@noresponse/node 1.0.1 → 2.0.1

package/CHANGELOG.md

@@ -0,0 +1,35 @@
+# Changelog
+
+All notable changes to `@noresponse/node`. The format follows Keep a Changelog and the package follows Semantic Versioning.
+
+## 2.0.0
+
+The client is now generated from the NoResponse OpenAPI document, with hand-written webhooks, auth adapters and wait helper. Every call site changes.
+
+### Breaking changes
+
+- Construction: `new NoResponse({ apiKey, baseUrl, timeoutMs, fetch, logger, retryConfig })`. `apiKey` defaults to `NORESPONSE_API_KEY` and `baseUrl` to `NORESPONSE_BASE_URL`, then `https://api.noresponse.org`; both options were required before and the environment was not read. The default timeout is 10 s (was 5 s). `maxRetries` and `retryBaseDelayMs` are replaced by `retryConfig`.
+- Methods moved under resources: `assess()` is `assessments.create(params, options)`, `getAssessment()` is `assessments.get(id, options)`, `waitForAssessment()` is `assessments.wait(id, options)`, `queryAssessments()` is `assessments.query(params)` and `recordOutcome()` is `assessments.recordOutcome(id, params, options)`. `keys.rotate()` is new.
+- Request bodies use the API's field names in camelCase: `create` takes `{ accountId, identifiers: { email, username, phone, name, ip }, policyContext: { flow, region }, requestId, deadlineMs, responseMode, clientContext, authContext }` instead of a flat object. Client-side checks of ids, the deadline, the outcome vocabulary and note lengths are gone; the API answers 400 with `invalidParams`.
+- The idempotency key is an option (`{ idempotencyKey }`), is generated when omitted, and is reused on every retry of that call.
+- Every model is camelCase (`assessmentId`, `assessmentVersion`, `expiresAt`, `risk.reasons[].code`). Dates stay RFC 3339 strings.
+- Returned objects carry `meta` (`requestId`, `retryAfter`, `location`, `idempotentReplayed`); `query` returns a page with `items`, `hasMore`, `next()` and an async iterator over every item.
+- Errors: one class per status (`BadRequestError`, `AuthenticationError`, `PermissionDeniedError`, `NotFoundError`, `ConflictError`, `RateLimitError`, `APIStatusError`), all extending `NoResponseError`, each with `status`, `type`, `title`, `detail`, `code`, `requestId`, `retryAfter` and `invalidParams`. Connection failures and timeouts are `APIConnectionError` and `APITimeoutError` instead of raw `TypeError` and `DOMException`. `retryable` is replaced by `isRetryable(error)`.
+- Retries cover connection errors, 408, 429 and every 5xx (before: network errors, 429 and 503), with jittered backoff from 500 ms to 8 s for at most 30 s in all. `Retry-After` is honoured and capped at 8 s; before, a `Retry-After: 3600` made the client sleep for an hour.
+- `wait` polls no faster than once a second and throws `APITimeoutError` (was a plain `Error`).
+- Webhooks: `verifyWebhook(rawBody, headerPairs, secrets, nowSeconds)` is `constructEvent(payload, headers, secrets, { toleranceSeconds, now })`, which also accepts a string body, a Fetch `Headers` object and Node headers. `webhookAssessment()` is gone: an `assessment.updated` event's `data` is already the typed assessment, and `isExpiredEvent()` picks out the terminal expiry event. `webhookVerificationResponse()` is `verificationResponse()`. Failures throw `WebhookVerificationError` with a `code`.
+- Auth adapters return and accept camelCase (`sessionCreatedAt`, `emailVerified`, `mfa.ageSeconds`); their outputs are unchanged on the wire.
+- Packaging: dual ESM and CommonJS builds, `zod` as a runtime dependency, package metadata pointing at https://docs.noresponse.org and https://github.com/noresponsehq/node.
+
+### Added
+
+- `keys.rotate({ overlapSeconds })`.
+- `nr.webhooks` and `NoResponse.webhooks` with `constructEvent` and `verificationResponse`.
+- `NORESPONSE_LOG=debug` and the `logger` option: one line per request and response, without headers or bodies.
+- A `User-Agent` of `noresponse-node/<version> (<runtime>)` on every request.
+- Standalone per-operation functions under `@noresponse/node/funcs/*` and a `NoResponseCore` client for them.
+- Node 20 and 22 in CI.
+
+## 1.0.1
+
+Hand-written client: `assess`, `getAssessment`, `waitForAssessment`, `queryAssessments`, `recordOutcome`, `verifyWebhook` and the four auth adapters.

package/README.md

@@ -1,35 +1,240 @@
 # @noresponse/node
 
-Server-side Node / TypeScript client for the provider-facing NoResponse signup API. Install it with `npm install @noresponse/node` (Node 20 or later). To work on the SDK, run `npm ci && npm test` in this folder; builds emit `dist/index.js` and type declarations.
+The NoResponse client for Node.js. It assesses a signup or gateway event, polls a pending assessment, pages through an account's history, records what you later learned, rotates your API key and verifies webhooks.
+
+Node.js 20 or later. ESM and CommonJS. TypeScript types included. The client is generated from the NoResponse OpenAPI document; webhooks, auth adapters and the wait helper are hand-written.
+
+```sh
+npm install @noresponse/node
+```
+
+## Quick start
 
 ```ts
-import { NoResponse, type Assessment } from "@noresponse/node";
+import { NoResponse } from "@noresponse/node";
+
+const nr = new NoResponse(); // reads NORESPONSE_API_KEY
+
+const assessment = await nr.assessments.create({
+  accountId: "usr_8f2k1",
+  identifiers: { email: "jordan.lee@example.com", name: "Jordan Lee", ip: "81.2.69.160" },
+});
+
+if (assessment.status === "pending") {
+  // No recommendation yet. Apply your fallback now, then wait or take the webhook.
+  const settled = await nr.assessments.wait(assessment.assessmentId);
+  console.log(settled.risk?.recommendation);
+} else {
+  console.log(assessment.risk?.recommendation); // allow, step_up or review
+}
+```
 
+Keep the API key on your server. The client throws at construction without one.
+
+## Configuration
+
+```ts
 const nr = new NoResponse({
-  apiKey: process.env.NORESPONSE_API_KEY!,       // server-only
-  baseUrl: process.env.NORESPONSE_API_URL!,     // https://api.noresponse.org in production
-  timeoutMs: 5000,                              // transport timeout; configurable per deployment
+  apiKey: process.env.NORESPONSE_API_KEY, // default
+  baseUrl: "https://api.noresponse.org",   // default; or NORESPONSE_BASE_URL
+  timeoutMs: 10_000,                       // per request
+  fetch,                                   // your own fetch, for example with a proxy agent
+  logger: console,                         // one line per request and response
+  retryConfig: { strategy: "none" },       // override the retry policy
 });
-const assessment: Assessment = await nr.assess({
-  accountId: "usr_123",
-  email: "person@example.com",                  // email, username or phone: at least one
-  name: "Jane A. Doe",                          // optional, used only for matching
-  ip: "73.162.18.45",                           // optional, the signup's public IP
-  idempotencyKey: "signup-usr_123-0000001",
+```
+
+| Option | Default | Notes |
+|---|---|---|
+| `apiKey` | `NORESPONSE_API_KEY` | A string, or a function returning a promise of one. |
+| `baseUrl` | `NORESPONSE_BASE_URL`, then `https://api.noresponse.org` | HTTPS, except localhost. |
+| `timeoutMs` | 10 000 | Per request. Also settable per call. |
+| `fetch` | global fetch | Any `fetch` implementation. |
+| `logger` | `console` when `NORESPONSE_LOG=debug` | Receives method, URL, status and request id. Headers and bodies are not logged. |
+| `retryConfig` | see [Retries](#retries) | |
+
+Every method takes request options as its last argument: `{ timeoutMs, signal, headers, retries, serverURL }`.
+
+## Assessments
+
+### Create
+
+```ts
+const assessment = await nr.assessments.create(
+  {
+    accountId: "usr_8f2k1",                                    // your opaque account id
+    identifiers: { email: "jordan.lee@example.com" },          // email, username or phone; name and ip refine the match
+    policyContext: { flow: "signup", region: "AU" },           // signup, login, recovery or profile_change
+    clientContext: { timezone: "Australia/Sydney", platform: "web", formDurationMs: 1800 },
+    authContext: fromClerk(claims, { sessionCreatedAt }),      // see Auth adapters
+    responseMode: "standard",                                  // detailed adds signals and risk.details (detailed scope)
+  },
+  { idempotencyKey: "signup-usr_8f2k1-0001" },
+);
+```
+
+The answer is the assessment whether the API answered 200 (complete or partial) or 202 (pending). `status` is `complete`, `partial` or `pending`; `risk.recommendation` is `allow`, `step_up` or `review` and is absent while pending.
+
+The idempotency key is generated (a UUID) when you leave it out and is sent again on every retry of that call. Pass your own to make a retry of the same signup from your side replay the same assessment: the API answers the latest version with `meta.idempotentReplayed` true and starts no new work. The same key with a different body answers 409.
+
+### Get and wait
+
+```ts
+const latest = await nr.assessments.get(assessment.assessmentId);
+const settled = await nr.assessments.wait(assessment.assessmentId, { timeoutMs: 30_000 });
+```
+
+`wait` polls `get` until the status is no longer pending, sleeping the server's `Retry-After` (at least one second) between polls, and throws `APITimeoutError` at `timeoutMs` (default 30 s). Pass `responseMode: "detailed"` to either.
+
+### Query an account's history
+
+```ts
+const page = await nr.assessments.query({ accountId: "usr_8f2k1", limit: 20 });
+page.items;        // newest first, each at its latest version
+page.hasMore;      // true when another page exists
+await page.next(); // the next page, or null
+
+for await (const item of page) {
+  // every assessment across every page
+}
+```
+
+### Record an outcome
+
+```ts
+const receipt = await nr.assessments.recordOutcome(assessment.assessmentId, {
+  outcome: "chargeback", // confirmed_abuse, account_takeover, chargeback, false_positive, legitimate or unknown
+  observedAt: "2026-10-20T10:00:00Z",
+  externalRef: "case-42",
 });
-if (assessment.status === "pending") {
-  // No recommendation yet: never allow. Apply YOUR fallback, then wait for the webhook or poll.
-} else if (assessment.risk?.recommendation === "step_up") {
-  // Your app decides whether to request an additional verification step.
+```
+
+Outcomes take an idempotency key the same way `create` does.
+
+## Keys
+
+```ts
+const rotation = await nr.keys.rotate({ overlapSeconds: 3600 });
+rotation.key;                  // the new key, shown once
+rotation.previousKeyExpiresAt; // when the key that signed the request stops working
+```
+
+The default overlap is 24 hours (minimum 60 seconds, maximum 7 days). Rotate with the new key next time.
+
+## Response metadata
+
+Every returned object carries `meta`:
+
+```ts
+assessment.meta.requestId;          // X-Request-ID, to quote when you contact us
+assessment.meta.retryAfter;         // seconds, when the API sent Retry-After
+assessment.meta.location;           // the polling path of a pending assessment
+assessment.meta.idempotentReplayed; // true when the answer replays an earlier request
+```
+
+## Errors
+
+Every API error extends `NoResponseError` and carries `status`, `type`, `title`, `detail`, `code`, `requestId`, `retryAfter` and, on a 400, `invalidParams` (the offending fields).
+
+| Class | When |
+|---|---|
+| `BadRequestError` | 400: the body or a header is malformed; see `invalidParams` and `code` |
+| `AuthenticationError` | 401: missing, malformed, revoked or expired key |
+| `PermissionDeniedError` | 403: the key lacks the operation's scope |
+| `NotFoundError` | 404: unknown, expired or foreign assessment |
+| `ConflictError` | 409: idempotency key reused with a different body, or a key already rotating |
+| `RateLimitError` | 429: see `retryAfter` |
+| `APIStatusError` | any other 4xx or 5xx, including 503, and a 2xx the client could not read (`code` is `invalid_response`) |
+| `APIConnectionError` | DNS, TLS or connection failure (also exported as `ConnectionError`) |
+| `APITimeoutError` | the request or a `wait` timed out (also exported as `RequestTimeoutError`) |
+
+```ts
+import { NoResponseError, RateLimitError, APIConnectionError, APITimeoutError } from "@noresponse/node";
+
+try {
+  await nr.assessments.create(params);
+} catch (error) {
+  if (error instanceof RateLimitError) schedule(error.retryAfter);
+  else if (error instanceof APIConnectionError || error instanceof APITimeoutError) fallback();
+  else if (error instanceof NoResponseError) log(error.status, error.code, error.requestId);
+  else throw error;
 }
 ```
 
-Also provides `getAssessment(assessmentId, { responseMode })`, `queryAssessments({ account_id, limit, cursor, responseMode })` and `recordOutcome(assessmentId, { outcome, idempotencyKey, observedAt, externalRef, notes })`, which reports what was later learned about the account (`confirmed_abuse`, `account_takeover`, `chargeback`, `false_positive`, `legitimate` or `unknown`). `responseMode: "detailed"` (with the `detailed` key scope) adds `risk.details` and `signals[]`; `raw` is refused. Pass `flow` (`signup`, `login`, `recovery`, or `profile_change`) and an uppercase `region` when the event is not the default signup. The client retries network failures, 429 and 503 a bounded number of times while preserving the same idempotency key.
+The transport errors extend `HTTPClientError`, not `NoResponseError`.
+
+## Retries
+
+Connection errors, 408, 429 and every 5xx are retried with exponential backoff (500 ms, then 2 s, 4.5 s, up to 8 s between attempts, with jitter) for at most 30 s in all. When the API sends `Retry-After`, the client sleeps that long instead, capped at 8 s. A POST sends the same `Idempotency-Key` on every attempt, so a retried create or outcome is recorded once. 409 and other 4xx are not retried.
+
+Override per client with `retryConfig`, or per call with `{ retries }`:
+
+```ts
+await nr.assessments.create(params, { retries: { strategy: "none" } });
+```
+
+## Webhooks
+
+Verify the exact bytes you received, then act on the typed event. `secrets` maps each `whk_` key id we give you to its secret; hold both during a rotation.
 
-Webhooks: `verifyWebhook(rawBody, headerPairs, secrets, nowSeconds?)` checks the `v1=` HMAC-SHA256 signature over the exact raw request bytes, the 300-second timestamp window and the event id, and returns the typed `WebhookEvent`. It takes **raw header pairs** so it can refuse a repeated header, including a case variant. Never parse then re-stringify the body before verifying. An `assessment.updated` event's `data` is the full assessment, exactly as `getAssessment` returns it: `webhookAssessment(event)` returns it as a typed `Assessment`. Keep the highest `assessment_version` per assessment. When receiving `endpoint.verification`, respond with `webhookVerificationResponse(event)`.
+```ts
+import { constructEvent, isExpiredEvent, verificationResponse, WebhookVerificationError } from "@noresponse/node";
+
+// Express: app.post("/webhooks/noresponse", express.raw({ type: "*/*" }), handler)
+async function handler(req, res) {
+  let event;
+  try {
+    event = constructEvent(req.body, req.headers, { [process.env.NORESPONSE_WEBHOOK_KEY_ID]: process.env.NORESPONSE_WEBHOOK_SECRET });
+  } catch (error) {
+    if (error instanceof WebhookVerificationError) return res.status(400).end();
+    throw error;
+  }
+  if (event.type === "endpoint.verification") return res.json(verificationResponse(event));
+  if (isExpiredEvent(event)) {
+    forget(event.data.assessmentId); // GET now answers 404
+  } else if (isNewer(event.data)) {  // keep the highest assessmentVersion per assessment
+    apply(event.data);              // the full assessment, as assessments.get returns it
+  }
+  res.status(204).end();
+}
+```
+
+`constructEvent(payload, headers, secrets, { toleranceSeconds })` takes the raw body (a `Buffer`, `Uint8Array` or the exact text), any header object (Fetch `Headers`, Node `IncomingHttpHeaders`, a plain object or entries) and refuses a repeated signature header, a delivery older than 300 seconds, an unknown key id or a bad signature with a `WebhookVerificationError` whose `code` says which. Deliveries are at least once: deduplicate on `event.id`. The same functions are on `NoResponse.webhooks` and `nr.webhooks`. This module uses `node:crypto`.
+
+## Auth adapters
+
+Map a session your backend has already verified into `authContext`:
+
+```ts
+import { fromClerk, fromWorkOS, fromAuth0, fromOIDC } from "@noresponse/node";
+
+const authContext = fromClerk(sessionClaims, {
+  sessionCreatedAt: "2026-10-19T18:00:00Z",
+  accountCreatedAt: user.createdAt,
+  emailVerified: true,
+});
+```
+
+Each adapter reads the standard claims (issuer, subject, audience, session and token ids, times), the provider's organisation, role and scope claims, and multi-factor evidence where the provider exposes it. Pass what the token leaves out as overrides. `fromOIDC(provider, claims, overrides)` covers any other provider.
+
+## Logging
+
+Set `NORESPONSE_LOG=debug`, or pass `logger`, to get one line per request and response: method, URL, status and request id. The API key, other headers and bodies are kept out of the log.
+
+## Standalone functions
+
+Every operation is also a tree-shakeable function that returns a result object instead of throwing:
+
+```ts
+import { NoResponseCore } from "@noresponse/node";
+import { assessmentsCreate } from "@noresponse/node/funcs/assessments-create.js";
+
+const result = await assessmentsCreate(new NoResponseCore({ apiKey }), { idempotencyKey, body });
+if (result.ok) console.log(result.value.result.status);
+```
 
-See [example rules](../docs/example-rules.md) for turning an assessment into an action, for example "step up when `breach_name_mismatch` or `proxy_ip` fired".
+## Support
 
-This SDK never makes the allow/deny decision for a provider. `pending`, HTTP 429/503 and network timeouts must follow provider-defined fail-open/step-up policy; idempotency keys must be reused for retries of the **same request body**. No tenant keys in browser bundles, environment values in logs, or production traffic before the API release GO decision.
+Documentation: https://docs.noresponse.org. Issues: https://github.com/noresponsehq/node/issues. Quote `meta.requestId` or `error.requestId` when you write to us.
 
-Every request, response, summary, detail, signal and webhook type is generated from the provider OpenAPI contract into `src/generated/models.ts` and re-exported from the package (for example `Assessment`, `Risk`, `RiskReason`, `RiskSummary`, `Signal`, `WebhookEvent`). The committed package-lock.json makes the TypeScript toolchain reproducible; use npm ci in CI and local validation. See [provider onboarding](../docs/provider-onboarding.md) for key rotation, webhook verification, retries and staging setup.
+Apache-2.0.

package/dist/commonjs/auth.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Auth context adapters. Hand-written; not generated.
+ *
+ * Each adapter maps claims your backend has already verified into the
+ * `authContext` of an assessment request. Pass verified claims, not a raw token.
+ */
+import type { AuthContext } from "./models/auth-context.js";
+export type VerifiedClaims = Record<string, unknown>;
+export type AuthContextOverrides = Partial<AuthContext>;
+/** Map verified WorkOS AuthKit claims plus verified user or session record overrides. */
+export declare function fromWorkOS(claims: VerifiedClaims, overrides?: AuthContextOverrides): AuthContext;
+/** Map verified Clerk session claims. Pass Session.createdAt as sessionCreatedAt. */
+export declare function fromClerk(claims: VerifiedClaims, overrides?: AuthContextOverrides): AuthContext;
+/** Map verified Auth0 ID token, userinfo or normalised session claims. Do not pass an opaque API access token. */
+export declare function fromAuth0(claims: VerifiedClaims, overrides?: AuthContextOverrides): AuthContext;
+/** Generic OIDC adapter for providers without a first-class helper. `provider` is a lowercase slug. */
+export declare function fromOIDC(provider: string, claims: VerifiedClaims, overrides?: AuthContextOverrides): AuthContext;
+//# sourceMappingURL=auth.d.ts.map

package/dist/commonjs/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrD,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAwExD,yFAAyF;AACzF,wBAAgB,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,GAAE,oBAAyB,GAAG,WAAW,CAQpG;AAED,qFAAqF;AACrF,wBAAgB,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,GAAE,oBAAyB,GAAG,WAAW,CAkBnG;AAED,kHAAkH;AAClH,wBAAgB,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,GAAE,oBAAyB,GAAG,WAAW,CAcnG;AAED,uGAAuG;AACvG,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,GAAE,oBAAyB,GAAG,WAAW,CAGpH"}

package/dist/commonjs/auth.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fromWorkOS = fromWorkOS;
+exports.fromClerk = fromClerk;
+exports.fromAuth0 = fromAuth0;
+exports.fromOIDC = fromOIDC;
+function text(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function iso(value) {
+    if (typeof value === "string")
+        return value;
+    // Whole UTC seconds (the fraction is truncated), as the Go and Python helpers write it.
+    if (typeof value === "number" && Number.isFinite(value)) {
+        return new Date(Math.trunc(value) * 1000).toISOString().replace(".000Z", "Z");
+    }
+    return undefined;
+}
+// Defaults are the contract's bounds for roles and scopes (32 items of at
+// most 64 characters); audiences are 8 x 256 and amr 8 x 32. The Go and
+// Python helpers apply the same caps. Over-long values are dropped, not truncated.
+function bounded(values, limit, maxLength) {
+    const kept = values
+        .filter((item) => typeof item === "string" && item.length > 0 && [...item].length <= maxLength)
+        .slice(0, limit);
+    return kept.length ? kept : undefined;
+}
+function strings(value, limit = 32, maxLength = 64) {
+    if (typeof value === "string")
+        return bounded(value.split(/\s+/), limit, maxLength);
+    return Array.isArray(value) ? bounded(value, limit, maxLength) : undefined;
+}
+function delimitedStrings(value, limit = 32, maxLength = 64) {
+    if (typeof value !== "string")
+        return strings(value, limit, maxLength);
+    return bounded(value.split(/[\s,]+/).map((item) => item.trim()), limit, maxLength);
+}
+function audiences(value) {
+    return strings(value, 8, 256);
+}
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function actorPresent(value) {
+    const record = object(value);
+    return Boolean(record ? (text(record["sub"]) ?? text(record["email"])) : text(value));
+}
+function defined(value) {
+    return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined));
+}
+function base(provider, claims, overrides = {}, options = {}) {
+    const issuer = text(overrides.issuer) ?? text(claims["iss"]);
+    const subject = text(overrides.subject) ?? text(claims["sub"]);
+    if (!issuer || !subject)
+        throw new TypeError("NoResponse auth context requires a verified issuer and subject");
+    const mergedAudiences = overrides.audiences ?? audiences(claims["aud"]);
+    const context = { provider, issuer, subject, verified: true, transport: "backend" };
+    if (mergedAudiences?.length) {
+        context.audiences = mergedAudiences;
+        context.audience = overrides.audience ?? mergedAudiences[0];
+    }
+    const issuedAt = iso(claims["iat"]);
+    if (options.includeIssuedAt !== false && issuedAt)
+        context.issuedAt = issuedAt;
+    const expiresAt = iso(claims["exp"]);
+    if (expiresAt)
+        context.expiresAt = expiresAt;
+    const authTime = iso(claims["auth_time"]);
+    if (authTime)
+        context.authTime = authTime;
+    const sessionId = text(claims["sid"]);
+    if (sessionId)
+        context.sessionId = sessionId;
+    const tokenId = text(claims["jti"]);
+    if (tokenId)
+        context.tokenId = tokenId;
+    return { ...context, ...defined(overrides) };
+}
+/** Map verified WorkOS AuthKit claims plus verified user or session record overrides. */
+function fromWorkOS(claims, overrides = {}) {
+    const defaults = {
+        organizationId: text(claims["org_id"]),
+        roles: strings(claims["roles"] ?? claims["role"]),
+        scopes: strings(claims["permissions"]),
+        impersonated: actorPresent(claims["act"]),
+    };
+    return base("workos", claims, { ...defaults, ...overrides });
+}
+/** Map verified Clerk session claims. Pass Session.createdAt as sessionCreatedAt. */
+function fromClerk(claims, overrides = {}) {
+    const org = object(claims["o"]);
+    const secondFactorAgeMinutes = Array.isArray(claims["fva"]) && typeof claims["fva"][1] === "number" && Number.isFinite(claims["fva"][1]) ? claims["fva"][1] : undefined;
+    const mfa = secondFactorAgeMinutes !== undefined && secondFactorAgeMinutes >= 0
+        ? { present: true, ageSeconds: Math.trunc(secondFactorAgeMinutes * 60) }
+        : undefined;
+    const defaults = {
+        organizationId: text(org?.["id"]) ?? text(claims["org_id"]),
+        // Clerk's role claim is one role slug, not a list.
+        roles: bounded([org?.["rol"]], 32, 64) ?? bounded([claims["org_role"]], 32, 64),
+        scopes: delimitedStrings(org?.["per"]) ?? delimitedStrings(claims["org_permissions"]),
+        impersonated: actorPresent(claims["act"]),
+        ...(mfa ? { mfa } : {}),
+    };
+    // iat is a 60-second token refresh clock, so it is not sent as issuedAt; session age is the sessionCreatedAt override.
+    return base("clerk", claims, { ...defaults, ...overrides }, { includeIssuedAt: false });
+}
+/** Map verified Auth0 ID token, userinfo or normalised session claims. Do not pass an opaque API access token. */
+function fromAuth0(claims, overrides = {}) {
+    const amr = strings(claims["amr"], 8, 32);
+    const mfaMethods = amr?.filter((method) => method.toLowerCase() !== "pwd");
+    const defaults = {
+        organizationId: text(claims["org_id"]),
+        scopes: strings(claims["scope"]) ?? strings(claims["permissions"]),
+        emailVerified: typeof claims["email_verified"] === "boolean" ? claims["email_verified"] : undefined,
+        phoneVerified: typeof claims["phone_number_verified"] === "boolean" ? claims["phone_number_verified"] : undefined,
+        impersonated: actorPresent(claims["act"]),
+        ...(mfaMethods?.length
+            ? { mfa: { present: amr?.some((method) => method.toLowerCase() === "mfa") ?? false, methods: mfaMethods } }
+            : {}),
+    };
+    return base("auth0", claims, { ...defaults, ...overrides });
+}
+/** Generic OIDC adapter for providers without a first-class helper. `provider` is a lowercase slug. */
+function fromOIDC(provider, claims, overrides = {}) {
+    if (!/^[a-z0-9][a-z0-9._-]{1,31}$/.test(provider))
+        throw new TypeError("provider must be a lowercase provider slug");
+    return base(provider, claims, overrides);
+}
+//# sourceMappingURL=auth.js.map

package/dist/commonjs/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":";;;;;;AAWA,SAAS,IAAI,CAAC,KAAc,EAAsB;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC1E;AACD,SAAS,GAAG,CAAC,KAAc,EAAsB;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,wFAAwF;IACxF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CAClB;AACD,0EAA0E;AAC1E,wEAAwE;AACxE,mFAAmF;AACnF,SAAS,OAAO,CAAC,MAAiB,EAAE,KAAa,EAAE,SAAiB,EAAwB;IAC1F,MAAM,IAAI,GAAG,MAAM;SAChB,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC;SAC9G,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACvC;AACD,SAAS,OAAO,CAAC,KAAc,EAAE,KAAK,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAwB;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC5E;AACD,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAK,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAwB;IAC1F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAAA,CACpF;AACD,SAAS,SAAS,CAAC,KAAc,EAAwB;IACvD,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;AAAA,CAC/B;AACD,SAAS,MAAM,CAAC,KAAc,EAAuC;IACnE,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC9H;AACD,SAAS,YAAY,CAAC,KAAc,EAAW;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAAA,CACvF;AACD,SAAS,OAAO,CAAmB,KAAQ,EAAK;IAC9C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAM,CAAC;AAAA,CAC1F;AAED,SAAS,IAAI,CACX,QAAgB,EAChB,MAAsB,EACtB,SAAS,GAAyB,EAAE,EACpC,OAAO,GAAkC,EAAE,EAC9B;IACb,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IAC/G,MAAM,eAAe,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,MAAM,OAAO,GAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACjG,IAAI,eAAe,EAAE,MAAM,EAAE,CAAC;QAC5B,OAAO,CAAC,SAAS,GAAG,eAAe,CAAC;QACpC,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,eAAe,CAAC,CAAC,CAAE,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK,IAAI,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC/E,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,IAAI,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,IAAI,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,IAAI,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,IAAI,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;IACvC,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;AAAA,CAC9C;AAED,yFAAyF;AACzF,oBAA2B,MAAsB,EAAE,SAAS,GAAyB,EAAE,EAAe;IACpG,MAAM,QAAQ,GAAyB;QACrC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACtC,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;KAC1C,CAAC;IACF,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;AAAA,CAC9D;AAED,qFAAqF;AACrF,mBAA0B,MAAsB,EAAE,SAAS,GAAyB,EAAE,EAAe;IACnG,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,MAAM,sBAAsB,GAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3I,MAAM,GAAG,GACP,sBAAsB,KAAK,SAAS,IAAI,sBAAsB,IAAI,CAAC;QACjE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,EAAE;QACxE,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GAAyB;QACrC,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3D,mDAAmD;QACnD,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;QAC/E,MAAM,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACrF,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxB,CAAC;IACF,uHAAuH;IACvH,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;AAAA,CACzF;AAED,kHAAkH;AAClH,mBAA0B,MAAsB,EAAE,SAAS,GAAyB,EAAE,EAAe;IACnG,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAyB;QACrC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAClE,aAAa,EAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;QACnG,aAAa,EAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,SAAS;QACjH,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,GAAG,CAAC,UAAU,EAAE,MAAM;YACpB,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;YAC3G,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;AAAA,CAC7D;AAED,uGAAuG;AACvG,kBAAyB,QAAgB,EAAE,MAAsB,EAAE,SAAS,GAAyB,EAAE,EAAe;IACpH,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACrH,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAAA,CAC1C"}

package/dist/commonjs/client.d.ts

@@ -0,0 +1,100 @@
+import type { Assessments as GeneratedAssessments } from "./sdk/assessments.js";
+import type { Keys as GeneratedKeys } from "./sdk/keys.js";
+import type { NoResponseCore } from "./core.js";
+import { type SDKOptions } from "./lib/config.js";
+import { HTTPClient, type Fetcher } from "./lib/http.js";
+import type { Logger } from "./lib/logger.js";
+import type { RetryConfig } from "./lib/retries.js";
+import type { RequestOptions } from "./lib/sdks.js";
+import type * as models from "./models/index.js";
+import type * as operations from "./models/operations/index.js";
+import { type ResponseMeta, type WithMeta } from "./meta.js";
+import { type WaitOptions } from "./wait.js";
+import { constructEvent, verificationResponse } from "./webhooks.js";
+export declare const DEFAULT_BASE_URL = "https://api.noresponse.org";
+export declare const DEFAULT_TIMEOUT_MS = 10000;
+export type NoResponseOptions = {
+    /** Your API key. Defaults to NORESPONSE_API_KEY. A function is called before each request. */
+    apiKey?: string | (() => Promise<string>);
+    /** Defaults to NORESPONSE_BASE_URL, then https://api.noresponse.org. HTTPS is required except for localhost. */
+    baseUrl?: string;
+    /** Per-request timeout in milliseconds. Default 10 000. */
+    timeoutMs?: number;
+    /** A fetch implementation, for tests or a custom agent. */
+    fetch?: Fetcher;
+    /** Receives one line per request and response: method, URL, status and request id. Headers and bodies are left out. Defaults to console when NORESPONSE_LOG=debug. */
+    logger?: Logger;
+    /** Override the retry policy. Default: 408, 429, 5xx and connection errors, backoff 500 ms to 8 s, at most 30 s in all. */
+    retryConfig?: RetryConfig;
+    /** A custom HTTP client. Takes precedence over `fetch`. */
+    httpClient?: HTTPClient;
+    /** Override the User-Agent header. */
+    userAgent?: string;
+};
+export type CreateOptions = RequestOptions & {
+    /** 16 to 128 characters of [A-Za-z0-9._:-]. Generated (a UUID) when omitted and reused on every retry of this call. */
+    idempotencyKey?: string;
+};
+export type GetOptions = RequestOptions & {
+    responseMode?: models.ResponseMode;
+};
+export type { ResponseMeta, WithMeta, WaitOptions };
+/** One page of an account's assessments. `for await` over it walks every item across pages. */
+export type AssessmentPage = models.AssessmentList & {
+    meta: ResponseMeta;
+    hasMore: boolean;
+    /** The next page, or null on the last one. */
+    next(): Promise<AssessmentPage | null>;
+    [Symbol.asyncIterator](): AsyncIterator<models.Assessment>;
+};
+export declare function toSDKOptions(options: NoResponseOptions): SDKOptions;
+export declare class Assessments {
+    private readonly inner;
+    constructor(inner: GeneratedAssessments);
+    /**
+     * Assess a signup or gateway event. Returns the assessment whether the
+     * answer was 200 (complete or partial) or 202 (pending; see meta.retryAfter
+     * and assessments.wait). The idempotency key is generated when omitted and
+     * reused on every retry of this call.
+     */
+    create(request: models.AssessmentRequest | operations.CreateAssessmentRequest, options?: CreateOptions): Promise<WithMeta<models.Assessment>>;
+    /** Fetch the latest version of one assessment. */
+    get(assessmentId: string | operations.GetAssessmentRequest, options?: GetOptions): Promise<WithMeta<models.Assessment>>;
+    /** Poll until the assessment is no longer pending, honouring Retry-After, for at most timeoutMs (default 30 s). */
+    wait(assessmentId: string, options?: WaitOptions): Promise<WithMeta<models.Assessment>>;
+    /**
+     * One page of an account's unexpired assessments, newest first. Iterate the
+     * returned page with `for await` to walk every item across pages, or call
+     * `page.next()` yourself.
+     */
+    query(request: models.AssessmentQuery, options?: RequestOptions): Promise<AssessmentPage>;
+    /** Report what you later learned about an assessed account. */
+    recordOutcome(assessmentId: string, params: models.AssessmentOutcomeRequest, options?: CreateOptions): Promise<WithMeta<models.AssessmentOutcome>>;
+    recordOutcome(request: operations.RecordAssessmentOutcomeRequest, options?: CreateOptions): Promise<WithMeta<models.AssessmentOutcome>>;
+}
+export declare class Keys {
+    private readonly inner;
+    constructor(inner: GeneratedKeys);
+    /** Mint a replacement for the key that signs the request. The old key keeps working for overlapSeconds (default 24 hours). */
+    rotate(request?: models.KeyRotationRequest, options?: RequestOptions): Promise<WithMeta<models.KeyRotation>>;
+}
+export declare class NoResponse {
+    static readonly webhooks: {
+        readonly constructEvent: typeof constructEvent;
+        readonly verificationResponse: typeof verificationResponse;
+    };
+    readonly webhooks: {
+        readonly constructEvent: typeof constructEvent;
+        readonly verificationResponse: typeof verificationResponse;
+    };
+    readonly assessments: Assessments;
+    readonly keys: Keys;
+    /** The generated client, for the standalone functions under `@noresponse/node/funcs/*`. */
+    readonly core: NoResponseCore;
+    readonly baseUrl: string;
+    constructor(options?: NoResponseOptions);
+    toJSON(): {
+        baseUrl: string;
+    };
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/commonjs/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,IAAI,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,KAAK,EAAE,IAAI,IAAI,aAAa,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,KAAK,MAAM,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAEhE,OAAO,EAAoB,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErE,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAC7D,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,gHAAgH;IAChH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sKAAsK;IACtK,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2HAA2H;IAC3H,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG;IAC3C,uHAAuH;IACvH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;CACpC,CAAC;AAEF,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAEpD,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,GAAG;IACnD,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,IAAI,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACvC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;CAC5D,CAAC;AAkCF,wBAAgB,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,CA0BnE;AA6BD,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAlC,YAA6B,KAAK,EAAE,oBAAoB,EAAI;IAE5D;;;;;OAKG;IACG,MAAM,CACV,OAAO,EAAE,MAAM,CAAC,iBAAiB,GAAG,UAAU,CAAC,uBAAuB,EACtE,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAStC;IAED,kDAAkD;IAC5C,GAAG,CACP,YAAY,EAAE,MAAM,GAAG,UAAU,CAAC,oBAAoB,EACtD,OAAO,GAAE,UAAe,GACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAQtC;IAED,mHAAmH;IACnH,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAE1F;IAED;;;;OAIG;IACG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAG9F;IAED,+DAA+D;IAC/D,aAAa,CACX,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,wBAAwB,EACvC,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC/C,aAAa,CACX,OAAO,EAAE,UAAU,CAAC,8BAA8B,EAClD,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;CAuBhD;AAED,qBAAa,IAAI;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAlC,YAA6B,KAAK,EAAE,aAAa,EAAI;IAErD,8HAA8H;IACxH,MAAM,CAAC,OAAO,GAAE,MAAM,CAAC,kBAAuB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAGrH;CACF;AAID,qBAAa,UAAU;IACrB,MAAM,CAAC,QAAQ,CAAC,QAAQ;;;MAAY;IACpC,QAAQ,CAAC,QAAQ;;;MAAY;IAC7B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,YAAY,OAAO,GAAE,iBAAsB,EAS1C;IAED,MAAM,IAAI;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAE5B;CAKF"}