
+ * the token of a locked user.
+ *
+ * If set, this operation will use {@link Security.bearerJwt} from the global security.
+ */
+export declare function oauthRevokeToken(client: GreenSecurityCore, request: components.TokenRevocationRequest, options?: RequestOptions): APIPromise<Result<operations.RevokeTokenRevokeTokenOk, errors.OAuthError | GreenSecurityError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
+//# sourceMappingURL=oauthRevokeToken.d.ts.map

package/dist/commonjs/funcs/oauthRevokeToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRevokeToken.d.ts","sourceRoot":"","sources":["../../../src/funcs/oauthRevokeToken.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAM/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAW,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,UAAU,CAAC,sBAAsB,EAC1C,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CACX,MAAM,CACJ,UAAU,CAAC,wBAAwB,EACjC,MAAM,CAAC,UAAU,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CACrB,CACF,CAMA"}

package/dist/commonjs/funcs/oauthRevokeToken.js

@@ -0,0 +1,149 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthRevokeToken = oauthRevokeToken;
+const encodings_js_1 = require("../lib/encodings.js");
+const http_js_1 = require("../lib/http.js");
+const M = __importStar(require("../lib/matchers.js"));
+const primitives_js_1 = require("../lib/primitives.js");
+const schemas_js_1 = require("../lib/schemas.js");
+const security_js_1 = require("../lib/security.js");
+const url_js_1 = require("../lib/url.js");
+const components = __importStar(require("../models/components/index.js"));
+const errors = __importStar(require("../models/errors/index.js"));
+const operations = __importStar(require("../models/operations/index.js"));
+const async_js_1 = require("../types/async.js");
+/**
+ * Revoke a token
+ *
+ * @remarks
+ * RFC 7009 token revocation. Revokes an app user, app installation or developer CLI token,
+ * or an apps CLI refresh token, immediately. Revoking any token of an apps CLI login (its
+ * `gsd_` developer token or its `gsdr_` refresh token) revokes every token of that login.
+ * `apps-cli logout` sends its refresh token this way.
+ *
+ * Once the caller is authenticated the response is `200` with `{}`, whether or not anything
+ * was revoked, so it cannot be used to probe for valid tokens. A token the caller may not
+ * revoke is left alone.
+ *
+ * The request body may be JSON or `application/x-www-form-urlencoded`.
+ *
+ * Every response, errors included, carries `Cache-Control: no-store` and `Pragma: no-cache`
+ * (RFC 6749 section 5.1), so no cache keeps a token or code.
+ *
+ * **Permissions.** For an apps CLI refresh token, send `token=gsdr_…` with
+ * `client_id=greensecurity-apps-cli` and no `Authorization` (RFC 7009 public client). It
+ * always answers `200`.
+ *
+ * Otherwise send one of these as `Authorization: Bearer`:
+ *
+ * - the token being revoked, which may revoke itself (a `gsd_` token may also revoke any
+ *   token of its own login), and no other token;
+ * - an unscoped token (session, permanent, or an access token issued without `scope`) of the
+ *   token's subject, or of the user whose view caused it to be issued;
+ * - an unscoped token of the service account of the app it was issued for.
+ *
+ * A narrowed token (an access token issued with `scope`) is refused with `401`
+ * `invalid_client`: its scope says nothing about revoking the caller's other tokens. So is
+ * the token of a locked user.
+ *
+ * If set, this operation will use {@link Security.bearerJwt} from the global security.
+ */
+function oauthRevokeToken(client, request, options) {
+    return new async_js_1.APIPromise($do(client, request, options));
+}
+async function $do(client, request, options) {
+    const parsed = (0, schemas_js_1.safeParse)(request, (value) => components.TokenRevocationRequest$outboundSchema.parse(value), "Input validation failed");
+    if (!parsed.ok) {
+        return [parsed, { status: "invalid" }];
+    }
+    const payload = parsed.value;
+    const body = (0, encodings_js_1.encodeJSON)("body", payload, { explode: true });
+    const path = (0, url_js_1.pathToFunc)("/oauth/revoke")();
+    const headers = new Headers((0, primitives_js_1.compactMap)({
+        "Content-Type": "application/json",
+        Accept: "application/json",
+    }));
+    const securityInput = await (0, security_js_1.extractSecurity)(client._options.security);
+    const requestSecurity = (0, security_js_1.resolveGlobalSecurity)(securityInput, [1]);
+    const context = {
+        options: client._options,
+        baseURL: options?.serverURL ?? client._baseURL ?? "",
+        operationID: "revokeToken",
+        oAuth2Scopes: null,
+        resolvedSecurity: requestSecurity,
+        securitySource: client._options.security,
+        retryConfig: options?.retries
+            || client._options.retryConfig
+            || { strategy: "none" },
+        retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+    };
+    const requestRes = client._createRequest(context, {
+        security: requestSecurity,
+        method: "POST",
+        baseURL: options?.serverURL,
+        path: path,
+        headers: headers,
+        body: body,
+        userAgent: client._options.userAgent,
+        timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+    }, options);
+    if (!requestRes.ok) {
+        return [requestRes, { status: "invalid" }];
+    }
+    const req = requestRes.value;
+    const doResult = await client._do(req, {
+        context,
+        isErrorStatusCode: (statusCode) => (0, http_js_1.matchStatusCode)({ status: statusCode }, ["4XX", "5XX"]),
+        retryConfig: context.retryConfig,
+        retryCodes: context.retryCodes,
+    });
+    if (!doResult.ok) {
+        return [doResult, { status: "request-error", request: req }];
+    }
+    const response = doResult.value;
+    const responseFields = {
+        HttpMeta: { Response: response, Request: req },
+    };
+    const [result] = await M.match(M.json(200, operations.RevokeTokenRevokeTokenOk$inboundSchema), M.jsonErr([400, 401], errors.OAuthError$inboundSchema), M.fail("4XX"), M.fail([500, "5XX"]))(response, req, { extraFields: responseFields });
+    if (!result.ok) {
+        return [result, { status: "complete", request: req, response }];
+    }
+    return [result, { status: "complete", request: req, response }];
+}
+//# sourceMappingURL=oauthRevokeToken.js.map

package/dist/commonjs/funcs/oauthRevokeToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRevokeToken.js","sourceRoot":"","sources":["../../../src/funcs/oauthRevokeToken.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DH,4CAuBC;AAnFD,sDAAiD;AACjD,4CAAiD;AACjD,sDAAwC;AACxC,wDAAkD;AAClD,kDAA8C;AAE9C,oDAA4E;AAC5E,0CAA2C;AAC3C,0EAA4D;AAS5D,kEAAoD;AAGpD,0EAA4D;AAC5D,gDAAwD;AAGxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAgB,gBAAgB,CAC9B,MAAyB,EACzB,OAA0C,EAC1C,OAAwB;IAexB,OAAO,IAAI,qBAAU,CAAC,GAAG,CACvB,MAAM,EACN,OAAO,EACP,OAAO,CACR,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,MAAyB,EACzB,OAA0C,EAC1C,OAAwB;IAkBxB,MAAM,MAAM,GAAG,IAAA,sBAAS,EACtB,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,qCAAqC,CAAC,KAAK,CAAC,KAAK,CAAC,EACxE,yBAAyB,CAC1B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAA,yBAAU,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,eAAe,CAAC,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAA,0BAAU,EAAC;QACrC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC,CAAC,CAAC;IAEJ,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAe,EAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,IAAA,mCAAqB,EAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,OAAO,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE;QACpD,WAAW,EAAE,aAAa;QAC1B,YAAY,EAAE,IAAI;QAElB,gBAAgB,EAAE,eAAe;QAEjC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;QACxC,WAAW,EAAE,OAAO,EAAE,OAAO;eACxB,MAAM,CAAC,QAAQ,CAAC,WAAW;eAC3B,EAAE,QAAQ,EAAE,MAAM,EAAE;QACzB,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;KACvE,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE;QAChD,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO,EAAE,SAAS;QAC3B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;QACpC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;KACjE,EAAE,OAAO,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC;IAE7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;QACrC,OAAO;QACP,iBAAiB,EAAE,CAAC,UAAkB,EAAE,EAAE,CACxC,IAAA,yBAAe,EAAC,EAAE,MAAM,EAAE,UAAU,EAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG;QACrB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;KAC/C,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAY5B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,sCAAsC,CAAC,EAC9D,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,wBAAwB,CAAC,EACtD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EACb,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACrB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/commonjs/funcs/organizationsGetFacility.d.ts

@@ -25,6 +25,7 @@ import { Result } from "../types/fp.js";
  * - `facility.system`
  * - `facility.contacts`
  * - `facility.vendor_counts`
+ * - `facility.device_counts` (also requires `zone_devices.view`)
  * - `facility.appointment_policy`
  * - `facility.vendor_policy`
  * - `facility.vendor_guest_policy`

package/dist/commonjs/funcs/organizationsGetFacility.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizationsGetFacility.d.ts","sourceRoot":"","sources":["../../../src/funcs/organizationsGetFacility.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAM/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAW,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,UAAU,CAAC,kBAAkB,EACtC,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CACX,MAAM,CACJ,UAAU,CAAC,QAAQ,EACjB,MAAM,CAAC,gBAAgB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CACrB,CACF,CAMA"}
+{"version":3,"file":"organizationsGetFacility.d.ts","sourceRoot":"","sources":["../../../src/funcs/organizationsGetFacility.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAM/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAW,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,UAAU,CAAC,kBAAkB,EACtC,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CACX,MAAM,CACJ,UAAU,CAAC,QAAQ,EACjB,MAAM,CAAC,gBAAgB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CACrB,CACF,CAMA"}

package/dist/commonjs/funcs/organizationsGetFacility.js

@@ -64,6 +64,7 @@ const async_js_1 = require("../types/async.js");
  * - `facility.system`
  * - `facility.contacts`
  * - `facility.vendor_counts`
+ * - `facility.device_counts` (also requires `zone_devices.view`)
  * - `facility.appointment_policy`
  * - `facility.vendor_policy`
  * - `facility.vendor_guest_policy`

package/dist/commonjs/funcs/organizationsGetFacility.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizationsGetFacility.js","sourceRoot":"","sources":["../../../src/funcs/organizationsGetFacility.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDH,4DAuBC;AA3ED,sDAAoE;AACpE,4CAAiD;AACjD,sDAAwC;AACxC,wDAAkD;AAClD,kDAA8C;AAE9C,oDAA4E;AAC5E,0CAA2C;AAC3C,0EAA4D;AAS5D,kEAAoD;AAGpD,0EAA4D;AAC5D,gDAAwD;AAGxD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAgB,wBAAwB,CACtC,MAAyB,EACzB,OAAsC,EACtC,OAAwB;IAexB,OAAO,IAAI,qBAAU,CAAC,GAAG,CACvB,MAAM,EACN,OAAO,EACP,OAAO,CACR,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,MAAyB,EACzB,OAAsC,EACtC,OAAwB;IAkBxB,MAAM,MAAM,GAAG,IAAA,sBAAS,EACtB,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,iCAAiC,CAAC,KAAK,CAAC,KAAK,CAAC,EACpE,yBAAyB,CAC1B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC;IAElB,MAAM,UAAU,GAAG;QACjB,EAAE,EAAE,IAAA,2BAAY,EAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE;YACjC,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,SAAS;SACxB,CAAC;KACH,CAAC;IACF,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC,CAAC;IAExD,MAAM,KAAK,GAAG,IAAA,8BAAe,EAAC;QAC5B,QAAQ,EAAE,OAAO,CAAC,MAAM;KACzB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAA,0BAAU,EAAC;QACrC,MAAM,EAAE,kBAAkB;KAC3B,CAAC,CAAC,CAAC;IAEJ,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAe,EAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,IAAA,mCAAqB,EAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,OAAO,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE;QACpD,WAAW,EAAE,aAAa;QAC1B,YAAY,EAAE,IAAI;QAElB,gBAAgB,EAAE,eAAe;QAEjC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;QACxC,WAAW,EAAE,OAAO,EAAE,OAAO;eACxB,MAAM,CAAC,QAAQ,CAAC,WAAW;eAC3B,EAAE,QAAQ,EAAE,MAAM,EAAE;QACzB,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;KACvE,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE;QAChD,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,OAAO,EAAE,SAAS;QAC3B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;QACpC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;KACjE,EAAE,OAAO,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC;IAE7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;QACrC,OAAO;QACP,iBAAiB,EAAE,CAAC,UAAkB,EAAE,EAAE,CACxC,IAAA,yBAAe,EAAC,EAAE,MAAM,EAAE,UAAU,EAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG;QACrB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;KAC/C,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAY5B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,sBAAsB,CAAC,EAC9C,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,8BAA8B,CAAC,EAC3E,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EACb,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACrB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC"}
+{"version":3,"file":"organizationsGetFacility.js","sourceRoot":"","sources":["../../../src/funcs/organizationsGetFacility.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDH,4DAuBC;AA5ED,sDAAoE;AACpE,4CAAiD;AACjD,sDAAwC;AACxC,wDAAkD;AAClD,kDAA8C;AAE9C,oDAA4E;AAC5E,0CAA2C;AAC3C,0EAA4D;AAS5D,kEAAoD;AAGpD,0EAA4D;AAC5D,gDAAwD;AAGxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAgB,wBAAwB,CACtC,MAAyB,EACzB,OAAsC,EACtC,OAAwB;IAexB,OAAO,IAAI,qBAAU,CAAC,GAAG,CACvB,MAAM,EACN,OAAO,EACP,OAAO,CACR,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,MAAyB,EACzB,OAAsC,EACtC,OAAwB;IAkBxB,MAAM,MAAM,GAAG,IAAA,sBAAS,EACtB,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,iCAAiC,CAAC,KAAK,CAAC,KAAK,CAAC,EACpE,yBAAyB,CAC1B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC;IAElB,MAAM,UAAU,GAAG;QACjB,EAAE,EAAE,IAAA,2BAAY,EAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE;YACjC,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,SAAS;SACxB,CAAC;KACH,CAAC;IACF,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC,CAAC;IAExD,MAAM,KAAK,GAAG,IAAA,8BAAe,EAAC;QAC5B,QAAQ,EAAE,OAAO,CAAC,MAAM;KACzB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAA,0BAAU,EAAC;QACrC,MAAM,EAAE,kBAAkB;KAC3B,CAAC,CAAC,CAAC;IAEJ,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAe,EAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,IAAA,mCAAqB,EAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,OAAO,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE;QACpD,WAAW,EAAE,aAAa;QAC1B,YAAY,EAAE,IAAI;QAElB,gBAAgB,EAAE,eAAe;QAEjC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;QACxC,WAAW,EAAE,OAAO,EAAE,OAAO;eACxB,MAAM,CAAC,QAAQ,CAAC,WAAW;eAC3B,EAAE,QAAQ,EAAE,MAAM,EAAE;QACzB,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;KACvE,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE;QAChD,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,OAAO,EAAE,SAAS;QAC3B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;QACpC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;KACjE,EAAE,OAAO,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC;IAE7B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;QACrC,OAAO;QACP,iBAAiB,EAAE,CAAC,UAAkB,EAAE,EAAE,CACxC,IAAA,yBAAe,EAAC,EAAE,MAAM,EAAE,UAAU,EAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG;QACrB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;KAC/C,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAY5B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,sBAAsB,CAAC,EAC9C,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,8BAA8B,CAAC,EAC3E,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EACb,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACrB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC"}